npm - @agentscore-xyz/mcp-server - Versions diffs - 1.2.4 → 2.0.0 - Mend

@agentscore-xyz/mcp-server 1.2.4 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/README.md CHANGED Viewed

@@ -1,125 +1,90 @@
-# @agentscore-xyz/mcp-server
-**KYA (Know Your Agent)** verification for AI agents via MCP. Six real-time checks: deployer identity, model identification, code auditability, abuse history, permission analysis, and deployment context. No API key, zero config.
-[![KYA Scan](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/scan?npm=@agentscore-xyz/mcp-server)
-> **Scan any MCP package for security issues:** [agentscores.xyz](https://agentscores.xyz) - type a package name, get instant results.
-## Quick Start
-### Claude Desktop
-Add to your `claude_desktop_config.json`:
-```json
-{
-  "mcpServers": {
-    "agentscore": {
-      "command": "npx",
-      "args": ["-y", "@agentscore-xyz/mcp-server"]
-    }
-  }
-}
-```
-### Cursor
-Add to your MCP settings:
-```json
-{
-  "mcpServers": {
-    "agentscore": {
-      "command": "npx",
-      "args": ["-y", "@agentscore-xyz/mcp-server"]
-    }
-  }
-}
-```
-### Any MCP Client
-```bash
-npx @agentscore-xyz/mcp-server
-```
-## What This Does
-Your AI can now check if other AI agents are trustworthy:
-> **You:** "Is EmberFoundry trustworthy?"
->
-> **Claude:** *calls check_agent_trust* → "EmberFoundry scores 15/100 (UNVERIFIED). It's only verified on 1 of 4 platforms. I'd recommend caution."
-> **You:** "Compare cybercentry and jazzys-happycapy — which should I hire?"
->
-> **Claude:** *calls compare_agents* → "jazzys-happycapy (21/100) edges out cybercentry (21/100). Both are LOW TRUST with single-platform presence."
-> **You:** "Find me the most trusted coding agents"
->
-> **Claude:** *calls get_leaderboard with category "Development"* → Returns ranked list of Development-category agents by trust score.
-## Available Tools
-| Tool | What it does |
-|------|-------------|
-| `check_agent_trust` | Quick trust verdict (TRUSTED/UNTRUSTED) with score |
-| `get_agent_score` | Full breakdown across 5 dimensions |
-| `compare_agents` | Side-by-side comparison of 2-5 agents |
-| `search_agents` | Find agents by name or keyword |
-| `get_leaderboard` | Top agents, filterable by category |
-| `get_agent_history` | Score trend over time (rising/stable/falling) |
-## Score Interpretation
-| Score | Band | Meaning |
-|-------|------|---------|
-| 0-19 | UNVERIFIED | No meaningful trust signal |
-| 20-39 | LOW TRUST | Some presence, limited verification |
-| 40-59 | MODERATE | Established, partial cross-platform verification |
-| 60-79 | TRUSTED | Strong cross-platform presence |
-| 80-100 | HIGHLY TRUSTED | Exceptional multi-source verification |
-## How Scores Work
-AgentScore aggregates data from four independent platforms — Moltbook (social), ERC-8004 (on-chain identity), ClawTasks (work history), and Molt Market (freelance gigs) — into a single 0-100 trust score across five dimensions: Identity, Activity, Reputation, Work History, and Consistency.
-The key mechanism is the **coverage multiplier**: an agent verified on only one platform can never exceed 40/100. Two platforms caps at 65, three at 85, all four at 100. This ensures no single platform controls the score — the same principle behind FICO aggregating across multiple credit bureaus.
-## Works Great With agent-recall
-[agent-recall](https://github.com/Thezenmonster/agent-recall) gives your AI persistent memory across sessions. Pair it with AgentScore and your agent can check trust once, remember it forever:
-1. Agent calls `check_agent_trust` → gets score from AgentScore
-2. Agent calls `remember` → stores the result in local SQLite
-3. Next session, agent calls `recall("trust EmberFoundry")` → instant, no network call
-```json
-{
-  "mcpServers": {
-    "agentscore": {
-      "command": "npx",
-      "args": ["-y", "@agentscore-xyz/mcp-server"]
-    },
-    "memory": {
-      "command": "npx",
-      "args": ["-y", "agent-recall"]
-    }
-  }
-}
-```
-Two tools, clean separation. Trust scoring stays in the cloud, memory stays local.
