@agentscore-xyz/mcp-server 2.0.0 → 2.0.1

package/README.md

@@ -39,7 +39,7 @@ Your AI can now make security decisions about MCP packages:
 
 > **You:** "The axios package was compromised. Which MCP servers are affected?"
 >
-> **Claude:** *calls check_exposure* "3 monitored MCP servers depend on axios: exa-mcp-server, tavily-mcp, and figma-mcp."
+> **Claude:** *calls check_exposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
 
 > **You:** "Scan @azure-devops/mcp for security issues"
 >
@@ -50,7 +50,7 @@ Your AI can now make security decisions about MCP packages:
 | Tool | What it does |
 |------|-------------|
 | `scan_package` | Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
-| `get_verdict` | Trust decision: allow, warn, or block. Single call for install/connect decisions. |
+| `get_verdict` | Trust decision: allow, warn, or block based on scan findings. Also reports monitoring status and publisher posture. |
 | `check_exposure` | Incident response: which monitored MCP servers depend on a given package? |
 | `check_abuse` | Query the KYA abuse database for reported packages or agents |
 | `monitor_status` | Check if a package is under continuous monitoring and get scan history |

package/dist/index.js

@@ -11,7 +11,7 @@ const server = new McpServer({
 server.tool("scan_package", "Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.", {
     npm: z.string().describe("npm package name (e.g. 'exa-mcp-server', '@modelcontextprotocol/server-github')"),
 }, async (args) => handleTool("scan_package", args));
-server.tool("get_verdict", "Get a trust verdict for an MCP package: allow, warn, or block. Combines scan findings, monitoring status, and publisher posture into a single decision. Use this before installing or connecting to an MCP server.", {
+server.tool("get_verdict", "Get a trust verdict for an MCP package: allow, warn, or block. Based on scan findings (score and severity). Also reports monitoring status and publisher posture. Use this before installing or connecting to an MCP server.", {
     npm: z.string().describe("npm package name"),
 }, async (args) => handleTool("get_verdict", args));
 server.tool("check_exposure", "Check which monitored MCP servers depend on a given package. Use this during incident response to find blast radius. Example: 'which MCP servers use axios?'", {

package/dist/tools.js

@@ -81,10 +81,19 @@ function formatExposure(data) {
     return lines.join("\n");
 }
 function formatAbuse(data) {
-    if (data.found) {
-        return `ABUSE REPORTED for ${data.agent}\nReason: ${data.reason || "unspecified"}\nSeverity: ${data.severity || "unspecified"}`;
+    if (data.status === "reported") {
+        const lines = [
+            `ABUSE REPORTED for ${data.agent}`,
+            `Reports: ${data.report_count}`,
+            `Severity: ${data.severity}`,
+            `Recommendation: ${data.recommendation}`,
+        ];
+        if (data.reasons?.length > 0) {
+            lines.push(`Reasons: ${data.reasons.join(", ")}`);
+        }
+        return lines.join("\n");
     }
-    return `No abuse reports found for ${data.agent || "this identifier"}.`;
+    return `No abuse reports found for ${data.agent}. Status: clean.`;
 }
 function formatMonitor(data) {
     if (!data.monitored) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentscore-xyz/mcp-server",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "mcpName": "io.github.Thezenmonster/agentscore",
   "description": "MCP security trust layer. Scan packages, get trust verdicts, check incident exposure, query abuse database. Five tools for MCP security decisions.",
   "type": "module",
@@ -9,7 +9,8 @@
   },
   "main": "./dist/index.js",
   "scripts": {
-    "build": "tsc",
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "prepublishOnly": "npm run build"

package/dist/format.d.ts

@@ -1,6 +0,0 @@
-export declare function formatTrustCheck(data: any): string;
-export declare function formatScore(data: any): string;
-export declare function formatCompare(data: any): string;
-export declare function formatSearch(data: any): string;
-export declare function formatLeaderboard(data: any, category?: string, limit?: number): string;
-export declare function formatHistory(data: any, name: string): string;

