hvtracker-mcp 0.1.2 → 0.2.1

package/README.md

@@ -23,7 +23,8 @@ package-based installation.
 ## Tools
 
 - `verify_mcp_server`: pre-connect trust verdict for an MCP server, package, GitHub repo, or agent name.
-- `check_agent_trust`: compact trust profile for a tracked AI agent or framework.
+- `check_agent_trust`: trust profile for a tracked AI agent or framework — incl. runtime capabilities (MCP status, providers, plugin surface, provenance drift) and the URL of its Ed25519-signed trust credential.
+- `compare_agents`: two agents side by side with an evidence-based verdict and the published compare-page link.
 - `search_agents`: search the HVTracker registry by name, repo, description, or category.
 
 ## Local Install

package/bin/hvtracker-mcp.js

@@ -7,10 +7,13 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 
-const VERSION = "0.1.2";
+const VERSION = "0.2.1";
 const DEFAULT_BASE_URL = "https://hvtracker.net";
 const BASE_URL = (process.env.HVTRACKER_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
 const TIMEOUT_MS = Number(process.env.HVTRACKER_TIMEOUT_SECONDS || 20) * 1000;
+// The full leaderboard is ~1MB and the API serves it with Cache-Control
+// max-age=900; re-pulling it per search_agents call is wasted origin load.
+const BOARD_TTL_MS = Number(process.env.HVTRACKER_BOARD_TTL_SECONDS || 900) * 1000;
 const READ_ONLY = {
   readOnlyHint: true,
   destructiveHint: false,
@@ -40,6 +43,25 @@ export async function apiGet(path, params = {}) {
   return payload;
 }
 
+const boardCache = { at: 0, data: null };
+
+export function resetBoardCache() {
+  boardCache.at = 0;
+  boardCache.data = null;
+}
+
+// Returns /api/v1/agents, cached for BOARD_TTL_MS. Failures are not cached —
+// the next call retries.
+async function getBoard() {
+  if (boardCache.data !== null && Date.now() - boardCache.at < BOARD_TTL_MS) {
+    return boardCache.data;
+  }
+  const data = await apiGet("/api/v1/agents");
+  boardCache.data = data;
+  boardCache.at = Date.now();
+  return data;
+}
+
 function asToolResult(value) {
   return {
     content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
@@ -92,7 +114,7 @@ export async function checkAgentTrust(nameOrRepo) {
   }
 