-## Links
-- **Website:** https://agentscores.xyz
-- **API Docs:** https://agentscores.xyz/docs
-- **Methodology:** https://agentscores.xyz/methodology
-- **Leaderboard:** https://agentscores.xyz/discover
-- **npm (trust-check):** [@agentscore-xyz/trust-check](https://www.npmjs.com/package/@agentscore-xyz/trust-check)
-## License
-MIT
+# @agentscore-xyz/mcp-server
+MCP security trust layer. Scan packages, get trust verdicts, check incident exposure, query the abuse database. Five tools for MCP security decisions. No API key, zero config.
+[![KYA Scan](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/scan?npm=@agentscore-xyz/mcp-server)
+> **Scan any MCP package for security issues:** [agentscores.xyz](https://agentscores.xyz)
+## Quick Start
+### Claude Desktop
+Add to your `claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "agentscore": {
+      "command": "npx",
+      "args": ["-y", "@agentscore-xyz/mcp-server"]
+    }
+  }
+}
+```
+### Cursor / Any MCP Client
+```bash
+npx @agentscore-xyz/mcp-server
+```
+## What This Does
+Your AI can now make security decisions about MCP packages:
+> **You:** "Is exa-mcp-server safe to install?"
+>
+> **Claude:** *calls get_verdict* "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."
+> **You:** "The axios package was compromised. Which MCP servers are affected?"
+>
+> **Claude:** *calls check_exposure* "3 monitored MCP servers depend on axios: exa-mcp-server, tavily-mcp, and figma-mcp."
+> **You:** "Scan @azure-devops/mcp for security issues"
+>
+> **Claude:** *calls scan_package* "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."
+## Available Tools
+| Tool | What it does |
+|------|-------------|
+| `scan_package` | Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
+| `get_verdict` | Trust decision: allow, warn, or block. Single call for install/connect decisions. |
+| `check_exposure` | Incident response: which monitored MCP servers depend on a given package? |
+| `check_abuse` | Query the KYA abuse database for reported packages or agents |
+| `monitor_status` | Check if a package is under continuous monitoring and get scan history |
+## Risk Levels
+| Score | Risk | Meaning |
+|-------|------|---------|
+| 85-100 | LOW | Clean or minor issues only |
+| 70-84 | MODERATE | Some findings, review recommended |
+| 50-69 | ELEVATED | Significant findings, use with caution |
+| 30-49 | HIGH | Serious issues, not recommended |
+| 0-29 | CRITICAL | Do not use |
+## What the Scanner Checks
+- Install scripts (postinstall/preinstall hooks with network calls or code execution)
+- Prompt injection patterns in package metadata
+- Suspicious URLs (sketchy TLDs, ngrok, raw IPs)
+- Source code patterns (command injection, unsafe eval, hardcoded secrets)
+- Publisher provenance (trusted publishing, attestations)
+- Dependency count and metadata completeness
+- MCP tool definitions extracted from published source
+## Monitoring
+AgentScore continuously monitors 60+ MCP packages. The `check_exposure` and `monitor_status` tools use this live dataset. When a package like axios gets compromised, you can instantly find which MCP servers are affected.