package/dist/format.js

@@ -1,181 +0,0 @@
-const AGENT_URL = "https://agentscores.xyz/agent";
-const UTM = "?utm_source=mcp&utm_medium=tool&utm_campaign=npm";
-export function formatTrustCheck(data) {
-    const name = data.name || "Unknown";
-    const trusted = data.trusted;
-    const score = data.score ?? 0;
-    const band = data.band || "UNKNOWN";
-    const threshold = data.threshold ?? 20;
-    const platforms = data.platforms ?? 0;
-    const scoredAt = data.scored_at || "never";
-    let verdict;
-    if (score === 0 && !data.scored_at) {
-        verdict = "UNKNOWN (not yet scored)";
-    }
-    else if (trusted) {
-        verdict = "TRUSTED";
-    }
-    else {
-        verdict = "UNTRUSTED (below threshold)";
-    }
-    const lines = [
-        `Agent: ${name}`,
-        `Verdict: ${verdict}`,
-        `Score: ${score}/100 (${band})`,
-        `Threshold: ${threshold}`,
-        `Platforms verified: ${platforms}/4`,
-        `Last scored: ${scoredAt}`,
-        "",
-        `Details: ${AGENT_URL}/${encodeURIComponent(name)}${UTM}`,
-    ];
-    return lines.join("\n");
-}
-export function formatScore(data) {
-    const agent = data.agent || {};
-    const score = data.score || {};
-    const breakdown = score.breakdown || {};
-    const name = agent.name || "Unknown";
-    const dims = [
-        { key: "identity", label: "Identity" },
-        { key: "activity", label: "Activity" },
-        { key: "reputation", label: "Reputation" },
-        { key: "workHistory", label: "Work History" },
-        { key: "consistency", label: "Consistency" },
-    ];
-    const platformList = Object.entries(agent.platforms || {})
-        .filter(([, v]) => v)
-        .map(([k]) => k);
-    const lines = [
-        `Agent: ${name}`,
-        `Overall: ${score.effective ?? 0}/100 (${score.band || "UNKNOWN"})`,
-        `Raw score: ${score.total ?? 0} | Coverage: ${score.data_coverage || "0%"}`,
-        "",
-        "Dimensions:",
-    ];
-    for (const dim of dims) {
-        const d = breakdown[dim.key] || {};
-        const s = d.score ?? 0;
-        const max = 20;
-        lines.push(`  ${dim.label.padEnd(14)} ${String(s).padStart(2)}/${max}`);
-    }
-    lines.push("");
-    lines.push(`Platforms: ${platformList.length > 0 ? platformList.join(", ") : "none"}`);
-    if (data.recommendations && data.recommendations.length > 0) {
-        lines.push("");
-        lines.push("Recommendations:");
-        for (const rec of data.recommendations.slice(0, 3)) {
-            lines.push(`  - ${rec.text || rec}`);
-        }
-    }
-    lines.push("");
-    lines.push(`Details: ${AGENT_URL}/${encodeURIComponent(name)}${UTM}`);
-    return lines.join("\n");
-}
-export function formatCompare(data) {
-    const agents = data.agents || [];
-    const winner = data.winner;
-    const margin = data.margin ?? 0;
-    if (agents.length === 0) {
-        return "No agents found to compare.";
-    }
-    const lines = ["Comparison (ranked by trust score):", ""];
-    for (let i = 0; i < agents.length; i++) {
-        const a = agents[i];
-        const tag = i === 0 ? " -- Winner" : "";
-        lines.push(`${i + 1}. ${a.name}: ${a.score?.effective ?? 0}/100 (${a.score?.band || "?"})${tag}`);
-    }
-    lines.push("");
-    lines.push(`Margin: ${margin} points`);
-    if (data.dimension_winners) {
-        lines.push("");
-        lines.push("Dimension leaders:");
