{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T03:15:31.710Z","url":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts","markdownUrl":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts.md","server":{"slug":"many77146-bot-dmt-receipts","name":"io.github.many77146-bot/dmt-receipts","registryName":"io.github.many77146-bot/dmt-receipts","description":"Stamp and verify Bitcoin-anchored OpenTimestamps memory receipts for AI agents.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"dmt-receipts","type":"mcpb","identifier":"https://github.com/many77146-bot/dmt-receipts/releases/download/v0.1.0/dmt-receipts-0.1.0.mcpb","withdrawn":false,"url":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts","version":null,"transport":"stdio","scoredAt":"2026-11-06T03:11:57.092Z"},"score":{"total":44,"tier":"low","status":"scored","weekDelta":null,"history":[{"date":"2026-11-06","total":44},{"date":"2026-11-05","total":43}]},"categories":[{"name":"Supply Chain Security","score":23,"verdict":"partial","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs were checked across the 92 of 92 dependencies we could resolve, so this covers what we could see, not the whole tree.","No install/post-install scripts declared.","30 of 92 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.tree_partial","args":{"seen":"92","resolved":"92"}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"92","unhealthy":"30"}}]},{"name":"Provenance & Transparency","score":23,"verdict":"fail","reasons":["Repository check failed: the declared repository URL redirects; it must resolve directly.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (MIT).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_redirected","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":76,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 259 tokens (~129/item across 2 items; 2 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"129","items":"2","tools":"2","tokens":"259","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":3,"verdict":"partial","reasons":["Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"1"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 2 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"2"}},{"code":"toolsafety.manipulation_clean","args":{"units":"2","judged":"2"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package."],"malware":[],"components":[{"slug":"dmt-receipts","type":"mcpb","identifier":"https://github.com/many77146-bot/dmt-receipts/releases/download/v0.1.0/dmt-receipts-0.1.0.mcpb","withdrawn":false,"score":44,"current":true,"url":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts","markdownUrl":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts.md"}],"facts":[{"label":"Registry","value":"mcpb"},{"label":"Package","value":"https://github.com/many77146-bot/dmt-receipts/releases/download/v0.1.0/dmt-receipts-0.1.0.mcpb"},{"label":"Transport","value":"stdio"},{"label":"SHA-256","value":"58a57206daac47b2bfb905c835c1987d3a35f87ebbe18de3fff9d598ebd2f4c7"}],"install":{"available":true,"bundleSha256":"58a57206daac47b2bfb905c835c1987d3a35f87ebbe18de3fff9d598ebd2f4c7"},"tools":[{"name":"stamp_memory","title":null,"description":"Canonicalize a dmt-memory/v1 JSON memory, SHA-256 it, stamp the digest on public OpenTimestamps calendars, and return the memory plus a base64 .ots receipt. Proves the exact bytes existed no later than a Bitcoin block time; does not prove authorship. Stores nothing.","inputs":[{"name":"agent_id","type":"string","required":true,"description":"Stable agent identifier"},{"name":"content","type":null,"required":true,"description":"Memory payload (string, object, array, number, or boolean)"},{"name":"created_at","type":"string","required":false,"description":"Optional ISO-8601 UTC timestamp ending in Z; defaults to now"},{"name":"key","type":"string","required":true,"description":"Memory key / slug / path"},{"name":"tags","type":"array","required":false,"description":"Optional string tags; defaults to []"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":147},{"name":"verify_receipt","title":null,"description":"Locally check that a base64 OpenTimestamps receipt header and digest match a dmt-memory/v1 object's canonical SHA-256. Does not validate calendar operations or Bitcoin inclusion; use ots upgrade/verify for full proof verification.","inputs":[{"name":"memory","type":"object","required":true,"description":"Full dmt-memory/v1 object (agent_id, key, content, tags, created_at)"},{"name":"ots_base64","type":"string","required":true,"description":"Base64-encoded .ots receipt"},{"name":"sha256","type":"string","required":false,"description":"Optional expected hex digest to cross-check"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":112}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-06T03:11:57.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":92,"partial":false,"deprecated":null,"stale":30,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-11-05","recent":[{"id":"chg_01a1aed7-70bb-76c5-b989-7c055e2e9a31","kind":"score.total_changed","summary":"Trust score (43 → 44)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-06","url":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts#chg-chg_01a1aed7-70bb-76c5-b989-7c055e2e9a31"},{"id":"chg_01a1ad4c-b74e-729b-b5a1-f687a7e3e072","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts#chg-chg_01a1ad4c-b74e-729b-b5a1-f687a7e3e072"},{"id":"chg_01a1ad4c-619e-797c-b721-d5cbcf1418e1","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts#chg-chg_01a1ad4c-619e-797c-b721-d5cbcf1418e1"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts/changelog.json"},"links":{"html":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts","markdown":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts.md","changelogJson":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts/changelog.json","changelogRss":"https://verifymcp.io/servers/many77146-bot-dmt-receipts/dmt-receipts.xml","external":[]}}