+## Links
+- **Website:** [agentscores.xyz](https://agentscores.xyz)
+- **API Docs:** [agentscores.xyz/docs](https://agentscores.xyz/docs)
+- **Methodology:** [agentscores.xyz/methodology](https://agentscores.xyz/methodology)
+## Licence
+MIT

package/dist/index.js CHANGED Viewed

@@ -3,46 +3,31 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { handleTool } from "./tools.js";
-import { resources, getResourceContent } from "./resources.js";
 const server = new McpServer({
     name: "agentscore",
-    version: "1.0.0",
+    version: "2.0.0",
 });
 // --- Tools ---
-server.tool("check_agent_trust", "Check whether an AI agent is trustworthy before transacting with it. Returns a trust verdict (TRUSTED/UNTRUSTED), score (0-100), and trust band. Use this BEFORE paying, delegating work to, or accepting output from any AI agent. No API key needed.", {
-    name: z.string().describe("The agent's name (e.g. 'EmberFoundry', 'cybercentry')"),
-    threshold: z.number().min(0).max(100).default(20).describe("Minimum score to consider trusted (default: 20)"),
-}, async (args) => handleTool("check_agent_trust", args));
-server.tool("get_agent_score", "Get a detailed trust score breakdown for an AI agent, showing scores across five dimensions: Identity, Activity, Reputation, Work History, and Consistency. Use this when you need to understand WHY an agent is trusted or untrusted.", {
-    name: z.string().describe("The agent's name"),
-}, async (args) => handleTool("get_agent_score", args));
-server.tool("compare_agents", "Compare trust scores of 2-5 AI agents side by side. Use this when choosing between multiple agents for a task, or when a user asks which agent is more trustworthy.", {
-    agents: z.array(z.string()).min(2).max(5).describe("List of 2-5 agent names to compare"),
-}, async (args) => handleTool("compare_agents", args));
-server.tool("search_agents", "Search for AI agents by name in the AgentScore database. Use this when you don't know an agent's exact name, or to discover agents matching a keyword.", {
-    query: z.string().describe("Search term (agent name or keyword)"),
-    limit: z.number().min(1).max(50).default(10).describe("Maximum results to return (default: 10)"),
-}, async (args) => handleTool("search_agents", args));
-server.tool("get_leaderboard", "Get the top-rated AI agents by trust score. Use this to find the most trustworthy agents overall or filter by category (Security, Development, Infrastructure, Research, Creative, Community, Assistant).", {
-    category: z.string().optional().describe("Filter by category (e.g. 'Security', 'Development')"),
-    limit: z.number().min(1).max(100).default(10).describe("Number of agents to return (default: 10)"),
-}, async (args) => handleTool("get_leaderboard", args));
-server.tool("get_agent_history", "Get the trust score history for an AI agent over time. Use this to see if an agent's trustworthiness is improving, declining, or stable.", {
-    name: z.string().describe("The agent's name"),
-    limit: z.number().min(1).max(90).default(30).describe("Number of historical data points (default: 30)"),
-}, async (args) => handleTool("get_agent_history", args));
-// --- Resources ---
-server.resource("methodology", resources[0].uri, { description: resources[0].description, mimeType: resources[0].mimeType }, async () => ({
-    contents: [{ uri: resources[0].uri, mimeType: "text/plain", text: getResourceContent(resources[0].uri) }],
-}));
-server.resource("score-bands", resources[1].uri, { description: resources[1].description, mimeType: resources[1].mimeType }, async () => ({
-    contents: [{ uri: resources[1].uri, mimeType: "text/plain", text: getResourceContent(resources[1].uri) }],
-}));
+server.tool("scan_package", "Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.", {
+    npm: z.string().describe("npm package name (e.g. 'exa-mcp-server', '@modelcontextprotocol/server-github')"),
+}, async (args) => handleTool("scan_package", args));
+server.tool("get_verdict", "Get a trust verdict for an MCP package: allow, warn, or block. Combines scan findings, monitoring status, and publisher posture into a single decision. Use this before installing or connecting to an MCP server.", {
+    npm: z.string().describe("npm package name"),
+}, async (args) => handleTool("get_verdict", args));
+server.tool("check_exposure", "Check which monitored MCP servers depend on a given package. Use this during incident response to find blast radius. Example: 'which MCP servers use axios?'", {
+    npm: z.string().describe("npm package name to check exposure for (e.g. 'axios')"),
+}, async (args) => handleTool("check_exposure", args));
+server.tool("check_abuse", "Check if a package or agent has been reported to the KYA abuse database. Returns whether abuse has been reported and any details.", {
+    agent: z.string().describe("Package name or agent identifier to check"),
