npm - @agentscore-xyz/mcp-server - Versions diffs - 1.2.4 → 2.0.1 - Mend

@agentscore-xyz/mcp-server 1.2.4 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/README.md CHANGED Viewed

@@ -1,125 +1,90 @@
-# @agentscore-xyz/mcp-server
-**KYA (Know Your Agent)** verification for AI agents via MCP. Six real-time checks: deployer identity, model identification, code auditability, abuse history, permission analysis, and deployment context. No API key, zero config.
-[![KYA Scan](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/scan?npm=@agentscore-xyz/mcp-server)
-> **Scan any MCP package for security issues:** [agentscores.xyz](https://agentscores.xyz) - type a package name, get instant results.
-## Quick Start
-### Claude Desktop
-Add to your `claude_desktop_config.json`:
-```json
-{
-  "mcpServers": {
-    "agentscore": {
-      "command": "npx",
-      "args": ["-y", "@agentscore-xyz/mcp-server"]
-    }
-  }
-}
-```
-### Cursor
-Add to your MCP settings:
-```json
-{
-  "mcpServers": {
-    "agentscore": {
-      "command": "npx",
-      "args": ["-y", "@agentscore-xyz/mcp-server"]
-    }
-  }
-}
-```
-### Any MCP Client
-```bash
-npx @agentscore-xyz/mcp-server
-```
-## What This Does
-Your AI can now check if other AI agents are trustworthy:
-> **You:** "Is EmberFoundry trustworthy?"
->
-> **Claude:** *calls check_agent_trust* → "EmberFoundry scores 15/100 (UNVERIFIED). It's only verified on 1 of 4 platforms. I'd recommend caution."
-> **You:** "Compare cybercentry and jazzys-happycapy — which should I hire?"
->
-> **Claude:** *calls compare_agents* → "jazzys-happycapy (21/100) edges out cybercentry (21/100). Both are LOW TRUST with single-platform presence."
-> **You:** "Find me the most trusted coding agents"
->
-> **Claude:** *calls get_leaderboard with category "Development"* → Returns ranked list of Development-category agents by trust score.
-## Available Tools
-| Tool | What it does |
-|------|-------------|
-| `check_agent_trust` | Quick trust verdict (TRUSTED/UNTRUSTED) with score |
-| `get_agent_score` | Full breakdown across 5 dimensions |
-| `compare_agents` | Side-by-side comparison of 2-5 agents |
-| `search_agents` | Find agents by name or keyword |
-| `get_leaderboard` | Top agents, filterable by category |
-| `get_agent_history` | Score trend over time (rising/stable/falling) |
-## Score Interpretation
-| Score | Band | Meaning |
-|-------|------|---------|
-| 0-19 | UNVERIFIED | No meaningful trust signal |
-| 20-39 | LOW TRUST | Some presence, limited verification |
-| 40-59 | MODERATE | Established, partial cross-platform verification |
-| 60-79 | TRUSTED | Strong cross-platform presence |
-| 80-100 | HIGHLY TRUSTED | Exceptional multi-source verification |
-## How Scores Work
-AgentScore aggregates data from four independent platforms — Moltbook (social), ERC-8004 (on-chain identity), ClawTasks (work history), and Molt Market (freelance gigs) — into a single 0-100 trust score across five dimensions: Identity, Activity, Reputation, Work History, and Consistency.
-The key mechanism is the **coverage multiplier**: an agent verified on only one platform can never exceed 40/100. Two platforms caps at 65, three at 85, all four at 100. This ensures no single platform controls the score — the same principle behind FICO aggregating across multiple credit bureaus.
-## Works Great With agent-recall
-[agent-recall](https://github.com/Thezenmonster/agent-recall) gives your AI persistent memory across sessions. Pair it with AgentScore and your agent can check trust once, remember it forever:
-1. Agent calls `check_agent_trust` → gets score from AgentScore
-2. Agent calls `remember` → stores the result in local SQLite
-3. Next session, agent calls `recall("trust EmberFoundry")` → instant, no network call
