{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T02:17:48.043Z","url":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts","markdownUrl":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts.md","server":{"slug":"colchora-dmt-receipts","name":"io.github.Colchora/dmt-receipts","registryName":"io.github.Colchora/dmt-receipts","description":"Prepare and verify TAP/Ordinals payloads for AI agent memories on Bitcoin.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"dmt-receipts","type":"mcpb","identifier":"https://github.com/Colchora/dmt-receipts/releases/download/v0.2.0/dmt-receipts-0.2.0.mcpb","withdrawn":false,"url":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts","version":null,"transport":"stdio","scoredAt":"2026-11-05T21:02:15.543Z"},"score":{"total":47,"tier":"low","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":47}]},"categories":[{"name":"Supply Chain Security","score":23,"verdict":"partial","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs were checked across the 99 of 99 dependencies we could resolve, so this covers what we could see, not the whole tree.","No install/post-install scripts declared.","32 of 99 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.tree_partial","args":{"seen":"99","resolved":"99"}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"99","unhealthy":"32"}}]},{"name":"Provenance & Transparency","score":48,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (MIT).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":67,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 408 tokens (~204/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"204","items":"2","tools":"2","tokens":"408","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability observed for 0 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"0"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 2 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"2"}},{"code":"toolsafety.manipulation_clean","args":{"units":"2","judged":"2"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Stability observed for 0 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"malware":[],"components":[{"slug":"dmt-receipts","type":"mcpb","identifier":"https://github.com/Colchora/dmt-receipts/releases/download/v0.2.0/dmt-receipts-0.2.0.mcpb","withdrawn":false,"score":47,"current":true,"url":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts","markdownUrl":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts.md"}],"facts":[{"label":"Registry","value":"mcpb"},{"label":"Package","value":"https://github.com/Colchora/dmt-receipts/releases/download/v0.2.0/dmt-receipts-0.2.0.mcpb"},{"label":"Transport","value":"stdio"},{"label":"SHA-256","value":"8cfc6588cbc726ea785214275dd1873aede64199c3b1ab24168eb81aac5abaaf"}],"install":{"available":true,"bundleSha256":"8cfc6588cbc726ea785214275dd1873aede64199c3b1ab24168eb81aac5abaaf"},"tools":[{"name":"prepare_memory","title":null,"description":"Canonicalize a dmt-memory/v1 JSON memory, SHA-256 it, and return an Ordinals/TAP inscription recipe (content UTF-8 + optional dta pointer). Does not broadcast a Bitcoin transaction or pay fees. Permanence requires inscribing the content on Bitcoin L1 via TAP Wallet or any Ordinals/TAP tool.","inputs":[{"name":"agent_id","type":"string","required":true,"description":"Stable agent identifier"},{"name":"content","type":null,"required":true,"description":"Memory payload (string, object, array, number, or boolean)"},{"name":"created_at","type":"string","required":false,"description":"Optional ISO-8601 UTC timestamp ending in Z; defaults to now"},{"name":"key","type":"string","required":true,"description":"Memory key / slug / path"},{"name":"tags","type":"array","required":false,"description":"Optional string tags; defaults to []"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":154},{"name":"verify_inscription","title":null,"description":"Recompute the canonical SHA-256 of a dmt-memory/v1 object and, when inscription_id is provided, attempt to fetch Ordinals content and compare bytes. Optionally enrich with soft-fail Trac Network TAP/DMT index metadata (deployment, mint holder, transfer amount, accumulator). Returns explorer links plus a trac object. Does not use calendar digest proofs.","inputs":[{"name":"fetch_content","type":"boolean","required":false,"description":"Fetch inscription content from ordinals.com when inscription_id is set (default true)"},{"name":"include_trac","type":"boolean","required":false,"description":"When inscription_id is set, query Trac TAP/DMT index metadata (default true). Soft-fails if Trac is down."},{"name":"inscription_id","type":"string","required":false,"description":"Bitcoin Ordinals inscription id (txid + 'i' + index)"},{"name":"memory","type":"object","required":true,"description":"Full dmt-memory/v1 object (agent_id, key, content, tags, created_at)"},{"name":"sha256","type":"string","required":false,"description":"Optional expected hex digest to cross-check"},{"name":"trac_rest_base","type":"string","required":false,"description":"Optional self-hosted tap-reader REST origin. Falls back to env DMT_TRAC_REST, then public Socket.IO at tap.trac.network."},{"name":"txid","type":"string","required":false,"description":"Optional Bitcoin transaction id"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":254}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T21:02:15.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":99,"partial":false,"deprecated":null,"stale":32,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-11-05","recent":[{"id":"chg_01a1ad84-fa16-7126-a37c-b2e2340ed815","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts#chg-chg_01a1ad84-fa16-7126-a37c-b2e2340ed815"},{"id":"chg_01a1ad4c-b481-7ec3-b869-e48a54c709d7","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts#chg-chg_01a1ad4c-b481-7ec3-b869-e48a54c709d7"},{"id":"chg_01a1ad4c-4152-79c7-801e-04052e3a42ed","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts#chg-chg_01a1ad4c-4152-79c7-801e-04052e3a42ed"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts/changelog.json"},"links":{"html":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts","markdown":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts.md","changelogJson":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts/changelog.json","changelogRss":"https://verifymcp.io/servers/colchora-dmt-receipts/dmt-receipts.xml","external":[{"label":"Repository","href":"https://github.com/Colchora/dmt-receipts"}]}}