# io.github.dgtalquantumleap-ai/vigil-fraud-alert (npm · vigil-fraud-alert-mcp)

Proximity-based card fraud detection with AI risk scoring.

- Trust score: 60/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `vigil-fraud-alert-mcp`: 60/100 (this document), [markdown](https://verifymcp.io/servers/dgtalquantumleap-ai-vigil-fraud-alert/vigil-fraud-alert-mcp.md), [page](https://verifymcp.io/servers/dgtalquantumleap-ai-vigil-fraud-alert/vigil-fraud-alert-mcp)

## Channel facts

- Registry: `npm`
- Package: `vigil-fraud-alert-mcp`
- Version: `1.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 78/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects esbuild 0.20.2, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (149 of 151), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 111 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1987 tokens (~152/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 85% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add dgtalquantumleap-ai-vigil-fraud-alert -- npx -y vigil-fraud-alert-mcp
```

### Codex

```bash
codex mcp add dgtalquantumleap-ai-vigil-fraud-alert -- npx -y vigil-fraud-alert-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dgtalquantumleap-ai-vigil-fraud-alert": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "vigil-fraud-alert-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dgtalquantumleap-ai-vigil-fraud-alert --command npx --arg -y --arg vigil-fraud-alert-mcp
```

### Hermes

```yaml
mcp_servers:
  dgtalquantumleap-ai-vigil-fraud-alert:
    command: "npx"
    args: ["-y", "vigil-fraud-alert-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "dgtalquantumleap-ai-vigil-fraud-alert": {
      "command": "npx",
      "args": [
        "-y",
        "vigil-fraud-alert-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 60, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 56, +42)

- [security regression] GHSA-67mh-4wv8-2f99 affects this package: medium
- [security regression] Known CVEs: unverified → fail
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-01 (score 14, −14)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, +9)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-07-29 (score 19, −18)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 37)

First indexed and scored.

## MCP tools (13)

### `vigil_authorize` (~432 tokens)

Authorize Card Transaction

Core fraud detection entry point. Runs a transaction through Vigil's
proximity engine and returns an approve/decline decision.

Decision priority:
  1\. Inactive card       → CARD_INACTIVE (decline)
  2\. LOCKDOWN mode       → LOCKDOWN (decline)
  3\. TRAVEL + plan match → TRAVEL_MATCH (approve)
  4\. No GPS on file      → NO_GPS_ON_FILE (decline)
  5\. Spoofed/rooted      → SPOOFED_DEVICE (decline)
  6\. GPS 5–15 min old    → GPS_STALE_SOFT (decline)
  7\. GPS >15 min old     → GPS_STALE_HARD (decline)
  8\. Within radius       → IN_RADIUS (approve)
  9\. Outside radius      → OUTSIDE_RADIUS (decline)

Auto-creates a FraudAlert for OUTSIDE_RADIUS, SPOOFED_DEVICE, and LOCKDOWN declines.
Returns transaction_id and optionally alert_id.

Input parameters:

- `amount_cents` (integer, required): Transaction amount in smallest currency unit (e.g. 4250 = $42.50)
- `card_id` (string, required): Vigil internal card ID (e.g. card_01)
- `currency` (string, required): ISO 4217 currency code (e.g. usd, cad, gbp)
- `merchant_city` (string, required): Merchant city
- `merchant_country` (string, required): ISO 3166-1 alpha-2 country code (e.g. CA, US, GB)
- `merchant_lat` (number): Merchant latitude — provide if issuer includes it (skips geocoding)
- `merchant_lng` (number): Merchant longitude — provide if issuer includes it (skips geocoding)
- `merchant_mcc` (string, required): 4-digit Merchant Category Code
- `merchant_name` (string, required): Merchant display name
- `merchant_network_id` (string, required): Merchant network identifier for geocode caching
- `timestamp` (string): ISO 8601 transaction timestamp — defaults to now

### `vigil_get_card` (~52 tokens)

Get Card Details

Get a card's current config: mode, radius, home location, travel plans.
Also returns gps_age_minutes so you can assess GPS freshness before authorizing.