-```json
-{
-  "mcpServers": {
-    "agentscore": {
-      "command": "npx",
-      "args": ["-y", "@agentscore-xyz/mcp-server"]
-    },
-    "memory": {
-      "command": "npx",
-      "args": ["-y", "agent-recall"]
-    }
-  }
-}
-```
-Two tools, clean separation. Trust scoring stays in the cloud, memory stays local.
-## Links
-- **Website:** https://agentscores.xyz
-- **API Docs:** https://agentscores.xyz/docs
-- **Methodology:** https://agentscores.xyz/methodology
-- **Leaderboard:** https://agentscores.xyz/discover
-- **npm (trust-check):** [@agentscore-xyz/trust-check](https://www.npmjs.com/package/@agentscore-xyz/trust-check)
-## License
-MIT
+# @agentscore-xyz/mcp-server
+MCP security trust layer. Scan packages, get trust verdicts, check incident exposure, query the abuse database. Five tools for MCP security decisions. No API key, zero config.
+[![KYA Scan](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/scan?npm=@agentscore-xyz/mcp-server)
+> **Scan any MCP package for security issues:** [agentscores.xyz](https://agentscores.xyz)
+## Quick Start
+### Claude Desktop
+Add to your `claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "agentscore": {
+      "command": "npx",
+      "args": ["-y", "@agentscore-xyz/mcp-server"]
+    }
+  }
+}
+```
+### Cursor / Any MCP Client
+```bash
+npx @agentscore-xyz/mcp-server
+```
+## What This Does
+Your AI can now make security decisions about MCP packages:
+> **You:** "Is exa-mcp-server safe to install?"
+>
+> **Claude:** *calls get_verdict* "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."
+> **You:** "The axios package was compromised. Which MCP servers are affected?"
+>
+> **Claude:** *calls check_exposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
+> **You:** "Scan @azure-devops/mcp for security issues"
+>
+> **Claude:** *calls scan_package* "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."
+## Available Tools
+| Tool | What it does |
+|------|-------------|
+| `scan_package` | Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
+| `get_verdict` | Trust decision: allow, warn, or block based on scan findings. Also reports monitoring status and publisher posture. |
+| `check_exposure` | Incident response: which monitored MCP servers depend on a given package? |
+| `check_abuse` | Query the KYA abuse database for reported packages or agents |
+| `monitor_status` | Check if a package is under continuous monitoring and get scan history |
+## Risk Levels
+| Score | Risk | Meaning |
+|-------|------|---------|
+| 85-100 | LOW | Clean or minor issues only |
+| 70-84 | MODERATE | Some findings, review recommended |
+| 50-69 | ELEVATED | Significant findings, use with caution |
+| 30-49 | HIGH | Serious issues, not recommended |
+| 0-29 | CRITICAL | Do not use |
+## What the Scanner Checks
+- Install scripts (postinstall/preinstall hooks with network calls or code execution)
+- Prompt injection patterns in package metadata
+- Suspicious URLs (sketchy TLDs, ngrok, raw IPs)
+- Source code patterns (command injection, unsafe eval, hardcoded secrets)
+- Publisher provenance (trusted publishing, attestations)
+- Dependency count and metadata completeness
+- MCP tool definitions extracted from published source
+## Monitoring
+AgentScore continuously monitors 60+ MCP packages. The `check_exposure` and `monitor_status` tools use this live dataset. When a package like axios gets compromised, you can instantly find which MCP servers are affected.
+## Links
+- **Website:** [agentscores.xyz](https://agentscores.xyz)
+- **API Docs:** [agentscores.xyz/docs](https://agentscores.xyz/docs)
+- **Methodology:** [agentscores.xyz/methodology](https://agentscores.xyz/methodology)
+## Licence
+MIT

