io.github.Helm-Protocol/openttt-pot

NPM · @HELM-PROTOCOL/TTT-MCP · SCANNED AUG 20

Cryptographic audit trail for Claude Code workflows — tamper-proof timestamps, IETF TTTPS compliant.

Available components

65 65 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security98

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
No install/post-install scripts declared.Pass
39 of 116 dependencies flagged as unhealthy. View diagnostics → Partial

Provenance & Transparency32

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: the license (BSL-1.1) isn't a recognized OSI-approved license. See how to fix → Fail
Actively maintained (last published 19 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability72

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 1127 tokens (~140/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @helm-protocol/ttt-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add helm-protocol-openttt-pot -- npx -y @helm-protocol/ttt-mcp

# add to Codex CLI

codex mcp add helm-protocol-openttt-pot -- npx -y @helm-protocol/ttt-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "helm-protocol-openttt-pot": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@helm-protocol/ttt-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add helm-protocol-openttt-pot --command npx --arg -y --arg @helm-protocol/ttt-mcp

# ~/.hermes/config.yaml

mcp_servers:
  helm-protocol-openttt-pot:
    command: "npx"
    args: ["-y", "@helm-protocol/ttt-mcp"]

// mcp.json

{
  "mcpServers": {
    "helm-protocol-openttt-pot": {
      "command": "npx",
      "args": [
        "-y",
        "@helm-protocol/ttt-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

15 Aug 26 65

First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Aug 2026 · Analysed npm/@helm-protocol/ttt-mcp@0.3.4

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	npm

Dependencies 116 packages

Packages resolved	116
Stale	39
Tree resolution	Complete

MCP tools · 8 exposed · ~1,127 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

pot_checkpoint ~161

Create a compressed rollup checkpoint of workflow history. Call this periodically to prevent token explosion when recovering from context compression. Returns checkpointId, compressed event history, chainIntact status, and nextCheckpointHint (recommended events before next checkpoint).

Input Output Examples

Name	Type	Req	Description
endTime	number	–	Unix ms end time (optional, default: now)
fromEventId	string	–	Start of range by eventId (optional, use with toEventId)
maxTokens	number	–	Approximate max tokens for rollup (default: 2000)
startTime	number	–	Unix ms start time (optional, default: 1h ago)
toEventId	string	–	End of range by eventId (optional, use with fromEventId)

No output schema declared.

No examples provided.

pot_generate ~373

Generate a cryptographic Proof of Time timestamp (draft-helmprotocol-tttps, https://datatracker.ietf.org/doc/draft-helmprotocol-tttps/). For Claude Code workflows: use eventId + prevEventId to build a causal chain. For DeFi: use txHash + chainId + poolAddress. For a spec-conformant draft-08 §3 record binding this attestation to a specific piece of content, also supply contentDigest. One of eventId, txHash, or contentDigest is required.

Input Output Examples

Name	Type	Req	Description
chainId	number	–	EVM chain ID (DeFi, e.g. 8453 for Base)
contentDigest	string	–	SHA-256 digest (lowercase hex, 64 characters) of the content this record attests to. Computed by the caller — the server never sees the content itself. When supplied, and the local time synthesis mee…
ctxId	string	–	draft-08 §3.3 context identifier (domain separator for the Commitment). Defaults to a fixed server value if omitted; MAY be public.
eventId	string	–	Workflow step identifier (Claude Code). E.g. 'refactor_auth_step1'
poolAddress	string	–	DEX pool contract address (DeFi)
prevEventId	string	–	Previous step's eventId — links steps into a causal chain
txHash	string	–	Transaction hash (DeFi, hex with 0x prefix)

No output schema declared.

No examples provided.

pot_graph ~89

Traverse the causal chain of workflow steps. Given an eventId, returns the full backward chain (ancestors via prevEventId) and forward chain (steps that follow). Use after context compression to reconstruct the complete workflow timeline.

Input Output Examples

Name	Type	Req	Description
depth	number	–	Max backward traversal depth. Default: 10, max: 100
eventId	string	yes	The workflow step to start traversal from

No output schema declared.

No examples provided.

pot_health ~29

Check PoT system health: time source status, subgraph sync, server uptime, and current mode.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

pot_query ~131

Query Proof of Time records. Use eventId for exact O(1) lookup of a specific workflow step (collision probability 2^-256). Use startTime/endTime for time-range queries.

Input Output Examples

Name	Type	Req	Description
endTime	number	–	End time (unix ms). Default: now
eventId	string	–	Exact eventId lookup — call this at workflow start to restore action history after context compression
limit	number	–	Max entries to return. Default: 100, max: 1000
startTime	number	–	Start time (unix ms). Default: 24h ago

No output schema declared.

No examples provided.

pot_stats ~39

Get PoT statistics: total swaps, turbo/full counts, and turbo ratio for a given period.

Input Output Examples

Name	Type	Req	Description
period	string	yes	Time period for statistics

No output schema declared.

No examples provided.

pot_verify ~113

Verify a Proof of Time using its hash and integrity shards. Returns validity, mode (turbo/full), and timestamp.

Input Output Examples

Name	Type	Req	Description
chainId	number	yes	EVM chain ID (e.g. 84532 for Base Sepolia)
grgShards	array	yes	Array of hex-encoded cryptographic integrity shards
poolAddress	string	yes	Uniswap V4 pool address (0x-prefixed)
potHash	string	yes	PoT hash to verify (hex with 0x prefix)

No output schema declared.

No examples provided.

pot_verify_v08 ~192

Verify a draft-helmprotocol-tttps-08 §3 Proof-of-Time record (as produced by pot_generate's potRecordV08 field): recomputes the Commitment and checks the Ed25519 signature, and — if content is supplied — recomputes SHA-256(content) and checks it against the record's Payload Digest field.

Input Output Examples

Name	Type	Req	Description
content	string	–	The payload (utf8) to check against the record's Payload Digest field, if available
ctxId	string	–	Context identifier the record was generated under. Must match what pot_generate used, or verification fails.
issuerPubKey	string	–	Hex-encoded 32-byte raw Ed25519 issuer public key. Defaults to this server's own key.
potRecordV08	string	yes	Hex-encoded 184 or 216-octet record from pot_generate's potRecordV08 field

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

15 Aug 20 Aug