{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:25:46.203Z","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp","markdownUrl":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp.md","server":{"slug":"box-kite-mcp","name":"Box Kite","registryName":"io.github.box-kite/mcp","description":"Box Kite's React styling engine as tools: props, components, and whether a value writes CSS.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"box-kite-mcp","type":"npm","identifier":"@box-kite/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp","version":"2.3.0","transport":"stdio","scoredAt":"2026-11-05T02:09:05.660Z"},"score":{"total":90,"tier":"high trust","status":"scored","weekDelta":14,"history":[{"date":"2026-11-05","total":90},{"date":"2026-11-04","total":89},{"date":"2026-11-03","total":74},{"date":"2026-11-02","total":73},{"date":"2026-11-01","total":88},{"date":"2026-10-31","total":87},{"date":"2026-10-30","total":72},{"date":"2026-10-29","total":76},{"date":"2026-10-28","total":76},{"date":"2026-10-27","total":85},{"date":"2026-10-26","total":85},{"date":"2026-10-25","total":85},{"date":"2026-10-24","total":84},{"date":"2026-10-23","total":84},{"date":"2026-10-22","total":83},{"date":"2026-10-21","total":83},{"date":"2026-10-20","total":82},{"date":"2026-10-19","total":67},{"date":"2026-10-18","total":81},{"date":"2026-10-17","total":66},{"date":"2026-10-16","total":79},{"date":"2026-10-15","total":79},{"date":"2026-10-14","total":79},{"date":"2026-10-13","total":39}]},"categories":[{"name":"Supply Chain Security","score":98,"verdict":"partial","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","30 of 92 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"92","unhealthy":"30"}}]},{"name":"Provenance & Transparency","score":100,"verdict":"pass","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to box-kite/box-kite).","Clear OSI-approved license (MIT).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"box-kite/box-kite"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":67,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 1053 tokens (~175/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"175","items":"6","tools":"6","tokens":"1053","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":73,"verdict":"partial","reasons":["Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"22"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"6"}},{"code":"toolsafety.manipulation_clean","args":{"units":"7","judged":"7"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"box-kite-mcp","type":"npm","identifier":"@box-kite/mcp","withdrawn":false,"score":90,"current":true,"url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp","markdownUrl":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"@box-kite/mcp"},{"label":"Version","value":"2.3.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"search_docs","title":"Search Box Kite","description":"Find the prop, component, nesting key or rule for what you are trying to build. Ranked across all four, so a goal (\"fade in on mount\", \"sticky header\", \"right-to-left\") finds the answer without knowing its name. Start here.","inputs":[{"name":"kind","type":"string","required":false,"description":"Narrow to one corpus. Leave out to search all four."},{"name":"limit","type":"integer","required":false,"description":"How many hits (default 12)."},{"name":"query","type":"string","required":true,"description":"What the UI should do, a CSS property, or a name you half-remember."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":116},{"name":"get_props","title":"Box style props","description":"The full record for named style props: the CSS they write, every value they accept, and a measured example — plus, for a numeric prop, the scale measured at 1/2/4/8, because the dividers differ per prop (235 props in all). Nesting keys are answered here too: hover, focus, focusVisible, hasFocus, active, valid, hasValid, invalid, hasInvalid, optional, hasChecked, hasRequired, hasDisabled, visited, target, open, placeholderShown, autofill, inRange, outOfRange, inert, rtl, ltr, indeterminate, checked, required, disabled, selected, before, after, placeholder, selection, marker, firstLine, firstLetter, backdrop, fileButton, sm, md, lg, xl, xxl, pointerCoarse, pointerFine, motionReduce, forcedColors, contrastMore, cq, dataAttr, ariaAttr, has, not, nth, group, peer, theme, startingStyle.","inputs":[{"name":"names","type":"array","required":true,"description":"Prop names, e.g. [\"fontSize\", \"borderRadius\", \"bgColor\"]."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":238},{"name":"get_component","title":"Box Kite component","description":"One component's whole contract: its props and their defaults, its sub-parts, its keyboard map and the ARIA it writes. Ask before composing a Dialog, Menu, Tabs, Combobox, DataGrid or any other behaviour component — the accessible mechanics are already in it.","inputs":[{"name":"include","type":"array","required":false,"description":"Only these sections. Leave out for all of them."},{"name":"name","type":"string","required":true,"description":"Component name, e.g. \"Tabs\", \"DataGrid\", \"Popover\". A part name works too (\"Tabs.Tab\")."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":112},{"name":"check_styles","title":"Check props against the engine","description":"Run a prop bag through the real styling engine and get back the CSS each prop writes — or why it wrote none. This is the only way to be sure: an unknown prop and an unaccepted value both produce no rule and no class name, with no warning anywhere. Use it on any prop bag you were not certain about, especially numbers and colour tokens.","inputs":[{"name":"props","type":"object","required":true,"description":"The props as JSON, exactly as written: {\"p\": 4, \"bgColor\": \"blue-550\", \"hover\": {\"opacity\": 1}}."