{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:59:22.741Z","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp","markdownUrl":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp.md","server":{"slug":"cryptoduke01-gloam","name":"Gloam","registryName":"io.github.cryptoduke01/gloam","description":"Private stablecoin payments for people and AI agents on mainnet, hosted or local with limits.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"gloamtrade-mcp","type":"npm","identifier":"@gloamtrade/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp","version":"0.8.0","transport":"stdio","scoredAt":"2026-11-05T15:46:49.957Z"},"score":{"total":49,"tier":"low","status":"scored","weekDelta":-20,"history":[{"date":"2026-11-05","total":49},{"date":"2026-11-04","total":69},{"date":"2026-11-03","total":68},{"date":"2026-11-02","total":53},{"date":"2026-11-01","total":70},{"date":"2026-10-31","total":70},{"date":"2026-10-30","total":69},{"date":"2026-10-29","total":69},{"date":"2026-10-28","total":68},{"date":"2026-10-27","total":68},{"date":"2026-10-26","total":67},{"date":"2026-10-25","total":67},{"date":"2026-10-24","total":66},{"date":"2026-10-23","total":68},{"date":"2026-10-22","total":68},{"date":"2026-10-21","total":52},{"date":"2026-10-20","total":64},{"date":"2026-10-19","total":64},{"date":"2026-10-18","total":64},{"date":"2026-10-17","total":64},{"date":"2026-10-16","total":64},{"date":"2026-10-15","total":64},{"date":"2026-10-14","total":64},{"date":"2026-10-13","total":36},{"date":"2026-10-12","total":36},{"date":"2026-10-11","total":36}]},"categories":[{"name":"Supply Chain Security","score":13,"verdict":"unverified","reasons":["Malware scan not yet available for this package.","Known CVEs could not be checked: the version this server declares is not published in its registry.","No install/post-install scripts declared.","Dependency health could not be checked: the version this server declares is not published in its registry."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"vendor_not_cached"}},{"code":"cve.inconclusive","args":{"reason":"root_version_missing"}},{"code":"installscript.none","args":{}},{"code":"dephealth.inconclusive","args":{"reason":"root_version_missing"}}]},{"name":"Provenance & Transparency","score":48,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (MIT).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":60,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 3706 tokens (~218/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"218","items":"17","tools":"17","tokens":"3706","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":56,"verdict":"fail","reasons":["Stability check failed: the tool surface changed between 0.2.0 and 0.8.0: 3 tool removals, 0 breaking changes, 3 additions."],"codes":[{"code":"stability.version_churn","args":{"to":"0.8.0","days":"22","from":"0.2.0","added":"3","breaks":"0","removed":"3"}}]},{"name":"Tool Coverage","score":99,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","96% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"96"}}]},{"name":"Tool Safety","score":75,"verdict":"fail","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","0 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; \"gloam_execute_private_swap\" implies \"execute\" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.","An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_undeclared","args":{"pct":"0","tool":"gloam_execute_private_swap","verb":"execute","declared":"none","annotated":"0","destructive":"5"}},{"code":"toolsafety.manipulation_clean","args":{"units":"17","judged":"17"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["Malware scan not yet available for this package.","Known CVEs could not be checked: the version this server declares is not published in its registry.","Dependency health could not be checked: the version this server declares is not published in its registry."],"malware":[],"components":[{"slug":"www","type":"remote","identifier":"https://www.gloam.trade/mcp","withdrawn":false,"score":84,"current":false,"url":"https://verifymcp.io/servers/cryptoduke01-gloam/www","markdownUrl":"https://verifymcp.io/servers/cryptoduke01-gloam/www.md"},{"slug":"gloamtrade-mcp","type":"npm","identifier":"@gloamtrade/mcp","withdrawn":false,"score":49,"current":true,"url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp","markdownUrl":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"@gloamtrade/mcp"},{"label":"Version","value":"0.8.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"gloam_info","title":"About Gloam","description":"What Gloam is, which networks it runs on, and what an agent can do with it. Call this first.