Input parameters:

- `card_id` (string, required): Vigil card ID

### `vigil_update_card_mode` (~83 tokens)

Update Card Mode

Switch card operating mode: home | travel | lockdown.

home     — proximity-based auth against GPS + configured radius
travel   — country-match auth using active travel plans; falls back to proximity
lockdown — all transactions declined, no exceptions, instant effect

Input parameters:

- `card_id` (string, required): Vigil card ID
- `mode` (string, required): New card mode

### `vigil_update_gps` (~173 tokens)

Update GPS Snapshot

Push a fresh GPS snapshot for a card. Called by the mobile app on
significant-change events (>100m move) and every 60s while foregrounded.

GPS freshness is critical to authorization:
  \>5 min old  → GPS_STALE_SOFT decline
  \>15 min old → GPS_STALE_HARD decline

Set is_mock_location=true or is_jailbroken=true to test spoofing detection.

Input parameters:

- `accuracy_meters` (number): GPS accuracy radius in metres
- `card_id` (string, required): Vigil card ID
- `is_jailbroken` (boolean): Jailbroken (iOS) or rooted (Android) device
- `is_mock_location` (boolean): Mock location provider detected on device
- `lat` (number, required): Latitude
- `lng` (number, required): Longitude

### `vigil_add_travel_plan` (~121 tokens)

Add Travel Plan

Add a travel plan to a card. In travel mode, any transaction in a matching
destination_country within [start_date, end_date] is approved without GPS check.

Multiple overlapping plans are supported (e.g. US + MX for a road trip).

Input parameters:

- `card_id` (string, required): Vigil card ID
- `destination_country` (string, required): ISO 3166-1 alpha-2 destination country code
- `end_date` (string, required): Travel end date YYYY-MM-DD
- `start_date` (string, required): Travel start date YYYY-MM-DD

### `vigil_list_transactions` (~96 tokens)

List Transactions

List transaction decisions. Filter by card_id and/or approval outcome.
Returns full records: merchant, amount, reason_code, distance_km, GPS coords, processing_ms.
Ordered most-recent first. Max 100 per call.

Input parameters:

- `approved` (boolean): Filter by approval outcome
- `card_id` (string): Filter by card ID — omit for all cards
- `limit` (integer): Max results (default 20)

### `vigil_list_alerts` (~118 tokens)

List Fraud Alerts

List fraud alerts. Filter by card_id, status, or severity.

Auto-created for OUTSIDE_RADIUS, SPOOFED_DEVICE, and LOCKDOWN declines.
Severity: critical (SPOOFED/LOCKDOWN), high (distance >5000km), medium (distance ≤5000km).
Statuses: open → investigating → resolved | false_positive

Input parameters:

- `card_id` (string): Filter by card ID — omit for all
- `severity` (string): Filter by severity level
- `status` (string): Filter by alert status

### `vigil_update_alert` (~107 tokens)

Update Fraud Alert

Advance a fraud alert through the investigation workflow and append notes.

Typical flow:
  open → investigating  (analyst picks it up)
  investigating → resolved       (confirmed fraud, card actioned)
  investigating → false_positive (user confirmed it was them)

Notes are appended with a timestamp — not replaced.

Input parameters:

- `alert_id` (string, required): Alert ID to update
- `notes` (string): Investigator notes to append (timestamped)
- `status` (string, required): New alert status

### `vigil_get_risk_profile` (~95 tokens)

Get Risk Profile

Get the risk profile for a card. Recalculates live from transaction history.

risk_score 0.0–1.0 weighted:
  40% block rate | 20% false-positive rate | 30% outside-radius count | 10% lockdown usage

anomaly_reason: plain-English explanation set by the async AI analyser (Claude Haiku).

