{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-07T17:25:53.379Z","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp","markdownUrl":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp.md","server":{"slug":"ashadow07-karmadue","name":"KarmaDue","registryName":"io.github.ashadow07/karmadue","description":"Pre-install safety check for agents: known traps, tested fixes, malware reports. No account.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"karmadue-mcp","type":"remote","identifier":"https://karmadue--mcp.expo.app/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp","version":"1.1.3","transport":null,"scoredAt":"2026-11-07T09:07:47.843Z"},"score":{"total":77,"tier":"medium","status":"scored","weekDelta":0,"history":[{"date":"2026-11-07","total":77},{"date":"2026-11-06","total":77},{"date":"2026-11-05","total":77},{"date":"2026-11-04","total":77},{"date":"2026-11-03","total":77},{"date":"2026-11-02","total":77},{"date":"2026-11-01","total":77},{"date":"2026-10-31","total":77},{"date":"2026-10-30","total":77},{"date":"2026-10-29","total":77},{"date":"2026-10-28","total":77},{"date":"2026-10-27","total":77},{"date":"2026-10-26","total":77},{"date":"2026-10-25","total":77},{"date":"2026-10-24","total":77},{"date":"2026-10-23","total":77},{"date":"2026-10-22","total":77},{"date":"2026-10-21","total":77},{"date":"2026-10-20","total":77},{"date":"2026-10-19","total":77},{"date":"2026-10-18","total":77},{"date":"2026-10-17","total":77},{"date":"2026-10-16","total":77},{"date":"2026-10-15","total":77},{"date":"2026-10-14","total":79},{"date":"2026-10-13","total":39},{"date":"2026-10-12","total":39}]},"categories":[{"name":"Endpoint Security","score":97,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.","HTTPS is enforced; there's no plaintext access path.","The HSTS (Strict-Transport-Security) header is present.","DNSSEC check failed: this domain isn't protected by DNSSEC.","The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.rfc9728_invoke","args":{}},{"code":"https.enforced","args":{}},{"code":"headers.hsts_present","args":{}},{"code":"dnssec.absent","args":{}},{"code":"auth.registration_cimd","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":59,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 843 tokens (~168/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"168","items":"5","tools":"5","tokens":"843","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":0,"verdict":"fail","reasons":["Stability check failed: schema churn in the 24 days we've observed: 27 tool removals, 0 breaking changes, 0 auth/transport breaks, 3 additions."],"codes":[{"code":"stability.churn","args":{"days":"24","added":"3","breaks":"0","removed":"27","auth_transport":"0"}}]},{"name":"Tool Coverage","score":95,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","86% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"86"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"5"}},{"code":"toolsafety.manipulation_clean","args":{"units":"6","judged":"6"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"functions-v1-mcp","type":"remote","identifier":"https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp","withdrawn":false,"score":63,"current":false,"url":"https://verifymcp.io/servers/ashadow07-karmadue/functions-v1-mcp","markdownUrl":"https://verifymcp.io/servers/ashadow07-karmadue/functions-v1-mcp.md"},{"slug":"functions-v1-mcp-connector","type":"remote","identifier":"https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/connector","withdrawn":false,"score":77,"current":false,"url":"https://verifymcp.io/servers/ashadow07-karmadue/functions-v1-mcp-connector","markdownUrl":"https://verifymcp.io/servers/ashadow07-karmadue/functions-v1-mcp-connector.md"},{"slug":"karmadue-mcp","type":"remote","identifier":"https://karmadue--mcp.expo.app/mcp","withdrawn":false,"score":77,"current":true,"url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp","markdownUrl":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp.md"}],"facts":[{"label":"Endpoint","value":"https://karmadue--mcp.expo.app/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"required"},{"label":"Version","value":"1.1.3"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"check_install","title":null,"description":"Read-only. Call before npm/pnpm/yarn install, pip install, uv add, npx or uvx, or adding an MCP server, including setup commands from a README or tutorial. Returns v, enforce, why; on known traps fix (tested steps), do_not (what failed, where), test, source. enforce=block: stop. enforce=ask: ask your person first. v=fix_first: use fix, not your command. Also returns safety (OSV advisories and malicious-package reports: verdict, advisories, fixed_in). When no tested record exists, repro_request says how to queue one with request_repro 'yes' (the only case where this call records anything: one anonymous request). Missing evidence is not safety clearance. Skip packages already pinned in a lockfile you are not changing.","inputs":[{"name":"detail","type":"string","required":false,"description":"Optional. 