Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.g-digital-by-Garrigues/ead-factory

NPM · @G-DIGITAL/MCP-EAD-FACTORY · SCANNED AUG 3

MCP server for EAD Factory: qualified evidence, signature, notifications and chat via AI agents.

+42 this week 66 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (110 of 114), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (110 of 114), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale. View diagnostics → Unverified
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 11 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 8966 tokens (~140/item across 64 items; 64 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 34% of tool parameters carry a description.Partial
  • Structured output schemas are declared (59% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @g-digital/mcp-ead-factory

# add to Claude Code
claude mcp add g-digital-by-garrigues-ead-factory -- npx -y @g-digital/mcp-ead-factory
# add to Codex CLI
codex mcp add g-digital-by-garrigues-ead-factory -- npx -y @g-digital/mcp-ead-factory
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "g-digital-by-garrigues-ead-factory": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@g-digital/mcp-ead-factory"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add g-digital-by-garrigues-ead-factory --command npx --arg -y --arg @g-digital/mcp-ead-factory
# ~/.hermes/config.yaml
mcp_servers:
  g-digital-by-garrigues-ead-factory:
    command: "npx"
    args: ["-y", "@g-digital/mcp-ead-factory"]
// mcp.json
{
  "mcpServers": {
    "g-digital-by-garrigues-ead-factory": {
      "command": "npx",
      "args": [
        "-y",
        "@g-digital/mcp-ead-factory"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Aug 26 +27
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Provenance: Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale. security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Capabilities: pass → unverified functional
    • Schema quality: unverified → good functional
    • Maintenance: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Stability: unverified → 0.23 functional
    • License: unverified → pass functional
    • Licence: MIT functional
  • 1 Aug 26 +14
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 −18
    • Malware scan: pass → unverified security
  • 28 Jul 26 +18
    • Security disclosure: unverified → fail functional
    • Tool coverage: unverified → 100 functional
    • First check of Tool coverage: 59 functional
    • First check of Schema quality: fail functional
    • First check of Tool coverage: 34 functional
    • First check of Schema quality: fail functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 24

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@g-digital/[email protected]

Provenance metadata_mismatch

Ecosystem: npm · Outcome: metadata_mismatch

Reason: repo_metadata_mismatch

Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/g-digital-by-Garrigues/MCP_Market_Distribution/.github/workflows/publish.yml@refs/heads/main
Rekor log index:
2218378456
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:ff74864af33ec286763d5a6cbeaf82980e7765ec7751b70126762487e8c2c0a5b8bcce051249e22c836ac00db1d305eafecd3b950bab8dc1a4577ea6c
Discovery method:
attestation_endpoint
Dependencies 110 packages

110 packages in the resolved dependency tree · 110 deprecated · 33 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 64 exposed · ~8,966 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
get_signature_request ~67

Retrieves a signature request's details and status by id (legacy top-level name). Use to check signing progress after activation. Requires: create_signature_request → signatureRequestId.

NameTypeReqDescription
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
cancellationReasonstring
closeConfigobject
createdAtstring
createdBystring
descriptionstring
documentsarray
idstring
languagestring
namestring
notificationsboolean
providerstring
senderAddressstring
senderNamestring
signatureRequestBodyarray
statusstring
statusHistoryarray
uniqueValidatorboolean
webhookUrisarray

No examples provided.

notification_certificate_generate ~160

Generates a delivery-certificate report for one or more notifications on a request. Use once notification_request_status shows the relevant notifications have left their in-flight state. Requires: notification_request_create → requestId, notification_request_status → notificationIds. Returns a reportId — call notification_certificate_pdf_url_get with it to get the actual download URL (2-step, same shape as Evidence's report tools).

NameTypeReqDescription
additionalData
embedAttachmentsEnabledboolean
languageCodestringyes
notificationIdsarrayyes
reportIdstringMANDATORY. UUID of the report.
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
templatestringyes
NameTypeReqDescription
additionalData
languageCodestringyes
notificationIdsarrayyes
reportIdstring
requestIdstring
templatestringyes

No examples provided.

notification_certificate_pdf_url_get ~48

Retrieves the download URL for a previously generated notification delivery certificate. Requires: notification_certificate_generate → reportId.

