{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T17:51:10.670Z","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask","markdownUrl":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask.md","server":{"slug":"com-erseni-vault-ask","name":"vault-ask","registryName":"com.erseni/vault-ask","description":"Request and send secrets for AI agents, end-to-end encrypted and never shown in the chat.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"erseni-vault-ask","type":"npm","identifier":"@erseni/vault-ask","withdrawn":false,"url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask","version":"0.2.1","transport":"stdio","scoredAt":"2026-11-05T10:28:34.286Z"},"score":{"total":85,"tier":"high trust","status":"scored","weekDelta":4,"history":[{"date":"2026-11-05","total":85},{"date":"2026-11-04","total":84},{"date":"2026-11-03","total":84},{"date":"2026-11-02","total":83},{"date":"2026-11-01","total":83},{"date":"2026-10-31","total":82},{"date":"2026-10-30","total":82},{"date":"2026-10-29","total":81},{"date":"2026-10-28","total":81},{"date":"2026-10-27","total":80},{"date":"2026-10-26","total":80},{"date":"2026-10-25","total":80},{"date":"2026-10-24","total":79},{"date":"2026-10-23","total":79},{"date":"2026-10-22","total":78},{"date":"2026-10-21","total":78},{"date":"2026-10-20","total":62},{"date":"2026-10-19","total":66}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"pass","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","No production dependencies, so there is no dependency health to assess."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.no_dependencies","args":{"deps":"0","unhealthy":"0"}}]},{"name":"Provenance & Transparency","score":100,"verdict":"pass","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to Erseni/secrets-component).","Clear OSI-approved license (AGPL-3.0-or-later).","Actively maintained (last published 16 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"Erseni/secrets-component"}},{"code":"license.osi","args":{"spdx":"AGPL-3.0-or-later"}},{"code":"maintenance.recent","args":{"age_days":"16"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":58,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 1147 tokens (~382/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"382","items":"3","tools":"3","tokens":"1147","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":57,"verdict":"partial","reasons":["Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"17"}}]},{"name":"Tool Coverage","score":97,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","90% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"90"}}]},{"name":"Tool Safety","score":75,"verdict":"fail","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; \"send_secret\" implies \"send\" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_undeclared","args":{"pct":"0","tool":"send_secret","verb":"send","declared":"none","annotated":"0","destructive":"1"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"erseni-vault-ask","type":"npm","identifier":"@erseni/vault-ask","withdrawn":false,"score":85,"current":true,"url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask","markdownUrl":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"@erseni/vault-ask"},{"label":"Version","value":"0.2.1"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"request_secret","title":null,"description":"Use this whenever you need a password, token, API key or other secret from the user, for example \"I will give you my database password\" or \"you need my API key for X\". Never ask the user to type or paste a secret into the chat. Asks the user for one or more secrets and writes them into a .env file or a file, without the values ever passing through this conversation. First call without request_id: returns a link. Show it to the user, then call again with the returned request_id; that call waits for the answer and writes the file with permissions 600. The result only contains names and lengths, never a value.","inputs":[{"name":"env_file","type":"string","required":false,"description":"Write NAME=value lines into this .env file"},{"name":"file","type":"string","required":false,"description":"Write the single requested value into this file"},{"name":"names","type":"array","required":false,"description":"Names of the values to ask for, for example [\"DB_PASSWORD\"]"},{"name":"request_id","type":"string","required":false,"description":"The id returned by the first call"},{"name":"ttl_seconds","type":"integer","required":false,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":219},{"name":"run_with_secret","title":null,"description":"Use this whenever a single command needs a password, token, API key or other secret from the user, for example \"connect to the database with my password\" or \"deploy with my API token\". Never ask the user to type or paste a secret into the chat. Asks the user for one or more secrets and runs exactly one command with them as environment variables. The user sees the command before entering anything, and only this command can receive the values. First call without request_id: returns a link. Show it to the user, then call again with the returned request_id; that call waits for the answer, runs the command and returns its exit code and its output with every value masked.","inputs":[{"name":"command","type":"array","required":false,"description":"The command and its arguments, for example [\"psql\", \"-h\", \"db.example.com\"]"},{"name":"cwd","type":"string","required":false,"description":"Working directory for the command"},{"name":"names","type":"array","required":false,"description":"Names of the values to ask for, for example [\"DB_PASSWORD\"]"},{"name":"request_id","type":"string","required":false,"description":"The id returned by the first call"},{"name":"ttl_seconds","type":"integer","required":false,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":230},{"name":"send_secret","title":null,"description":"Use this whenever the user asks you to generate, create or send them a password, token, API key or other secret, for example \"generate a password for my database\", \"generier mir ein Passwort\" or \"send me the key\". Do not generate a secret any other way and never write one into the chat. Generates the value locally (32 letters and digits unless length or charset say otherwise) or takes it from from_file or from_env, encrypts it on this