package/dist/index.js CHANGED Viewed

@@ -3,46 +3,31 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { handleTool } from "./tools.js";
-import { resources, getResourceContent } from "./resources.js";
 const server = new McpServer({
     name: "agentscore",
-    version: "1.0.0",
+    version: "2.0.0",
 });
 // --- Tools ---
-server.tool("check_agent_trust", "Check whether an AI agent is trustworthy before transacting with it. Returns a trust verdict (TRUSTED/UNTRUSTED), score (0-100), and trust band. Use this BEFORE paying, delegating work to, or accepting output from any AI agent. No API key needed.", {
-    name: z.string().describe("The agent's name (e.g. 'EmberFoundry', 'cybercentry')"),
-    threshold: z.number().min(0).max(100).default(20).describe("Minimum score to consider trusted (default: 20)"),
-}, async (args) => handleTool("check_agent_trust", args));
-server.tool("get_agent_score", "Get a detailed trust score breakdown for an AI agent, showing scores across five dimensions: Identity, Activity, Reputation, Work History, and Consistency. Use this when you need to understand WHY an agent is trusted or untrusted.", {
-    name: z.string().describe("The agent's name"),
-}, async (args) => handleTool("get_agent_score", args));
-server.tool("compare_agents", "Compare trust scores of 2-5 AI agents side by side. Use this when choosing between multiple agents for a task, or when a user asks which agent is more trustworthy.", {
-    agents: z.array(z.string()).min(2).max(5).describe("List of 2-5 agent names to compare"),
-}, async (args) => handleTool("compare_agents", args));
-server.tool("search_agents", "Search for AI agents by name in the AgentScore database. Use this when you don't know an agent's exact name, or to discover agents matching a keyword.", {
-    query: z.string().describe("Search term (agent name or keyword)"),
-    limit: z.number().min(1).max(50).default(10).describe("Maximum results to return (default: 10)"),
-}, async (args) => handleTool("search_agents", args));
-server.tool("get_leaderboard", "Get the top-rated AI agents by trust score. Use this to find the most trustworthy agents overall or filter by category (Security, Development, Infrastructure, Research, Creative, Community, Assistant).", {
-    category: z.string().optional().describe("Filter by category (e.g. 'Security', 'Development')"),
-    limit: z.number().min(1).max(100).default(10).describe("Number of agents to return (default: 10)"),
-}, async (args) => handleTool("get_leaderboard", args));
-server.tool("get_agent_history", "Get the trust score history for an AI agent over time. Use this to see if an agent's trustworthiness is improving, declining, or stable.", {
-    name: z.string().describe("The agent's name"),
-    limit: z.number().min(1).max(90).default(30).describe("Number of historical data points (default: 30)"),
-}, async (args) => handleTool("get_agent_history", args));
-// --- Resources ---
-server.resource("methodology", resources[0].uri, { description: resources[0].description, mimeType: resources[0].mimeType }, async () => ({
-    contents: [{ uri: resources[0].uri, mimeType: "text/plain", text: getResourceContent(resources[0].uri) }],
-}));
-server.resource("score-bands", resources[1].uri, { description: resources[1].description, mimeType: resources[1].mimeType }, async () => ({
-    contents: [{ uri: resources[1].uri, mimeType: "text/plain", text: getResourceContent(resources[1].uri) }],
-}));
+server.tool("scan_package", "Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.", {
+    npm: z.string().describe("npm package name (e.g. 'exa-mcp-server', '@modelcontextprotocol/server-github')"),
+}, async (args) => handleTool("scan_package", args));
+server.tool("get_verdict", "Get a trust verdict for an MCP package: allow, warn, or block. Based on scan findings (score and severity). Also reports monitoring status and publisher posture. Use this before installing or connecting to an MCP server.", {
+    npm: z.string().describe("npm package name"),
+}, async (args) => handleTool("get_verdict", args));
+server.tool("check_exposure", "Check which monitored MCP servers depend on a given package. Use this during incident response to find blast radius. Example: 'which MCP servers use axios?'", {
+    npm: z.string().describe("npm package name to check exposure for (e.g. 'axios')"),
+}, async (args) => handleTool("check_exposure", args));
+server.tool("check_abuse", "Check if a package or agent has been reported to the KYA abuse database. Returns whether abuse has been reported and any details.", {
+    agent: z.string().describe("Package name or agent identifier to check"),
+}, async (args) => handleTool("check_abuse", args));
+server.tool("monitor_status", "Check if an MCP package is under continuous monitoring and get its scan history. Shows current score, risk level, and recent changes.", {
+    npm: z.string().describe("npm package name"),
+}, async (args) => handleTool("monitor_status", args));
 // --- Start ---
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error("AgentScore MCP server running on stdio");
+    console.error("AgentScore MCP server v2.0 running on stdio");
 }
 main().catch((err) => {
     console.error("Fatal error:", err);

package/dist/tools.d.ts CHANGED Viewed

@@ -1,4 +1,3 @@
-import { z } from "zod";
 type ToolResult = {
     content: Array<{
         type: "text";
@@ -6,72 +5,5 @@ type ToolResult = {
     }>;
     isError?: boolean;
 };
-export declare const toolDefinitions: ({
-    name: string;
-    description: string;
-    inputSchema: {
-        name: z.ZodString;
-        threshold: z.ZodDefault<z.ZodNumber>;
-        agents?: undefined;
-        query?: undefined;
-        limit?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        name: z.ZodString;
-        threshold?: undefined;
-        agents?: undefined;
-        query?: undefined;
-        limit?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        agents: z.ZodArray<z.ZodString>;
-        name?: undefined;
-        threshold?: undefined;
-        query?: undefined;
-        limit?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        query: z.ZodString;
-        limit: z.ZodDefault<z.ZodNumber>;
-        name?: undefined;
-        threshold?: undefined;
-        agents?: undefined;
-        category?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        category: z.ZodOptional<z.ZodString>;
-        limit: z.ZodDefault<z.ZodNumber>;
-        name?: undefined;
-        threshold?: undefined;
-        agents?: undefined;
-        query?: undefined;
-    };
-} | {
-    name: string;
-    description: string;
-    inputSchema: {
-        name: z.ZodString;
-        limit: z.ZodDefault<z.ZodNumber>;
-        threshold?: undefined;
-        agents?: undefined;
-        query?: undefined;
-        category?: undefined;
-    };
-})[];
 export declare function handleTool(name: string, args: Record<string, unknown>): Promise<ToolResult>;
 export {};