NameTypeReqDescription
reportIdstringyesMANDATORY. UUID of the report.
NameTypeReqDescription
datayes

No examples provided.

notification_document_add ~104

Registers one or more document attachments (metadata only — fileName + SHA-256 hash) on a draft notification request. Use once per batch of documents before activating. Requires: notification_request_create → requestId. This only registers metadata; call notification_document_upload_url_create for each registered attachment to get a URL to PUT the actual file bytes to.

NameTypeReqDescription
attachmentsarrayyes
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
notificationIdsarray
requestIdstring
uploadLinksarray

No examples provided.

notification_document_download_url_create ~83

Creates a presigned download URL for a document attachment on a notification request. Requires: notification_request_create → requestId, notification_document_add → attachmentId.

NameTypeReqDescription
attachmentIdstringyesMANDATORY. UUID of the attachment. Obtain from notification_document_add.
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.

No output schema declared.

No examples provided.

notification_document_upload_url_create ~102

Creates a presigned upload URL for a document attachment already registered via notification_document_add — PUT the file bytes to the returned URL. Requires: notification_request_create → requestId, notification_document_add → attachmentId.

NameTypeReqDescription
attachmentIdstringyesMANDATORY. UUID of the attachment. Obtain from notification_document_add.
fileSizeinteger
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
expirationstring
urlstring

No examples provided.

notification_receiver_add ~266

Adds one or more receivers to a draft notification request — each receiver becomes its own per-channel notification under the shared requestId (there is no separate receiverId; track receivers by the notificationIds this call returns). Use once per batch of receivers before calling notification_request_send. Requires: notification_request_create → requestId. Each receiver's shape depends on its `provider` (SMTP/SMS/NOTICEMAN/WFB) — see the schema for the fields each variant needs. Notification delivery provider: SMTP = Email delivery. | SMS = SMS text message delivery. | NOTICEMAN = EAD Factory's own certified notification channel (qualified electronic delivery). | NOTICEMAN_AND_WHATSAPP = Certified channel plus a WhatsApp copy. | NOTICEMAN_AND_WHATSAPP_AND_RCS = Certified channel plus WhatsApp and RCS copies. | NOTICEMAN_AND_RCS = Certified channel plus an RCS (Rich Communication Services) copy. | WFB = WhatsApp Business messaging, uncertified (no Noticeman qualified channel). | RCS = RCS (Rich Communication Services) messaging only, uncertified.

NameTypeReqDescription
receiversarrayyes
requestIdstringyesUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
notificationIdsarray
requestIdstring

No examples provided.

notification_request_create ~160

Creates a new notification request (draft) — the top-level container for receivers and attachments in a certified-notification flow. Use this first, before any other Notification-manager tool. No prerequisites. Set `autosend: true` to also send immediately on activation of the first receiver batch, or leave it false to add receivers/documents over several calls before calling notification_request_send yourself. Returns requestId and one notificationId per receiver already on the request (if any were included inline).

NameTypeReqDescription
autosendboolean
contentstring
dataobject
languagestringyes
metadataobject
requestIdstringUUID of the notification request. Obtain from notification_request_create.
NameTypeReqDescription
notificationIdsarray
requestIdstring
uploadLinksarray

No examples provided.

notification_request_send ~196

Activates a notification request, triggering delivery to every added receiver across their configured channels (email/SMS/Noticeman/WhatsApp/RCS). Runs as an MCP Task (bounded-polling until every receiver's notification leaves its in-flight state — EAD Factory's upstream emits no events for this transition). Requires: notification_request_create -> requestId, at least one receiver added via notification_receiver_add. On completion, returns each notification's id and final delivery state (per-receiver failures are reported in the result, not treated as a Task failure). REQUIRES an MCP client with Tasks support — from a client without it this call fails; in that case create the request with autosend: true (notification_request_create) and poll notification_request_status yourself. Use notification_request_status to check progress without waiting.

NameTypeReqDescription
requestIdstringyesMANDATORY. UUID of the notification request. Obtain from notification_request_create.

No output schema declared.

