{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T02:18:10.762Z","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp","markdownUrl":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp.md","server":{"slug":"deltax-public-deltax-preflight","name":"DeltaX Preflight","registryName":"io.github.DeltaX-Public/deltax-preflight","description":"Check finite candidate proposals against separate policy and evidence, with canonical hash receipts.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"deltax-preflight-mcp","type":"mcpb","identifier":"https://github.com/DeltaX-Public/deltax-preflight/releases/download/mcp-v0.1.0/deltax-preflight-mcp-0.1.0.mcpb","withdrawn":false,"url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp","version":null,"transport":"stdio","scoredAt":"2026-11-06T00:32:59.538Z"},"score":{"total":47,"tier":"low","status":"scored","weekDelta":3,"history":[{"date":"2026-11-06","total":47},{"date":"2026-11-05","total":46},{"date":"2026-11-04","total":46},{"date":"2026-11-03","total":45},{"date":"2026-11-02","total":44},{"date":"2026-11-01","total":43},{"date":"2026-10-31","total":44},{"date":"2026-10-30","total":44},{"date":"2026-10-29","total":43},{"date":"2026-10-28","total":43},{"date":"2026-10-27","total":42},{"date":"2026-10-26","total":42},{"date":"2026-10-25","total":41},{"date":"2026-10-24","total":41},{"date":"2026-10-23","total":40},{"date":"2026-10-22","total":40}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).","Install-script risk not yet assessed.","Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none)."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"no_manifest_bundled"}},{"code":"installscript.inconclusive","args":{"reason":"install_surface_unavailable"}},{"code":"dephealth.inconclusive","args":{"reason":"no_manifest_bundled"}}]},{"name":"Provenance & Transparency","score":45,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (Apache-2.0).","Actively maintained (last published 14 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"Apache-2.0"}},{"code":"maintenance.recent","args":{"age_days":"14"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":71,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 298 tokens (~99/item across 3 items; 3 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"99","items":"3","tools":"3","tokens":"298","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":50,"verdict":"partial","reasons":["Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"15"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).","Install-script risk not yet assessed.","Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none)."],"malware":[],"components":[{"slug":"deltax-preflight-mcp","type":"mcpb","identifier":"https://github.com/DeltaX-Public/deltax-preflight/releases/download/mcp-v0.1.0/deltax-preflight-mcp-0.1.0.mcpb","withdrawn":false,"score":47,"current":true,"url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp","markdownUrl":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp.md"}],"facts":[{"label":"Registry","value":"mcpb"},{"label":"Package","value":"https://github.com/DeltaX-Public/deltax-preflight/releases/download/mcp-v0.1.0/deltax-preflight-mcp-0.1.0.mcpb"},{"label":"Transport","value":"stdio"},{"label":"SHA-256","value":"018a56917bda7aa562ac9b3fc86df856ed984e03629efd01c7c3bc24f6e05d73"}],"install":{"available":true,"bundleSha256":"018a56917bda7aa562ac9b3fc86df856ed984e03629efd01c7c3bc24f6e05d73"},"tools":[{"name":"preflight_check","title":null,"description":"Check a decision proposal against separate policy and evidence documents using the local Preflight v2 validator. Returns the unchanged result, receipt and optional local handoff. PASS_SINGLE, REFUSE, EVIDENCE_REQUIRED and SELECTION_REQUIRED are normal results; none authorizes execution. Caller-supplied facts and policy are not independently verified.","inputs":[{"name":"decision","type":null,"required":true,"description":"Preflight v2 decision JSON document; the core validator checks its fields."},{"name":"evidence","type":null,"required":true,"description":"Preflight v2 evidence JSON document, bound to the exact decision_hash."},{"name":"policy","type":null,"required":true,"description":"Preflight v2 policy JSON document from the workflow owner."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":129},{"name":"preflight_hash_decision","title":null,"description":"Validate a Preflight v2 decision and compute its canonical SHA-256 decision_hash for binding separately obtained evidence. A hash does not authenticate facts or grant authority.","inputs":[{"name":"decision","type":null,"required":true,"description":"Preflight v2 decision JSON document."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":55},{"name":"preflight_hash_policy","title":null,"description":"Validate a Preflight v2 policy and compute its canonical SHA-256 policy_hash. A hash is only a trusted pin when its expected value is controlled outside the proposal.","inputs":[{"name":"policy","type":null,"required":true,"description":"Preflight v2 policy JSON document."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":56}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-06T00:32:59.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-22","recent":[{"id":"chg_01a1ae45-e8a8-7a1d-adf4-a14c0a3db5fc","kind":"score.total_changed","summary":"Trust score (46 → 47)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-06","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a1ae45-e8a8-7a1d-adf4-a14c0a3db5fc"},{"id":"chg_01a1a3e2-2bbc-71ab-bbc4-e952f3f6873f","kind":"score.total_changed","summary":"Trust score (45 → 46)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a1a3e2-2bbc-71ab-bbc4-e952f3f6873f"},{"id":"chg_01a19ec3-2031-736a-a7de-762b3efffd7f","kind":"check.reverified","summary":"Maintenance (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a19ec3-2031-736a-a7de-762b3efffd7f"},{"id":"chg_01a19ec3-2032-7905-8f95-868919805b36","kind":"score.total_changed","summary":"Trust score (44 → 45)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a19ec3-2032-7905-8f95-868919805b36"},{"id":"chg_01a199a2-ba40-77b9-9b2d-ec4a23d6bd7e","kind":"score.total_changed","summary":"Trust score (43 → 44)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a199a2-ba40-77b9-9b2d-ec4a23d6bd7e"},{"id":"chg_01a19480-4a60-7b54-b486-d6808561f6a2","kind":"check.unverifiable","summary":"Maintenance (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a19480-4a60-7b54-b486-d6808561f6a2"},{"id":"chg_01a19480-4a61-7a86-92fa-935f324660ff","kind":"score.total_changed","summary":"Trust score (44 → 43)","materiality":"functional","direction":"regression","scoreDelta":-1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a19480-4a61-7a86-92fa-935f324660ff"},{"id":"chg_01a18a1e-b1ae-77e8-9501-735a7cff2be8","kind":"score.total_changed","summary":"Trust score (43 → 44)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a18a1e-b1ae-77e8-9501-735a7cff2be8"},{"id":"chg_01a17fd0-48ea-7d9b-8e9a-294c98efe0bf","kind":"score.total_changed","summary":"Trust score (42 → 43)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a17fd0-48ea-7d9b-8e9a-294c98efe0bf"},{"id":"chg_01a17583-6272-7095-a1ee-3af684d5c76f","kind":"score.total_changed","summary":"Trust score (41 → 42)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a17583-6272-7095-a1ee-3af684d5c76f"},{"id":"chg_01a16b36-f804-74b6-ac88-2478979f272e","kind":"score.total_changed","summary":"Trust score (40 → 41)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a16b36-f804-74b6-ac88-2478979f272e"},{"id":"chg_01a164c7-7ff6-717b-83d0-3114d9ddc6c7","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a164c7-7ff6-717b-83d0-3114d9ddc6c7"},{"id":"chg_01a164c5-d0ec-796f-8d92-3b5a949715eb","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp#chg-chg_01a164c5-d0ec-796f-8d92-3b5a949715eb"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp","markdown":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp.md","changelogJson":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/deltax-public-deltax-preflight/deltax-preflight-mcp.xml","external":[{"label":"Repository","href":"https://github.com/DeltaX-Public/deltax-preflight"}]}}