Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.g-digital-by-Garrigues/ead-factory

NPM · @G-DIGITAL/MCP-EAD-FACTORY · SCANNED SEP 21

MCP server for EAD Factory: qualified evidence, signature, notifications and chat via AI agents.

0 this week 81 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 37 of 111 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale. View diagnostics → Unverified
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 11 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 9085 tokens (~141/item across 64 items; 64 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 34% of tool parameters carry a description.Partial
  • Structured output schemas are declared (59% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 64 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.g-digital-by-Garrigues/ead-factory MCP server?

io.github.g-digital-by-Garrigues/ead-factory runs locally as an npm package, launched with npx -y @g-digital/mcp-ead-factory. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @g-digital/mcp-ead-factory

# add to Claude Code
claude mcp add g-digital-by-garrigues-ead-factory -- npx -y @g-digital/mcp-ead-factory
// .cursor/mcp.json
{
  "mcpServers": {
    "g-digital-by-garrigues-ead-factory": {
      "command": "npx",
      "args": [
        "-y",
        "@g-digital/mcp-ead-factory"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "g-digital-by-garrigues-ead-factory": {
      "command": "npx",
      "args": [
        "-y",
        "@g-digital/mcp-ead-factory"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add g-digital-by-garrigues-ead-factory -- npx -y @g-digital/mcp-ead-factory
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "g-digital-by-garrigues-ead-factory": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@g-digital/mcp-ead-factory"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add g-digital-by-garrigues-ead-factory --command npx --arg -y --arg @g-digital/mcp-ead-factory
# ~/.hermes/config.yaml
mcp_servers:
  g-digital-by-garrigues-ead-factory:
    command: "npx"
    args: ["-y", "@g-digital/mcp-ead-factory"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "g-digital-by-garrigues-ead-factory": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@g-digital/mcp-ead-factory"
      ]
    }
  }
}
# add to Vellum
assistant mcp add g-digital-by-garrigues-ead-factory -t stdio -c npx -a -y @g-digital/mcp-ead-factory
// mcp.json
{
  "mcpServers": {
    "g-digital-by-garrigues-ead-factory": {
      "command": "npx",
      "args": [
        "-y",
        "@g-digital/mcp-ead-factory"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 21 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1
    • Security disclosure: unverified → fail functional
  • 16 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 15 Sept 26 −3
    • Stability: pass → 0.77 functional
    • Package version: 1.3.1 → 1.4.0 functional
  • 14 Sept 26 0
    • Stability: 0.97 → pass security
  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 0
    • Security disclosure: unverified → fail functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Analysed npm/@g-digital/mcp-ead-factory@1.4.0

Provenance Repository mismatch

The attestation is cryptographically sound but binds a different repository to the one the registry declares. Most often the declared URL is simply stale.

Result Repository mismatch
Ecosystem npm
Reason Repository mismatch
Discovered via Registry attestation endpoint
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/g-digital-by-Garrigues/MCP_Market_Distribution/.github/workflows/publish.yml@refs/heads/main
Rekor log index 2767634841
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:e8f40698d311106b3dc0ab27c3a007161788a7b9758063230a28bdd408580966d534612c99cf4af2339f5c6a638a7044ffc16b1a321968c037407b3b4

Background: How many MCP packages publish verified provenance →

Dependencies 111 packages
Packages resolved 111
Deprecated 1
Stale 36
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 64 exposed · ~9,085 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_signature_request ~67

Retrieves a signature request's details and status by id (legacy top-level name). Use to check signing progress after activation. Requires: create_signature_request → signatureRequestId.

NameTypeReqDescription
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
cancellationReasonstring
closeConfigobject
createdAtstring
createdBystring
descriptionstring
documentsarray
idstring
languagestring
namestring
notificationsboolean
providerstring
senderAddressstring
senderNamestring
signatureRequestBodyarray
statusstring
statusHistoryarray
uniqueValidatorboolean
webhookUrisarray

No examples provided.

notification_certificate_generate ~160

Generates a delivery-certificate report for one or more notifications on a request. Use once notification_request_status shows the relevant notifications have left their in-flight state. Requires: notification_request_create → requestId, notification_request_status → notificationIds. Returns a reportId — call notification_certificate_pdf_url_get with it to get the actual download URL (2-step, same shape as Evidence's report tools).

NameTypeReqDescription
additionalData
embedAttachmentsEnabledboolean
languageCodestringyes
notificationIdsarrayyes
reportIdstringMANDATORY. UUID of the report.
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
templatestringyes
NameTypeReqDescription
additionalData
languageCodestringyes
notificationIdsarrayyes
reportIdstring
requestIdstring
templatestringyes

No examples provided.

notification_certificate_pdf_url_get ~48

Retrieves the download URL for a previously generated notification delivery certificate. Requires: notification_certificate_generate → reportId.