machine and returns only a one-time link that shows the value once in the browser. Give the user that link. With env_file, file or command the same value also goes to that destination (needs name except for file), so the system and the link hold the same value. The result contains the link, its expiry and the length, never the value.","inputs":[{"name":"charset","type":"string","required":false,"description":"Characters of the generated value, default alnum"},{"name":"command","type":"array","required":false,"description":"Also run this command with the value in the environment variable NAME, for example [\"./scripts/set-db-password\"]. Its output comes back with the value masked"},{"name":"cwd","type":"string","required":false,"description":"Working directory for relative paths and the command"},{"name":"env_file","type":"string","required":false,"description":"Also write NAME=value into this .env file (permissions 600)"},{"name":"file","type":"string","required":false,"description":"Also write the value into this file (permissions 600)"},{"name":"from_env","type":"string","required":false,"description":"Send the value of this environment variable of the server process instead of a generated value"},{"name":"from_file","type":"string","required":false,"description":"Send the content of this file instead of a generated value"},{"name":"label","type":"string","required":false,"description":"Label shown above the value on the page, for example \"Database password for app@db.example.com\""},{"name":"length","type":"integer","required":false,"description":"Length of the generated value, default 32"},{"name":"name","type":"string","required":false,"description":"Name of the value, for example \"DB_PASSWORD\". Default label on the page, and the variable name for env_file and command"},{"name":"ttl_seconds","type":"integer","required":false,"description":"How long the link stays valid, default 86400"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":421}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T10:28:34.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":0,"partial":false,"deprecated":null,"stale":null,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-19","recent":[{"id":"chg_01a1ab40-d18c-722b-a58f-3d6eae7b9a9a","kind":"score.total_changed","summary":"Trust score (84 → 85)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a1ab40-d18c-722b-a58f-3d6eae7b9a9a"},{"id":"chg_01a1a0eb-d9cb-7ab2-9f3e-d7ab8e5622ec","kind":"score.total_changed","summary":"Trust score (83 → 84)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a1a0eb-d9cb-7ab2-9f3e-d7ab8e5622ec"},{"id":"chg_01a1969a-e75e-7404-8282-0df8c5ae3f2c","kind":"score.total_changed","summary":"Trust score (82 → 83)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a1969a-e75e-7404-8282-0df8c5ae3f2c"},{"id":"chg_01a18c4c-8972-70f5-902a-5ef53bd2f1ae","kind":"score.total_changed","summary":"Trust score (81 → 82)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a18c4c-8972-70f5-902a-5ef53bd2f1ae"},{"id":"chg_01a181ff-3117-727b-83a6-f02c251b943d","kind":"score.total_changed","summary":"Trust score (80 → 81)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a181ff-3117-727b-83a6-f02c251b943d"},{"id":"chg_01a1728a-6a61-781d-afc7-de77821a3107","kind":"score.total_changed","summary":"Trust score (79 → 80)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a1728a-6a61-781d-afc7-de77821a3107"},{"id":"chg_01a1683b-f2d2-753b-8641-b5399d83a21b","kind":"score.total_changed","summary":"Trust score (78 → 79)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-23","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a1683b-f2d2-753b-8641-b5399d83a21b"},{"id":"chg_01a15def-1efb-72d6-9ccd-4c7aadb4ef35","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-21","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a15def-1efb-72d6-9ccd-4c7aadb4ef35"},{"id":"chg_01a15def-1eff-7b76-ae02-b9957c404476","kind":"score.total_changed","summary":"Trust score (62 → 78)","materiality":"functional","direction":"improvement","scoreDelta":16,"occurredOn":"2026-10-21","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a15def-1eff-7b76-ae02-b9957c404476"},{"id":"chg_01a157dd-4c94-7954-b175-a00637d44122","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a157dd-4c94-7954-b175-a00637d44122"},{"id":"chg_01a157dd-4c96-72d6-8ca0-8b7b6ca9a37b","kind":"check.verdict","summary":"Provenance (fail → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a157dd-4c96-72d6-8ca0-8b7b6ca9a37b"},{"id":"chg_01a157dd-4c96-790c-8294-1b78f9dde5ad","kind":"provenance.repo_changed","summary":"The attested source repository moved (Erseni/secrets-component)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a157dd-4c96-790c-8294-1b78f9dde5ad"},{"id":"chg_01a157dd-4c97-73e9-ae76-ed401a1237e9","kind":"check.reverified","summary":"Security disclosure (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a157dd-4c97-73e9-ae76-ed401a1237e9"},{"id":"chg_01a157dd-4c97-79ae-9bcd-b0167784ff91","kind":"package.version_changed","summary":"Package version (0.2.0 → 0.2.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a157dd-4c97-79ae-9bcd-b0167784ff91"},{"id":"chg_01a157dd-4c97-7e67-bd33-151780243144","kind":"score.total_changed","summary":"Trust score (66 → 62)","materiality":"functional","direction":"regression","scoreDelta":-4,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a157dd-4c97-7e67-bd33-151780243144"},{"id":"chg_01a1540c-e144-7a76-afe3-23a6e3340e02","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a1540c-e144-7a76-afe3-23a6e3340e02"},{"id":"chg_01a15408-ac17-78ee-923f-83ed25aa7992","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask#chg-chg_01a15408-ac17-78ee-923f-83ed25aa7992"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask/changelog.json"},"links":{"html":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask","markdown":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask.md","changelogJson":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask/changelog.json","changelogRss":"https://verifymcp.io/servers/com-erseni-vault-ask/erseni-vault-ask.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/@erseni/vault-ask"},{"label":"Socket report","href":"https://socket.dev/npm/package/@erseni/vault-ask"},{"label":"Repository","href":"https://github.com/Erseni/secrets-component"},{"label":"Website","href":"https://vault.erseni.com/ai-agents"}]}}