MCP server

Commit — Supply Chain Risk Scoring

io.github.piiiico/proof-of-commitment

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.

Website Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

12

Token cost

About 3,754 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.proof-of-commitment]
url = "https://poc-backend.amdal-dev.workers.dev/mcp"

Gemini CLI

{"mcpServers":{"proof-of-commitment":{"httpUrl":"https://poc-backend.amdal-dev.workers.dev/mcp"}}}

Cursor

{"mcpServers":{"proof-of-commitment":{"url":"https://poc-backend.amdal-dev.workers.dev/mcp"}}}

VS Code

{"servers":{"proof-of-commitment":{"type":"http","url":"https://poc-backend.amdal-dev.workers.dev/mcp"}}}

Antigravity

agy mcp add proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"proof-of-commitment","server_url":"https://poc-backend.amdal-dev.workers.dev/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"proof-of-commitment","server_url":"https://poc-backend.amdal-dev.workers.dev/mcp"}

Tools

• audit_dependencies ~549 tokens
  Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concentration risk) - HIGH:
• audit_dependency_tree ~504 tokens
  Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (
• audit_github_repo ~386 tokens
  Audit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — just provide the GitHub URL or owner/repo slug, and get a f
• get_api_key ~283 tokens
  Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring (weekl
• lookup_business ~162 tokens
  Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free, verified, unfakeable.
• lookup_business_by_org ~138 tokens
  Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.
• lookup_cargo_crate ~269 tokens
  Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply chain risks apply to
• lookup_github_repo ~262 tokens
  Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments — harder to fake than R
• lookup_go_module ~387 tokens
  Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contributors (the closest eq
• lookup_npm_package ~402 tokens
  Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also returns publisherLifec
• lookup_pypi_package ~258 tokens
  Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was compromised via stole
• query_commitment ~154 tokens
  Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content.

Browse

• GitHub tools
• Rust tools
• Email
• Social media
• GitHub and code hosting
• Cloud and hosting

Related MCP servers

• Agent Notary
  Verifiable delivery for the agent economy: commit-reveal content notarization. Sellers commit to a d
• Physical Capability Cloud
  Discover, hire, and verify real-world physical capability through MCP.
• FreeSign — Free e-signature
  Free e-signature for humans and AI agents — zero-document PDF signing from hashes only.
• Presend dependency checks
  Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.
• TensorFeed
  AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.
• Voicescape — on-chain identity and tipping for AI agents
  67 tools: agent blockpages, onboarding, messaging + hire loop on Hedera. Server never holds keys.
• Gapup
  271 agent-payable tools: competitive intel, finance, KYC, compliance, ESG. x402 per-call.
• AINumbers Fintech Intelligence Suite
  754 MCP tools across 1220 fintech tools: ChainGraph AP2 decisions, execution_hash. Zero PII.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.piiiico/proof-of-commitment.svg)](https://aptlynx.net/servers/io.github.piiiico/proof-of-commitment)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents