# Opedd — Licensed Content for AI (npm · opedd-mcp)

Licensed, rights-cleared content for AI agents - verifiable license keys + EU AI Act attestation.

- Trust score: 66/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- remote · `mcp.opedd.com`: 66/100, [markdown](https://verifymcp.io/servers/com-opedd-opedd-mcp/mcp.md), [page](https://verifymcp.io/servers/com-opedd-opedd-mcp/mcp)
- npm · `opedd-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/com-opedd-opedd-mcp/opedd-mcp.md), [page](https://verifymcp.io/servers/com-opedd-opedd-mcp/opedd-mcp)

## Channel facts

- Registry: `npm`
- Package: `opedd-mcp`
- Version: `0.6.8`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (108 of 109), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1603 tokens (~200/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add com-opedd-opedd-mcp -- npx -y opedd-mcp
```

### Codex

```bash
codex mcp add com-opedd-opedd-mcp -- npx -y opedd-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-opedd-opedd-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "opedd-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-opedd-opedd-mcp --command npx --arg -y --arg opedd-mcp
```

### Hermes

```yaml
mcp_servers:
  com-opedd-opedd-mcp:
    command: "npx"
    args: ["-y", "opedd-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "com-opedd-opedd-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "opedd-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 66, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 66, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 23, +18)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (8)

### `lookup_content` (~82 tokens)

Look up a piece of content on the Opedd registry by URL. Returns the article title, publisher, available license types, and pricing (human republication price and AI training/inference price). Always call this first to check if content is licensable and what it costs.

Input parameters:

- `url` (string, required): The canonical URL of the article or content to look up

### `purchase_license` (~279 tokens)

Purchase a content license from the Opedd protocol using a Stripe payment method. Returns a license key (format: OP-XXXX-XXXX) and a certificate URL. The buyer receives a Handshake Email with their license key. Set OPEDD_BUYER_EMAIL and OPEDD_PAYMENT_METHOD_ID env vars to avoid passing them on every call. License types: 'human' = republication rights, 'ai' = training dataset rights, 'ai_inference' = inference/RAG rights.

Input parameters:

- `article_id` (string): Opedd article UUID (use this OR article_url)
- `article_url` (string): URL of the article to license (use this OR article_id)
- `buyer_email` (string): Email address for the license. Falls back to OPEDD_BUYER_EMAIL env var.
- `buyer_name` (string): Full name of the buyer (for the license record and certificate)
- `buyer_organization` (string): Organization or company name (for enterprise/editorial licenses)
- `intended_use` (string): Intended use of the licensed content
- `license_type` (string, required): human = republication/editorial rights, ai = training dataset rights, ai_inference = inference/RAG rights
- `payment_method_id` (string): Stripe payment method ID (pm_...). Falls back to OPEDD_PAYMENT_METHOD_ID env var.

### `verify_license` (~79 tokens)

Verify the authenticity of an Opedd license key. Returns license details including: article title, publisher, license type, issue date, amount paid, buyer info, and blockchain proof status. Use this to confirm a license is valid before using licensed content.

Input parameters:

- `license_key` (string, required): The license key to verify (format: OP-XXXX-XXXX)

### `browse_registry` (~107 tokens)

Browse the public Opedd license registry. Returns recently issued licenses and licensable content. Filter by publisher_id to explore all content from a specific publisher. Filter by article_id to see all licenses issued for a specific article.

Input parameters:

- `article_id` (string): Filter results to a specific article (UUID)
- `limit` (number): Number of results to return (default: 10, max: 50)
- `publisher_id` (string): Filter results to a specific publisher (UUID)

### `publisher_directory` (~209 tokens)

Browse the public Opedd publisher catalog via GET /publisher-directory. Returns paginated publishers with article counts, pricing (per-article + annual + monthly-forward-feed), plan, and sample articles (RAG-extended metadata). **The primary discovery surface for AI labs to find Opedd-licensable publishers** — distinct from `browse_registry` (which lists issued LICENSES, not publishers). Filter by category (case-insensitive substring), min_articles, or verified status. Public no-auth — useful pre-purchase scoping before buyers commit to enterprise-license POST.

Input parameters:

- `category` (string): Case-insensitive substring filter on publisher category (e.g. 'finance', 'AI').
- `limit` (number): Page size cap.
- `min_articles` (number): Filter to publishers with at least this many licensable articles.
- `offset` (number): Pagination offset.
- `verified` (string): 'true' to show only verified publishers (default), 'false' for unverified.