'full' adds tested_on, untruncated notes, records and links."},{"name":"ecosystem","type":"string","required":true,"description":"Package ecosystem of the target: npm (npm, pnpm, yarn, npx), pypi (pip, uv, uvx) or mcp (an MCP server you are about to add, or a bare name that may exist in more than one ecosystem). A bare name fou…"},{"name":"request_repro","type":"string","required":false,"description":"Optional. 'yes' queues one anonymous reproduction request (package and version only) when no tested record exists for the target."},{"name":"runtime_env","type":"string","required":false,"description":"Optional, e.g. node 20 linux."},{"name":"target","type":"string","required":true,"description":"Package or server as you would install it, e.g. tailwindcss@4, psycopg2, @modelcontextprotocol/server-filesystem."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":376},{"name":"search_recipes","title":null,"description":"Call when an install, build or import fails, before retrying or guessing a fix. Paste the key error line; returns tested fixes.","inputs":[{"name":"error_signature","type":"string","required":true,"description":"The key error line, verbatim."},{"name":"runtime_env","type":"string","required":false,"description":"Optional, e.g. python 3.13 macos."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":72},{"name":"report_leaf","title":null,"description":"Only if your owner opted in: after an install finishes, report pass or fail and the command. Reviewed before use.","inputs":[{"name":"command_run","type":"string","required":true,"description":"The exact install command you ran, e.g. npm i -D tailwindcss@4. No secrets or tokens."},{"name":"runtime_env","type":"string","required":true,"description":"Your setup, e.g. node 20 linux or python 3.13 macos."},{"name":"status","type":"string","required":true,"description":"Outcome of the install: pass if it finished and worked, fail if it errored."},{"name":"stderr_snippet","type":"string","required":false,"description":"Optional. The key error lines if it failed, verbatim. Never include secrets, tokens or personal data."},{"name":"target","type":"string","required":true,"description":"Package or server you installed, as you passed it to check_install, e.g. tailwindcss@4 or @modelcontextprotocol/server-filesystem."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":181},{"name":"search","title":null,"description":"Search PinTree records for packages, tools and MCP servers.","inputs":[{"name":"query","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":26},{"name":"fetch","title":null,"description":"Fetch one record by id from search.","inputs":[{"name":"id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":22}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-07T09:07:47.000Z","track":"remote","endpoint":"https://karmadue--mcp.expo.app/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=expo.app","issuer":"CN=WE1,O=Google Trust Services,C=US","notBefore":"2026-10-08T21:51:35Z","notAfter":"2027-01-06T22:51:30Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=WE1,O=Google Trust Services,C=US","issuer":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","notBefore":"2023-12-13T09:00:00Z","notAfter":"2029-02-20T14:00:00Z","keyType":"ECDSA","keyBits":256,"isCa":true},{"subject":"CN=GTS Root R4,O=Google Trust Services LLC,C=US","issuer":"CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE","notBefore":"2023-11-15T03:43:21Z","notAfter":"2028-01-28T00:00:42Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"karmadue--mcp.expo.app.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"app.","outcome":"verified","label":"Verified"},{"zone":"expo.app.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"enforced_validated","label":"Enforced and verified","gate":"invoke","gateLabel":"On tool calls","status":200,"authorizationServers":["https://karmadue.expo.app"]},"httpsRedirect":{"outcome":"https_enforced","label":"HTTPS enforced","status":301},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-12","recent":[{"id":"chg_01a1b01a-4311-7b4d-a830-d8822c88e571","kind":"score.rubric_changed","summary":"We updated how we score, so this day's move reflects our rubric, not a change to the server","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-06","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a1b01a-4311-7b4d-a830-d8822c88e571"},{"id":"chg_01a15368-4be2-7888-90c9-7dee669b5323","kind":"param.added_optional","summary":"“check_install” added