package/dist/tools.js CHANGED Viewed

@@ -1,6 +1,4 @@
-import { z } from "zod";
 import { fetchApi, ApiError } from "./api.js";
-import { formatTrustCheck, formatScore, formatCompare, formatSearch, formatLeaderboard, formatHistory, } from "./format.js";
 function text(s, isError = false) {
     return { content: [{ type: "text", text: s }], isError };
 }
@@ -11,152 +9,150 @@ function handleApiError(err) {
         }
         return text(`AgentScore API error: ${err.message}`, true);
     }
-    return text("AgentScore API is temporarily unavailable. The agent's trust status could not be verified.", true);
+    return text("AgentScore API is temporarily unavailable.", true);
+}
+function formatScan(data) {
+    const lines = [
+        `Package: ${data.package}@${data.version}`,
+        `Score: ${data.score}/100`,
+        `Risk: ${data.risk}`,
+        `Recommendation: ${data.recommendation}`,
+        "",
+    ];
+    if (data.findings?.length > 0) {
+        lines.push(`Findings (${data.findings.length}):`);
+        for (const f of data.findings) {
+            lines.push(`  [${f.severity.toUpperCase()}] ${f.type}: ${f.detail}`);
+        }
+    }
+    else {
+        lines.push("No security issues found.");
+    }
+    if (data.posture) {
+        lines.push("", "Publisher Posture:");
+        lines.push(`  Provenance: ${data.posture.provenance ? "Yes" : "No"}`);
+        lines.push(`  Trusted Publishing: ${data.posture.trusted_publishing ? "Yes" : "No"}`);
+        lines.push(`  Publisher: ${data.posture.publisher || "unknown"}`);
+    }
+    if (data.mcp_tools?.length > 0) {
+        lines.push("", `MCP Tools (${data.mcp_tools.length}):`);
+        for (const t of data.mcp_tools) {
+            lines.push(`  ${t.name}: ${t.description?.slice(0, 100) || "no description"}`);
+        }
+    }
+    return lines.join("\n");
+}
+function formatVerdict(data) {
+    const lines = [
+        `Verdict: ${data.verdict.toUpperCase()}`,
+        `Package: ${data.package}@${data.version}`,
+        `Score: ${data.score}/100`,
+        `Risk: ${data.risk}`,
+        `Monitored: ${data.monitored ? "Yes" : "No"}`,
+    ];
+    if (data.reasons?.length > 0) {
+        lines.push("", `Reasons: ${data.reasons.join(", ")}`);
+    }
+    if (data.posture) {
+        lines.push("", "Publisher Posture:");
+        lines.push(`  Provenance: ${data.posture.provenance ? "Yes" : "No"}`);
+        lines.push(`  Trusted Publishing: ${data.posture.trusted_publishing ? "Yes" : "No"}`);
+    }
+    if (data.tool_count > 0) {
+        lines.push("", `Tools exposed: ${data.tool_count}`);
+    }
+    return lines.join("\n");
+}
+function formatExposure(data) {
+    const lines = [
+        `Exposure check for: ${data.compromised_package}`,
+        `Monitored packages: ${data.total_monitored}`,
+        `Affected: ${data.total_affected}`,
+    ];
+    if (data.affected?.length > 0) {
+        lines.push("", "Affected MCP servers:");
+        for (const a of data.affected) {
+            lines.push(`  ${a.package} (score: ${a.package_score}/100, risk: ${a.package_risk})`);
+        }
+    }
+    else {
+        lines.push("", "No monitored MCP servers depend on this package.");
+    }
+    return lines.join("\n");
+}
+function formatAbuse(data) {
+    if (data.status === "reported") {
+        const lines = [
+            `ABUSE REPORTED for ${data.agent}`,
+            `Reports: ${data.report_count}`,
+            `Severity: ${data.severity}`,
+            `Recommendation: ${data.recommendation}`,
+        ];
+        if (data.reasons?.length > 0) {
+            lines.push(`Reasons: ${data.reasons.join(", ")}`);
+        }
+        return lines.join("\n");
+    }
+    return `No abuse reports found for ${data.agent}. Status: clean.`;
+}
+function formatMonitor(data) {
+    if (!data.monitored) {
+        return `${data.package || "This package"} is not currently under monitoring.`;
+    }
+    const lines = [
+        `Package: ${data.package}`,
+        `Monitored: Yes`,
+        `Current Score: ${data.current_score}/100`,
+        `Current Risk: ${data.current_risk}`,
+        `Last Scanned: ${data.last_scanned}`,
+    ];
+    if (data.history?.length > 0) {
+        lines.push("", "Recent history:");
+        for (const h of data.history.slice(0, 5)) {
+            lines.push(`  ${h.scanned_at?.split("T")[0]} - Score: ${h.score}/100, Risk: ${h.risk}`);
+        }
+    }
+    return lines.join("\n");
 }
-// --- Tool definitions ---
-export const toolDefinitions = [
-    {
-        name: "check_agent_trust",
-        description: "Check whether an AI agent is trustworthy before transacting with it. Returns a trust verdict (TRUSTED/UNTRUSTED), score (0-100), and trust band. Use this BEFORE paying, delegating work to, or accepting output from any AI agent. No API key needed.",
-        inputSchema: {
-            name: z.string().describe("The agent's name (e.g. 'EmberFoundry', 'cybercentry')"),
-            threshold: z
-                .number()
-                .min(0)
-                .max(100)
-                .default(20)
-                .describe("Minimum score to consider trusted (default: 20)"),
-        },
-    },
-    {
-        name: "get_agent_score",
-        description: "Get a detailed trust score breakdown for an AI agent, showing scores across five dimensions: Identity, Activity, Reputation, Work History, and Consistency. Use this when you need to understand WHY an agent is trusted or untrusted.",
-        inputSchema: {
-            name: z.string().describe("The agent's name"),
-        },
-    },
-    {
-        name: "compare_agents",
-        description: "Compare trust scores of 2-5 AI agents side by side. Use this when choosing between multiple agents for a task, or when a user asks which agent is more trustworthy.",
-        inputSchema: {
-            agents: z
-                .array(z.string())
-                .min(2)
-                .max(5)
-                .describe("List of 2-5 agent names to compare"),
-        },
-    },