   const slug = verdict.slug;
-  return {
+  const result = {
     query: nameOrRepo,
     tracked: true,
     trusted: verdict.trusted,
@@ -104,13 +126,73 @@ export async function checkAgentTrust(nameOrRepo) {
     mcp_server_support: verdict.mcp_server_support,
     tool_permissions: verdict.tool_permissions || [],
     profile_url: slug ? `${BASE_URL}/agents/${slug}/` : null,
+    credential_url: slug ? `${BASE_URL}/data/agents/${slug}.json` : null,
     reasons: verdict.reasons || []
   };
+  if (slug) {
+    try {
+      const agent = await apiGet(`/data/agents/${slug}.json`);
+      const ext = agent.external_service_dependencies || {};
+      const tooling = agent.tool_plugin_surface || {};
+      const drift = agent.package_provenance_drift || {};
+      result.coverage_grade = agent.coverage_grade ?? null;
+      result.capabilities = {
+        mcp_status: (agent.mcp_server_support || {}).status || "none",
+        provider_count: (ext.providers || []).length,
+        requires_api_keys: Boolean(ext.requires_api_keys),
+        plugin_system: tooling.plugin_system || "none",
+        drift_status: drift.status || "not_applicable"
+      };
+    } catch {
+      // enrichment is best-effort; the verdict stands alone
+    }
+  }
+  return result;
+}
+
+export async function compareAgents(a, b) {
+  const [ra, rb] = [await checkAgentTrust(a), await checkAgentTrust(b)];
+  if (!ra.tracked || !rb.tracked) {
+    const missing = [[a, ra], [b, rb]].filter(([, r]) => !r.tracked).map(([q]) => q);
+    return {
+      a: ra,
+      b: rb,
+      verdict: `No verdict: ${missing.join(", ")} not in the registry — no independent trust evidence to compare.`,
+      compare_url: null
+    };
+  }
+  const sa = ra.trust_score || 0;
+  const sb = rb.trust_score || 0;
+  let verdict;
+  if (sa === sb) {
+    verdict = `${ra.repo} and ${rb.repo} tie at HVTrust ${sa} (grades ${ra.evidence_grade}/${rb.evidence_grade}).`;
+  } else {
+    const [hi, lo] = sa > sb ? [ra, rb] : [rb, ra];
+    verdict = `${hi.repo} scores higher on verifiable trust: HVTrust ${hi.trust_score} (grade ${hi.evidence_grade}) vs ${lo.repo} at ${lo.trust_score} (grade ${lo.evidence_grade}).`;
+  }
+  let compareUrl = null;
+  if (ra.slug && rb.slug) {
+    const [first, second] = [ra.slug, rb.slug].sort();
+    const candidate = `${BASE_URL}/compare/${first}-vs-${second}/`;
+    try {
+      const probe = await fetch(candidate, {
+        method: "HEAD",
+        headers: { "user-agent": `hvtracker-mcp/${VERSION}` },
+        signal: AbortSignal.timeout(TIMEOUT_MS)
+      });
+      if (probe.ok) {
+        compareUrl = candidate;
+      }
+    } catch {
+      // no published compare page (or unreachable) — omit the link
+    }
+  }
+  return { a: ra, b: rb, verdict, compare_url: compareUrl };
 }
 
 export async function searchAgents(query = "", category = "", limit = 10) {
   try {
-    const data = await apiGet("/api/v1/agents");
+    const data = await getBoard();
     const ql = String(query || "").trim().toLowerCase();
     const cl = String(category || "").trim().toLowerCase();
     const matches = [];
@@ -179,6 +261,20 @@ export function createServer() {
     async ({ name_or_repo }) => asToolResult(await checkAgentTrust(name_or_repo))
   );
 
+  server.registerTool(
+    "compare_agents",
+    {
+      title: "Compare Agents",
+      description: "Compare two tracked AI agents side by side: trust scores, grades, runtime capabilities, and an evidence-based verdict.",
+      inputSchema: {
+        a: z.string().describe("First agent — name, slug, GitHub repo/URL, or package."),
+        b: z.string().describe("Second agent — name, slug, GitHub repo/URL, or package.")
+      },
+      annotations: READ_ONLY
+    },
+    async ({ a, b }) => asToolResult(await compareAgents(a, b))
+  );
+
   server.registerTool(
     "search_agents",
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hvtracker-mcp",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "MCP server for HVTracker trust checks.",
   "license": "MIT",
   "type": "module",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.YugantM/hvtracker-mcp",
   "title": "HVTracker MCP",
   "description": "Pre-connect trust checks for AI agents and MCP servers using HVTracker's public trust registry.",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "repository": {
     "url": "https://github.com/YugantM/hvtracker-mcp",
     "source": "github"
@@ -18,7 +18,7 @@
     {
       "registryType": "npm",
       "identifier": "hvtracker-mcp",
-      "version": "0.1.2",
+      "version": "0.2.1",
       "transport": {
         "type": "stdio"
       }
@@ -26,18 +26,24 @@
     {
       "registryType": "pypi",
       "identifier": "hvtracker-mcp",
-      "version": "0.1.2",
+      "version": "0.2.1",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/yugantm/hvtracker-mcp:v0.1.2",
+      "identifier": "ghcr.io/yugantm/hvtracker-mcp:v0.2.1",
       "transport": {
         "type": "stdio"
       }
     }
   ],
-  "tags": ["security", "trust", "ai-agents", "mcp", "supply-chain"]
+  "tags": [
+    "security",
+    "trust",
+    "ai-agents",
+    "mcp",
+    "supply-chain"
+  ]
 }