{"serverId":"mcp-registry/io.github.piiiico/proof-of-commitment","tools":[{"name":"get_api_key","fixed":{"name":"get_api_key","description":"Create a free Commit API key instantly — no browser required.\n\nWhen you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring (weekly alerts when your dependencies get riskier).\n\nAfter creating the key, configure your MCP client to pass it:\n  Authorization: Bearer sk_commit_<your-key>\n\nExample: get_api_key({ email: \"dev@company.co","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["email"],"properties":{"email":{"type":"string","format":"email","pattern":"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$","description":"Your email address — used for alert delivery and key recovery. One key per email."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":257,"tokensAfter":257},{"name":"lookup_business","fixed":{"name":"lookup_business","description":"Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free, verified, unfakeable.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["query"],"properties":{"query":{"type":"string","description":"Business name to search for (e.g. 'Peppes Pizza', 'Equinor')"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":158,"tokensAfter":158},{"name":"lookup_business_by_org","fixed":{"name":"lookup_business_by_org","description":"Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["orgNumber"],"properties":{"orgNumber":{"type":"string","description":"Norwegian organization number (9 digits, e.g. '984388659')"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":134,"tokensAfter":134},{"name":"lookup_cargo_crate","fixed":{"name":"lookup_cargo_crate","description":"Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity.\n\nSupply chain risks apply to Cargo too — crate owners with publish access are the attack surface. A single owner on a high-download crate is the same risk pattern as npm.\n\nUseful for: vetting Rust dependencies before adding to Ca","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["crate"],"properties":{"crate":{"type":"string","description":"Crate name on crates.io. Examples: \"serde\", \"tokio\", \"reqwest\", \"clap\". Case-insensitive."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":225,"tokensAfter":225},{"name":"lookup_github_repo","fixed":{"name":"lookup_github_repo","description":"Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments — harder to fake than README claims or marketing copy.\n\nUseful for: vetting open-source dependencies, evaluating AI tools/frameworks, assessing vendor reliability, due diligence on any GitHub project.\n\nExamples: \"vercel/nex","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["repo"],"properties":{"repo":{"type":"string","description":"GitHub repository in \"owner/repo\" format or full URL. Examples: \"vercel/next.js\", \"https://github.com/facebook/react\""}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":232,"tokensAfter":232},{"name":"lookup_go_module","fixed":{"name":"lookup_go_module","description":"Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., \"github.com/gin-gonic/gin\", \"golang.org/x/net\", \"k8s.io/client-go\", \"gopkg.in/yaml.v3\") and returns real signals: module age, version count, publish cadence, GitHub contributors (the closest equivalent to \"publishers\" since Go has no centralized publisher concept — git push access is the publish equivalent), GitHub stars, OpenSSF Scorecard score.\n\nThe Go ecosystem has no centralized downloa","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["module"],"properties":{"module":{"type":"string","description":"Full Go module path. Must include the host. Examples: \"github.com/gin-gonic/gin\", \"golang.org/x/net\", \"k8s.io/client-go\", \"gopkg.in/yaml.v3\". Case-sensitive (preserves capitalization in path)."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":256,"tokensAfter":256},{"name":"lookup_npm_package","fixed":{"name":"lookup_npm_package","description":"Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity.\n\nAlso returns publisherLifecycle — cross-referencing current maintainers against per-version publish history to flag dormant publishers who still hold npm scope access. The Mastra incident (June 2026) exploited exactly this: a c","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["package"],"properties":{"package":{"type":"string","description":"npm package name. Examples: \"langchain\", \"@anthropic-ai/sdk\", \"express\". Scoped packages need the @ prefix."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":230,"tokensAfter":230},{"name":"lookup_pypi_package","fixed":{"name":"lookup_pypi_package","description":"Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity.\n\nSupply chain attacks target Python packages — LiteLLM (97M downloads/mo) was compromised via stolen PyPI token in March 2026. Behavioral signals reveal what star counts hide.\n\nUseful for: vetting Python dependencies, identifying abandonware, supply chain risk due diligence.\nExamples: \"langchain\", ","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["package"],"properties":{"package":{"type":"string","description":"PyPI package name. Examples: \"langchain\", \"openai\", \"requests\", \"fastapi\". Case-insensitive."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":229,"tokensAfter":229},{"name":"query_commitment","fixed":{"name":"query_commitment","description":"Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content.","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["domain"],"properties":{"domain":{"type":"string","description":"The domain to query (e.g. 'example.com'). Will be normalized to lowercase without protocol or path."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":149,"tokensAfter":149}],"toolsChanged":9,"tokensSaved":0,"todo":[],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}