io.github.g-digital-by-Garrigues/ead-factory
NPM · @G-DIGITAL/MCP-EAD-FACTORY · SCANNED AUG 3
MCP server for EAD Factory: qualified evidence, signature, notifications and chat via AI agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (110 of 114), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (110 of 114), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale. View diagnostics → Unverified
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 11 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 8966 tokens (~140/item across 64 items; 64 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 34% of tool parameters carry a description.Partial
- Structured output schemas are declared (59% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @g-digital/mcp-ead-factory
claude mcp add g-digital-by-garrigues-ead-factory -- npx -y @g-digital/mcp-ead-factory
codex mcp add g-digital-by-garrigues-ead-factory -- npx -y @g-digital/mcp-ead-factory
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"g-digital-by-garrigues-ead-factory": {
"type": "local",
"command": [
"npx",
"-y",
"@g-digital/mcp-ead-factory"
],
"enabled": true
}
}
} openclaw mcp add g-digital-by-garrigues-ead-factory --command npx --arg -y --arg @g-digital/mcp-ead-factory
mcp_servers:
g-digital-by-garrigues-ead-factory:
command: "npx"
args: ["-y", "@g-digital/mcp-ead-factory"] {
"mcpServers": {
"g-digital-by-garrigues-ead-factory": {
"command": "npx",
"args": [
"-y",
"@g-digital/mcp-ead-factory"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +27
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Provenance: Build provenance is cryptographically sound, but it attests a different repository to the one declared in the registry. Most often the declared URL is simply stale. security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Schema quality: unverified → good ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +14
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 28 Jul 26 +18
- Security disclosure: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Tool coverage: 59 functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 34 functional
- First check of Schema quality: fail functional
- First check of Schema quality: unverified functional
- 27 Jul 26 24
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@g-digital/[email protected]
Provenance metadata_mismatch
Ecosystem: npm · Outcome: metadata_mismatch
Reason: repo_metadata_mismatch
- Certificate issuer:
- https://token.actions.githubusercontent.com
- Certificate SAN:
- https://github.com/g-digital-by-Garrigues/MCP_Market_Distribution/.github/workflows/publish.yml@refs/heads/main
- Rekor log index:
- 2218378456
- Predicate type:
- https://slsa.dev/provenance/v1
- Subject digest:
- sha512:ff74864af33ec286763d5a6cbeaf82980e7765ec7751b70126762487e8c2c0a5b8bcce051249e22c836ac00db1d305eafecd3b950bab8dc1a4577ea6c
- Discovery method:
- attestation_endpoint
Dependencies 110 packages
110 packages in the resolved dependency tree · 110 deprecated · 33 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
get_signature_request ~67
Retrieves a signature request's details and status by id (legacy top-level name). Use to check signing progress after activation. Requires: create_signature_request → signatureRequestId.
| Name | Type | Req | Description |
|---|---|---|---|
| signatureRequestId | string | yes | MANDATORY. UUID of the signature request. Obtain from create_signature_request. |
| Name | Type | Req | Description |
|---|---|---|---|
| cancellationReason | string | — | — |
| closeConfig | object | — | — |
| createdAt | string | — | — |
| createdBy | string | — | — |
| description | string | — | — |
| documents | array | — | — |
| id | string | — | — |
| language | string | — | — |
| name | string | — | — |
| notifications | boolean | — | — |
| provider | string | — | — |
| senderAddress | string | — | — |
| senderName | string | — | — |
| signatureRequestBody | array | — | — |
| status | string | — | — |
| statusHistory | array | — | — |
| uniqueValidator | boolean | — | — |
| webhookUris | array | — | — |
No examples provided.
notification_certificate_generate ~160
Generates a delivery-certificate report for one or more notifications on a request. Use once notification_request_status shows the relevant notifications have left their in-flight state. Requires: notification_request_create → requestId, notification_request_status → notificationIds. Returns a reportId — call notification_certificate_pdf_url_get with it to get the actual download URL (2-step, same shape as Evidence's report tools).
| Name | Type | Req | Description |
|---|---|---|---|
| additionalData | — | — | — |
| embedAttachmentsEnabled | boolean | — | — |
| languageCode | string | yes | — |
| notificationIds | array | yes | — |
| reportId | string | — | MANDATORY. UUID of the report. |
| requestId | string | yes | UUID of the notification request. Obtain from notification_request_create. |
| template | string | yes | — |
| Name | Type | Req | Description |
|---|---|---|---|
| additionalData | — | — | — |
| languageCode | string | yes | — |
| notificationIds | array | yes | — |
| reportId | string | — | — |
| requestId | string | — | — |
| template | string | yes | — |
No examples provided.
notification_certificate_pdf_url_get ~48
Retrieves the download URL for a previously generated notification delivery certificate. Requires: notification_certificate_generate → reportId.
| Name | Type | Req | Description |
|---|---|---|---|
| reportId | string | yes | MANDATORY. UUID of the report. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | — | yes | — |
No examples provided.