+}, async (args) => handleTool("check_abuse", args));
+server.tool("monitor_status", "Check if an MCP package is under continuous monitoring and get its scan history. Shows current score, risk level, and recent changes.", {
+    npm: z.string().describe("npm package name"),
+}, async (args) => handleTool("monitor_status", args));
 // --- Start ---
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error("AgentScore MCP server running on stdio");
+    console.error("AgentScore MCP server v2.0 running on stdio");
 }
 main().catch((err) => {
     console.error("Fatal error:", err);

package/dist/tools.d.ts CHANGED Viewed

@@ -1,4 +1,3 @@
-import { z } from "zod";
 type ToolResult = {
     content: Array<{
         type: "text";
@@ -6,72 +5,5 @@ type ToolResult = {
     }>;
     isError?: boolean;
 };
-export declare const toolDefinitions: ({
-    name: string;
-    description: string;
-    inputSchema: {
-        name: z.ZodString;
-        threshold: z.ZodDefault<z.ZodNumber>;
-        agents?: undefined;
-        query?: undefined;
-        limit?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        name: z.ZodString;
-        threshold?: undefined;
-        agents?: undefined;
-        query?: undefined;
-        limit?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        agents: z.ZodArray<z.ZodString>;
-        name?: undefined;
-        threshold?: undefined;
-        query?: undefined;
-        limit?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        query: z.ZodString;
-        limit: z.ZodDefault<z.ZodNumber>;
-        name?: undefined;
-        threshold?: undefined;
-        agents?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        category: z.ZodOptional<z.ZodString>;
-        limit: z.ZodDefault<z.ZodNumber>;
-        name?: undefined;
-        threshold?: undefined;
-        agents?: undefined;
-        query?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        name: z.ZodString;
-        limit: z.ZodDefault<z.ZodNumber>;
-        threshold?: undefined;
-        agents?: undefined;
-        query?: undefined;
-        category?: undefined;
-    };
-})[];
 export declare function handleTool(name: string, args: Record<string, unknown>): Promise<ToolResult>;
 export {};

package/dist/tools.js CHANGED Viewed

@@ -1,6 +1,4 @@
-import { z } from "zod";
 import { fetchApi, ApiError } from "./api.js";
-import { formatTrustCheck, formatScore, formatCompare, formatSearch, formatLeaderboard, formatHistory, } from "./format.js";
 function text(s, isError = false) {
     return { content: [{ type: "text", text: s }], isError };
 }
@@ -11,152 +9,141 @@ function handleApiError(err) {
         }
         return text(`AgentScore API error: ${err.message}`, true);
     }
-    return text("AgentScore API is temporarily unavailable. The agent's trust status could not be verified.", true);
+    return text("AgentScore API is temporarily unavailable.", true);
+}
+function formatScan(data) {
+    const lines = [
+        `Package: ${data.package}@${data.version}`,
+        `Score: ${data.score}/100`,
+        `Risk: ${data.risk}`,
+        `Recommendation: ${data.recommendation}`,
+        "",
+    ];
+    if (data.findings?.length > 0) {
+        lines.push(`Findings (${data.findings.length}):`);
+        for (const f of data.findings) {
+            lines.push(`  [${f.severity.toUpperCase()}] ${f.type}: ${f.detail}`);
+        }
+    }
+    else {
+        lines.push("No security issues found.");
+    }
+    if (data.posture) {
+        lines.push("", "Publisher Posture:");
+        lines.push(`  Provenance: ${data.posture.provenance ? "Yes" : "No"}`);
+        lines.push(`  Trusted Publishing: ${data.posture.trusted_publishing ? "Yes" : "No"}`);
+        lines.push(`  Publisher: ${data.posture.publisher || "unknown"}`);
+    }
+    if (data.mcp_tools?.length > 0) {
+        lines.push("", `MCP Tools (${data.mcp_tools.length}):`);
+        for (const t of data.mcp_tools) {
+            lines.push(`  ${t.name}: ${t.description?.slice(0, 100) || "no description"}`);
+        }
+    }
+    return lines.join("\n");
+}
+function formatVerdict(data) {
+    const lines = [
+        `Verdict: ${data.verdict.toUpperCase()}`,
+        `Package: ${data.package}@${data.version}`,
+        `Score: ${data.score}/100`,
+        `Risk: ${data.risk}`,
+        `Monitored: ${data.monitored ? "Yes" : "No"}`,
+    ];
+    if (data.reasons?.length > 0) {
+        lines.push("", `Reasons: ${data.reasons.join(", ")}`);
+    }
+    if (data.posture) {
+        lines.push("", "Publisher Posture:");
+        lines.push(`  Provenance: ${data.posture.provenance ? "Yes" : "No"}`);
+        lines.push(`  Trusted Publishing: ${data.posture.trusted_publishing ? "Yes" : "No"}`);
+    }
+    if (data.tool_count > 0) {
+        lines.push("", `Tools exposed: ${data.tool_count}`);
+    }