an optional parameter “detail”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a15368-4be2-7888-90c9-7dee669b5323"},{"id":"chg_01a14fbe-1eea-7eb3-8c99-4fe8f3c90860","kind":"param.description_changed","summary":"“report_leaf” reworded the description of “runtime_env”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1eea-7eb3-8c99-4fe8f3c90860"},{"id":"chg_01a14fbe-1f45-70b8-8e25-d17073e39c87","kind":"param.description_changed","summary":"“report_leaf” reworded the description of “stderr_snippet”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1f45-70b8-8e25-d17073e39c87"},{"id":"chg_01a14fbe-1f50-7e2b-a55a-c48d7d2ba731","kind":"param.description_changed","summary":"“report_leaf” reworded the description of “target”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1f50-7e2b-a55a-c48d7d2ba731"},{"id":"chg_01a14fbe-1e20-712c-b7ec-fd39e9c46750","kind":"check.verdict","summary":"Schema quality (pass → fail)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1e20-712c-b7ec-fd39e9c46750"},{"id":"chg_01a14fbe-1e7e-70a8-9605-13db54dfb764","kind":"check.measure","summary":"Tool coverage (42% → 85%)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1e7e-70a8-9605-13db54dfb764"},{"id":"chg_01a14fbe-1e85-7e15-8aa6-067394b5f334","kind":"tool.description_changed","summary":"Tool “check_install” rewrote its description, which is the text the model reads","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1e85-7e15-8aa6-067394b5f334"},{"id":"chg_01a14fbe-1ed6-76c7-9a79-8c01154a3d76","kind":"param.description_changed","summary":"“check_install” reworded the description of “ecosystem”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1ed6-76c7-9a79-8c01154a3d76"},{"id":"chg_01a14fbe-1ed8-7bf5-9453-c701e730fa27","kind":"param.added_optional","summary":"“check_install” added an optional parameter “request_repro”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1ed8-7bf5-9453-c701e730fa27"},{"id":"chg_01a14fbe-1ee2-7eba-b90f-ccdd5cefa9e8","kind":"param.description_changed","summary":"“report_leaf” reworded the description of “command_run”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1ee2-7eba-b90f-ccdd5cefa9e8"},{"id":"chg_01a14fbe-1f3c-76ea-b7fa-9bfdcf5517b6","kind":"param.description_changed","summary":"“report_leaf” reworded the description of “status”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a14fbe-1f3c-76ea-b7fa-9bfdcf5517b6"},{"id":"chg_01a13ed0-7b27-7cae-841f-749b935c024b","kind":"param.removed_optional","summary":"“search” dropped the optional parameter “offset”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-7b27-7cae-841f-749b935c024b"},{"id":"chg_01a13ed0-7b27-788b-8ad8-5569ef7924ac","kind":"param.removed_optional","summary":"“search” dropped the optional parameter “include_examples”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-7b27-788b-8ad8-5569ef7924ac"},{"id":"chg_01a13ed0-7b27-7397-89e0-c7472cda2d35","kind":"param.removed_optional","summary":"“search” dropped the optional parameter “category”","materiality":"cosmetic","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-7b27-7397-89e0-c7472cda2d35"},{"id":"chg_01a13ed0-7b25-7d9d-9267-933d214cf0e2","kind":"tool.description_changed","summary":"Tool “search” rewrote its description, which is the text the model reads","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-7b25-7d9d-9267-933d214cf0e2"},{"id":"chg_01a13ed0-7751-78a6-a861-673e9f601d92","kind":"check.reverified","summary":"Stability (unverified → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-7751-78a6-a861-673e9f601d92"},{"id":"chg_01a13ed0-77a8-7d71-b138-a428e2d4c09a","kind":"check.measure","summary":"Tool coverage (100% → 42%)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-77a8-7d71-b138-a428e2d4c09a"},{"id":"chg_01a13ed0-77b4-77c6-8c96-0571bf3124f6","kind":"check.verdict","summary":"Schema quality (fail → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-77b4-77c6-8c96-0571bf3124f6"},{"id":"chg_01a13ed0-780e-74c6-934b-ff36d596a766","kind":"check.verdict","summary":"Destructive annotations (100 → pass)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-15","url":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp#chg-chg_01a13ed0-780e-74c6-934b-ff36d596a766"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp","markdown":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp.md","changelogJson":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/ashadow07-karmadue/karmadue-mcp.xml","external":[{"label":"Remote endpoint","href":"https://karmadue--mcp.expo.app/mcp"},{"label":"Repository","href":"https://github.com/ashadow07/karmadue"},{"label":"Website","href":"https://karmadue.expo.app/docs/mcp"}]}}