{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T15:52:58.510Z","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron","markdownUrl":"https://verifymcp.io/servers/app-merron-ai-act-check/merron.md","server":{"slug":"app-merron-ai-act-check","name":"Merron","registryName":"app.merron/ai-act-check","description":"Inspect selected project excerpts and screen user-confirmed facts for bounded EU AI Act readiness.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"merron","type":"remote","identifier":"https://merron.app/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron","version":"0.1.0","transport":null,"scoredAt":"2026-11-05T01:23:42.786Z"},"score":{"total":85,"tier":"high trust","status":"scored","weekDelta":0,"history":[{"date":"2026-11-05","total":85},{"date":"2026-11-04","total":85},{"date":"2026-11-03","total":85},{"date":"2026-11-02","total":85},{"date":"2026-11-01","total":85},{"date":"2026-10-31","total":85},{"date":"2026-10-30","total":85},{"date":"2026-10-29","total":85},{"date":"2026-10-28","total":85},{"date":"2026-10-27","total":85},{"date":"2026-10-26","total":85},{"date":"2026-10-25","total":85},{"date":"2026-10-24","total":85},{"date":"2026-10-23","total":85},{"date":"2026-10-22","total":85},{"date":"2026-10-21","total":85},{"date":"2026-10-20","total":85},{"date":"2026-10-19","total":85},{"date":"2026-10-18","total":85},{"date":"2026-10-17","total":85},{"date":"2026-10-16","total":85},{"date":"2026-10-15","total":85},{"date":"2026-10-14","total":85},{"date":"2026-10-13","total":85},{"date":"2026-10-12","total":85},{"date":"2026-10-11","total":84},{"date":"2026-10-10","total":84},{"date":"2026-10-08","total":83},{"date":"2026-10-05","total":82},{"date":"2026-10-04","total":81}]},"categories":[{"name":"Endpoint Security","score":80,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation.","HTTPS is enforced; there's no plaintext access path.","The HSTS (Strict-Transport-Security) header is present.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.none_no_destructive","args":{}},{"code":"https.enforced","args":{}},{"code":"headers.hsts_present","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":69,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 604 tokens (~151/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"151","items":"4","tools":"4","tokens":"604","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":100,"verdict":"pass","reasons":["No destabilizing schema changes in the last 30 days."],"codes":[{"code":"stability.stable","args":{}}]},{"name":"Tool Coverage","score":81,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","43% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"43"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"4"}},{"code":"toolsafety.manipulation_clean","args":{"units":"5","judged":"5"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"merron","type":"remote","identifier":"https://merron.app/mcp","withdrawn":false,"score":85,"current":true,"url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron","markdownUrl":"https://verifymcp.io/servers/app-merron-ai-act-check/merron.md"}],"facts":[{"label":"Endpoint","value":"https://merron.app/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"none"},{"label":"Version","value":"0.1.0"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"merron_scan_project","title":"Inspect selected project excerpts","description":"Find possible AI integrations, model calls, disclosure wording and sensitive-use wording in user-selected project excerpts. Returns file/line references and follow-up questions, not a legal classification. First explain that the excerpts will be sent to Merron and obtain the user's agreement. Never send secrets, personal customer records, whole repositories or files the user has not authorised. Does not fetch URLs, execute code, persist inputs or access private cases.","inputs":[{"name":"files","type":"array","required":true,"description":null},{"name":"sharingConfirmed","type":"boolean","required":true,"description":"True only after the user agrees to send these selected excerpts to Merron."