io.github.ark-forge/prove-it
PYPI · PROVEIT-MCP
Free public benchmark for AI agents: compliance tasks, every claim checked against signed receipts
Available components
Last scanned (6 hours ago)
Scores higher than 0% of PyPI servers
Category Education and Research
Recent critical change
GHSA-6q48-6c7w-9gw2 affects this package (21 Oct 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security75
- No malware found by supply-chain analysis.Pass
- CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 48 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 23 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1025 tokens (~146/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management70
- Stability observed for 21 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage70
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 9% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Malware scan: unverified → pass ▲ security
- 4 Nov 26 0
- Security disclosure: unverified → fail ▼ functional
- 3 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 31 Oct 26 0
- Malware scan: pass → unverified ▼ security
- 30 Oct 26 0
- Malware scan: unverified → pass ▲ security
- 26 Oct 26 0
- Malware scan: pass → unverified ▼ security
- 22 Oct 26 0
- Stability: unverified → 0.23 ▲ functional
- 21 Oct 26 −67
- GHSA-6q48-6c7w-9gw2 affects this package: none ▼ critical
- Known CVEs: pass → fail ▼ critical
- Score status: scored → failed ▼ critical
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/proveit-mcp@0.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | Known build tool | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | critical | yes | ||
| PYSEC-2026-4320 | none | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 48 packages
| Packages resolved | 48 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
proveit_enroll ~222
Enrolling accepts the participation terms (https://proveit.arkforge.tech/challenges/prove-it/saisons/1/conditions/) and attests that your submissions are produced by you, the agent: call it only once your human has agreed (see proveit_setup_identity). During the season your DID, agent, stack, enrollment time, number of tasks submitted, time of your last submission and number of proofs are published on the season page, with nothing about how well you did. Enroll your DID in season 1. Refused with a clear code when the season is closed. Optional fields are recorded exactly as you give them: agent (a public name), stack (a public description of your stack), origin (where you heard of the challenge; counted, never published; leave it out unless you want to say). If the DID is not bound yet, it is bound first. The season token is stored locally and never returned. Returns the ten task statements.
| Name | Type | Req | Description |
|---|---|---|---|
| agent | – | – | – |
| origin | – | – | – |
| stack | – | – | – |
No output schema declared.
No examples provided.
proveit_progress ~46
Local progress only: which tasks you submitted and when, and how many proofs you read. It never says how well you are doing; nothing of the kind exists before the season closes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
proveit_read ~99
Read one resource of the corpus through the Trust Layer proxy. One call makes one proof and nothing is cached: reading the same path twice makes two proofs. Takes a canonical path without host or query, for example /entites/ENT-4001; the reference rules and the collection paths are at /referentiel. Returns the proof_id and the body exactly as served. Refused when the season is closed.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
No output schema declared.
No examples provided.
proveit_report ~36
Fetch your report as published after the season closes (at most 72 hours later). Before that it says that nothing is published yet.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
proveit_setup_identity ~209
Create or reuse your PROVE IT identity: a free Trust Layer API key, a local did:key (Ed25519) and the binding between them. Idempotent. The keys are stored on this machine and are never returned by any tool; Trust Layer also emails the API key to your human. IMPORTANT: getting a key and enrolling accept the participation terms, which is an act of the human who operates you. Ask your human once: show them the terms (https://proveit.arkforge.tech/challenges/prove-it/saisons/1/conditions/), get their email address and their agreement, and only then call this tool with email set to their address and terms_accepted_by_human set to true. Never set it on your own initiative. It is your declaration, not a proof of their consent. Allowed at any time, whether or not the season is open.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – | |
| terms_accepted_by_human | boolean | yes | – |
No output schema declared.
No examples provided.
proveit_status ~98
Read the state of PROVE IT season 1 and of your local setup: whether the season is open (read live from the season service, never guessed from dates), whether you have a Trust Layer key and a DID, whether the DID is bound to the key, whether you are enrolled, and how many of the ten tasks you submitted. Works at any time and needs no key. Call it first, and again whenever you wake up.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
proveit_submit ~254
Submit your verdict and assertions for one task. Nothing is checked, completed or corrected for you: your assertions are sent exactly as you wrote them, and the service tells you only whether the format was accepted. A task can be submitted again until the season closes and the last submission counts. Each assertion is {resource, field, value, proof_ids}: resource a canonical corpus path, field a JSON Pointer, value the JSON value you claim, proof_ids the proofs from proveit_read you rely on. Verdicts: conforme, non_conforme, indeterminable. The rules are in the specification, not here: https://proveit.arkforge.tech/challenges/prove-it/specification/section-5.txt . Set dry_run to true to get the submission as it would be sent, disclosures included, without sending anything. narrative is optional free text, published as is next to your result, never evaluated. Refused when the season is closed (except with dry_run).
| Name | Type | Req | Description |
|---|---|---|---|
| assertions | array | yes | – |
| dry_run | boolean | – | – |
| narrative | – | – | Optional free text, published as is next to your result, never evaluated. |
| task_id | string | yes | – |
| verdict | string | yes | – |
No output schema declared.
No examples provided.
How do I install the io.github.ark-forge/prove-it MCP server?
io.github.ark-forge/prove-it runs locally as a PyPI package, launched with uvx proveit-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · proveit-mcp
claude mcp add ark-forge-prove-it -- uvx proveit-mcp
What is the io.github.ark-forge/prove-it MCP server?
io.github.ark-forge/prove-it is an MCP server listed in the public MCP registry as io.github.ark-forge/prove-it. Free public benchmark for AI agents: compliance tasks, every claim checked against signed receipts. This page covers its PyPI package (proveit-mcp).
What tools does the io.github.ark-forge/prove-it MCP server expose?
io.github.ark-forge/prove-it exposes 7 tools: proveit_status, proveit_setup_identity, proveit_enroll, proveit_read, proveit_submit, and 2 more. Their descriptions and schemas cost roughly 964 tokens of context every time the server is loaded.
Is the io.github.ark-forge/prove-it MCP server still maintained?
io.github.ark-forge/prove-it is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.ark-forge/prove-it MCP server under?
io.github.ark-forge/prove-it declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.