Input parameters:

- `card_id` (string, required): Vigil card ID

### `vigil_confirm_transaction` (~104 tokens)

Confirm Transaction

Record user response to "Was this you?" push notification.

confirmed="yes" — user made this transaction (marks a blocked txn as false positive)
confirmed="no"  — user did NOT make this transaction (escalates alert to investigating)

This data feeds directly into risk score calculation and fraud analytics.

Input parameters:

- `confirmed` (string, required): "yes" = user made this transaction; "no" = fraud
- `transaction_id` (string, required): Transaction ID to confirm

### `vigil_analyze_transaction` (~247 tokens)

AI Transaction Analysis

Run Claude Haiku analysis on a transaction or pending authorization.

Returns:
  risk_score       0–100 integer (100 = certain fraud)
  risk_factors     Array of plain-English factors (location mismatch, late hour, etc.)
  recommended_action  "block" | "confirm" | "allow"
  alert_message    Ready-to-send SMS copy (160 chars, ends with YES=confirm NO=block)
  explanation      1–2 sentence plain-English reasoning

Use this AFTER vigil_authorize to enrich the decision with AI context,
or call it independently before authorizing to pre-score a transaction.
Falls back to rules-based scoring if Anthropic API is unreachable.

Input parameters:

- `amount_cents` (integer)
- `card_id` (string): Card ID — used to attach recent history context
- `currency` (string)
- `merchant_city` (string)
- `merchant_country` (string)
- `merchant_lat` (number)
- `merchant_lng` (number)
- `merchant_mcc` (string)
- `merchant_name` (string)
- `transaction_id` (string): Existing transaction ID — populates all fields automatically

### `vigil_block_transaction` (~205 tokens)

Block Card — Emergency Lockdown

Immediately lock a card (set mode=lockdown) and escalate any open alerts.

Use when:
  \- User confirmed fraud via "Was this you? NO" response
  \- AI analysis returns recommended_action="block"
  \- Analyst manually confirms suspicious activity

What this does:
  1\. Sets card.mode = 'lockdown' (all future transactions declined instantly)
  2\. Escalates all open alerts for this card to status='investigating'
  3\. Returns summary of actions taken

NOTE: Final blocking authority rests with the user or analyst — this tool
executes the block but should only be called after confirmation.
Stripe/Lithic card cancellation must be called separately in production.

Input parameters:

- `card_id` (string, required): Card ID to block
- `reason` (string, required): Plain-English reason for blocking (logged to all open alerts)
- `transaction_id` (string): Transaction ID that triggered the block (optional, for audit trail)

### `vigil_generate_report` (~154 tokens)

Generate AML Compliance Report

Generate a professional AML/fraud compliance report for a card using Claude Sonnet.

Produces a structured report with:
  \- Executive Summary
  \- Incident Timeline (all declined transactions in period)
  \- Risk Assessment with score breakdown
  \- Recommended Actions
  \- Compliance Notes (for bank/regulator submission)

Use for:
  \- Monthly fraud review submission to Stripe/Lithic
  \- AML regulatory filing
  \- Internal fraud review

Returns report_id, summary (200 chars), and full_report (full text).

Input parameters:

- `card_id` (string, required): Card to report on
- `period_end` (string, required): Report end date YYYY-MM-DD
- `period_start` (string, required): Report start date YYYY-MM-DD

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/dgtalquantumleap-ai-vigil-fraud-alert/vigil-fraud-alert-mcp#diagnostics

## Score history

- 2026-08-03: 60
- 2026-08-02: 56
- 2026-08-01: 14
- 2026-07-31: 28
- 2026-07-29: 19
- 2026-07-28: 37
- 2026-07-27: 37

## Links

- npm package: https://www.npmjs.com/package/vigil-fraud-alert-mcp
- Socket report: https://socket.dev/npm/package/vigil-fraud-alert-mcp
- Changelog RSS feed: https://verifymcp.io/servers/dgtalquantumleap-ai-vigil-fraud-alert/vigil-fraud-alert-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/dgtalquantumleap-ai-vigil-fraud-alert/vigil-fraud-alert-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/dgtalquantumleap-ai-vigil-fraud-alert/vigil-fraud-alert-mcp