Commit — Supply Chain Risk Scoring

piiiico/proof-of-commitment

Gives you supply chain risk scores for npm, PyPI, Cargo, and Go packages through 9 MCP tools that surface behavioral signals like publisher concentration and release cadence. Built to catch the single-maintainer packages that stars and download counts hide. Query individual packages, audit lock files, or scan entire dependency trees from Claude Desktop or Cursor. The same scoring engine powers getcommit.dev and ships as a standalone CLI with CI gates and IDE hooks that block risky installs before they land. Useful when you need to know if that transitive dependency with 500 million weekly downloads has one person holding the keys.

GitHub stars: 9
tools: 12
transport: STDIO, HTTP
last updated: Jun 20, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://poc-backend.amdal-dev.workers.dev/mcp --name proof-of-commitment

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 12 tools

Verified live against the running server on Nov 6, 2026.

query_commitmentQuery verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content.1 params

Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content.

Parameters* required

domain*string

The domain to query (e.g. 'example.com'). Will be normalized to lowercase without protocol or path.

lookup_businessSearch for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free...1 params

Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free...

Parameters* required

query*string

Business name to search for (e.g. 'Peppes Pizza', 'Equinor')

lookup_business_by_orgLook up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.1 params

Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.

Parameters* required

orgNumber*string

Norwegian organization number (9 digits, e.g. '984388659')

lookup_github_repoGet a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments...1 params

Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments...

Parameters* required

repo*string

GitHub repository in "owner/repo" format or full URL. Examples: "vercel/next.js", "https://github.com/facebook/react"

lookup_npm_packageGet a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also...1 params

Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also...

Parameters* required

package*string

npm package name. Examples: "langchain", "@anthropic-ai/sdk", "express". Scoped packages need the @ prefix.

lookup_pypi_packageGet a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was...1 params

Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was...

Parameters* required

package*string

PyPI package name. Examples: "langchain", "openai", "requests", "fastapi". Case-insensitive.

lookup_cargo_crateGet a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply...1 params

Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply...

Parameters* required

crate*string

Crate name on crates.io. Examples: "serde", "tokio", "reqwest", "clap". Case-insensitive.

lookup_go_moduleGet a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contr...1 params

Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contr...

Parameters* required

module*string

Full Go module path. Must include the host. Examples: "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3". Case-sensitive (preserves capitalization in path).

audit_dependenciesBatch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concen...2 params

Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concen...

Parameters* required

ecosystemstring

Package ecosystem. "auto" detects by naming convention (Python-style = pypi, otherwise npm). Force "npm", "pypi", "cargo", or "golang" to override. Go modules require full path (host/owner/repo) —...one of npm · pypi · cargo · golang · autodefault: auto

packages*array

List of package names to score. Up to 20 at once. Examples: ["langchain", "litellm", "openai", "axios"] or ["@anthropic-ai/sdk", "zod", "express"] or ["github.com/gin-gonic/gin", "golang.org/x/net"...

audit_github_repoAudit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — just provide the GitHub URL or owner/...1 params

Audit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — just provide the GitHub URL or owner/...

Parameters* required

repo*string

GitHub repository to audit. Accepts: "owner/repo", "https://github.com/owner/repo", or any GitHub URL. Examples: "vercel/next.js", "https://github.com/langchain-ai/langchainjs"

audit_dependency_treeMap the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidd...2 params

Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidd...

Parameters* required

depthinteger

How deep to traverse. 1 = direct deps only (fast). 2 = also traverse deps of CRITICAL/HIGH packages (slower, reveals hidden risk). Default: 1default: 1

package*string

npm package name to map. Examples: "express", "langchain", "@anthropic-ai/sdk", "zod"

get_api_keyCreate a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables pac...1 params

Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables pac...

Parameters* required

email*string

Your email address — used for alert delivery and key recovery. One key per email.

Readme

Details

Repository: github.com/piiiico/proof-of-commitment
Website: getcommit.dev
Package: proof-of-commitment
Transport: STDIO, HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Commit — Supply Chain Risk Scoring

Install

Tools

Readme

Details

More from piiiico