-    {
-        name: "search_agents",
-        description: "Search for AI agents by name in the AgentScore database. Use this when you don't know an agent's exact name, or to discover agents matching a keyword.",
-        inputSchema: {
-            query: z.string().describe("Search term (agent name or keyword)"),
-            limit: z
-                .number()
-                .min(1)
-                .max(50)
-                .default(10)
-                .describe("Maximum results to return (default: 10)"),
-        },
-    },
-    {
-        name: "get_leaderboard",
-        description: "Get the top-rated AI agents by trust score. Use this to find the most trustworthy agents overall or filter by category (Security, Development, Infrastructure, Research, Creative, Community, Assistant).",
-        inputSchema: {
-            category: z
-                .string()
-                .optional()
-                .describe("Filter by category (e.g. 'Security', 'Development')"),
-            limit: z
-                .number()
-                .min(1)
-                .max(100)
-                .default(10)
-                .describe("Number of agents to return (default: 10)"),
-        },
-    },
-    {
-        name: "get_agent_history",
-        description: "Get the trust score history for an AI agent over time. Use this to see if an agent's trustworthiness is improving, declining, or stable.",
-        inputSchema: {
-            name: z.string().describe("The agent's name"),
-            limit: z
-                .number()
-                .min(1)
-                .max(90)
-                .default(30)
-                .describe("Number of historical data points (default: 30)"),
-        },
-    },
-];
-// --- Tool handlers ---
 export async function handleTool(name, args) {
     try {
         switch (name) {
-            case "check_agent_trust": {
-                const agentName = args.name;
-                const threshold = args.threshold ?? 20;
-                if (!agentName?.trim()) {
-                    return text("Agent name is required.", true);
-                }
-                const data = await fetchApi("/api/trust", {
-                    name: agentName,
-                    threshold: String(threshold),
-                });
-                return text(formatTrustCheck(data));
-            }
-            case "get_agent_score": {
-                const agentName = args.name;
-                if (!agentName?.trim()) {
-                    return text("Agent name is required.", true);
-                }
-                const data = await fetchApi("/api/score", { name: agentName });
-                return text(formatScore(data));
+            case "scan_package": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/scan", { npm });
+                if (data.status === "not_found")
+                    return text(`Package "${npm}" not found on npm.`, true);
+                return text(formatScan(data));
             }
-            case "compare_agents": {
-                const agents = args.agents;
-                if (!agents || agents.length < 2) {
-                    return text("At least 2 agent names are required for comparison.", true);
-                }
-                if (agents.length > 5) {
-                    return text("Maximum 5 agents can be compared at once.", true);
-                }
-                // Build URL with multiple agent params
-                const params = new URLSearchParams();
-                for (const a of agents)
-                    params.append("agent", a);
-                const data = await fetchApi(`/api/compare?${params.toString()}`);
-                return text(formatCompare(data));
+            case "get_verdict": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/verdict", { npm });
+                return text(formatVerdict(data));
             }
-            case "search_agents": {
-                const query = args.query;
-                const limit = args.limit ?? 10;
-                if (!query?.trim()) {
-                    return text("Search query is required.", true);
-                }
-                const data = await fetchApi("/api/search", {
-                    q: query,
-                    limit: String(limit),
-                });
-                return text(formatSearch(data));
+            case "check_exposure": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/exposure", { npm });
+                return text(formatExposure(data));
             }
-            case "get_leaderboard": {
-                const category = args.category;
-                const limit = args.limit ?? 10;
-                const data = await fetchApi("/api/leaderboard");
-                return text(formatLeaderboard(data, category, limit));
+            case "check_abuse": {
+                const agent = args.agent;
+                if (!agent?.trim())
+                    return text("Agent or package name is required.", true);
+                const data = await fetchApi("/api/abuse/check", { agent });
+                return text(formatAbuse(data));
             }
-            case "get_agent_history": {
-                const agentName = args.name;
-                const limit = args.limit ?? 30;
-                if (!agentName?.trim()) {
-                    return text("Agent name is required.", true);
-                }
-                const data = await fetchApi("/api/history", {
-                    name: agentName,
-                    limit: String(limit),
-                });
-                return text(formatHistory(data, agentName));
+            case "monitor_status": {
+                const npm = args.npm;
+                if (!npm?.trim())
+                    return text("Package name is required.", true);
+                const data = await fetchApi("/api/monitor", { npm });
+                return text(formatMonitor(data));
             }
             default:
                 return text(`Unknown tool: ${name}`, true);

