{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T01:28:48.425Z","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp","markdownUrl":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp.md","server":{"slug":"com-provenpaid-mcp","name":"ProvenPaid","registryName":"com.provenpaid/mcp","description":"Check an x402 endpoint before your agent pays it: challenge validity and on-chain payer evidence.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"provenpaid-mcp","type":"pypi","identifier":"provenpaid-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp","version":"0.2.0","transport":"stdio","scoredAt":"2026-11-05T04:29:08.007Z"},"score":{"total":87,"tier":"high trust","status":"scored","weekDelta":18,"history":[{"date":"2026-11-05","total":87},{"date":"2026-11-04","total":72},{"date":"2026-11-03","total":87},{"date":"2026-11-02","total":86},{"date":"2026-11-01","total":71},{"date":"2026-10-31","total":70},{"date":"2026-10-30","total":70},{"date":"2026-10-29","total":69},{"date":"2026-10-28","total":69},{"date":"2026-10-27","total":83},{"date":"2026-10-26","total":83},{"date":"2026-10-25","total":82},{"date":"2026-10-24","total":82},{"date":"2026-10-23","total":81},{"date":"2026-10-22","total":81},{"date":"2026-10-21","total":77},{"date":"2026-10-20","total":77},{"date":"2026-10-19","total":77},{"date":"2026-10-18","total":77},{"date":"2026-10-17","total":77},{"date":"2026-10-16","total":77},{"date":"2026-10-15","total":77},{"date":"2026-10-14","total":77},{"date":"2026-10-13","total":49},{"date":"2026-10-12","total":34}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"partial","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it.","2 of 33 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.allowlisted","args":{"tool":"setuptools.build_meta","hooks":"build_backend"}},{"code":"dephealth.assessed","args":{"deps":"33","unhealthy":"2"}}]},{"name":"Provenance & Transparency","score":97,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to justinsmithphd/provenpaid-mcp).","Clear OSI-approved license (MIT).","Actively maintained (last published 25 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"justinsmithphd/provenpaid-mcp"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"25"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":67,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 285 tokens (~95/item across 3 items; 3 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"95","items":"3","tools":"3","tokens":"285","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":73,"verdict":"partial","reasons":["Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"22"}}]},{"name":"Tool Coverage","score":71,"verdict":"fail","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","0% of tool parameters carry a description.","Structured output schemas are declared (33% of tools); any adoption earns full credit."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"0"}},{"code":"toolquality.output_present","args":{"pct":"33"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"provenpaid-mcp","type":"pypi","identifier":"provenpaid-mcp","withdrawn":false,"score":87,"current":true,"url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp","markdownUrl":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp.md"}],"facts":[{"label":"Registry","value":"pypi"},{"label":"Package","value":"provenpaid-mcp"},{"label":"Version","value":"0.2.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"check_x402_endpoint","title":null,"description":"Check a paid x402 endpoint before paying it. First 10 checks free, then about $0.01 in USDC on Base.\n\nReturns payer depth first: how many distinct wallets paid the endpoint's receiving address\n(x402-style, last 30 days), repeat-payer share, payer concentration and coverage, with a\none-line statement. Then the full on-chain detail and the payment challenge validation.\nNot charged for invalid, unsafe, non-x402 or unsupported URLs.","inputs":[{"name":"url","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":113},{"name":"provenpaid_methodology","title":null,"description":"Free. How ProvenPaid computes each signal, what it does not verify, and when it charges.","inputs":[],"outputs":[{"name":"result","type":"string","required":true,"description":null}],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":30},{"name":"provenpaid_status","title":null,"description":"Free. The paying wallet address, network, per-check price cap and paid checks left today.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":28}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T04:29:08.