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":124},{"name":"merron_get_questions","title":"Get AI Act screening questions","description":"Get relevant business questions and explanations for a selected AI system. Pass only known user answers; omit unknown values or use null. Does not classify or assume unanswered questions mean No. No sign-in or private workspace access.","inputs":[{"name":"facts","type":"object","required":false,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":60},{"name":"merron_screen_ai_act","title":"Screen confirmed facts for the EU AI Act","description":"Run Merron's versioned, bounded AI Act rules on facts the user has explicitly confirmed. Returns a conditional screening result, unresolved routes, missing questions and official references. Never infer confirmation or legal compliance from source code or absence of signals. Unknown answers remain unknown. This computation does not check documents, use an AI model, save a report, access accounts or certify compliance.","inputs":[{"name":"facts","type":"object","required":true,"description":null},{"name":"factsConfirmedByUser","type":"boolean","required":true,"description":"True only after the user confirms the supplied answers describe the actual system."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":115},{"name":"merron_prepare_workspace","title":"Prepare the system in a private Merron workspace","description":"Save this AI system to Merron so the user can build an evidence pack from it: the name, a description, the answers the user confirmed and the file/line findings from merron_scan_project. Returns a private single-use link, valid 7 days; the user signs in, the system opens prefilled and Merron guides them through connecting the code, confirming the answers and creating the pack. Ask the user first and tell them what will be saved. Never include code excerpts, secrets or personal data; findings carry only paths, line numbers and codes. Give the user the link exactly as returned.","inputs":[{"name":"system","type":"object","required":true,"description":null},{"name":"userAgreed","type":"boolean","required":true,"description":"True only after the user agrees to save these details to Merron."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":161}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T01:23:42.000Z","track":"remote","endpoint":"https://merron.app/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=*.merron.app","issuer":"CN=YR1,O=Let's Encrypt,C=US","notBefore":"2026-10-20T20:24:16Z","notAfter":"2027-01-18T20:24:15Z","keyType":"RSA","keyBits":2048,"isCa":false},{"subject":"CN=YR1,O=Let's Encrypt,C=US","issuer":"CN=Root YR,O=ISRG,C=US","notBefore":"2025-09-03T00:00:00Z","notAfter":"2028-09-02T23:59:59Z","keyType":"RSA","keyBits":2048,"isCa":true},{"subject":"CN=Root YR,O=ISRG,C=US","issuer":"CN=ISRG Root X1,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"RSA","keyBits":4096,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"merron.app.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"app.","outcome":"verified","label":"Verified"},{"zone":"merron.app.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"none","label":"No authorisation required","gate":null,"gateLabel":null,"status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"https_enforced","label":"HTTPS enforced","status":308},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-09-12","recent":[{"id":"chg_01a12eaf-af43-7c6a-a76b-c2c6299770a3","kind":"check.verdict","summary":"Stability (0.97 → pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a12eaf-af43-7c6a-a76b-c2c6299770a3"},{"id":"chg_01a12eaf-af47-7cc3-bd87-1abc2e2f663f","kind":"score.total_changed","summary":"Trust score (84 → 85)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a12eaf-af47-7cc3-bd87-1abc2e2f663f"},{"id":"chg_01a12618-6021-77f4-998a-718653d63c41","kind":"score.total_changed","summary":"Trust score (83 → 84)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a12618-6021-77f4-998a-718653d63c41"},{"id":"chg_01a1190e-533b-7607-a4c9-2ac815707a9d","kind":"score.total_changed","summary":"Trust score (82 → 83)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-08","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a1190e-533b-7607-a4c9-2ac815707a9d"},{"id":"chg_01a109c6-4090-77d9-b861-dd81f19dccba","kind":"score.total_changed","summary":"Trust score (81 → 82)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-05","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a109c6-4090-77d9-b861-dd81f19dccba"},{"id":"chg_01a0ff4f-6f4a-7b6b-8ea0-e47711ba29fa","kind":"score.total_changed","summary":"Trust score (80 → 81)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-03","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0ff4f-6f4a-7b6b-8ea0-e47711ba29fa"},{"id":"chg_01a0f501-ee1a-7ae8-9880-048d69992cd9","kind":"score.total_changed","summary":"Trust