Credda Trust
NPM · @CREDDA/MCP-SERVER · SCANNED AUG 3
Check a counterparty's verifiable Credda trust record; verify or present signed credentials.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency6
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 9 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability88
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1810 tokens (~106/item across 17 items; 15 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @credda/mcp-server
claude mcp add credda-io-credda-trust -- npx -y @credda/mcp-server
codex mcp add credda-io-credda-trust -- npx -y @credda/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"credda-io-credda-trust": {
"type": "local",
"command": [
"npx",
"-y",
"@credda/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add credda-io-credda-trust --command npx --arg -y --arg @credda/mcp-server
mcp_servers:
credda-io-credda-trust:
command: "npx"
args: ["-y", "@credda/mcp-server"] {
"mcpServers": {
"credda-io-credda-trust": {
"command": "npx",
"args": [
"-y",
"@credda/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +28
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- License: unverified → fail ▼ functional
- Schema quality: unverified → excellent ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Stability: unverified → 0.27 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Jul 26 −8
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 47
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@credda/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 96 packages
96 packages in the resolved dependency tree · 95 deprecated · 29 stale · 1 without a linked repository.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
check_delivery_receipts Check a counterparty agent's delivery record ~161
The evidence view for an agent-to-agent handshake: given the share token a counterparty hands you, returns their DELIVERY RECEIPTS — how many deliveries are recorded, how many a DISTINCT counterparty confirmed, how many were their own operator vouching for them (which never counts as confirmed), failures, disputes, and the on-time rate over confirmed deliveries — plus a signed W3C credential of that record you can offline-verify with verify_verifiable_credential. No API key needed. This is a DELIVERY RECORD, not a safety, alignment or capability rating, and never a recommendation: it tells you what was delivered and who confirmed it, and the decision stays yours.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | The counterparty's Credda share token |
No output schema declared.
No examples provided.
check_trust Check a counterparty's Credda trust ~121
Look up a counterparty's verifiable, deterministic Credda reliability score by their public share token — the token is a capability they hand you (e.g. in a profile URL or a handshake message), no API key needed. Returns the score, band, verified-platform count, and a signed credential you can offline-verify with verify_trust_credential. The score is a pure function of an append-only event ledger — never set or nudged by a human or an AI.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | The counterparty's Credda share token |
No output schema declared.
No examples provided.
create_score_monitor Create a continuous score monitor ~180
Watch one of your users' scores continuously instead of polling: an edge-triggered monitor fires a `monitor.triggered` webhook event when the score crosses DOWN through `belowScore` (also fires if the FIRST computed score is already below it), crosses UP through `aboveScore`, or when `onBandChange` is set and the band label changes. At least one condition is required. Requires CREDDA_API_KEY. A monitor is notification config only — it never affects a score.
| Name | Type | Req | Description |
|---|---|---|---|
| aboveScore | number | — | Fire when the score crosses UP through this threshold (0–100) |
| belowScore | number | — | Fire when the score crosses DOWN through this threshold (0–100) |
| onBandChange | boolean | — | Fire whenever the score band label changes |
| userId | string | yes | The user's external id on your platform |
No output schema declared.
No examples provided.
delete_score_monitor Delete a score monitor ~62
Delete one of your continuous score monitors by id (hard delete — a monitor is notification config, not ledger data, so nothing score-related is touched). Requires CREDDA_API_KEY.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The monitor id (from list_score_monitors) |
No output schema declared.
No examples provided.
explain_user_score Explain a user's score factor by factor ~107
The bias-free evidence view of a user's score: a plain-language summary plus the per-factor breakdown (completion rate, on-time rate, dispute rate, verification depth), platform trust, consistency, momentum, and confidence level. Requires CREDDA_API_KEY. This explains EVIDENCE only — Credda deliberately has no "evaluate/recommend this person" endpoint; the decision stays with you, made against transparent facts.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | yes | The user's external id on your platform |
No output schema declared.
No examples provided.
get_my_usage Read your own API key's usage and quota ~95
Observability for the agent's own key: your platform's API usage per day (by status class), tier rate limit, monthly quota consumption, and busiest endpoints over the window. Requires CREDDA_API_KEY. Advisory observability only — usage never affects any score.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | — | Trailing window in days (default 7, max 400 — days beyond Redis retention are served from durable daily rollups) |
No output schema declared.
