{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T19:32:24.440Z","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard","markdownUrl":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard.md","server":{"slug":"chelseakr-fhir-scorecard","name":"FHIR Scorecard","registryName":"io.github.ChelseaKR/fhir-scorecard","description":"Read-only grades for publicly observable FHIR endpoints, served from the published dataset.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"fhir-scorecard","type":"pypi","identifier":"fhir-scorecard","withdrawn":false,"url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard","version":"0.3.0","transport":"stdio","scoredAt":"2026-11-05T09:20:30.034Z"},"score":{"total":77,"tier":"medium","status":"scored","weekDelta":3,"history":[{"date":"2026-11-05","total":77},{"date":"2026-11-04","total":76},{"date":"2026-11-03","total":76},{"date":"2026-11-02","total":60},{"date":"2026-11-01","total":75},{"date":"2026-10-31","total":60},{"date":"2026-10-30","total":74},{"date":"2026-10-29","total":74},{"date":"2026-10-28","total":58},{"date":"2026-10-27","total":58},{"date":"2026-10-26","total":54},{"date":"2026-10-25","total":54},{"date":"2026-10-24","total":54},{"date":"2026-10-23","total":60},{"date":"2026-10-22","total":60},{"date":"2026-10-21","total":60},{"date":"2026-10-20","total":60}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"pass","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","Runs hatchling.build at install time, a recognised build step with no custom scripting around it.","No production dependencies, so there is no dependency health to assess."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.allowlisted","args":{"tool":"hatchling.build","hooks":"build_backend"}},{"code":"dephealth.no_dependencies","args":{"deps":"0","unhealthy":"0"}}]},{"name":"Provenance & Transparency","score":71,"verdict":"fail","reasons":["Repository check failed: the declared repository URL returned HTTP 404.","Cryptographically verified build provenance (signed, bound to ChelseaKR/fhir-scorecard).","Clear OSI-approved license (Apache-2.0).","Actively maintained (last published 16 days ago).","Security-disclosure policy not yet verified: we couldn't inspect the source repository."],"codes":[{"code":"provenance.repo_http_error","args":{"status":"404"}},{"code":"provenance.verified","args":{"repo":"ChelseaKR/fhir-scorecard"}},{"code":"license.osi","args":{"spdx":"Apache-2.0"}},{"code":"maintenance.recent","args":{"age_days":"16"}},{"code":"disclosure.repo_inconclusive","args":{"reason":"repo_not_visible"}}]},{"name":"Schema Quality & AI Usability","score":67,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 293 tokens (~58/item across 5 items; 5 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"58","items":"5","tools":"5","tokens":"293","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":53,"verdict":"partial","reasons":["Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"16"}}]},{"name":"Tool Coverage","score":80,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","40% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"40"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"5"}},{"code":"toolsafety.manipulation_clean","args":{"units":"5","judged":"5"}}]},{"name":"Capabilities","score":20,"verdict":"fail","reasons":["Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28."],"codes":[{"code":"protocol.outdated","args":{"latest":"2026-07-28","version":"2024-11-05"}}]}],"inconclusive":["Security-disclosure policy not yet verified: we couldn't inspect the source repository."],"malware":[],"components":[{"slug":"fhir-scorecard","type":"pypi","identifier":"fhir-scorecard","withdrawn":false,"score":77,"current":true,"url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard","markdownUrl":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard.md"}],"facts":[{"label":"Registry","value":"pypi"},{"label":"Package","value":"fhir-scorecard"},{"label":"Version","value":"0.3.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"list_endpoints","title":null,"description":"List graded FHIR endpoints, optionally filtered by kind (payer, payer_provider_directory, provider, ehr, reference) or by grade.","inputs":[{"name":"grade","type":"string","required":false,"description":"Filter by letter grade A-F"},{"name":"kind","type":"string","required":false,"description":"Filter by endpoint category"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":60},{"name":"get_endpoint","title":null,"description":"Full scorecard for one endpoint: every dimension, every finding with its spec citation, availability, and drift history.","inputs":[{"name":"endpoint_id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":39},{"name":"cited_passages","title":null,"description":"For one endpoint, each finding together with the passages of the FHIR, SMART App Launch, or US Core specification page it cites, quoted verbatim from the copies retained under corpus/. No model is called; use these passages to explain a finding in the specification's own words.","inputs":[{"name":"endpoint_id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":73},{"name":"declared_capabilities","title":null,"description":"What one endpoint's CapabilityStatement declared: every resource, interaction, search parameter, operation and profile as flat rows, with the retrieval date and the document's SHA-256. An observation of a declaration, never a test of it. The state field says when there was no readable declaration, and rows is null then, never an empty list.","inputs":[{"name":"endpoint_id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":86},{"name":"grading_method","title":null,"description":"How grades are computed, what each finding code checks, and the documented limits of the dataset. Read this before characterizing any grade.