### `detect_platform` (~203 tokens)

Detect the content platform behind a URL via POST /detect-platform (Phase 12 Wave 3 W3.1). Public no-auth lookup. Given a URL, identifies what platform powers it (Substack / Beehiiv / Ghost / Medium / Brevo / custom) and returns the suggested onboarding workflow. Hostname-detectable platforms (Substack subdomain, Beehiiv suffix, etc.) resolve in milliseconds; custom domains may take ~few seconds while the detector probes well-known platform endpoints in parallel. Returns: {platform, confidence, archive_method, forward_method, required_credentials, instructions}. The archive_method + forward_method fields are the two onboarding-workflow inputs Opedd's setup wizard reads (one for historical content backfill, one for new-content forward stream). instructions is human-readable operator copy explaining the inferred path.

Input parameters:

- `url` (string, required): Publisher URL to inspect (any well-formed URL works; hostname-match short-circuits the probe path).

### `rsl_get` (~322 tokens)

Fetch a publisher's RSL Standard manifest via GET /rsl-manifest (Phase 12 Wave 1 W1.1). Public no-auth endpoint — discovery surface for AI agents/crawlers wanting to know what's licensable from a publisher BEFORE going through the buyer-account signup flow. Returns the 4 canonical license types (ai_retrieval, ai_training, human_per_article, human_full_archive) the publisher has opted into, plus the EU CDSM Article 4(3) opt-out posture (`tdm_reservation`). Set `jsonld: true` to request the JSON-LD shape with embedded HMAC-SHA256 signed receipt over the CDSM Article 4(3) reservation state + `tdm:reservationSignedAt` timestamp — regulators can post-hoc verify the reservation was the claimed value at the claimed time. Default `jsonld: false` returns the raw RSL Standard JSON manifest. Per INVARIANTS.md W1.6: this is the PUBLISHER-side CDSM Article 4(3) declaration surface. It is NOT an EU AI Act Article 53 attestation (which is buyer-side, JWT-auth, via article_53_attestation tool).

Input parameters:

- `jsonld` (boolean): If true, request JSON-LD shape (Accept: application/ld+json) with embedded HMAC-SHA256 signed receipt. Default false returns raw RSL Standard JSON shape.
- `publisher_id` (string, required): UUID of the publisher whose RSL manifest to fetch. Publisher must be verified.

### `purchase_enterprise_license` (~322 tokens)

Purchase a bulk enterprise license covering multiple publishers (Phase 10). Returns a Stripe client_secret for payment completion + the enterprise_license_id. After payment, an ent_* access key is emailed to buyer_email. Scopes: 'custom' (pass-through publisher_ids), 'platform_wide' (auto-resolve all opted-in publishers), 'filtered' (Phase 10 filter_rules). License tiers: 'rag' (= ai_retrieval), 'training' (= ai_training, flat-fee not metered), 'inference' (= ai_retrieval), 'full_ai' (writes both retrieval + training records).

Input parameters:

- `billing_type` (string): Billing cadence (default: annual)
- `buyer_email` (string, required): Email to deliver the access key after payment
- `buyer_org` (string, required): Buyer organization name (for billing + audit ledger)
- `buyer_webhook_url` (string): Optional HMAC-signed webhook for content.published events on covered publishers
- `duration_months` (number): License duration in months (default: 12)
- `filter_rules` (object): Required when scope='filtered'. See Phase 10 docs for shape: excluded_publisher_ids / direct_license_carveouts / categories / max_price_per_event.
- `license_tier` (string): License tier (default: rag)
- `publisher_ids` (array, required): Array of publisher UUIDs. Required for scope='custom'; ignored for platform_wide/filtered (resolved server-side).
- `scope` (string): Coverage scope (default: custom)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-opedd-opedd-mcp/opedd-mcp#diagnostics

## Score history

- 2026-08-04: 66
- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 23
- 2026-07-31: 5
- 2026-07-30: 25
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/opedd-mcp
- Socket report: https://socket.dev/npm/package/opedd-mcp
- Repository: https://github.com/Opedd/opedd-mcp
- Website: https://opedd.com/for-ai-agents?utm_source=mcp-registry&utm_medium=listing&utm_campaign=mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-opedd-opedd-mcp/opedd-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-opedd-opedd-mcp/opedd-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-opedd-opedd-mcp/opedd-mcp