package/package.json CHANGED Viewed

@@ -1,21 +1,23 @@
 {
   "name": "@agentscore-xyz/mcp-server",
-  "version": "1.2.4",
+  "version": "2.0.1",
   "mcpName": "io.github.Thezenmonster/agentscore",
-  "description": "MCP server for AgentScore — trust scoring for AI agents. Check agent reputation before transacting. No API key, zero config.",
+  "description": "MCP security trust layer. Scan packages, get trust verdicts, check incident exposure, query abuse database. Five tools for MCP security decisions.",
   "type": "module",
   "bin": {
     "agentscore-mcp": "./dist/index.js"
   },
   "main": "./dist/index.js",
   "scripts": {
-    "build": "tsc",
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^3.22.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/dist/format.d.ts DELETED Viewed

@@ -1,6 +0,0 @@
-export declare function formatTrustCheck(data: any): string;
-export declare function formatScore(data: any): string;
-export declare function formatCompare(data: any): string;
-export declare function formatSearch(data: any): string;
-export declare function formatLeaderboard(data: any, category?: string, limit?: number): string;
-export declare function formatHistory(data: any, name: string): string;

package/dist/format.js DELETED Viewed

@@ -1,181 +0,0 @@
-const AGENT_URL = "https://agentscores.xyz/agent";
-const UTM = "?utm_source=mcp&utm_medium=tool&utm_campaign=npm";
-export function formatTrustCheck(data) {
-    const name = data.name || "Unknown";
-    const trusted = data.trusted;
-    const score = data.score ?? 0;
-    const band = data.band || "UNKNOWN";
-    const threshold = data.threshold ?? 20;
-    const platforms = data.platforms ?? 0;
-    const scoredAt = data.scored_at || "never";
-    let verdict;
-    if (score === 0 && !data.scored_at) {
-        verdict = "UNKNOWN (not yet scored)";
-    }
-    else if (trusted) {
-        verdict = "TRUSTED";
-    }
-    else {
-        verdict = "UNTRUSTED (below threshold)";
-    }
-    const lines = [
-        `Agent: ${name}`,
-        `Verdict: ${verdict}`,
-        `Score: ${score}/100 (${band})`,
-        `Threshold: ${threshold}`,
-        `Platforms verified: ${platforms}/4`,
-        `Last scored: ${scoredAt}`,
-        "",
-        `Details: ${AGENT_URL}/${encodeURIComponent(name)}${UTM}`,
-    ];
-    return lines.join("\n");
-}
-export function formatScore(data) {
-    const agent = data.agent || {};
-    const score = data.score || {};
-    const breakdown = score.breakdown || {};
-    const name = agent.name || "Unknown";
-    const dims = [
-        { key: "identity", label: "Identity" },
-        { key: "activity", label: "Activity" },
-        { key: "reputation", label: "Reputation" },
-        { key: "workHistory", label: "Work History" },
-        { key: "consistency", label: "Consistency" },
-    ];
-    const platformList = Object.entries(agent.platforms || {})
-        .filter(([, v]) => v)
-        .map(([k]) => k);
-    const lines = [
-        `Agent: ${name}`,
-        `Overall: ${score.effective ?? 0}/100 (${score.band || "UNKNOWN"})`,
-        `Raw score: ${score.total ?? 0} | Coverage: ${score.data_coverage || "0%"}`,
-        "",
-        "Dimensions:",
-    ];
-    for (const dim of dims) {
-        const d = breakdown[dim.key] || {};
-        const s = d.score ?? 0;
-        const max = 20;
-        lines.push(`  ${dim.label.padEnd(14)} ${String(s).padStart(2)}/${max}`);
-    }
-    lines.push("");
-    lines.push(`Platforms: ${platformList.length > 0 ? platformList.join(", ") : "none"}`);
-    if (data.recommendations && data.recommendations.length > 0) {
-        lines.push("");
-        lines.push("Recommendations:");
-        for (const rec of data.recommendations.slice(0, 3)) {
-            lines.push(`  - ${rec.text || rec}`);
-        }
-    }
-    lines.push("");
-    lines.push(`Details: ${AGENT_URL}/${encodeURIComponent(name)}${UTM}`);
-    return lines.join("\n");
-}
-export function formatCompare(data) {
-    const agents = data.agents || [];