+    return lines.join("\n");
+}
+function formatExposure(data) {
+    const lines = [
+        `Exposure check for: ${data.compromised_package}`,
+        `Monitored packages: ${data.total_monitored}`,
+        `Affected: ${data.total_affected}`,
+    ];
+    if (data.affected?.length > 0) {
+        lines.push("", "Affected MCP servers:");
+        for (const a of data.affected) {
+            lines.push(`  ${a.package} (score: ${a.package_score}/100, risk: ${a.package_risk})`);
+        }
+    }
+    else {
+        lines.push("", "No monitored MCP servers depend on this package.");
+    }
+    return lines.join("\n");
+}
+function formatAbuse(data) {
+    if (data.found) {
+        return `ABUSE REPORTED for ${data.agent}\nReason: ${data.reason || "unspecified"}\nSeverity: ${data.severity || "unspecified"}`;
+    }
+    return `No abuse reports found for ${data.agent || "this identifier"}.`;
+}
+function formatMonitor(data) {
+    if (!data.monitored) {
+        return `${data.package || "This package"} is not currently under monitoring.`;
+    }
+    const lines = [
+        `Package: ${data.package}`,
+        `Monitored: Yes`,
+        `Current Score: ${data.current_score}/100`,
+        `Current Risk: ${data.current_risk}`,
+        `Last Scanned: ${data.last_scanned}`,
+    ];
+    if (data.history?.length > 0) {
+        lines.push("", "Recent history:");
+        for (const h of data.history.slice(0, 5)) {
+            lines.push(`  ${h.scanned_at?.split("T")[0]} - Score: ${h.score}/100, Risk: ${h.risk}`);
+        }
+    }
+    return lines.join("\n");
 }
-// --- Tool definitions ---
-export const toolDefinitions = [
-    {
-        name: "check_agent_trust",
-        description: "Check whether an AI agent is trustworthy before transacting with it. Returns a trust verdict (TRUSTED/UNTRUSTED), score (0-100), and trust band. Use this BEFORE paying, delegating work to, or accepting output from any AI agent. No API key needed.",
-        inputSchema: {
-            name: z.string().describe("The agent's name (e.g. 'EmberFoundry', 'cybercentry')"),
-            threshold: z
-                .number()
-                .min(0)
-                .max(100)
-                .default(20)
-                .describe("Minimum score to consider trusted (default: 20)"),
-        },
-    },
-    {
-        name: "get_agent_score",
-        description: "Get a detailed trust score breakdown for an AI agent, showing scores across five dimensions: Identity, Activity, Reputation, Work History, and Consistency. Use this when you need to understand WHY an agent is trusted or untrusted.",
-        inputSchema: {
-            name: z.string().describe("The agent's name"),
-        },
-    },
-    {
-        name: "compare_agents",
-        description: "Compare trust scores of 2-5 AI agents side by side. Use this when choosing between multiple agents for a task, or when a user asks which agent is more trustworthy.",
-        inputSchema: {
-            agents: z
-                .array(z.string())
-                .min(2)
-                .max(5)
-                .describe("List of 2-5 agent names to compare"),
-        },
-    },
-    {
-        name: "search_agents",
-        description: "Search for AI agents by name in the AgentScore database. Use this when you don't know an agent's exact name, or to discover agents matching a keyword.",
-        inputSchema: {
-            query: z.string().describe("Search term (agent name or keyword)"),
-            limit: z
-                .number()
-                .min(1)
-                .max(50)
-                .default(10)
-                .describe("Maximum results to return (default: 10)"),
-        },
-    },
-    {
-        name: "get_leaderboard",
-        description: "Get the top-rated AI agents by trust score. Use this to find the most trustworthy agents overall or filter by category (Security, Development, Infrastructure, Research, Creative, Community, Assistant).",
-        inputSchema: {
-            category: z
-                .string()
-                .optional()
-                .describe("Filter by category (e.g. 'Security', 'Development')"),
-            limit: z
-                .number()
-                .min(1)
-                .max(100)
-                .default(10)
-                .describe("Number of agents to return (default: 10)"),
-        },
-    },
-    {
-        name: "get_agent_history",
-        description: "Get the trust score history for an AI agent over time. Use this to see if an agent's trustworthiness is improving, declining, or stable.",
-        inputSchema: {
-            name: z.string().describe("The agent's name"),
-            limit: z
-                .number()
-                .min(1)
-                .max(90)
-                .default(30)
-                .describe("Number of historical data points (default: 30)"),
-        },