NameTypeReqDescription
reportIdstringyesMANDATORY. UUID of the report.
NameTypeReqDescription
datayes

No examples provided.

notification_document_add ~104

Registers one or more document attachments (metadata only — fileName + SHA-256 hash) on a draft notification request. Use once per batch of documents before activating. Requires: notification_request_create → requestId. This only registers metadata; call notification_document_upload_url_create for each registered attachment to get a URL to PUT the actual file bytes to.

NameTypeReqDescription
attachmentsarrayyes
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
notificationIdsarray
requestIdstring
uploadLinksarray

No examples provided.

notification_document_download_url_create ~83

Creates a presigned download URL for a document attachment on a notification request. Requires: notification_request_create → requestId, notification_document_add → attachmentId.

NameTypeReqDescription
attachmentIdstringyesMANDATORY. UUID of the attachment. Obtain from notification_document_add.
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.

No output schema declared.

No examples provided.

notification_document_upload_url_create ~102

Creates a presigned upload URL for a document attachment already registered via notification_document_add — PUT the file bytes to the returned URL. Requires: notification_request_create → requestId, notification_document_add → attachmentId.

NameTypeReqDescription
attachmentIdstringyesMANDATORY. UUID of the attachment. Obtain from notification_document_add.
fileSizeinteger
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
expirationstring
urlstring

No examples provided.

notification_receiver_add ~266

Adds one or more receivers to a draft notification request — each receiver becomes its own per-channel notification under the shared requestId (there is no separate receiverId; track receivers by the notificationIds this call returns). Use once per batch of receivers before calling notification_request_send. Requires: notification_request_create → requestId. Each receiver's shape depends on its `provider` (SMTP/SMS/NOTICEMAN/WFB) — see the schema for the fields each variant needs. Notification delivery provider: SMTP = Email delivery. | SMS = SMS text message delivery. | NOTICEMAN = EAD Factory's own certified notification channel (qualified electronic delivery). | NOTICEMAN_AND_WHATSAPP = Certified channel plus a WhatsApp copy. | NOTICEMAN_AND_WHATSAPP_AND_RCS = Certified channel plus WhatsApp and RCS copies. | NOTICEMAN_AND_RCS = Certified channel plus an RCS (Rich Communication Services) copy. | WFB = WhatsApp Business messaging, uncertified (no Noticeman qualified channel). | RCS = RCS (Rich Communication Services) messaging only, uncertified.

NameTypeReqDescription
receiversarrayyes
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
notificationIdsarray
requestIdstring

No examples provided.

notification_request_create ~199

Creates a new notification request (draft) — the top-level container for receivers and attachments in a certified-notification flow. Use this first, before any other Notification-manager tool. No prerequisites. Set `autosend: true` to also send immediately on activation of the first receiver batch, or leave it false to add receivers/documents over several calls before calling notification_request_send yourself. Returns requestId and one notificationId per receiver already on the request (if any were included inline).

NameTypeReqDescription
autosendboolean
contentstring
dataobject
languagestringyes
metadataobject
requestIdstringOPTIONAL. Supply a UUID here only if you want to choose the new request's id yourself; omit it and the API assigns one. Either way this call RETURNS the requestId that every other Notification tool t…
NameTypeReqDescription
notificationIdsarray
requestIdstring
uploadLinksarray

No examples provided.

notification_request_send ~196

Activates a notification request, triggering delivery to every added receiver across their configured channels (email/SMS/Noticeman/WhatsApp/RCS). Runs as an MCP Task (bounded-polling until every receiver's notification leaves its in-flight state — EAD Factory's upstream emits no events for this transition). Requires: notification_request_create -> requestId, at least one receiver added via notification_receiver_add. On completion, returns each notification's id and final delivery state (per-receiver failures are reported in the result, not treated as a Task failure). REQUIRES an MCP client with Tasks support — from a client without it this call fails; in that case create the request with autosend: true (notification_request_create) and poll notification_request_status yourself. Use notification_request_status to check progress without waiting.

NameTypeReqDescription
requestIdstringyesMANDATORY. UUID of the notification request. Obtain from notification_request_create.

No output schema declared.

No examples provided.

notification_request_status ~135

Searches notifications, optionally filtered by requestId and/or delivery state — the closest equivalent to "checking a request's status": a request fans out into one notification per receiver, each with its own state history, so this returns every notification matching the filter with its current state. Omit requestId to search across every request. Requires: notification_request_create → requestId (if filtering to one request).

