{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T19:28:48.215Z","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch","markdownUrl":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch.md","server":{"slug":"nightswatchhq-nuthatch","name":"nuthatch","registryName":"io.github.nightswatchhq/nuthatch","description":"Query an EVM contract's indexed history with SQL, via a local nuthatch nest and nuthatch dev.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"ghcr-io-nightswatchhq-nuthatch","type":"oci","identifier":"ghcr.io/nightswatchhq/nuthatch","withdrawn":false,"url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch","version":"4.0.0","transport":"stdio","scoredAt":"2026-11-05T01:46:27.120Z"},"score":{"total":1,"tier":"low","status":"scored","weekDelta":0,"history":[{"date":"2026-11-05","total":1},{"date":"2026-11-04","total":1},{"date":"2026-11-03","total":1},{"date":"2026-11-02","total":1},{"date":"2026-11-01","total":1},{"date":"2026-10-31","total":1},{"date":"2026-10-30","total":1},{"date":"2026-10-29","total":1},{"date":"2026-10-28","total":1},{"date":"2026-10-27","total":1},{"date":"2026-10-26","total":1},{"date":"2026-10-25","total":1},{"date":"2026-10-24","total":1},{"date":"2026-10-23","total":1},{"date":"2026-10-22","total":1},{"date":"2026-10-21","total":1},{"date":"2026-10-20","total":1},{"date":"2026-10-19","total":1},{"date":"2026-10-18","total":30},{"date":"2026-10-17","total":30},{"date":"2026-10-16","total":30},{"date":"2026-10-15","total":30},{"date":"2026-10-14","total":30},{"date":"2026-10-13","total":30},{"date":"2026-10-12","total":30},{"date":"2026-10-07","total":37},{"date":"2026-10-05","total":37},{"date":"2026-10-04","total":37},{"date":"2026-10-03","total":37},{"date":"2026-10-02","total":37}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: we could not reach the registry to check. This is a gap on our side.","Install-script risk not yet assessed.","Dependency health could not be checked: we could not reach the registry to check. This is a gap on our side."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"registry_unavailable"}},{"code":"installscript.inconclusive","args":{"reason":"no_install_concept"}},{"code":"dephealth.inconclusive","args":{"reason":"registry_unavailable"}}]},{"name":"Provenance & Transparency","score":3,"verdict":"fail","reasons":["Repository check failed: the declared repository URL redirects; it must resolve directly.","Build provenance not yet verified.","License not yet determined.","Maintenance history not yet determined.","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_redirected","args":{}},{"code":"provenance.inconclusive","args":{"reason":"registry_unreachable"}},{"code":"license.inconclusive","args":{"reason":"registry_unreachable"}},{"code":"maintenance.inconclusive","args":{"reason":"registry_unreachable"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":0,"verdict":"unverified","reasons":["Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess."],"codes":[{"code":"schema.sandbox_failed","args":{"infra":"true","reason":"sandbox_infra","status":"failed"}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare."],"codes":[{"code":"stability.sandbox_failed","args":{"infra":"true","reason":"sandbox_infra","status":"failed"}}]},{"name":"Tool Coverage","score":0,"verdict":"unverified","reasons":["Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess."],"codes":[{"code":"toolquality.sandbox_failed","args":{"infra":"true","reason":"sandbox_infra","status":"failed"}}]},{"name":"Tool Safety","score":0,"verdict":"unverified","reasons":["Tool safety not yet verified: our sandbox run of this package did not complete, so we have no tool text to scan."],"codes":[{"code":"toolsafety.sandbox_failed","args":{"infra":"true","reason":"sandbox_infra","status":"failed"}}]},{"name":"Capabilities","score":0,"verdict":"unverified","reasons":["Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake."],"codes":[{"code":"cap.sandbox_failed","args":{"infra":"true","reason":"sandbox_infra","status":"failed"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: we could not reach the registry to check. This is a gap on our side.","Install-script risk not yet assessed.","Dependency health could not be checked: we could not reach the registry to check. This is a gap on our side.","Build provenance not yet verified.","License not yet determined.","Maintenance history not yet determined.","Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.","Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.","Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.","Tool safety not yet verified: our sandbox run of this package did not complete, so we have no tool text to scan.","Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake."],"malware":[],"components":[{"slug":"ghcr-io-nightswatchhq-nuthatch","type":"oci","identifier":"ghcr.io/nightswatchhq/nuthatch","withdrawn":false,"score":1,"current":true,"url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch","markdownUrl":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch.md"}],"facts":[{"label":"Registry","value":"oci"},{"label":"Package","value":"ghcr.io/nightswatchhq/nuthatch"},{"label":"Version","value":"4.0.