notification_document_add ~104
Registers one or more document attachments (metadata only — fileName + SHA-256 hash) on a draft notification request. Use once per batch of documents before activating. Requires: notification_request_create → requestId. This only registers metadata; call notification_document_upload_url_create for each registered attachment to get a URL to PUT the actual file bytes to.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | yes | — |
| requestId | string | yes | UUID of the notification request. Obtain from notification_request_create. |
| Name | Type | Req | Description |
|---|---|---|---|
| notificationIds | array | — | — |
| requestId | string | — | — |
| uploadLinks | array | — | — |
No examples provided.
notification_document_download_url_create ~83
Creates a presigned download URL for a document attachment on a notification request. Requires: notification_request_create → requestId, notification_document_add → attachmentId.
| Name | Type | Req | Description |
|---|---|---|---|
| attachmentId | string | yes | MANDATORY. UUID of the attachment. Obtain from notification_document_add. |
| requestId | string | yes | UUID of the notification request. Obtain from notification_request_create. |
No output schema declared.
No examples provided.
notification_document_upload_url_create ~102
Creates a presigned upload URL for a document attachment already registered via notification_document_add — PUT the file bytes to the returned URL. Requires: notification_request_create → requestId, notification_document_add → attachmentId.
| Name | Type | Req | Description |
|---|---|---|---|
| attachmentId | string | yes | MANDATORY. UUID of the attachment. Obtain from notification_document_add. |
| fileSize | integer | — | — |
| requestId | string | yes | UUID of the notification request. Obtain from notification_request_create. |
| Name | Type | Req | Description |
|---|---|---|---|
| expiration | string | — | — |
| url | string | — | — |
No examples provided.
notification_receiver_add ~266
Adds one or more receivers to a draft notification request — each receiver becomes its own per-channel notification under the shared requestId (there is no separate receiverId; track receivers by the notificationIds this call returns). Use once per batch of receivers before calling notification_request_send. Requires: notification_request_create → requestId. Each receiver's shape depends on its `provider` (SMTP/SMS/NOTICEMAN/WFB) — see the schema for the fields each variant needs. Notification delivery provider: SMTP = Email delivery. | SMS = SMS text message delivery. | NOTICEMAN = EAD Factory's own certified notification channel (qualified electronic delivery). | NOTICEMAN_AND_WHATSAPP = Certified channel plus a WhatsApp copy. | NOTICEMAN_AND_WHATSAPP_AND_RCS = Certified channel plus WhatsApp and RCS copies. | NOTICEMAN_AND_RCS = Certified channel plus an RCS (Rich Communication Services) copy. | WFB = WhatsApp Business messaging, uncertified (no Noticeman qualified channel). | RCS = RCS (Rich Communication Services) messaging only, uncertified.
| Name | Type | Req | Description |
|---|---|---|---|
| receivers | array | yes | — |
| requestId | string | yes | UUID of the notification request. Obtain from notification_request_create. |
| Name | Type | Req | Description |
|---|---|---|---|
| notificationIds | array | — | — |
| requestId | string | — | — |
No examples provided.
notification_request_create ~160
Creates a new notification request (draft) — the top-level container for receivers and attachments in a certified-notification flow. Use this first, before any other Notification-manager tool. No prerequisites. Set `autosend: true` to also send immediately on activation of the first receiver batch, or leave it false to add receivers/documents over several calls before calling notification_request_send yourself. Returns requestId and one notificationId per receiver already on the request (if any were included inline).
| Name | Type | Req | Description |
|---|---|---|---|
| autosend | boolean | — | — |
| content | string | — | — |
| data | object | — | — |
| language | string | yes | — |
| metadata | object | — | — |
| requestId | string | — | UUID of the notification request. Obtain from notification_request_create. |
| Name | Type | Req | Description |
|---|---|---|---|
| notificationIds | array | — | — |
| requestId | string | — | — |
| uploadLinks | array | — | — |
No examples provided.
notification_request_send ~196
Activates a notification request, triggering delivery to every added receiver across their configured channels (email/SMS/Noticeman/WhatsApp/RCS). Runs as an MCP Task (bounded-polling until every receiver's notification leaves its in-flight state — EAD Factory's upstream emits no events for this transition). Requires: notification_request_create -> requestId, at least one receiver added via notification_receiver_add. On completion, returns each notification's id and final delivery state (per-receiver failures are reported in the result, not treated as a Task failure). REQUIRES an MCP client with Tasks support — from a client without it this call fails; in that case create the request with autosend: true (notification_request_create) and poll notification_request_status yourself. Use notification_request_status to check progress without waiting.
| Name | Type | Req | Description |
|---|---|---|---|
| requestId | string | yes | MANDATORY. UUID of the notification request. Obtain from notification_request_create. |
No output schema declared.
