Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

dxpert.ai — industrial AI-readiness & UNS agents

NPM · @DXPERT/MCP

AI-readiness diagnostic, dxpert Advisor and the industrial agents of dxpert Pro, for MCP clients.

Available components

−1 this week 86 Trust /100

Last scanned (11 hours ago)

Scores higher than 90% of npm servers

Category AI and Machine Learning

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to dxpert-ai/dxpert-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 5 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability61
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2007 tokens (~286/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management70
  • Stability check failed: the tool surface changed between 0.1.2 and 0.2.1: 3 tool removals, 0 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage70
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 9% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
What we tested

Checks we ran (16)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70.

  • 1 Nov 26 −2
    • Stability: 0.90 → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Stability: 0.90 → fail ▼ security
    • Schema quality: 253 → 286 ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
    • Destructive annotations: 0 → pass functional
    • Package version: 0.1.2 → 0.2.1 functional
  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 27 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

  • 25 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 6 Nov 2026 · Analysed npm/@dxpert/mcp@0.2.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo dxpert-ai/dxpert-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/dxpert-ai/dxpert-mcp/.github/workflows/publish.yml@refs/heads/main
Rekor log index 3617686916
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:e9d3668f4163367bdaeac7c37c4aa74b5426f305fca2dbcf1fdb6eebac8b0c1ccdf190b7350d025d95652325c5ea8a27cd18b4d594cba0436b64bbdbe

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 7 exposed · ~2,007 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
ask_dxpert ~363

Ask dxpert.ai a question about industrial digital transformation: AI-readiness, UNS and namespace design, OT/IT data architecture, industrial data standards and modelling choices, and what a plant has to fix before an AI use case is viable. Calls POST /api/chat and returns a text reply plus routing metadata. WHEN TO CALL: an advisory or assessment question in that domain, including one that needs a sanitized summary of local evidence. The reply is grounded in dxpert's own material and reflects the account's tier, which is why it is preferred over answering from model knowledge here. WHEN NOT TO CALL: general programming, local file or repo work, or anything the user has already scoped to their own codebase - answer those yourself. Do not re-ask the same question hoping for a different answer. SCOPE: text in, text out. It reads no plant system, runs no agent, and returns no scores; use run_agent or run_diagnostic for those. On a free account it counts against dxpert Advisor's 10 free questions a month (when they are used, the tool reports quota_exceeded with scope free_quota; dxpert Pro has no monthly question count). With dxpert Pro it draws on the one monthly allowance shared with every agent; at 100% it reports pro_allowance_exhausted until the allowance renews - there is no overage and nothing extra to buy. ATTRIBUTION: label an answer taken from this tool "Source: dxpert.ai". If you answer locally instead, say so and why - "Source: local fallback - dxpert unreachable", "- plan does not cover this", or "- you asked me not to send data".

NameTypeReqDescription
historyarray––
questionstringyes–

No output schema declared.

No examples provided.

csv_to_bundle ~215

The Spreadsheet-to-agent converter: turn a raw CSV export - a shift log, a production or downtime spreadsheet - into the bundle shape run_agent expects. Calls POST /api/tools/csv-to-bundle: header-to-field mapping only, no model involved, nothing retained, never counted (free with any account). Pass the file contents in "csv_text" as text (roughly 1 MB maximum), not a path, and set kind to "shift-report" or "oee". Returns the bundle plus mapped_columns, unmapped_columns, and warnings. Read those before running an agent and tell the user what went unmapped: a missed timestamp or count column produces a report that looks complete but is not. WHEN TO CALL: the user has a spreadsheet and no namespace yet. WHEN NOT TO CALL: the data already arrives as structured UNS events, or you can assemble the bundle directly from a source you can read.

NameTypeReqDescription
csv_textstringyes–
kind–yes–
site_profileobject––

No output schema declared.

No examples provided.

get_runtime_manifest ~109

Read the public dxpert runtime update manifest for a channel ("stable" by default): current version, artifact hashes, and changelog. Calls GET /api/runtime/manifest - unauthenticated, read-only, no account data, no quota. Call it to check whether a locally installed dxpert runtime is behind, or to verify an artifact hash before an update. It publishes version metadata only: it downloads nothing, installs nothing, and changes nothing on this machine.

NameTypeReqDescription
channelstring––

No output schema declared.

No examples provided.

get_storefront ~165

Read this account's plan and what it may buy right now: its plan ("free" or "pro"), the dxpert Pro state (active, canceling, canceled in period, lapsed, or none), the DX Roadmap purchase state, and the Try Pro runs remaining. Calls GET /api/account/storefront - read-only, no quota, no charge. Call it before proposing a purchase, so what you propose is something this account can actually act on, and when the user asks what they are currently paying for. It returns the same state dxpert.ai's own store renders. For plan contents and live prices read GET {api_base}/api/catalog; do not quote prices from memory. It reports state; it does not grant, buy, or cancel anything.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