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":121},{"name":"get_rules","title":"Box Kite rules","description":"The 55 rules this library is written by — where the element comes from, where HTML attributes go, how a layer is anchored, how a theme scopes. With no arguments it lists all 55 headings; pass numbers for the ones you need in full.","inputs":[{"name":"numbers","type":"array","required":false,"description":"Rule numbers to read in full. Leave out for the index."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":79},{"name":"get_blocks","title":"Installable blocks","description":"Whole sections rather than atoms — a data-grid page, a settings form, a dashboard shell — installed by the shadcn CLI, which also installs the package. Reach for one before composing a large surface by hand.","inputs":[{"name":"name","type":"string","required":false,"description":"A block name for its files and dependencies. Leave out to list them."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":73}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T02:09:05.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":92,"partial":false,"deprecated":null,"stale":30,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-13","recent":[{"id":"chg_01a1a977-88aa-7093-b945-0d3dad98e8f8","kind":"score.total_changed","summary":"Trust score (89 → 90)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a977-88aa-7093-b945-0d3dad98e8f8"},{"id":"chg_01a1a6dd-3dcd-7869-8cd6-0a17cb4776d1","kind":"score.total_changed","summary":"Trust score (49 → 89)","materiality":"functional","direction":"improvement","scoreDelta":40,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dd-3dcd-7869-8cd6-0a17cb4776d1"},{"id":"chg_01a1a6dc-33ce-736a-82f6-937b27e3c23e","kind":"check.unverifiable","summary":"Tool safety (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dc-33ce-736a-82f6-937b27e3c23e"},{"id":"chg_01a1a6dc-33ea-7681-9d49-b04b6fe2de2e","kind":"check.unverifiable","summary":"Stability (0.67 → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dc-33ea-7681-9d49-b04b6fe2de2e"},{"id":"chg_01a1a6dc-340c-79a6-a21e-10f7d3df21ab","kind":"check.unverifiable","summary":"Capabilities (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dc-340c-79a6-a21e-10f7d3df21ab"},{"id":"chg_01a1a6dc-342a-7c1f-86fc-721fa3ab906c","kind":"check.unverifiable","summary":"Tool coverage (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dc-342a-7c1f-86fc-721fa3ab906c"},{"id":"chg_01a1a6dc-342d-78d7-81d3-647a5127213c","kind":"package.version_changed","summary":"Package version (2.2.18 → 2.3.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dc-342d-78d7-81d3-647a5127213c"},{"id":"chg_01a1a6dc-3452-7398-9c64-fab8eb2e44b8","kind":"score.total_changed","summary":"Trust score (89 → 49)","materiality":"functional","direction":"regression","scoreDelta":-40,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a6dc-3452-7398-9c64-fab8eb2e44b8"},{"id":"chg_01a1a451-a23a-7b5d-84d9-c0e42a7d0884","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a451-a23a-7b5d-84d9-c0e42a7d0884"},{"id":"chg_01a1a451-a23d-7c62-a900-193020094b54","kind":"score.total_changed","summary":"Trust score (74 → 89)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a451-a23d-7c62-a900-193020094b54"},{"id":"chg_01a1a3c8-15a9-715c-9754-32e9317c02fc","kind":"package.version_changed","summary":"Package version (2.2.16 → 2.2.18)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a3c8-15a9-715c-9754-32e9317c02fc"},{"id":"chg_01a1a1da-c680-7164-ad17-b6b6d14a2e57","kind":"package.version_changed","summary":"Package version (2.2.16 → 2.2.17)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a1da-c680-7164-ad17-b6b6d14a2e57"},{"id":"chg_01a1a1da-c683-7d17-a58f-78932729a7f6","kind":"score.total_changed","summary":"Trust score (89 → 74)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a1a1da-c683-7d17-a58f-78932729a7f6"},{"id":"chg_01a19f29-4cb2-7e9a-ba73-58b8102ab14f","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19f29-4cb2-7e9a-ba73-58b8102ab14f"},{"id":"chg_01a19f29-4cb5-7bb7-8183-3aa36998302c","kind":"score.total_changed","summary":"Trust score (73 → 89)","materiality":"functional","direction":"improvement","scoreDelta":16,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19f29-4cb5-7bb7-8183-3aa36998302c"},{"id":"chg_01a19ea2-7583-7054-8d46-c656932c8bbc","kind":"package.version_changed","summary":"Package version (2.2.13 → 2.2.16)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19ea2-7583-7054-8d46-c656932c8bbc"},{"id":"chg_01a19ea2-7584-7aaa-a2ed-de5d71b201c4","kind":"score.total_changed","summary":"Trust score (63 → 73)","materiality":"functional","direction":"improvement","scoreDelta":10,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19ea2-7584-7aaa-a2ed-de5d71b201c4"},{"id":"chg_01a19d23-8617-7957-959c-51d5af8f19bd","kind":"check.unverifiable","summary":"Known CVEs (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19d23-8617-7957-959c-51d5af8f19bd"},{"id":"chg_01a19d23-8618-7885-b5f2-8f8bb4abe38f","kind":"check.unverifiable","summary":"Dependency health (0.85 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19d23-8618-7885-b5f2-8f8bb4abe38f"},{"id":"chg_01a19d23-8619-7986-990f-4da11fa8c1e9","kind":"package.version_changed","summary":"Package version (2.2.13 → 2.2.15)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp#chg-chg_01a19d23-8619-7986-990f-4da11fa8c1e9"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp","markdown":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp.md","changelogJson":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/box-kite-mcp/box-kite-mcp.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/@box-kite/mcp"},{"label":"Socket report","href":"https://socket.dev/npm/package/@box-kite/mcp"},{"label":"Repository","href":"https://github.com/box-kite/box-kite"},{"label":"Website","href":"https://www.box-kite.dev/start-with-ai/"}]}}