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T01:46:27.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"inconclusive","label":"Inconclusive","reason":"no_trust_root","reasonLabel":"No trust root","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-01","recent":[{"id":"chg_01a151cd-f5d7-75cd-8d29-6125417254e6","kind":"check.unverifiable","summary":"Tool safety (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a151cd-f5d7-75cd-8d29-6125417254e6"},{"id":"chg_01a151cd-f5d8-7404-a043-319abb1c1ece","kind":"check.reason","summary":"Stability (Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a151cd-f5d8-7404-a043-319abb1c1ece"},{"id":"chg_01a151cd-f5d8-78e6-aa41-c2b8aff4995d","kind":"check.unverifiable","summary":"Tool coverage (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a151cd-f5d8-78e6-aa41-c2b8aff4995d"},{"id":"chg_01a151cd-f5d8-7cc7-bad3-049073eb2a6b","kind":"check.unverifiable","summary":"Capabilities (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a151cd-f5d8-7cc7-bad3-049073eb2a6b"},{"id":"chg_01a151cd-f5d9-7148-a7b3-a41df8ca8705","kind":"check.unverifiable","summary":"Schema quality (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a151cd-f5d9-7148-a7b3-a41df8ca8705"},{"id":"chg_01a151cd-f5d9-7497-b922-08e1b1f17713","kind":"score.total_changed","summary":"Trust score (30 → 1)","materiality":"functional","direction":"regression","scoreDelta":-29,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a151cd-f5d9-7497-b922-08e1b1f17713"},{"id":"chg_01a132e3-e643-7179-8d04-9cc7cef0e222","kind":"check.reverified","summary":"Security disclosure (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-13","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a132e3-e643-7179-8d04-9cc7cef0e222"},{"id":"chg_01a12fad-c005-7709-bdec-ff44e1057e6d","kind":"check.verdict","summary":"Source repository (pass → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a12fad-c005-7709-bdec-ff44e1057e6d"},{"id":"chg_01a12fad-c006-7d52-a0ee-998f72da053f","kind":"check.unverifiable","summary":"Provenance (fail → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a12fad-c006-7d52-a0ee-998f72da053f"},{"id":"chg_01a12fad-c007-72b6-987f-3da9bcf12a4a","kind":"check.unverifiable","summary":"License (fail → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a12fad-c007-72b6-987f-3da9bcf12a4a"},{"id":"chg_01a12fad-c007-798b-b018-b42457bb6f5d","kind":"check.unverifiable","summary":"Security disclosure (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a12fad-c007-798b-b018-b42457bb6f5d"},{"id":"chg_01a12fad-c008-721e-85d9-0050c8750992","kind":"check.unverifiable","summary":"Maintenance (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a12fad-c008-721e-85d9-0050c8750992"},{"id":"chg_01a12fad-c008-76a5-b218-e822511c547a","kind":"score.total_changed","summary":"Trust score (37 → 30)","materiality":"functional","direction":"regression","scoreDelta":-7,"occurredOn":"2026-10-12","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a12fad-c008-76a5-b218-e822511c547a"},{"id":"chg_01a0f75a-1b8b-7a65-9b53-ded1570983da","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-01","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a0f75a-1b8b-7a65-9b53-ded1570983da"},{"id":"chg_01a0f756-6c9d-7015-a14d-12d28a143b98","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-01","url":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch#chg-chg_01a0f756-6c9d-7015-a14d-12d28a143b98"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch/changelog.json"},"links":{"html":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch","markdown":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch.md","changelogJson":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch/changelog.json","changelogRss":"https://verifymcp.io/servers/nightswatchhq-nuthatch/ghcr-io-nightswatchhq-nuthatch.xml","external":[{"label":"GitHub Container Registry","href":"https://ghcr.io/nightswatchhq/nuthatch"},{"label":"Website","href":"https://www.nuthatch-indexer.com/"}]}}