# io.github.dulzuradev/liveauth-mcp (npm · @liveauth-labs/mcp-server)

MCP server for LiveAuth: PoW + Lightning auth, L402 bundles, and paid MCP tool receipts.

- Trust score: 60/100 (medium)
- Change this week: +14
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@liveauth-labs/mcp-server`: 60/100 (this document), [markdown](https://verifymcp.io/servers/dulzuradev-liveauth-mcp/liveauth-labs-mcp-server.md), [page](https://verifymcp.io/servers/dulzuradev-liveauth-mcp/liveauth-labs-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@liveauth-labs/mcp-server`
- Version: `1.0.8`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 71/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.5.0, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (19 of 20), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 51 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 534 tokens (~76/item across 7 items; 7 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add dulzuradev-liveauth-mcp -- npx -y @liveauth-labs/mcp-server
```

### Codex

```bash
codex mcp add dulzuradev-liveauth-mcp -- npx -y @liveauth-labs/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dulzuradev-liveauth-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@liveauth-labs/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dulzuradev-liveauth-mcp --command npx --arg -y --arg @liveauth-labs/mcp-server
```

### Hermes

```yaml
mcp_servers:
  dulzuradev-liveauth-mcp:
    command: "npx"
    args: ["-y", "@liveauth-labs/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "dulzuradev-liveauth-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@liveauth-labs/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 60, −1)

No change was recorded against any check on this day. Supply Chain Security went from 79 to 71. Other categories moved too: Stability & Change Management rose 4.

### 2026-08-02 (score 61, +18)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Stability: unverified → 0.23

### 2026-07-31 (score 43, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 43, −3)

- [security regression] CVE-2025-66414 affects this package: high
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (7)

### `liveauth_mcp_start` (~75 tokens)

Start a new LiveAuth MCP session. Returns a PoW challenge (default), Lightning invoice, or L402 bundle auth hint.

Input parameters:

- `forceL402` (boolean): If true, request an L402 bundle auth session
- `forceLightning` (boolean): If true, request Lightning invoice instead of PoW challenge

### `liveauth_mcp_status` (~51 tokens)

Check the status of an MCP session. Use to poll for Lightning payment confirmation. Also returns the invoice via lnurl compatibility.

Input parameters:

- `quoteId` (string, required): The quoteId from the start response

### `liveauth_mcp_lnurl` (~51 tokens)

Get the Lightning invoice for a session (lnget-compatible). Use this to retrieve the BOLT11 invoice for payment.

Input parameters:

- `quoteId` (string, required): The quoteId from the start response

### `liveauth_mcp_confirm` (~182 tokens)

Submit the solved proof-of-work challenge (or poll for Lightning payment) to receive a JWT. For Lightning, call with just quoteId to check/poll payment status.

Input parameters:

- `challengeHex` (string): The challenge hex from the start response (PoW only)
- `difficultyBits` (number): Difficulty bits from the challenge (PoW only)
- `expiresAtUnix` (number): Expiration timestamp from the challenge (PoW only)
- `hashHex` (string): The resulting hash hex (PoW only)
- `macaroon` (string): L402 bundle macaroon (L402 only)
- `nonce` (number): The nonce that solves the PoW challenge (PoW only)
- `quoteId` (string, required): The quoteId from the start response
- `signature` (string): Signature from the challenge (PoW only)

### `liveauth_mcp_charge` (~87 tokens)

Meter API usage after making an authenticated call. Call this with the cost in sats for each API request made using the JWT.

Input parameters:

- `callCostSats` (number): Optional cost of the API call in sats. Omit to use LiveAuth project or tool pricing.
- `toolName` (string): Optional registered MCP tool slug or name for per-tool pricing and revenue attribution.

### `liveauth_mcp_usage` (~39 tokens)

Query current usage and remaining budget for the MCP session. Use this to check how many sats and calls have been used without making a charge.

### `liveauth_mcp_refresh` (~49 tokens)

Refresh the JWT token without re-authenticating. Use the refreshToken returned from confirm to get a new JWT.

Input parameters:

- `refreshToken` (string, required): The refreshToken from the confirm response

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/dulzuradev-liveauth-mcp/liveauth-labs-mcp-server#diagnostics

## Score history

- 2026-08-03: 60
- 2026-08-02: 61
- 2026-08-01: 43
- 2026-07-31: 43
- 2026-07-30: 43
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@liveauth-labs/mcp-server
- Socket report: https://socket.dev/npm/package/@liveauth-labs/mcp-server
- Repository: https://github.com/dulzuradev/liveauth-mcp
- Changelog RSS feed: https://verifymcp.io/servers/dulzuradev-liveauth-mcp/liveauth-labs-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/dulzuradev-liveauth-mcp/liveauth-labs-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/dulzuradev-liveauth-mcp/liveauth-labs-mcp-server