NameTypeReqDescription
filters
ids
page
requestIdUUID of the notification request. Obtain from notification_request_create.
size
sort
states
NameTypeReqDescription
datayes

No examples provided.

signature_certificate_generate ~99

Generates the well-signed appearance certificate document for a signature request. Use once every signatory has signed (check with get_signature_request). Requires: create_signature_request → signatureRequestId. Unlike EAD Enterprise's equivalent tool (a GET that polls an already-generated URL), this triggers generation and returns the result in the same call.

NameTypeReqDescription
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
dataobjectyes

No examples provided.

signature_coordinate_set ~167

Sets the on-page (x, y, page) coordinates where a signatory's signature appears on a document. Use after add_signatory_to_document if the signature placement needs to be explicit rather than auto-positioned. Requires: create_signature_request → signatureRequestId, add_document_to_signature_request → documentId, add_signatory_to_document → signatoryId.

NameTypeReqDescription
coordinatesarray
documentIdstringyesMANDATORY. UUID of the document within the signature request. Obtain from add_document_to_signature_request.
signatoryIdstringyesMANDATORY. UUID of the signatory. Obtain from add_signatory_to_document.
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.

No output schema declared.

No examples provided.

signature_document_download_url_get ~147

Retrieves the download link for the FINAL, well-signed version of a document — the actual signed file, once every signatory has signed. Requires: create_signature_request → signatureRequestId, add_document_to_signature_request → documentId. Use get_signature_request first to confirm signing is complete before calling this. Not to be confused with signature_certificate_generate, which produces a separate appearance certificate document, not the signed document itself.

NameTypeReqDescription
documentIdstringyesMANDATORY. UUID of the document within the signature request. Obtain from add_document_to_signature_request.
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
expirationstring
urlstring

No examples provided.

signature_request_cancel ~74

Cancels an active signature request — no further signing can occur. Use when a request was activated in error or is no longer needed. Requires: create_signature_request → signatureRequestId. Cannot be undone.

NameTypeReqDescription
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
idstring
statusstring

No examples provided.

signature_request_full ~259

Creates a signature request, adds one or more documents (each with its own signatories), and activates it — the full flagship signature flow in one call instead of create_signature_request + N x (add_document_to_signature_request + add_signatory_to_document) + activate_signature_request. Each document's file uses the shared FileInput contract (local path, base64, https URL, or n8n binary item) — never a bespoke file field. Set `activate: false` to leave the request in draft so you can add validators/observers (add_validator_to_signatory, add_observer_to_document) before activating it yourself. On success returns the request id, each document's id, and each signatory's id. Use the atomic tools instead when you need to inspect or react to each intermediate step, or need validators/observers before activation.

NameTypeReqDescription
activatebooleanActivate the request immediately after adding all documents/signatories.
createdBystringyesMANDATORY. Identifier of the requester.
descriptionstring
documentsarrayyesOne or more documents, each with its own signatories, added to the request.
namestringyesMANDATORY. Signature request name.

No output schema declared.

No examples provided.

signature_request_list ~187

List signature requests, optionally filtered by close condition among other criteria. Use to find a request when you don't have its id (e.g. by name or status). Signature-request close condition: ALL_REQUIRED = The request only closes once EVERY signatory has signed. | PARTIAL_ALLOWED = The request can close once the minimum required signatories have signed, even if others haven't yet.

NameTypeReqDescription
cancellationReasons
closeAtFrom
closeAtTo
closeCondition
creators
dateFrom
dateTo
emailObservers
emailSignatories
hashes
ids
names
page
providers
signatureTypes
size
sort
statuses
NameTypeReqDescription
_metadataobject
recordsarray

No examples provided.

Common questions

What is the io.github.g-digital-by-Garrigues/ead-factory MCP server?

io.github.g-digital-by-Garrigues/ead-factory is an MCP server listed in the public MCP registry as io.github.g-digital-by-Garrigues/ead-factory. MCP server for EAD Factory: qualified evidence, signature, notifications and chat via AI agents. This page covers its npm package (@g-digital/mcp-ead-factory).

Is the io.github.g-digital-by-Garrigues/ead-factory MCP server safe to use?

io.github.g-digital-by-Garrigues/ead-factory scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.g-digital-by-Garrigues/ead-factory MCP server expose?

io.github.g-digital-by-Garrigues/ead-factory exposes 64 tools: evidence_case_file_delete_bulk, evidence_case_file_search, evidence_case_file_create, evidence_case_file_update_bulk, evidence_case_file_get, and 59 more. Their descriptions and schemas cost roughly 9,085 tokens of context every time the server is loaded.

Is the io.github.g-digital-by-Garrigues/ead-factory MCP server still maintained?

io.github.g-digital-by-Garrigues/ead-factory is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.g-digital-by-Garrigues/ead-factory MCP server under?

io.github.g-digital-by-Garrigues/ead-factory declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.