No examples provided.

notification_request_status ~135

Searches notifications, optionally filtered by requestId and/or delivery state — the closest equivalent to "checking a request's status": a request fans out into one notification per receiver, each with its own state history, so this returns every notification matching the filter with its current state. Omit requestId to search across every request. Requires: notification_request_create → requestId (if filtering to one request).

NameTypeReqDescription
filters
ids
page
requestIdUUID of the notification request. Obtain from notification_request_create.
size
sort
states
NameTypeReqDescription
datayes

No examples provided.

signature_certificate_generate ~99

Generates the well-signed appearance certificate document for a signature request. Use once every signatory has signed (check with get_signature_request). Requires: create_signature_request → signatureRequestId. Unlike EAD Enterprise's equivalent tool (a GET that polls an already-generated URL), this triggers generation and returns the result in the same call.

NameTypeReqDescription
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
dataobjectyes

No examples provided.

signature_coordinate_set ~167

Sets the on-page (x, y, page) coordinates where a signatory's signature appears on a document. Use after add_signatory_to_document if the signature placement needs to be explicit rather than auto-positioned. Requires: create_signature_request → signatureRequestId, add_document_to_signature_request → documentId, add_signatory_to_document → signatoryId.

NameTypeReqDescription
coordinatesarray
documentIdstringyesMANDATORY. UUID of the document within the signature request. Obtain from add_document_to_signature_request.
signatoryIdstringyesMANDATORY. UUID of the signatory. Obtain from add_signatory_to_document.
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.

No output schema declared.

No examples provided.

signature_document_download_url_get ~147

Retrieves the download link for the FINAL, well-signed version of a document — the actual signed file, once every signatory has signed. Requires: create_signature_request → signatureRequestId, add_document_to_signature_request → documentId. Use get_signature_request first to confirm signing is complete before calling this. Not to be confused with signature_certificate_generate, which produces a separate appearance certificate document, not the signed document itself.

NameTypeReqDescription
documentIdstringyesMANDATORY. UUID of the document within the signature request. Obtain from add_document_to_signature_request.
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
expirationstring
urlstring

No examples provided.

signature_request_cancel ~74

Cancels an active signature request — no further signing can occur. Use when a request was activated in error or is no longer needed. Requires: create_signature_request → signatureRequestId. Cannot be undone.

NameTypeReqDescription
signatureRequestIdstringyesMANDATORY. UUID of the signature request. Obtain from create_signature_request.
NameTypeReqDescription
idstring
statusstring

No examples provided.

signature_request_full ~259

Creates a signature request, adds one or more documents (each with its own signatories), and activates it — the full flagship signature flow in one call instead of create_signature_request + N x (add_document_to_signature_request + add_signatory_to_document) + activate_signature_request. Each document's file uses the shared FileInput contract (local path, base64, https URL, or n8n binary item) — never a bespoke file field. Set `activate: false` to leave the request in draft so you can add validators/observers (add_validator_to_signatory, add_observer_to_document) before activating it yourself. On success returns the request id, each document's id, and each signatory's id. Use the atomic tools instead when you need to inspect or react to each intermediate step, or need validators/observers before activation.

NameTypeReqDescription
activatebooleanActivate the request immediately after adding all documents/signatories.
createdBystringyesMANDATORY. Identifier of the requester.
descriptionstring
documentsarrayyesOne or more documents, each with its own signatories, added to the request.
namestringyesMANDATORY. Signature request name.

No output schema declared.

No examples provided.

signature_request_list ~187

List signature requests, optionally filtered by close condition among other criteria. Use to find a request when you don't have its id (e.g. by name or status). Signature-request close condition: ALL_REQUIRED = The request only closes once EVERY signatory has signed. | PARTIAL_ALLOWED = The request can close once the minimum required signatories have signed, even if others haven't yet.

NameTypeReqDescription
cancellationReasons
closeAtFrom
closeAtTo
closeCondition
creators
dateFrom
dateTo
emailObservers
emailSignatories
hashes
ids
names
page
providers
signatureTypes
size
sort
statuses
NameTypeReqDescription
_metadataobject
recordsarray

No examples provided.