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[{"hook":"build_backend","tier":"allowlisted"}],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":33,"partial":false,"deprecated":null,"stale":1,"noRepo":1}},"mismatches":[],"changelog":{"trackingSince":"2026-10-12","recent":[{"id":"chg_01a1a9f7-be41-7033-8d87-0b6f0da1301b","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a1a9f7-be41-7033-8d87-0b6f0da1301b"},{"id":"chg_01a1a9f7-be42-7504-98ec-97de204b82e0","kind":"score.total_changed","summary":"Trust score (72 → 87)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a1a9f7-be42-7504-98ec-97de204b82e0"},{"id":"chg_01a1a4fd-c8da-7dfb-a02c-07e10f04a0db","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a1a4fd-c8da-7dfb-a02c-07e10f04a0db"},{"id":"chg_01a1a4fd-c8dc-7bc3-96f7-3ef71798b163","kind":"score.total_changed","summary":"Trust score (87 → 72)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a1a4fd-c8dc-7bc3-96f7-3ef71798b163"},{"id":"chg_01a19fd9-47d5-7598-8729-24c698b81cf1","kind":"score.total_changed","summary":"Trust score (86 → 87)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a19fd9-47d5-7598-8729-24c698b81cf1"},{"id":"chg_01a19a0f-3990-79f5-a7bd-eb0a37bef073","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a19a0f-3990-79f5-a7bd-eb0a37bef073"},{"id":"chg_01a19a0f-3991-7e27-8c47-b39d4b363ae2","kind":"score.total_changed","summary":"Trust score (71 → 86)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a19a0f-3991-7e27-8c47-b39d4b363ae2"},{"id":"chg_01a1958b-595e-7432-8e79-7ab6788f32d5","kind":"score.total_changed","summary":"Trust score (70 → 71)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a1958b-595e-7432-8e79-7ab6788f32d5"},{"id":"chg_01a18b3c-5c8c-7aa0-b339-7973f7c5ccb0","kind":"score.total_changed","summary":"Trust score (69 → 70)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a18b3c-5c8c-7aa0-b339-7973f7c5ccb0"},{"id":"chg_01a180ee-228e-78bb-95e2-81d4dedfdc4d","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a180ee-228e-78bb-95e2-81d4dedfdc4d"},{"id":"chg_01a180ee-2294-78d7-9255-1384193f50ef","kind":"score.total_changed","summary":"Trust score (83 → 69)","materiality":"functional","direction":"regression","scoreDelta":-14,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a180ee-2294-78d7-9255-1384193f50ef"},{"id":"chg_01a175fb-18c7-70d0-b45b-5c92a9c45b8a","kind":"score.total_changed","summary":"Trust score (82 → 83)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a175fb-18c7-70d0-b45b-5c92a9c45b8a"},{"id":"chg_01a16bad-fae1-7e3d-b918-d272e5dfdbbc","kind":"score.total_changed","summary":"Trust score (81 → 82)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a16bad-fae1-7e3d-b918-d272e5dfdbbc"},{"id":"chg_01a16160-240f-72d0-a81b-827870c5676c","kind":"check.reverified","summary":"Stability (unverified → 0.27)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a16160-240f-72d0-a81b-827870c5676c"},{"id":"chg_01a16160-2410-73e9-bd80-8b0de9f76ae1","kind":"score.total_changed","summary":"Trust score (77 → 81)","materiality":"functional","direction":"improvement","scoreDelta":4,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a16160-2410-73e9-bd80-8b0de9f76ae1"},{"id":"chg_01a151eb-be65-784f-966f-711c61ac5065","kind":"check.reverified","summary":"Security disclosure (unverified → fail)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a151eb-be65-784f-966f-711c61ac5065"},{"id":"chg_01a14d34-2b8a-70b9-9e9e-8b61d517ebfc","kind":"check.unverifiable","summary":"Security disclosure (fail → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a14d34-2b8a-70b9-9e9e-8b61d517ebfc"},{"id":"chg_01a13b2f-98a3-789c-859c-aa199b40585b","kind":"check.reverified","summary":"Injection markers (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a13b2f-98a3-789c-859c-aa199b40585b"},{"id":"chg_01a13b2f-98a4-703a-9d99-5d31f4494013","kind":"check.appeared","summary":"First check of Judged manipulation (pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a13b2f-98a4-703a-9d99-5d31f4494013"},{"id":"chg_01a13b2f-98a4-7547-8dd3-ed6941f29495","kind":"check.reason","summary":"Stability (Stability not yet verified: not enough scan history yet (needs a 30-day window).)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp#chg-chg_01a13b2f-98a4-7547-8dd3-ed6941f29495"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp","markdown":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp.md","changelogJson":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/com-provenpaid-mcp/provenpaid-mcp.xml","external":[{"label":"PyPI project","href":"https://pypi.org/project/provenpaid-mcp/"},{"label":"Socket report","href":"https://socket.dev/pypi/package/provenpaid-mcp"},{"label":"Repository","href":"https://github.com/justinsmithphd/provenpaid-mcp"},{"label":"Website","href":"https://api.provenpaid.com/"}]}}