No examples provided.
get_trust_export Get a counterparty's portable trust export ~91
Fetch the full portable, self-verifying trust bundle for a share token: current score, score history, and a signed W3C Verifiable Credential with a revocation pointer. Use this when you need more than the headline score — e.g. to check a counterparty's trend over time before a higher-stakes commitment.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | The counterparty's Credda share token |
No output schema declared.
No examples provided.
get_user_score Read one of your platform's users' Credda score ~103
Read a user's latest computed Credda reliability score by their external id (the id YOUR platform reports events under) — score, band, confidence, factor breakdown, and the formula version that computed it. Requires CREDDA_API_KEY. Read-only: the score is a pure, deterministic function of the append-only event ledger — no tool (and no AI) can set or nudge it.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | yes | The user's external id on your platform |
No output schema declared.
No examples provided.
list_score_monitors List your platform's score monitors ~82
List your platform's continuous score monitors (cursor-paginated): each monitor's user, thresholds, band-change flag, active state, and when it last triggered. Requires CREDDA_API_KEY.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | — | Cursor from a previous page (`nextCursor`) |
| limit | integer | — | Page size (default 50, max 100) |
No output schema declared.
No examples provided.
list_webhook_event_types List the webhook event types Credda can send ~100
The public outbound webhook event catalog — every event type the API can deliver (e.g. `score.updated`, `score.band_changed`, `monitor.triggered`), with a description and example payload per event, the common delivery envelope, and how to verify a delivery signature. No API key needed. Use it to discover what create_score_monitor and webhook subscriptions can notify you about. Webhooks are advisory: no event can change anyone's score.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
mint_my_trust_token Mint a fresh trust token to present to a counterparty ~114
Mint a fresh Credda share token for YOUR OWN identity, to hand to a counterparty as your side of a trust handshake (they can then call check_trust on it, or you can fetch and hand them get_trust_export / verify_trust_credential's credential directly). Requires this MCP server to be configured with CREDDA_API_KEY and CREDDA_USER_ID — it never acts on a counterparty's behalf. Minting does not change your score; it only issues a new capability token.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
present_my_credential Present your Credda trust credential in one call ~127
Convenience wrapper for the agent-to-agent handshake: mints a fresh share token for YOUR OWN identity and immediately fetches its full portable trust export (score + history + signed W3C credential + revocation pointer) in a single tool call, instead of mint_my_trust_token followed by a separate get_trust_export round trip. Hand the returned token or credential to a counterparty so they can check_trust it or verify it offline. Requires this MCP server to be configured with CREDDA_API_KEY and CREDDA_USER_ID. Minting does not change your score.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
present_my_delivery_receipts Present your own delivery record to a counterparty ~120
Your side of the handshake: mints a fresh share token for YOUR OWN Credda-scored identity and fetches its signed delivery credential in one call — the counterparty-confirmed record of what you have actually delivered, which the other side can check offline. Requires this MCP server to be configured with CREDDA_API_KEY and CREDDA_USER_ID; it never acts on a counterparty's behalf. Minting issues a capability token — it does not change your score, and nothing you report about yourself is ever counted as confirmed evidence.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
verify_trust_credential Verify a presented Credda credential (offline) ~104
Offline-verify a signed Credda Verifiable Trust Credential (compact EdDSA JWT format) that a counterparty presented to you directly — e.g. in an agent-to-agent handshake — without a round trip to Credda. Checks the signature against Credda's published JWKS, plus issuer and expiry. Rejects (throws) on an invalid, expired, or tampered credential.
| Name | Type | Req | Description |
|---|---|---|---|
| credential | string | yes | The compact JWT credential string presented to you |
No output schema declared.
No examples provided.
verify_verifiable_credential Verify a presented W3C Verifiable Credential (offline) ~115
Offline-verify a W3C Verifiable Credential (VC-JWT) that a counterparty presented to you, resolving Credda's did:web DID document and checking the revocation status list. Use this for credentials in the wider W3C VC ecosystem format rather than verify_trust_credential's compact format. Rejects (throws) on an invalid, expired, revoked, or tampered credential.
| Name | Type | Req | Description |
|---|---|---|---|
| vcJwt | string | yes | The W3C Verifiable Credential (VC-JWT) presented to you |
No output schema declared.
No examples provided.