-    },
-];
-// --- Tool handlers ---
 export async function handleTool(name, args) {
     try {
         switch (name) {
-            case "check_agent_trust": {
-                const agentName = args.name;
-                const threshold = args.threshold ?? 20;
-                if (!agentName?.trim()) {
-                    return text("Agent name is required.", true);
-                }
-                const data = await fetchApi("/api/trust", {
-                    name: agentName,
-                    threshold: String(threshold),
-                });
-                return text(formatTrustCheck(data));
-            }
-            case "get_agent_score": {
-                const agentName = args.name;
-                if (!agentName?.trim()) {
-                    return text("Agent name is required.", true);
-                }
-                const data = await fetchApi("/api/score", { name: agentName });
-                return text(formatScore(data));
+            case "scan_package": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/scan", { npm });
+                if (data.status === "not_found")
+                    return text(`Package "${npm}" not found on npm.`, true);
+                return text(formatScan(data));
             }
-            case "compare_agents": {
-                const agents = args.agents;
-                if (!agents || agents.length < 2) {
-                    return text("At least 2 agent names are required for comparison.", true);
-                }
-                if (agents.length > 5) {
-                    return text("Maximum 5 agents can be compared at once.", true);
-                }
-                // Build URL with multiple agent params
-                const params = new URLSearchParams();
-                for (const a of agents)
-                    params.append("agent", a);
-                const data = await fetchApi(`/api/compare?${params.toString()}`);
-                return text(formatCompare(data));
+            case "get_verdict": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/verdict", { npm });
+                return text(formatVerdict(data));
             }
-            case "search_agents": {
-                const query = args.query;
-                const limit = args.limit ?? 10;
-                if (!query?.trim()) {
-                    return text("Search query is required.", true);
-                }
-                const data = await fetchApi("/api/search", {
-                    q: query,
-                    limit: String(limit),
-                });
-                return text(formatSearch(data));
+            case "check_exposure": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/exposure", { npm });
+                return text(formatExposure(data));
             }
-            case "get_leaderboard": {
-                const category = args.category;
-                const limit = args.limit ?? 10;
-                const data = await fetchApi("/api/leaderboard");
-                return text(formatLeaderboard(data, category, limit));
+            case "check_abuse": {
+                const agent = args.agent;
+                if (!agent?.trim())
+                    return text("Agent or package name is required.", true);
+                const data = await fetchApi("/api/abuse/check", { agent });
+                return text(formatAbuse(data));
             }
-            case "get_agent_history": {
-                const agentName = args.name;
-                const limit = args.limit ?? 30;
-                if (!agentName?.trim()) {
-                    return text("Agent name is required.", true);
-                }
-                const data = await fetchApi("/api/history", {
-                    name: agentName,
-                    limit: String(limit),
-                });
-                return text(formatHistory(data, agentName));
+            case "monitor_status": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/monitor", { npm });
+                return text(formatMonitor(data));
             }
             default:
                 return text(`Unknown tool: ${name}`, true);

package/package.json CHANGED Viewed

@@ -1,8 +1,8 @@
 {
   "name": "@agentscore-xyz/mcp-server",
-  "version": "1.2.4",
+  "version": "2.0.0",
   "mcpName": "io.github.Thezenmonster/agentscore",
-  "description": "MCP server for AgentScore — trust scoring for AI agents. Check agent reputation before transacting. No API key, zero config.",
+  "description": "MCP security trust layer. Scan packages, get trust verdicts, check incident exposure, query abuse database. Five tools for MCP security decisions.",
   "type": "module",
   "bin": {
     "agentscore-mcp": "./dist/index.js"
@@ -15,7 +15,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^3.22.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",