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":34},{"name":"gloam_privacy_status","title":"Privacy status","description":"Honest, current privacy posture: what is live, what is not, and how strong the anonymity set is. Agents should check this before assuming what a payment or a swap keeps private.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":48},{"name":"gloam_swap_quote","title":"Quote a private swap","description":"Read only. Price a private swap of one note's value from one asset into another on a Gloam network, with everything that would stop it: price impact and peg on Base and Ethereum, the vault's limits (the refund note must fit, the vault must take what you receive), the vault's cash-out fee read live, and where gas is dear the relay's smallest swap. A private swap hides who swapped; the tokens and the amounts are public. Swap with gloam_execute_private_swap.","inputs":[{"name":"amount","type":"number","required":false,"description":"How much to swap, in the asset's units (e.g. 25 for 25 USDC)."},{"name":"from","type":"string","required":false,"description":"What you pay: a symbol (\"USDG\", \"USDC\", \"ETH\") or a 0x token address. Left out with a note handle: the note's asset."},{"name":"maxImpactBps","type":"integer","required":false,"description":"The most price impact to accept, in basis points (100 = 1%). It can only lower the owner's cap (GLOAM_SWAP_MAX_IMPACT_BPS, 200 unless set), never raise it."},{"name":"network","type":"string","required":false,"description":"Which network to swap on: \"robinhood-mainnet\", \"tempo-mainnet\", \"base-mainnet\", \"ethereum-mainnet\", \"robinhood\", \"tempo\", \"base\", \"ethereum\". The -mainnet ones are the mainnets (beta deposit limits);…"},{"name":"note","type":"string","required":false,"description":"A note handle (gloam_list_notes): quote swapping its whole value."},{"name":"to","type":"string","required":true,"description":"What you receive: a symbol or a 0x token address (\"ETH\" is native ETH)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":373},{"name":"gloam_execute_private_swap","title":"Execute a private swap","description":"REAL execution. Swap one note's value from one asset into another, privately: proves locally (the swapped note's unshield to a one-time escrow, the new note, and a refund note) and sends it through the Gloam relay, never from this server's wallet. Who swapped stays private; the tokens and the amounts are public. A swap spends one whole note: with an amount below a note's value, the note is first split with a private send to this server's own notes. Checked first against the owner's spending limits (\"swap\" must be listed in the agent's tools) and everything gloam_swap_quote checks. Both new notes are kept before anything is sent; gloam_finish_swap brings back a swap whose money waits at its escrow. A swap that reverts leaves its note held: it moves whole to a fresh note right away, and nothing spends it before that.","inputs":[{"name":"amount","type":"number","required":false,"description":"How much to swap, in the asset's units. Left out with a note handle: its whole value."},{"name":"from","type":"string","required":false,"description":"What you pay: a symbol or a 0x token address. Left out with a note handle: the note's asset."},{"name":"maxImpactBps","type":"integer","required":false,"description":"The most price impact to accept, in basis points (100 = 1%). It can only lower the owner's cap (GLOAM_SWAP_MAX_IMPACT_BPS, 200 unless set), never raise it."},{"name":"network","type":"string","required":false,"description":"Which network to swap on: \"robinhood-mainnet\", \"tempo-mainnet\", \"base-mainnet\", \"ethereum-mainnet\", \"robinhood\", \"tempo\", \"base\", \"ethereum\". The -mainnet ones are the mainnets (beta deposit limits);…"},{"name":"note","type":"string","required":false,"description":"The note handle to swap from (gloam_list_notes). Left out: an exact match, else the smallest note that covers the amount."},{"name":"to","type":"string","required":true,"description":"What you receive: a symbol or a 0x token address."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":449},{"name":"gloam_finish_swap","title":"Finish a private swap","description":"Settle a swap this server made, by its refund note's handle (or its new note's): reads how it ended and does what is needed. When the swapped note's money waits at the swap's escrow, it brings it back as the refund note through the relay; when the refund note can't take it (the vault's fee rose, or the vault is full on routers with an exit), it sends it to a `to` address you give, which is public and goes through the owner's limits like any spend.","inputs":[{"name":"note","type":"string","required":true,"description":"The swap's refund note handle (gloam_list_notes shows it), or its new note's."