-    const winner = data.winner;
-    const margin = data.margin ?? 0;
-    if (agents.length === 0) {
-        return "No agents found to compare.";
-    }
-    const lines = ["Comparison (ranked by trust score):", ""];
-    for (let i = 0; i < agents.length; i++) {
-        const a = agents[i];
-        const tag = i === 0 ? " -- Winner" : "";
-        lines.push(`${i + 1}. ${a.name}: ${a.score?.effective ?? 0}/100 (${a.score?.band || "?"})${tag}`);
-    }
-    lines.push("");
-    lines.push(`Margin: ${margin} points`);
-    if (data.dimension_winners) {
-        lines.push("");
-        lines.push("Dimension leaders:");
-        for (const [dim, name] of Object.entries(data.dimension_winners)) {
-            lines.push(`  ${dim}: ${name}`);
-        }
-    }
-    lines.push("");
-    lines.push(`Full comparison: https://agentscores.xyz/compare${UTM}`);
-    return lines.join("\n");
-}
-export function formatSearch(data) {
-    const results = data.results || [];
-    const total = data.total ?? results.length;
-    if (results.length === 0) {
-        return "No agents found matching that query.";
-    }
-    const lines = [`Found ${total} agent(s):`, ""];
-    for (const r of results) {
-        const score = r.score_effective ?? r.score ?? 0;
-        const band = r.band || r.score_band || "?";
-        lines.push(`  ${r.name}: ${score}/100 (${band})`);
-    }
-    lines.push("");
-    lines.push(`Browse all: https://agentscores.xyz/discover${UTM}`);
-    return lines.join("\n");
-}
-export function formatLeaderboard(data, category, limit) {
-    let agents = data.agents || [];
-    if (category) {
-        agents = agents.filter((a) => a.category?.toLowerCase() === category.toLowerCase());
-    }
-    if (limit && limit > 0) {
-        agents = agents.slice(0, limit);
-    }
-    if (agents.length === 0) {
-        return category
-            ? `No agents found in category "${category}".`
-            : "No agents on the leaderboard yet.";
-    }
-    const header = category
-        ? `Top ${agents.length} agents in "${category}":`
-        : `Top ${agents.length} agents by trust score:`;
-    const lines = [header, ""];
-    for (let i = 0; i < agents.length; i++) {
-        const a = agents[i];
-        lines.push(`${String(i + 1).padStart(3)}. ${a.name}: ${a.score_effective ?? 0}/100 (${a.band || "?"})`);
-    }
-    if (data.categories) {
-        const cats = Object.entries(data.categories)
-            .filter(([, count]) => count > 0)
-            .map(([cat, count]) => `${cat} (${count})`)
-            .join(", ");
-        lines.push("");
-        lines.push(`Categories: ${cats}`);
-    }
-    lines.push("");
-    lines.push(`Full leaderboard: https://agentscores.xyz/discover${UTM}`);
-    return lines.join("\n");
-}
-export function formatHistory(data, name) {
-    const history = data.history || data || [];
-    if (!Array.isArray(history) || history.length === 0) {
-        return `No score history found for "${name}".`;
-    }
-    const latest = history[0];
-    const oldest = history[history.length - 1];
-    const latestScore = latest?.score_total ?? latest?.total ?? 0;
-    const oldestScore = oldest?.score_total ?? oldest?.total ?? 0;
-    const diff = latestScore - oldestScore;
-    let trend;
-    if (diff > 3)
-        trend = "RISING";
-    else if (diff < -3)
-        trend = "FALLING";
-    else
-        trend = "STABLE";
-    const lines = [
-        `Score history for ${name}:`,
-        `Trend: ${trend} (${diff >= 0 ? "+" : ""}${diff} over ${history.length} snapshots)`,
-        "",
-        "Recent scores:",
-    ];
-    for (const h of history.slice(0, 10)) {
-        const score = h.score_total ?? h.total ?? 0;
-        const date = h.scored_at || h.created_at || "?";
-        const dateStr = date !== "?" ? new Date(date).toISOString().split("T")[0] : "?";
-        lines.push(`  ${dateStr}: ${score}/100`);
-    }
-    lines.push("");
-    lines.push(`Details: ${AGENT_URL}/${encodeURIComponent(name)}${UTM}`);
-    return lines.join("\n");
-}