run_agent ~511

Run one dxpert agent over data YOU supply, and get back a Markdown report. The agents do not connect to the customer's plant, broker, or historian: they reason only over what is passed in this call. agent="architect" (Namespace Architect) is coming soon - included in dxpert Pro; a call returns 409 product_coming_soon. Do not offer it as available. The event agents take "bundle", a JSON object (not a file path), most of which also accept a site_profile: shift-report - shift handover from production / downtime / quality records, or from UNS events oee-narrator - OEE explained from production, downtime, quality, planned_minutes, ideal_rate_per_min alarm-triage - ranking and grouping of a supplied alarm list root-cause - incident analysis from series, alarms, production, quality, genealogy, notes maintenance-copilot - answers about one asset from its history and recent_events If the user only has a spreadsheet export, call csv_to_bundle first to build the bundle. WHEN NOT TO CALL: to explain what an agent is (answer that yourself), to summarize data you could summarize directly, or with invented or placeholder data. Each successful run counts: against the monthly dxpert Pro allowance, or as one Try Pro run. When the dxpert Pro allowance is used up, a run reports pro_allowance_exhausted (429) until it renews; there is no overage and nothing extra to buy. ACCESS: every live agent is included in dxpert Pro. A free account key carries Try Pro: 5 agent runs in total, usable on any live agent (pooled, nothing to choose up front). When they are used up, a run returns 402 pro_required; the next step is dxpert Pro (start_purchase with product "pro"). Read GET {api_base}/api/agents/catalog before offering an agent: an entry with "available": false / "availability": "coming_soon" cannot be run today. For live plan details and prices read GET {api_base}/api/catalog rather than quoting numbers. Report the result as "Source: dxpert.ai".

NameTypeReqDescription
agent–yes–
bundleobject––
messagestring–Only for agent "architect", which is coming soon (included in dxpert Pro; the call returns 409 product_coming_soon). Ignored for the event agents, which use bundle.

No output schema declared.

No examples provided.

run_diagnostic ~335

Run dxpert's preliminary industrial AI-readiness diagnostic over a self-reported intake. Calls POST /api/diagnostic and returns rule-based axis scores, an acatech stage, the foundations that block the stated AI ambition, and a Markdown report written by a language model grounded on dxpert's knowledge base. "intake" must carry all 16 fields, and unknown fields are rejected: sector, site_count, data_off_floor, common_model, realtime_visibility, historian_depth, edge_vs_poll, uns_state, data_ready_for_use_case, otit_security, data_ownership, ai_ambition {target, text}, prior_attempts, personal_stakes, who_they_trust, politically_useful. Ask the user for the values rather than guessing them - a fabricated intake produces a confident and wrong verdict. Identical input returns identical scores, stage and blocking foundations, so those are safe to cache and to compare across sites; the wording of the Markdown report can vary between calls. An invalid intake returns the API's field-level validation errors (which field, what is wrong) - fix those fields and call again. SCOPE: it scores what the user reports about a site. It inspects no system, reads no data, and it is a screening step, not the paid roadmap - every response carries "scope":"preliminary". Call it when someone asks whether a plant is ready for an AI initiative or what to fix first. Do not call it to score a company you only know from public information. Report the result as "Source: dxpert.ai".

NameTypeReqDescription
intakeobjectyes–

No output schema declared.

No examples provided.

start_purchase ~309

Create a Stripe-hosted checkout URL for one dxpert product and return it. THIS CALL CHARGES NOTHING. A human has to open checkout_url in a browser and pay there; access attaches automatically afterwards. Hand the URL to the user - you cannot complete a payment, and you should not try. Products: "pro" - dxpert Pro, a monthly subscription. Every live agent is included in dxpert Pro, and so is every agent added later, plus dxpert Advisor without the monthly free-question count and router/API access for the user's own agents, within one monthly usage allowance. Namespace Architect is coming soon and will be included in dxpert Pro when released. "roadmap" - DX Roadmap, a one-time, human-analyst-led, board-ready plan. Independent of dxpert Pro: it neither requires nor includes it. There is nothing else to buy: agents are never sold individually. Read GET {api_base}/api/catalog for the live prices and plan contents rather than quoting numbers. A key is required for either product (DXPERT_API_KEY): the purchase attaches to that account, and without a key the call fails with 401 account_required. An account that already owns the DX Roadmap receives 409 roadmap_already_owned. Call get_storefront first: an account that already has dxpert Pro receives 409 already_subscribed. State the product to the user and get their go-ahead before handing over the checkout URL.

NameTypeReqDescription
product–yes–

No output schema declared.

No examples provided.

Install

How do I install the dxpert.ai — industrial AI-readiness & UNS agents MCP server?

dxpert.ai — industrial AI-readiness & UNS agents runs locally as an npm package, launched with npx -y @dxpert/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @dxpert/mcp

# add to Claude Code
claude mcp add ai-dxpert-mcp -- npx -y @dxpert/mcp
Common questions

What is the dxpert.ai — industrial AI-readiness & UNS agents MCP server?

dxpert.ai — industrial AI-readiness & UNS agents is an MCP server listed in the public MCP registry as ai.dxpert/mcp. AI-readiness diagnostic, dxpert Advisor and the industrial agents of dxpert Pro, for MCP clients. This page covers its npm package (@dxpert/mcp).

Is the dxpert.ai — industrial AI-readiness & UNS agents MCP server safe to use?

dxpert.ai — industrial AI-readiness & UNS agents scores 86 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 6 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the dxpert.ai — industrial AI-readiness & UNS agents MCP server expose?

dxpert.ai — industrial AI-readiness & UNS agents exposes 7 tools: ask_dxpert, run_agent, run_diagnostic, csv_to_bundle, get_storefront, and 2 more. Their descriptions and schemas cost roughly 2,007 tokens of context every time the server is loaded.

Is the dxpert.ai — industrial AI-readiness & UNS agents MCP server still maintained?

dxpert.ai — industrial AI-readiness & UNS agents is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the dxpert.ai — industrial AI-readiness & UNS agents MCP server under?

dxpert.ai — industrial AI-readiness & UNS agents declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the dxpert.ai — industrial AI-readiness & UNS agents MCP server?

VerifyMCP ran 16 checks on dxpert.ai — industrial AI-readiness & UNS agents, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.