},{"name":"to","type":"string","required":false,"description":"Only for an exit: the 0x address the waiting money goes to. Public."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":167},{"name":"gloam_plan_shield","title":"Plan a shield (deposit to private)","description":"Describe moving funds into a private balance (shield), the first step before paying privately. To actually shield, use gloam_execute_shield.","inputs":[{"name":"agentAddress","type":"string","required":false,"description":null},{"name":"asset","type":"string","required":false,"description":"Asset to shield, e.g. USDG, USDC.e, or ETH on testnet."},{"name":"usd","type":"number","required":true,"description":"Amount to shield, in USD."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":86},{"name":"gloam_execute_shield","title":"Execute a private shield","description":"Deposit into a PRIVATE balance on the chosen Gloam network. Mints a note, generates the Groth16 shield proof server-side with that network's keys, and broadcasts shieldBound() (approving the ERC-20 first when the asset is a token). A mainnet vault takes only the assets it lists (this tool names them if given another), within the deposit limits it reads from the vault; direct deposits are free. The note's secret stays inside this server; the agent gets a note handle to pay from later (gloam_execute_private_pay, gloam_list_notes). Requires GLOAM_AGENT_PRIVATE_KEY; without it, returns a plan.","inputs":[{"name":"amount","type":"number","required":true,"description":"Amount to shield into a private balance, in the asset's units (e.g. 25 for 25 USDC.e)."},{"name":"asset","type":"string","required":false,"description":"ERC-20 token address to shield; omit to use the network default (USDG on Robinhood Chain mainnet, USDC.e on Tempo mainnet, USDC on Base and Ethereum, PathUSD on Tempo testnet, native ETH on Robinhood…"},{"name":"decimals","type":"integer","required":false,"description":"Decimals of the asset; omit to use the asset's own (6 for the stablecoins, 18 for GLOAM and ETH)."},{"name":"network","type":"string","required":false,"description":"Which network to shield on: \"robinhood-mainnet\", \"tempo-mainnet\", \"base-mainnet\", \"ethereum-mainnet\", \"robinhood\", \"tempo\", \"base\", \"ethereum\". The -mainnet ones are the mainnets (beta deposit limits…"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":374},{"name":"gloam_execute_transfer","title":"Execute a transfer (public)","description":"Send test ETH publicly on Robinhood Chain TESTNET from the agent wallet, for funding while practicing. This is the PUBLIC rail (amount and recipient are visible) and testnet only. For private movement, use gloam_execute_shield and gloam_execute_private_pay. Requires GLOAM_AGENT_PRIVATE_KEY; without it, returns a plan only.","inputs":[{"name":"eth","type":"number","required":true,"description":"Amount of testnet ETH to send."},{"name":"to","type":"string","required":true,"description":"Recipient 0x address."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":106},{"name":"gloam_list_notes","title":"Private notes and balance","description":"This server's private notes as handles, with network, asset, amount, status (unspent, pending, spent, dead when its transaction can never land, or held when its last swap reverted and it must move to a fresh note before anything spends it) and the transaction that created each one, plus the spendable private balance per asset. Never shows a secret. Pass refresh to check pending notes against the chain.","inputs":[{"name":"includeSpent","type":"boolean","required":false,"description":"Also list spent and dead notes."},{"name":"network","type":"string","required":false,"description":"Only this network."},{"name":"refresh","type":"boolean","required":false,"description":"Check pending notes on chain first (read-only calls), and move each held note to a fresh note of this server's (a private send through the relay)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":156},{"name":"gloam_receive_tag","title":"This server's receive tag","description":"The receive tag (gloamr1.…) others pay this server to. Payments sealed to it open only with the key this server keeps. Created on first use. Share it freely: it is a public key, not a secret.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":59},{"name":"gloam_payment_requirements","title":"Price a resource in private payments (x402 and MPP)","description":"SERVER side. Build the HTTP 402 price an agent-paid resource returns, settled privately through Gloam: the amount and the payee never go public, and through the relay neither does the payer's wallet. Returns it in both dialects: x402 requirements (and their encoded form), and an MPP challenge (mpp.wwwAuthenticate, the WWW-Authenticate: Payment value for method gloam, intent charge). payTo defaults to this server's own receive tag. Check what the payer presents with gloam_verify_payment.","inputs":[{"name":"amount","type":"number","required":true,"description":"Price in the asset's display units, e.g. 0.25."