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":35}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T09:20:30.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[{"hook":"build_backend","tier":"allowlisted"}],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":0,"partial":false,"deprecated":null,"stale":null,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-20","recent":[{"id":"chg_01a1ab02-7f6d-701b-ab56-314d2f76aaba","kind":"score.total_changed","summary":"Trust score (76 → 77)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a1ab02-7f6d-701b-ab56-314d2f76aaba"},{"id":"chg_01a1a041-fb7f-7915-9ed3-ac4bc43ac34b","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a1a041-fb7f-7915-9ed3-ac4bc43ac34b"},{"id":"chg_01a1a041-fb88-71bb-a7ad-5572d0604d52","kind":"score.total_changed","summary":"Trust score (60 → 76)","materiality":"functional","direction":"improvement","scoreDelta":16,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a1a041-fb88-71bb-a7ad-5572d0604d52"},{"id":"chg_01a19bbf-6ac7-7aa8-aa1f-ca64260965c0","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a19bbf-6ac7-7aa8-aa1f-ca64260965c0"},{"id":"chg_01a19bbf-6ac8-7b3a-9dbd-2e77eefc90d5","kind":"score.total_changed","summary":"Trust score (75 → 60)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a19bbf-6ac8-7b3a-9dbd-2e77eefc90d5"},{"id":"chg_01a195f5-2917-7c00-a2b7-2935c38f5b1f","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a195f5-2917-7c00-a2b7-2935c38f5b1f"},{"id":"chg_01a195f5-2918-7c1c-a694-f18e9273e976","kind":"score.total_changed","summary":"Trust score (60 → 75)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a195f5-2918-7c1c-a694-f18e9273e976"},{"id":"chg_01a19172-50a5-73e0-af39-5c6291c5e40a","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a19172-50a5-73e0-af39-5c6291c5e40a"},{"id":"chg_01a19172-50a6-758f-9d99-dd154b82e8af","kind":"score.total_changed","summary":"Trust score (74 → 60)","materiality":"functional","direction":"regression","scoreDelta":-14,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a19172-50a6-758f-9d99-dd154b82e8af"},{"id":"chg_01a186eb-d0ee-763f-9832-fdc9ee293971","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a186eb-d0ee-763f-9832-fdc9ee293971"},{"id":"chg_01a186eb-d0f0-7149-9225-076f3c50b757","kind":"score.total_changed","summary":"Trust score (58 → 74)","materiality":"functional","direction":"improvement","scoreDelta":16,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a186eb-d0f0-7149-9225-076f3c50b757"},{"id":"chg_01a17cd0-95b3-701c-b075-5eb7f384f86d","kind":"check.reverified","summary":"Stability (unverified → 0.23)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a17cd0-95b3-701c-b075-5eb7f384f86d"},{"id":"chg_01a17cd0-95b3-7e28-b5cb-9c9987a5a93c","kind":"score.total_changed","summary":"Trust score (54 → 58)","materiality":"functional","direction":"improvement","scoreDelta":4,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a17cd0-95b3-7e28-b5cb-9c9987a5a93c"},{"id":"chg_01a16d5c-f716-7118-96d1-7948967f9556","kind":"check.verdict","summary":"Source repository (pass → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a16d5c-f716-7118-96d1-7948967f9556"},{"id":"chg_01a16d5c-f717-7561-beeb-f1a6039e3285","kind":"check.unverifiable","summary":"Security disclosure (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a16d5c-f717-7561-beeb-f1a6039e3285"},{"id":"chg_01a16d5c-f717-7bfe-81da-136567770c4b","kind":"score.total_changed","summary":"Trust score (60 → 54)","materiality":"functional","direction":"regression","scoreDelta":-6,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a16d5c-f717-7bfe-81da-136567770c4b"},{"id":"chg_01a157dd-42a2-7e13-8d33-ec6657c8a85f","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard#chg-chg_01a157dd-42a2-7e13-8d33-ec6657c8a85f"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard/changelog.json"},"links":{"html":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard","markdown":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard.md","changelogJson":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard/changelog.json","changelogRss":"https://verifymcp.io/servers/chelseakr-fhir-scorecard/fhir-scorecard.xml","external":[{"label":"PyPI project","href":"https://pypi.org/project/fhir-scorecard/"},{"label":"Socket report","href":"https://socket.dev/pypi/package/fhir-scorecard"}]}}