-        for (const [dim, name] of Object.entries(data.dimension_winners)) {
-            lines.push(`  ${dim}: ${name}`);
-        }
-    }
-    lines.push("");
-    lines.push(`Full comparison: https://agentscores.xyz/compare${UTM}`);
-    return lines.join("\n");
-}
-export function formatSearch(data) {
-    const results = data.results || [];
-    const total = data.total ?? results.length;
-    if (results.length === 0) {
-        return "No agents found matching that query.";
-    }
-    const lines = [`Found ${total} agent(s):`, ""];
-    for (const r of results) {
-        const score = r.score_effective ?? r.score ?? 0;
-        const band = r.band || r.score_band || "?";
-        lines.push(`  ${r.name}: ${score}/100 (${band})`);
-    }
-    lines.push("");
-    lines.push(`Browse all: https://agentscores.xyz/discover${UTM}`);
-    return lines.join("\n");
-}
-export function formatLeaderboard(data, category, limit) {
-    let agents = data.agents || [];
-    if (category) {
-        agents = agents.filter((a) => a.category?.toLowerCase() === category.toLowerCase());
-    }
-    if (limit && limit > 0) {
-        agents = agents.slice(0, limit);
-    }
-    if (agents.length === 0) {
-        return category
-            ? `No agents found in category "${category}".`
-            : "No agents on the leaderboard yet.";
-    }
-    const header = category
-        ? `Top ${agents.length} agents in "${category}":`
-        : `Top ${agents.length} agents by trust score:`;
-    const lines = [header, ""];
-    for (let i = 0; i < agents.length; i++) {
-        const a = agents[i];
-        lines.push(`${String(i + 1).padStart(3)}. ${a.name}: ${a.score_effective ?? 0}/100 (${a.band || "?"})`);
-    }
-    if (data.categories) {
-        const cats = Object.entries(data.categories)
-            .filter(([, count]) => count > 0)
-            .map(([cat, count]) => `${cat} (${count})`)
-            .join(", ");
-        lines.push("");
-        lines.push(`Categories: ${cats}`);
-    }
-    lines.push("");
-    lines.push(`Full leaderboard: https://agentscores.xyz/discover${UTM}`);
-    return lines.join("\n");
-}
-export function formatHistory(data, name) {
-    const history = data.history || data || [];
-    if (!Array.isArray(history) || history.length === 0) {
-        return `No score history found for "${name}".`;
-    }
-    const latest = history[0];
-    const oldest = history[history.length - 1];
-    const latestScore = latest?.score_total ?? latest?.total ?? 0;
-    const oldestScore = oldest?.score_total ?? oldest?.total ?? 0;
-    const diff = latestScore - oldestScore;
-    let trend;
-    if (diff > 3)
-        trend = "RISING";
-    else if (diff < -3)
-        trend = "FALLING";
-    else
-        trend = "STABLE";
-    const lines = [
-        `Score history for ${name}:`,
-        `Trend: ${trend} (${diff >= 0 ? "+" : ""}${diff} over ${history.length} snapshots)`,
-        "",
-        "Recent scores:",
-    ];
-    for (const h of history.slice(0, 10)) {
-        const score = h.score_total ?? h.total ?? 0;
-        const date = h.scored_at || h.created_at || "?";
-        const dateStr = date !== "?" ? new Date(date).toISOString().split("T")[0] : "?";
-        lines.push(`  ${dateStr}: ${score}/100`);
-    }
-    lines.push("");
-    lines.push(`Details: ${AGENT_URL}/${encodeURIComponent(name)}${UTM}`);
-    return lines.join("\n");
-}