},{"name":"asset","type":"string","required":false,"description":"Settlement token address; omit for the network default (USDG on Robinhood Chain mainnet, USDC.e on Tempo mainnet, USDC on Base and Ethereum, PathUSD on Tempo testnet, ETH on Robinhood Chain testnet)."},{"name":"assetSymbol","type":"string","required":false,"description":"Asset label, e.g. USDC.e; omit for the asset's own symbol."},{"name":"decimals","type":"integer","required":false,"description":"Decimals of the settlement asset; omit for the asset's own (6 for the stablecoins)."},{"name":"expiresInSeconds","type":"integer","required":false,"description":"How long the MPP challenge stays valid. Leave room to prove and confirm a payment."},{"name":"network","type":"string","required":false,"description":"Which Gloam network the payer settles on: \"robinhood-mainnet\", \"tempo-mainnet\", \"base-mainnet\", \"ethereum-mainnet\", \"robinhood\", \"tempo\", \"base\", \"ethereum\". The -mainnet ones are the mainnets (beta…"},{"name":"payTo","type":"string","required":false,"description":"Payee receive tag (gloamr1.…). Omit to be paid to this server's own tag, which gloam_verify_payment can open."},{"name":"realm","type":"string","required":false,"description":"MPP protection space for the challenge. Default: the resource URL's host."},{"name":"resource","type":"string","required":true,"description":"What is being paid for: a URL or an MCP tool id."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":447},{"name":"gloam_pay_x402","title":"Plan a private payment for a 402 challenge","description":"AGENT side. Given a Gloam 402 price (x402 requirements, or an MPP WWW-Authenticate: Payment challenge with method gloam), describe the private payment the agent would make: a self-custodial private send of the required amount to the payee, sealed to the payee's receive tag, broadcast by this server (no operator or facilitator holds its key). Plans only; to pay, call gloam_execute_private_pay, or gloam_fetch_paid to do the whole request.","inputs":[{"name":"note","type":"string","required":false,"description":"Handle of the note to pay from (gloam_list_notes), if you want a specific one."},{"name":"requirements","type":"string","required":true,"description":"Encoded requirements from gloam_payment_requirements (or the raw JSON), or an MPP challenge (the WWW-Authenticate value)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":175},{"name":"gloam_execute_private_pay","title":"Execute a private payment (x402 or MPP)","description":"AGENT side, REAL execution. Settle a 402 price privately from a note this server holds: syncs the pool tree, builds the private send to the payee, seals the payment note to the payee's receive tag, generates the Groth16 transfer proof, and broadcasts transfer(). Self-custodial (this server's key signs; no operator holds funds). Returns the X-PAYMENT header for x402 requirements, or for an MPP challenge (method gloam) the Authorization: Payment credential, and the change as a note handle. A challenge is paid once, and a call whose answer never arrived is not paid twice: the retry reuses the first payment, or answers payment_in_progress while that one is running. payTo must be a receive tag. Requires GLOAM_AGENT_PRIVATE_KEY; without it, returns a plan.","inputs":[{"name":"issuerTag","type":"string","required":false,"description":"Optional issuer tag to attach a compliance disclosure."},{"name":"note","type":"string","required":false,"description":"Handle of the note to pay from (gloam_list_notes). Omit to use the smallest note that covers the amount."},{"name":"requirements","type":"string","required":true,"description":"Encoded requirements from gloam_payment_requirements (or raw JSON), or an MPP challenge (the WWW-Authenticate: Payment value)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":267},{"name":"gloam_fetch_paid","title":"Fetch a paid resource (x402 or MPP, paid privately)","description":"AGENT side, REAL execution. Request a URL; if it answers 402 with a Gloam private price, pay it privately from this server's notes (same limits as gloam_execute_private_pay), retry, and return the response. Understands both dialects: an MPP challenge (WWW-Authenticate: Payment with method gloam, answered with Authorization: Payment) is preferred when offered, else x402 (X-PAYMENT). Also pays x402 