{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T15:50:24.837Z","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin","markdownUrl":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin.md","server":{"slug":"paureis-cloudpin","name":"cloudpin","registryName":"io.github.paureis/cloudpin","description":"Read-only checks that cloud CLI commands run on the accounts a project pins in .cloudpin.yml.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"cloudpin","type":"npm","identifier":"cloudpin","withdrawn":false,"url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin","version":"1.2.3","transport":"stdio","scoredAt":"2026-11-05T09:01:44.223Z"},"score":{"total":68,"tier":"medium","status":"scored","weekDelta":3,"history":[{"date":"2026-11-05","total":68},{"date":"2026-11-04","total":83},{"date":"2026-11-03","total":82},{"date":"2026-11-02","total":82},{"date":"2026-11-01","total":81},{"date":"2026-10-31","total":81},{"date":"2026-10-30","total":65},{"date":"2026-10-29","total":65}]},"categories":[{"name":"Supply Chain Security","score":63,"verdict":"unverified","reasons":["No malware found by supply-chain analysis.","Known CVEs could not be checked: the version this server declares is not published in its registry.","No install/post-install scripts declared.","Dependency health could not be checked: the version this server declares is not published in its registry."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.inconclusive","args":{"reason":"root_version_missing"}},{"code":"installscript.none","args":{}},{"code":"dephealth.inconclusive","args":{"reason":"root_version_missing"}}]},{"name":"Provenance & Transparency","score":74,"verdict":"unverified","reasons":["Repository presence not verified: we could not reach the forge to check. This is a gap on our side, not a finding about the repository.","Cryptographically verified build provenance (signed, bound to paureis/cloudpin).","Clear OSI-approved license (MIT).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_inconclusive","args":{"status":"504"}},{"code":"provenance.verified","args":{"repo":"paureis/cloudpin"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":70,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 367 tokens (~183/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"183","items":"2","tools":"2","tokens":"367","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":23,"verdict":"partial","reasons":["Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"7"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"2"}},{"code":"toolsafety.manipulation_clean","args":{"units":"3","judged":"3"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["Known CVEs could not be checked: the version this server declares is not published in its registry.","Dependency health could not be checked: the version this server declares is not published in its registry.","Repository presence not verified: we could not reach the forge to check. This is a gap on our side, not a finding about the repository."],"malware":[],"components":[{"slug":"cloudpin","type":"npm","identifier":"cloudpin","withdrawn":false,"score":68,"current":true,"url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin","markdownUrl":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"cloudpin"},{"label":"Version","value":"1.2.3"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"cloudpin_status","title":null,"description":"Which cloud accounts each CLI (az, aws, gcloud, vercel, gh, kubectl, helm, supabase, wrangler) is using here, what this project's .cloudpin.yml pins, which environment applies, and which agent hooks are installed. Call it before cloud work.","inputs":[{"name":"cwd","type":"string","required":false,"description":"Project folder; defaults to the current one."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":83},{"name":"cloudpin_check","title":null,"description":"Would cloudpin allow this shell command, as an agent's? Returns each cloud CLI call in it, the account it would use and why, and the verdict (allow, block or ask) with the reason and the fix. Nothing is run.","inputs":[{"name":"command","type":"string","required":true,"description":"The full command line, e.g. \"cd web && vercel deploy --prod\"."},{"name":"cwd","type":"string","required":false,"description":"Folder the command would run in; defaults to the current one."},{"name":"shell","type":"string","required":false,"description":"The shell that would run it: powershell for a PowerShell tool's command; defaults to bash."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":129}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T09:01:44.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-29","recent":[{"id":"chg_01a1aaf1-51c5-7cbe-bdea-e470075d4e00","kind":"check.unverifiable","summary":"Known CVEs (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1aaf1-51c5-7cbe-bdea-e470075d4e00"},{"id":"chg_01a1aaf1-51c8-70b0-8a65-f2117a1200de","kind":"check.unverifiable","summary":"Provenance (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1aaf1-51c8-70b0-8a65-f2117a1200de"},{"id":"chg_01a1aaf1-51c8-76a0-8aff-9005999be633","kind":"check.unverifiable","summary":"Dependency health (0.84 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1aaf1-51c8-76a0-8aff-9005999be633"},{"id":"chg_01a1aaf1-51c8-7c58-a29d-b38be3b667a8","kind":"package.version_changed","summary":"Package version (1.2.1 → 1.2.3)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1aaf1-51c8-7c58-a29d-b38be3b667a8"},{"id":"chg_01a1aaf1-51c9-71f9-a4d3-b8548fb2f33b","kind":"score.total_changed","summary":"Trust score (83 → 68)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1aaf1-51c9-71f9-a4d3-b8548fb2f33b"},{"id":"chg_01a1aa82-434b-7266-8829-5e9ded1dd792","kind":"package.version_changed","summary":"Package version (1.2.1 → 1.2.2)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1aa82-434b-7266-8829-5e9ded1dd792"},{"id":"chg_01a1a3e4-3c9a-7b39-bc6b-f9fc9a996283","kind":"score.total_changed","summary":"Trust score (82 → 83)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a1a3e4-3c9a-7b39-bc6b-f9fc9a996283"},{"id":"chg_01a199a4-d141-716b-87fc-d2fbf3be31ff","kind":"score.total_changed","summary":"Trust score (81 → 82)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a199a4-d141-716b-87fc-d2fbf3be31ff"},{"id":"chg_01a18f5f-0725-7c5f-99d6-dc206f852c7a","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18f5f-0725-7c5f-99d6-dc206f852c7a"},{"id":"chg_01a18f5f-0726-7f27-8f39-422f94b50397","kind":"score.total_changed","summary":"Trust score (65 → 81)","materiality":"functional","direction":"improvement","scoreDelta":16,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18f5f-0726-7f27-8f39-422f94b50397"},{"id":"chg_01a18b27-ac6f-723e-a105-3c5c8cd745a3","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18b27-ac6f-723e-a105-3c5c8cd745a3"},{"id":"chg_01a18b27-ac70-72a5-9278-66c8cea649aa","kind":"package.version_changed","summary":"Package version (1.2.0 → 1.2.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18b27-ac70-72a5-9278-66c8cea649aa"},{"id":"chg_01a18b27-ac70-78bc-a45e-e7a894d6408b","kind":"score.total_changed","summary":"Trust score (80 → 65)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18b27-ac70-78bc-a45e-e7a894d6408b"},{"id":"chg_01a18a21-c21c-7319-a079-dce9dc77af47","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18a21-c21c-7319-a079-dce9dc77af47"},{"id":"chg_01a18a21-c21d-72a5-9b04-4dabf3fb385a","kind":"score.total_changed","summary":"Trust score (65 → 80)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18a21-c21d-72a5-9b04-4dabf3fb385a"},{"id":"chg_01a18999-672a-7892-9e06-aca8ba89b5e6","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin#chg-chg_01a18999-672a-7892-9e06-aca8ba89b5e6"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin/changelog.json"},"links":{"html":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin","markdown":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin.md","changelogJson":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin/changelog.json","changelogRss":"https://verifymcp.io/servers/paureis-cloudpin/cloudpin.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/cloudpin"},{"label":"Socket report","href":"https://socket.dev/npm/package/cloudpin"},{"label":"Repository","href":"https://github.com/paureis/cloudpin"},{"label":"Website","href":"https://github.com/paureis/cloudpin/blob/main/docs/mcp.md"}]}}