No examples provided.
notification_request_status ~135
Searches notifications, optionally filtered by requestId and/or delivery state — the closest equivalent to "checking a request's status": a request fans out into one notification per receiver, each with its own state history, so this returns every notification matching the filter with its current state. Omit requestId to search across every request. Requires: notification_request_create → requestId (if filtering to one request).
| Name | Type | Req | Description |
|---|---|---|---|
| filters | — | — | — |
| ids | — | — | — |
| page | — | — | — |
| requestId | — | — | UUID of the notification request. Obtain from notification_request_create. |
| size | — | — | — |
| sort | — | — | — |
| states | — | — | — |
| Name | Type | Req | Description |
|---|---|---|---|
| data | — | yes | — |
No examples provided.
signature_certificate_generate ~99
Generates the well-signed appearance certificate document for a signature request. Use once every signatory has signed (check with get_signature_request). Requires: create_signature_request → signatureRequestId. Unlike EAD Enterprise's equivalent tool (a GET that polls an already-generated URL), this triggers generation and returns the result in the same call.
| Name | Type | Req | Description |
|---|---|---|---|
| signatureRequestId | string | yes | MANDATORY. UUID of the signature request. Obtain from create_signature_request. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | — |
No examples provided.
signature_coordinate_set ~167
Sets the on-page (x, y, page) coordinates where a signatory's signature appears on a document. Use after add_signatory_to_document if the signature placement needs to be explicit rather than auto-positioned. Requires: create_signature_request → signatureRequestId, add_document_to_signature_request → documentId, add_signatory_to_document → signatoryId.
| Name | Type | Req | Description |
|---|---|---|---|
| coordinates | array | — | — |
| documentId | string | yes | MANDATORY. UUID of the document within the signature request. Obtain from add_document_to_signature_request. |
| signatoryId | string | yes | MANDATORY. UUID of the signatory. Obtain from add_signatory_to_document. |
| signatureRequestId | string | yes | MANDATORY. UUID of the signature request. Obtain from create_signature_request. |
No output schema declared.
No examples provided.
signature_document_download_url_get ~147
Retrieves the download link for the FINAL, well-signed version of a document — the actual signed file, once every signatory has signed. Requires: create_signature_request → signatureRequestId, add_document_to_signature_request → documentId. Use get_signature_request first to confirm signing is complete before calling this. Not to be confused with signature_certificate_generate, which produces a separate appearance certificate document, not the signed document itself.
| Name | Type | Req | Description |
|---|---|---|---|
| documentId | string | yes | MANDATORY. UUID of the document within the signature request. Obtain from add_document_to_signature_request. |
| signatureRequestId | string | yes | MANDATORY. UUID of the signature request. Obtain from create_signature_request. |
| Name | Type | Req | Description |
|---|---|---|---|
| expiration | string | — | — |
| url | string | — | — |
No examples provided.
signature_request_cancel ~74
Cancels an active signature request — no further signing can occur. Use when a request was activated in error or is no longer needed. Requires: create_signature_request → signatureRequestId. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| signatureRequestId | string | yes | MANDATORY. UUID of the signature request. Obtain from create_signature_request. |
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | — | — |
| status | string | — | — |
No examples provided.
signature_request_full ~259
Creates a signature request, adds one or more documents (each with its own signatories), and activates it — the full flagship signature flow in one call instead of create_signature_request + N x (add_document_to_signature_request + add_signatory_to_document) + activate_signature_request. Each document's file uses the shared FileInput contract (local path, base64, https URL, or n8n binary item) — never a bespoke file field. Set `activate: false` to leave the request in draft so you can add validators/observers (add_validator_to_signatory, add_observer_to_document) before activating it yourself. On success returns the request id, each document's id, and each signatory's id. Use the atomic tools instead when you need to inspect or react to each intermediate step, or need validators/observers before activation.
| Name | Type | Req | Description |
|---|---|---|---|
| activate | boolean | — | Activate the request immediately after adding all documents/signatories. |
| createdBy | string | yes | MANDATORY. Identifier of the requester. |
| description | string | — | — |
| documents | array | yes | One or more documents, each with its own signatories, added to the request. |
| name | string | yes | MANDATORY. Signature request name. |
No output schema declared.
No examples provided.
signature_request_list ~187
List signature requests, optionally filtered by close condition among other criteria. Use to find a request when you don't have its id (e.g. by name or status). Signature-request close condition: ALL_REQUIRED = The request only closes once EVERY signatory has signed. | PARTIAL_ALLOWED = The request can close once the minimum required signatories have signed, even if others haven't yet.
| Name | Type | Req | Description |
|---|---|---|---|
| cancellationReasons | — | — | — |
| closeAtFrom | — | — | — |
| closeAtTo | — | — | — |
| closeCondition | — | — | — |
| creators | — | — | — |
| dateFrom | — | — | — |
| dateTo | — | — | — |
| emailObservers | — | — | — |
| emailSignatories | — | — | — |
| hashes | — | — | — |
| ids | — | — | — |
| names | — | — | — |
| page | — | — | — |
| providers | — | — | — |
| signatureTypes | — | — | — |
| size | — | — | — |
| sort | — | — | — |
| statuses | — | — | — |
| Name | Type | Req | Description |
|---|---|---|---|
| _metadata | object | — | — |
| records | array | — | — |
No examples provided.