scheme gloam-cashout (a gateway on Robinhood Chain that pays out to a public address): a cash out of exactly the quoted USDG from this server's notes to that address, sent through the Gloam relay. The payee and the amount are public there; this server's wallet and balance are not. gloam-cashout needs maxAmount. With gloam-private and gloam-cashout both offered, gloam-private is paid unless prefer says gloam-cashout. The agent never handles a note secret or the payment header unless a retry is needed. A call whose answer never arrived is not paid twice: the same call again gets that answer, presents the first payment, or answers payment_in_progress while it is running. Requires GLOAM_AGENT_PRIVATE_KEY to pay.","inputs":[{"name":"body","type":"string","required":false,"description":"Request body for POST."},{"name":"contentType","type":"string","required":false,"description":"Content-Type for the body (default application/json)."},{"name":"maxAmount","type":"number","required":false,"description":"Refuse if the 402 asks for more than this, in the asset's units. Needs the asset's decimals from Gloam's list or the limits file; for any other asset the fetch is refused."},{"name":"method","type":"string","required":false,"description":null},{"name":"note","type":"string","required":false,"description":"Handle of the note to pay from; omit to use the smallest that covers the price."},{"name":"paymentHeader","type":"string","required":false,"description":"Present a payment already made (paymentHeader from an earlier result: an X-PAYMENT value or an MPP Payment credential) instead of paying again."},{"name":"prefer","type":"string","required":false,"description":"Which x402 scheme to pay when the resource offers both gloam-private and gloam-cashout. Default gloam-private, which keeps the payee private too."},{"name":"url","type":"string","required":true,"description":"http(s) URL of the resource."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":468},{"name":"gloam_verify_payment","title":"Verify and settle a private payment (x402 or MPP)","description":"SERVER side. Check a presented payment and make it final: an x402 X-PAYMENT value against its requirements, or an MPP credential (the Authorization: Payment value, method gloam) against the challenge it echoes, which must be one this server issued for this price (pass the price as requirements in both cases). Opens the payment note with this server's receive key, checks it binds the required amount and asset in the right pool (and, for MPP, that it is the payment output of a Transferred event and bound to that challenge), then sweeps it into a fresh note only this server knows and waits for that to confirm. Grant access only when the result says grantAccess: true; for MPP, serve with its paymentReceipt as the Payment-Receipt header. A payer creates the payment note, so without the sweep it could spend the money back after being served. Needs GLOAM_AGENT_PRIVATE_KEY or the relay (GLOAM_USE_RELAY=1) to sweep.","inputs":[{"name":"payment","type":"string","required":true,"description":"The X-PAYMENT header value (or raw JSON payload), or the MPP Authorization: Payment value presented by the payer."},{"name":"requirements","type":"string","required":false,"description":"The price of the resource you are serving: x402 requirements (encoded or raw JSON), or the MPP challenge (WWW-Authenticate value). Required for both x402 and MPP: the payment must match this price."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":297},{"name":"gloam_get_limits","title":"Spending limits","description":"This agent's spending limits as the owner set them: which money tools it may use, which assets, the cap per payment and per rolling 24 hours, allowed recipients, and when its permission expires. Check this before planning a payment. This MCP server enforces them before it signs (off-chain). When the agent's key is a Tempo access key, the result also has `onchain`: the owner's AccountKeychain authorization (expiry, the remaining periodic limit and call scopes), which the Tempo protocol enforces on every transaction whatever this server does. The vault contract itself does not know about limits.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":131},{"name":"gloam_get_spending_report","title":"Spending report","description":"What this agent has spent in the last 24 hours and how much is left under its daily limit, per asset, plus its most recent payments and any refused attempts. Read from the local spending log this server keeps.","inputs":[{"name":"recent","type":"integer","required":false,"description":"How many recent payments to list."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":69}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T15:46:49.