{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T18:26:10.226Z","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server","markdownUrl":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server.md","server":{"slug":"com-sebastienrousseau-passmcp-server","name":"passmcp","registryName":"com.sebastienrousseau/passmcp-server","description":"Evaluate an MCP server with passmcp and verify its attestations, from inside the agent. Read-only.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"ghcr-io-sebastienrousseau-passmcp-server","type":"oci","identifier":"ghcr.io/sebastienrousseau/passmcp-server","withdrawn":false,"url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server","version":"0.0.8","transport":"stdio","scoredAt":"2026-11-05T06:47:01.487Z"},"score":{"total":53,"tier":"low","status":"scored","weekDelta":-3,"history":[{"date":"2026-11-05","total":53},{"date":"2026-11-04","total":56},{"date":"2026-11-03","total":56},{"date":"2026-11-02","total":56},{"date":"2026-11-01","total":56},{"date":"2026-10-31","total":56},{"date":"2026-10-30","total":56},{"date":"2026-10-29","total":56},{"date":"2026-10-28","total":55},{"date":"2026-10-27","total":55},{"date":"2026-10-26","total":54},{"date":"2026-10-25","total":54},{"date":"2026-10-24","total":53},{"date":"2026-10-23","total":53},{"date":"2026-10-22","total":52},{"date":"2026-10-21","total":52},{"date":"2026-10-20","total":51},{"date":"2026-10-19","total":51},{"date":"2026-10-18","total":50},{"date":"2026-10-17","total":50},{"date":"2026-10-16","total":49},{"date":"2026-10-15","total":49},{"date":"2026-10-14","total":49},{"date":"2026-10-13","total":48},{"date":"2026-10-12","total":42},{"date":"2026-10-10","total":42},{"date":"2026-10-07","total":42},{"date":"2026-10-04","total":42},{"date":"2026-10-03","total":42},{"date":"2026-10-02","total":42}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this image's dependency list comes from an SBOM its publisher attached, which nothing verifies, so we will not report it as a clean result.","Install-script risk not yet assessed.","Dependency health could not be checked: this image's dependency list comes from an SBOM its publisher attached. It names packages and versions but not whether each is deprecated, still maintained or linked to its source, so there is nothing we can fairly grade."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"sbom_unverified"}},{"code":"installscript.inconclusive","args":{"reason":"no_install_concept"}},{"code":"dephealth.inconclusive","args":{"reason":"sbom_no_registry_facts"}}]},{"name":"Provenance & Transparency","score":48,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (GPL-3.0-only).","Actively maintained (last published 17 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"GPL-3.0-only"}},{"code":"maintenance.recent","args":{"age_days":"17"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":80,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Tool/resource definitions use about 381 tokens (~127/item across 3 items; 3 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_lean","args":{"avg":"127","items":"3","tools":"3","tokens":"381","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":80,"verdict":"partial","reasons":["Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"24"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description.","Structured output schemas are declared (100% of tools); any adoption earns full credit."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}},{"code":"toolquality.output_present","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this image's dependency list comes from an SBOM its publisher attached, which nothing verifies, so we will not report it as a clean result.","Install-script risk not yet assessed.","Dependency health could not be checked: this image's dependency list comes from an SBOM its publisher attached. It names packages and versions but not whether each is deprecated, still maintained or linked to its source, so there is nothing we can fairly grade."],"malware":[],"components":[{"slug":"ghcr-io-sebastienrousseau-passmcp-server","type":"oci","identifier":"ghcr.io/sebastienrousseau/passmcp-server","withdrawn":false,"score":53,"current":true,"url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server","markdownUrl":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server.md"}],"facts":[{"label":"Registry","value":"oci"},{"label":"Package","value":"ghcr.io/sebastienrousseau/passmcp-server"},{"label":"Version","value":"0.0.8"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"passmcp_check","title":"Evaluate an MCP server with passmcp","description":"Evaluate an MCP server's Streamable HTTP endpoint with passmcp's diagnostic and return its score, grade, counts and every failing check with what it means and a link to the fix. Use it to find out whether a server is ready for agents before relying on it. The endpoint must be on this server's allowlist (loopback addresses by default). No credentials leave this machine, and passmcp calls only the server's tools that declare readOnlyHint. An evaluation takes up to a minute.","inputs":[{"name":"endpoint","type":"string","required":true,"description":"The server's Streamable HTTP URL, such as http://127.0.0.1:3000/mcp."},{"name":"phases","type":"array","required":false,"description":"Evaluate only these phases; omit for all nine."