package/dist/resources.d.ts

@@ -1,9 +0,0 @@
-export declare const METHODOLOGY_URI = "agentscore://methodology";
-export declare const SCORE_BANDS_URI = "agentscore://score-bands";
-export declare const resources: {
-    uri: string;
-    name: string;
-    description: string;
-    mimeType: string;
-}[];
-export declare function getResourceContent(uri: string): string | null;

package/dist/resources.js

@@ -1,82 +0,0 @@
-export const METHODOLOGY_URI = "agentscore://methodology";
-export const SCORE_BANDS_URI = "agentscore://score-bands";
-export const resources = [
-    {
-        uri: METHODOLOGY_URI,
-        name: "AgentScore Methodology",
-        description: "How AgentScore calculates trust scores: the five dimensions, data sources, coverage multipliers, and anti-gaming measures.",
-        mimeType: "text/plain",
-    },
-    {
-        uri: SCORE_BANDS_URI,
-        name: "Trust Score Bands",
-        description: "Reference table for interpreting AgentScore trust bands and what they mean.",
-        mimeType: "text/plain",
-    },
-];
-export function getResourceContent(uri) {
-    if (uri === METHODOLOGY_URI) {
-        return METHODOLOGY_TEXT;
-    }
-    if (uri === SCORE_BANDS_URI) {
-        return SCORE_BANDS_TEXT;
-    }
-    return null;
-}
-const METHODOLOGY_TEXT = `AgentScore Methodology
-======================
-
-AgentScore produces a 0-100 trust score for AI agents by aggregating data from four independent platforms.
-
-Data Sources:
-  1. Moltbook    — Social reputation (karma, posts, followers, verification)
-  2. ERC-8004    — On-chain identity (Ethereum agent registry)
-  3. ClawTasks   — Work history (task completions, success rate, earnings)
-  4. Molt Market  — Freelance gigs (completed gigs, client feedback)
-
-Five Scoring Dimensions (20 points each):
-  1. Identity     — Verified accounts, on-chain registration, profile completeness
-  2. Activity     — Posting frequency, recency, multi-platform engagement
-  3. Reputation   — Karma, followers, peer feedback, community standing
-  4. Work History — Tasks completed, success rate, earnings, client reviews
-  5. Consistency  — Cross-platform name matching, profile alignment, posting regularity
-
-Coverage Multipliers:
-  The effective score is the raw score multiplied by a coverage factor based on how many platforms verify the agent:
-    0 platforms: 0.00 (no score)
-    1 platform:  0.40 (max effective score: 40)
-    2 platforms: 0.65 (max effective score: 65)
-    3 platforms: 0.85 (max effective score: 85)
-    4 platforms: 1.00 (max effective score: 100)
-
-  This means an agent on only one platform — even with perfect scores — can never exceed 40/100.
-  Multi-source verification is the architecture, not a feature.
-
-Inactivity Decay:
-  Agents inactive for more than 30 days receive a decay multiplier on Activity and Reputation:
-    decay = max(0.50, 1.0 - (inactive_days - 30) * 0.005)
-  Floor at 50% — earned trust is never fully erased by inactivity.
-
-Anti-Gaming:
-  - Single-source penalty (60% reduction for one-platform agents)
-  - Cross-platform consistency checks
-  - Anomaly detection for sudden score changes
-  - Gaming one platform is easy; gaming four simultaneously is exponentially harder
-
-Full methodology: https://agentscores.xyz/methodology?utm_source=mcp&utm_medium=resource&utm_campaign=npm
-Whitepaper: https://agentscores.xyz/methodology/whitepaper?utm_source=mcp&utm_medium=resource&utm_campaign=npm`;
-const SCORE_BANDS_TEXT = `AgentScore Trust Bands
-======================
-
-Score     Band             Meaning
------     ----             -------
- 0-19     UNVERIFIED       No meaningful trust signal. Agent may exist on one platform but lacks cross-platform verification.
-20-39     LOW TRUST        Some presence but limited verification. Typically single-platform agents with moderate activity.
-40-59     MODERATE         Established presence with partial cross-platform verification. Building trust.
-60-79     TRUSTED          Strong cross-platform presence. Verified on multiple independent platforms.
-80-100    HIGHLY TRUSTED   Exceptional multi-source verification. Verified across all platforms with strong scores.
-
-Note: The highest effective score in the ecosystem is currently 22/100 — because no agent has verified across all four platforms yet. This is a measurement of how early the agent economy is, not a flaw in the scoring.
-
-Effective score = raw score * coverage multiplier
-Coverage multipliers: 1 platform = 0.40, 2 = 0.65, 3 = 0.85, 4 = 1.00`;