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":null,"reasonLabel":null,"discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-11","recent":[{"id":"chg_01a1ac64-3221-7643-92a5-b1b42ab6d6ba","kind":"check.unverifiable","summary":"Dependency health (0.84 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1ac64-3221-7643-92a5-b1b42ab6d6ba"},{"id":"chg_01a1ac64-3221-7ef7-8b57-3f12dda0c66c","kind":"package.version_changed","summary":"Package version (0.7.0 → 0.8.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1ac64-3221-7ef7-8b57-3f12dda0c66c"},{"id":"chg_01a1ac64-3222-75f3-b417-5fd53851af7b","kind":"score.total_changed","summary":"Trust score (54 → 49)","materiality":"functional","direction":"regression","scoreDelta":-5,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1ac64-3222-75f3-b417-5fd53851af7b"},{"id":"chg_01a1ac64-321e-734e-99e7-94ca14953d85","kind":"check.unverifiable","summary":"Known CVEs (fail → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1ac64-321e-734e-99e7-94ca14953d85"},{"id":"chg_01a1abbb-9f19-7150-9277-4ef5e38a5ba3","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1abbb-9f19-7150-9277-4ef5e38a5ba3"},{"id":"chg_01a1abbb-9f1b-7cd5-991d-a28d2e50e3ae","kind":"score.total_changed","summary":"Trust score (69 → 54)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1abbb-9f1b-7cd5-991d-a28d2e50e3ae"},{"id":"chg_01a1abbb-9f1b-7631-b32f-7211cbf9a100","kind":"package.version_changed","summary":"Package version (0.7.0 → 0.7.2)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1abbb-9f1b-7631-b32f-7211cbf9a100"},{"id":"chg_01a1a988-8b5d-7156-96f2-111a52a06c18","kind":"advisory.resolved","summary":"CVE-2026-118764 no longer affects this package","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1a988-8b5d-7156-96f2-111a52a06c18"},{"id":"chg_01a1a463-f9de-79dc-9cf9-590ed8d0f14d","kind":"score.total_changed","summary":"Trust score (68 → 69)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a1a463-f9de-79dc-9cf9-590ed8d0f14d"},{"id":"chg_01a19f3f-b8c8-710e-a746-9923beee2229","kind":"score.total_changed","summary":"Trust score (53 → 68)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19f3f-b8c8-710e-a746-9923beee2229"},{"id":"chg_01a19f3f-b8aa-7b89-a1a3-ce226da0a572","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19f3f-b8aa-7b89-a1a3-ce226da0a572"},{"id":"chg_01a19d59-601e-74d1-95ae-4fd984988d68","kind":"score.total_changed","summary":"Trust score (70 → 53)","materiality":"functional","direction":"regression","scoreDelta":-17,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19d59-601e-74d1-95ae-4fd984988d68"},{"id":"chg_01a19d59-6017-7d3b-b307-3d68e2eab4e2","kind":"check.verdict","summary":"Stability (0.60 → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19d59-6017-7d3b-b307-3d68e2eab4e2"},{"id":"chg_01a19d59-601a-7d9b-8c6d-246843edf43c","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19d59-601a-7d9b-8c6d-246843edf43c"},{"id":"chg_01a19d59-601b-7d1f-863a-ff9febbc2a96","kind":"check.measure","summary":"Schema quality (151 → 205)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19d59-601b-7d1f-863a-ff9febbc2a96"},{"id":"chg_01a19d59-601c-786d-b418-ef6b1d9d9421","kind":"check.measure","summary":"Tool coverage (89% → 96%)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19d59-601c-786d-b418-ef6b1d9d9421"},{"id":"chg_01a19d59-601d-7e02-8e4c-4da54c1b13bf","kind":"package.version_changed","summary":"Package version (0.3.0 → 0.7.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a19d59-601d-7e02-8e4c-4da54c1b13bf"},{"id":"chg_01a18fcc-6895-7ab8-855c-50e42a549f65","kind":"advisory.identified","summary":"CVE-2026-118764 affects this package (high)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a18fcc-6895-7ab8-855c-50e42a549f65"},{"id":"chg_01a18fcc-6896-7d72-a339-0e8c59c5420c","kind":"score.total_changed","summary":"Trust score (69 → 70)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a18fcc-6896-7d72-a339-0e8c59c5420c"},{"id":"chg_01a18aa7-0baf-7bd9-9dd5-56bbe1c47a2d","kind":"package.version_changed","summary":"Package version (0.2.0 → 0.3.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp#chg-chg_01a18aa7-0baf-7bd9-9dd5-56bbe1c47a2d"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp","markdown":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp.md","changelogJson":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/cryptoduke01-gloam/gloamtrade-mcp.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/@gloamtrade/mcp"},{"label":"Socket report","href":"https://socket.dev/npm/package/@gloamtrade/mcp"},{"label":"Repository","href":"https://github.com/cryptoduke01/gloam"},{"label":"Website","href":"https://gloam.trade/docs/agents"}]}}