}],"outputs":[{"name":"blocked","type":"string","required":false,"description":null},{"name":"counts","type":"object","required":true,"description":null},{"name":"endpoint","type":"string","required":true,"description":null},{"name":"failures","type":"array","required":true,"description":null},{"name":"grade","type":"string","required":true,"description":null},{"name":"score","type":"number","required":true,"description":null},{"name":"truncated","type":"boolean","required":false,"description":null}],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":159},{"name":"passmcp_verify_attestation","title":"Verify a passmcp attestation","description":"Check a passmcp attestation, the in-toto statement passmcp produces about one MCP server, offline: its structure, its subject digest, and optionally that it is about a given endpoint. Returns whether it is valid, what it says, and why not when it is not. Nothing is fetched; pass the statement's JSON text.","inputs":[{"name":"endpoint","type":"string","required":false,"description":"When given, the endpoint the statement must be about."},{"name":"statement","type":"string","required":true,"description":"The attestation's JSON text."}],"outputs":[{"name":"covers","type":"boolean","required":false,"description":null},{"name":"endpoint","type":"string","required":false,"description":null},{"name":"error","type":"string","required":false,"description":null},{"name":"failing","type":"array","required":false,"description":null},{"name":"grade","type":"string","required":false,"description":null},{"name":"score","type":"number","required":false,"description":null},{"name":"valid","type":"boolean","required":true,"description":null}],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":112},{"name":"passmcp_version","title":"Report the versions in use","description":"Return passmcp-server's version and the version of the passmcp program it uses, for a bug report or to confirm a check exists.","inputs":[],"outputs":[{"name":"passmcp","type":"string","required":true,"description":null},{"name":"passmcpServer","type":"string","required":true,"description":null}],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":40}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T06:47:01.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-09-30","recent":[{"id":"chg_01a1aa75-fcaf-7e63-b6e2-e08aa37fcd5b","kind":"check.verdict","summary":"Stability (pass → 0.80)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a1aa75-fcaf-7e63-b6e2-e08aa37fcd5b"},{"id":"chg_01a1aa75-fcb2-757c-8a07-ba0e573dc426","kind":"score.total_changed","summary":"Trust score (56 → 53)","materiality":"functional","direction":"regression","scoreDelta":-3,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a1aa75-fcb2-757c-8a07-ba0e573dc426"},{"id":"chg_01a18b8d-09f6-7e47-b2c5-269e9f2a12dd","kind":"check.verdict","summary":"Stability (0.97 → pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a18b8d-09f6-7e47-b2c5-269e9f2a12dd"},{"id":"chg_01a18665-57fc-7631-b936-e7863e8440f3","kind":"score.total_changed","summary":"Trust score (55 → 56)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a18665-57fc-7631-b936-e7863e8440f3"},{"id":"chg_01a17c13-5b53-7e81-986a-1376690d9e16","kind":"score.total_changed","summary":"Trust score (54 → 55)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a17c13-5b53-7e81-986a-1376690d9e16"},{"id":"chg_01a171c5-2dfd-77f5-af09-aefd7e2c40c0","kind":"score.total_changed","summary":"Trust score (53 → 54)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a171c5-2dfd-77f5-af09-aefd7e2c40c0"},{"id":"chg_01a16777-7d56-7194-b972-43bb2bd01765","kind":"score.total_changed","summary":"Trust score (52 → 53)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-23","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a16777-7d56-7194-b972-43bb2bd01765"},{"id":"chg_01a15d2a-269e-740f-8cfc-eae32e416c76","kind":"score.total_changed","summary":"Trust score (51 → 52)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-21","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a15d2a-269e-740f-8cfc-eae32e416c76"},{"id":"chg_01a1519d-41d1-7687-b09f-61dc8eb72572","kind":"package.version_changed","summary":"Package version (0.0.3 → 0.0.8)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a1519d-41d1-7687-b09f-61dc8eb72572"},{"id":"chg_01a1519d-41d2-7487-8b32-2d514c428df9","kind":"score.total_changed","summary":"Trust score (50 → 51)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a1519d-41d2-7487-8b32-2d514c428df9"},{"id":"chg_01a1488e-6fab-78eb-a479-e65ec20b9e8b","kind":"score.total_changed","summary":"Trust score (49 → 50)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-17","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a1488e-6fab-78eb-a479-e65ec20b9e8b"},{"id":"chg_01a13924-1c1b-76d2-8bec-2b843fd98bd9","kind":"score.total_changed","summary":"Trust score (48 → 49)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a13924-1c1b-76d2-8bec-2b843fd98bd9"},{"id":"chg_01a133f2-efe8-73ae-ab9a-5440ae4c8f9f","kind":"check.reverified","summary":"Stability (unverified → 0.43)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-13","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a133f2-efe8-73ae-ab9a-5440ae4c8f9f"},{"id":"chg_01a133f2-efe9-7583-8a2f-69d4ffdd9ed7","kind":"score.total_changed","summary":"Trust score (42 → 48)","materiality":"functional","direction":"improvement","scoreDelta":6,"occurredOn":"2026-10-13","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a133f2-efe9-7583-8a2f-69d4ffdd9ed7"},{"id":"chg_01a0efc9-cf43-7236-b42c-b22f83b6b380","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-09-30","url":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server#chg-chg_01a0efc9-cf43-7236-b42c-b22f83b6b380"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server/changelog.json"},"links":{"html":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server","markdown":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server.md","changelogJson":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server/changelog.json","changelogRss":"https://verifymcp.io/servers/com-sebastienrousseau-passmcp-server/ghcr-io-sebastienrousseau-passmcp-server.xml","external":[{"label":"GitHub Container Registry","href":"https://ghcr.io/sebastienrousseau/passmcp-server"},{"label":"Repository","href":"https://github.com/sebastienrousseau/passmcp-server"}]}}