score (79 → 80)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-01","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0f501-ee1a-7ae8-9880-048d69992cd9"},{"id":"chg_01a0eab5-423a-76b9-968b-53910652653a","kind":"check.measure","summary":"Schema quality (134 → 151)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-09-29","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0eab5-423a-76b9-968b-53910652653a"},{"id":"chg_01a0eab5-423e-71d7-945f-b05c209ac480","kind":"tool.added","summary":"New tool “merron_prepare_workspace”","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-29","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0eab5-423e-71d7-945f-b05c209ac480"},{"id":"chg_01a0eab5-423f-7bdf-ac4d-3c9b7db00abe","kind":"server.version_changed","summary":"Server version (0.1.1 → 0.2.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-29","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0eab5-423f-7bdf-ac4d-3c9b7db00abe"},{"id":"chg_01a0eab5-4240-739a-92af-e742dd7473e5","kind":"server.instructions_changed","summary":"The server rewrote its instructions, which are the text every model session reads","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-29","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0eab5-4240-739a-92af-e742dd7473e5"},{"id":"chg_01a0e58f-4991-78b7-adfa-82cc208188f5","kind":"score.rubric_changed","summary":"We updated how we score, so this day's move reflects our rubric, not a change to the server","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-28","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0e58f-4991-78b7-adfa-82cc208188f5"},{"id":"chg_01a0e069-3fa3-7b8e-8a5f-e2222838e8dc","kind":"score.total_changed","summary":"Trust score (78 → 79)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-09-27","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0e069-3fa3-7b8e-8a5f-e2222838e8dc"},{"id":"chg_01a0d61d-1c44-7ca9-8c06-c1b5e7d5370c","kind":"score.rubric_changed","summary":"We updated how we score, so this day's move reflects our rubric, not a change to the server","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-25","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0d61d-1c44-7ca9-8c06-c1b5e7d5370c"},{"id":"chg_01a0cbcf-ccbc-706c-a8c0-80a79df35f19","kind":"score.total_changed","summary":"Trust score (76 → 77)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-09-23","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0cbcf-ccbc-706c-a8c0-80a79df35f19"},{"id":"chg_01a0c183-bb2e-73c9-bd65-58a8201983a9","kind":"score.total_changed","summary":"Trust score (75 → 76)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-09-21","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0c183-bb2e-73c9-bd65-58a8201983a9"},{"id":"chg_01a0b736-d660-7d10-84ef-d95087558358","kind":"check.measure","summary":"Schema quality (excellent → good)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-19","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0b736-d660-7d10-84ef-d95087558358"},{"id":"chg_01a0b736-d662-7e57-b359-5a52fa8c5e4b","kind":"tool.description_changed","summary":"Tool “merron_get_questions” rewrote its description, which is the text the model reads","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-19","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0b736-d662-7e57-b359-5a52fa8c5e4b"},{"id":"chg_01a0b736-d663-7e4e-9e11-360b9877b772","kind":"param.description_changed","summary":"“merron_screen_ai_act” reworded the description of “factsConfirmedByUser”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-19","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0b736-d663-7e4e-9e11-360b9877b772"},{"id":"chg_01a0acea-9dfc-7d2e-9be0-9ba23d470daa","kind":"score.total_changed","summary":"Trust score (74 → 75)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-09-17","url":"https://verifymcp.io/servers/app-merron-ai-act-check/merron#chg-chg_01a0acea-9dfc-7d2e-9be0-9ba23d470daa"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/app-merron-ai-act-check/merron/changelog.json"},"links":{"html":"https://verifymcp.io/servers/app-merron-ai-act-check/merron","markdown":"https://verifymcp.io/servers/app-merron-ai-act-check/merron.md","changelogJson":"https://verifymcp.io/servers/app-merron-ai-act-check/merron/changelog.json","changelogRss":"https://verifymcp.io/servers/app-merron-ai-act-check/merron.xml","external":[{"label":"Remote endpoint","href":"https://merron.app/mcp"},{"label":"Website","href":"https://merron.app/integrations/mcp"}]}}