{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T08:41:14.865Z","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp","markdownUrl":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp.md","server":{"slug":"dudman1-mercury402-mcp","name":"Mercury402: Treasury/FRED financial data over x402","registryName":"io.github.dudman1/mercury402-mcp","description":"Treasury/FRED financial data over x402: pay-per-call US yields, macro and forex in USDC on Base","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"mercury402-mcp","type":"npm","identifier":"mercury402-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp","version":"0.1.4","transport":"stdio","scoredAt":"2026-11-06T01:17:08.294Z"},"score":{"total":81,"tier":"high trust","status":"scored","weekDelta":3,"history":[{"date":"2026-11-06","total":81},{"date":"2026-11-05","total":81},{"date":"2026-11-04","total":80},{"date":"2026-11-03","total":80},{"date":"2026-11-02","total":79},{"date":"2026-11-01","total":79},{"date":"2026-10-31","total":78},{"date":"2026-10-30","total":78},{"date":"2026-10-29","total":77},{"date":"2026-10-28","total":77},{"date":"2026-10-27","total":76},{"date":"2026-10-26","total":76}]},"categories":[{"name":"Supply Chain Security","score":81,"verdict":"fail","reasons":["No malware found by supply-chain analysis.","CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available.","No install/post-install scripts declared.","31 of 102 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.direct","args":{"package":"zod","version":"3.25.76","severity":"high"}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"102","unhealthy":"31"}}]},{"name":"Provenance & Transparency","score":97,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to dudman1/mercury402).","Clear OSI-approved license (MIT).","Actively maintained (last published 10 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"dudman1/mercury402"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"10"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":79,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 309 tokens (~154/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"154","items":"2","tools":"2","tokens":"309","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":37,"verdict":"partial","reasons":["Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"11"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 2 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"2"}},{"code":"toolsafety.manipulation_clean","args":{"units":"2","judged":"2"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"mcp","type":"remote","identifier":"https://mcp.mercury402.com/mcp","withdrawn":false,"score":70,"current":false,"url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mcp","markdownUrl":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mcp.md"},{"slug":"mercury402-mcp","type":"npm","identifier":"mercury402-mcp","withdrawn":false,"score":81,"current":true,"url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp","markdownUrl":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"mercury402-mcp"},{"label":"Version","value":"0.1.4"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"list_endpoints","title":"List Mercury402 endpoints","description":"List Mercury402 financial data endpoints (78 total) with path, method, category, description, price in USD (paid per call in USDC on Base via x402) and accepted parameters. Free; makes no network calls.","inputs":[{"name":"category","type":"string","required":false,"description":"Only return this category"},{"name":"search","type":"string","required":false,"description":"Case-insensitive substring match on path or description"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":82},{"name":"get_endpoint_data","title":"Call a Mercury402 endpoint","description":"Call a Mercury402 endpoint on the live API. Without paid mode, endpoints return HTTP 402 and this tool returns the price and x402 payment instructions instead of data. With paid mode enabled (MERCURY402_PAYER_PRIVATE_KEY), it pays in USDC on Base (capped by MERCURY402_MAX_PRICE_USD) and returns the data. Use list_endpoints first to find paths and parameters. Path params can be inline (\"/v1/fred/UNRATE\") or passed in params (\"/v1/fred/{series_id}\" + {\"series_id\":\"UNRATE\"}). Other params go to the query string (GET) or JSON body (POST).","inputs":[{"name":"params","type":"object","required":false,"description":"Path, query (GET) or body (POST) parameters"},{"name":"path","type":"string","required":true,"description":"Endpoint path, e.g. \"/v1/treasury/yield-curve/daily-snapshot\" or \"/v1/fred/UNRATE\""},{"name":"pay","type":"boolean","required":false,"description":"Paid mode only: set false to just get the price quote without paying. Default true."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":227}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-06T01:17:08.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[{"id":"GHSA-mrhx-c7xc-m3w5","cve":"CVE-2023-54404","severity":"high","fixAvailable":true}],"vulnerabilitiesTotal":1,"dependencies":{"nodes":102,"partial":false,"deprecated":null,"stale":31,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-26","recent":[{"id":"chg_01a1a949-1a1f-7ccd-a660-675c6e60667c","kind":"score.total_changed","summary":"Trust score (80 → 81)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a1a949-1a1f-7ccd-a660-675c6e60667c"},{"id":"chg_01a19efb-be86-73ac-b7ea-08b923b3004b","kind":"score.total_changed","summary":"Trust score (79 → 80)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a19efb-be86-73ac-b7ea-08b923b3004b"},{"id":"chg_01a194af-3a75-7ec4-80fb-853f577e3de7","kind":"score.total_changed","summary":"Trust score (78 → 79)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a194af-3a75-7ec4-80fb-853f577e3de7"},{"id":"chg_01a18a62-dff0-784c-a4b6-2131a2f90e96","kind":"score.total_changed","summary":"Trust score (77 → 78)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a18a62-dff0-784c-a4b6-2131a2f90e96"},{"id":"chg_01a18016-f322-7282-aa97-6a2c72280fff","kind":"score.total_changed","summary":"Trust score (76 → 77)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a18016-f322-7282-aa97-6a2c72280fff"},{"id":"chg_01a17688-d079-71c9-9fec-4663b2381531","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a17688-d079-71c9-9fec-4663b2381531"},{"id":"chg_01a17670-5906-7d26-8dec-785f13715fcd","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp#chg-chg_01a17670-5906-7d26-8dec-785f13715fcd"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp","markdown":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp.md","changelogJson":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/dudman1-mercury402-mcp/mercury402-mcp.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/mercury402-mcp"},{"label":"Socket report","href":"https://socket.dev/npm/package/mercury402-mcp"},{"label":"Repository","href":"https://github.com/dudman1/mercury402"},{"label":"Website","href":"https://mercury402.com/"}]}}