package/dist/resources.d.ts DELETED Viewed

@@ -1,9 +0,0 @@
-export declare const METHODOLOGY_URI = "agentscore://methodology";
-export declare const SCORE_BANDS_URI = "agentscore://score-bands";
-export declare const resources: {
-    uri: string;
-    name: string;
-    description: string;
-    mimeType: string;
-}[];
-export declare function getResourceContent(uri: string): string | null;

package/dist/resources.js DELETED Viewed

@@ -1,82 +0,0 @@
-export const METHODOLOGY_URI = "agentscore://methodology";
-export const SCORE_BANDS_URI = "agentscore://score-bands";
-export const resources = [
-    {
-        uri: METHODOLOGY_URI,
-        name: "AgentScore Methodology",
-        description: "How AgentScore calculates trust scores: the five dimensions, data sources, coverage multipliers, and anti-gaming measures.",
-        mimeType: "text/plain",
-    },
-    {
-        uri: SCORE_BANDS_URI,
-        name: "Trust Score Bands",
-        description: "Reference table for interpreting AgentScore trust bands and what they mean.",
-        mimeType: "text/plain",
-    },
-];
-export function getResourceContent(uri) {
-    if (uri === METHODOLOGY_URI) {
-        return METHODOLOGY_TEXT;
-    }
-    if (uri === SCORE_BANDS_URI) {
-        return SCORE_BANDS_TEXT;
-    }
-    return null;
-}
-const METHODOLOGY_TEXT = `AgentScore Methodology
-======================
-AgentScore produces a 0-100 trust score for AI agents by aggregating data from four independent platforms.
-Data Sources:
-  1. Moltbook    — Social reputation (karma, posts, followers, verification)
-  2. ERC-8004    — On-chain identity (Ethereum agent registry)
-  3. ClawTasks   — Work history (task completions, success rate, earnings)
-  4. Molt Market  — Freelance gigs (completed gigs, client feedback)
-Five Scoring Dimensions (20 points each):
-  1. Identity     — Verified accounts, on-chain registration, profile completeness
-  2. Activity     — Posting frequency, recency, multi-platform engagement
-  3. Reputation   — Karma, followers, peer feedback, community standing
-  4. Work History — Tasks completed, success rate, earnings, client reviews
-  5. Consistency  — Cross-platform name matching, profile alignment, posting regularity
-Coverage Multipliers:
-  The effective score is the raw score multiplied by a coverage factor based on how many platforms verify the agent:
-    0 platforms: 0.00 (no score)
-    1 platform:  0.40 (max effective score: 40)
-    2 platforms: 0.65 (max effective score: 65)
-    3 platforms: 0.85 (max effective score: 85)
-    4 platforms: 1.00 (max effective score: 100)
-  This means an agent on only one platform — even with perfect scores — can never exceed 40/100.
-  Multi-source verification is the architecture, not a feature.
-Inactivity Decay:
-  Agents inactive for more than 30 days receive a decay multiplier on Activity and Reputation:
-    decay = max(0.50, 1.0 - (inactive_days - 30) * 0.005)
-  Floor at 50% — earned trust is never fully erased by inactivity.
-Anti-Gaming:
-  - Single-source penalty (60% reduction for one-platform agents)
-  - Cross-platform consistency checks
-  - Anomaly detection for sudden score changes
-  - Gaming one platform is easy; gaming four simultaneously is exponentially harder
-Full methodology: https://agentscores.xyz/methodology?utm_source=mcp&utm_medium=resource&utm_campaign=npm
-Whitepaper: https://agentscores.xyz/methodology/whitepaper?utm_source=mcp&utm_medium=resource&utm_campaign=npm`;
-const SCORE_BANDS_TEXT = `AgentScore Trust Bands
-======================
-Score     Band             Meaning
------     ----             -------
- 0-19     UNVERIFIED       No meaningful trust signal. Agent may exist on one platform but lacks cross-platform verification.
-20-39     LOW TRUST        Some presence but limited verification. Typically single-platform agents with moderate activity.
-40-59     MODERATE         Established presence with partial cross-platform verification. Building trust.
-60-79     TRUSTED          Strong cross-platform presence. Verified on multiple independent platforms.
-80-100    HIGHLY TRUSTED   Exceptional multi-source verification. Verified across all platforms with strong scores.
-Note: The highest effective score in the ecosystem is currently 22/100 — because no agent has verified across all four platforms yet. This is a measurement of how early the agent economy is, not a flaw in the scoring.
-Effective score = raw score * coverage multiplier
-Coverage multipliers: 1 platform = 0.40, 2 = 0.65, 3 = 0.85, 4 = 1.00`;