{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T15:58:14.391Z","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp","markdownUrl":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp.md","server":{"slug":"perrylink-dsh-customs","name":"Customs Declaration Consistency","registryName":"io.github.PerryLink/dsh-customs","description":"Read-only MCP server that checks a Chinese customs declaration ledger for internal inconsistency.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"dsh-customs-mcp","type":"npm","identifier":"dsh-customs-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp","version":"0.1.0","transport":"stdio","scoredAt":"2026-11-05T03:14:40.843Z"},"score":{"total":69,"tier":"medium","status":"scored","weekDelta":3,"history":[{"date":"2026-11-05","total":69},{"date":"2026-11-04","total":69},{"date":"2026-11-03","total":69},{"date":"2026-11-02","total":68},{"date":"2026-11-01","total":68},{"date":"2026-10-31","total":67},{"date":"2026-10-30","total":67},{"date":"2026-10-29","total":66},{"date":"2026-10-28","total":66},{"date":"2026-10-27","total":65},{"date":"2026-10-26","total":65},{"date":"2026-10-25","total":64},{"date":"2026-10-24","total":62},{"date":"2026-10-23","total":62},{"date":"2026-10-22","total":62},{"date":"2026-10-21","total":62},{"date":"2026-10-20","total":47}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"pass","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","No production dependencies, so there is no dependency health to assess."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.no_dependencies","args":{"deps":"0","unhealthy":"0"}}]},{"name":"Provenance & Transparency","score":19,"verdict":"fail","reasons":["Repository check failed: no source repository is declared.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (Apache-2.0).","Actively maintained (last published 15 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_none","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"Apache-2.0"}},{"code":"maintenance.recent","args":{"age_days":"15"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":74,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 754 tokens (~188/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"188","items":"4","tools":"4","tokens":"754","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":53,"verdict":"partial","reasons":["Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"16"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"4"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":20,"verdict":"fail","reasons":["Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28."],"codes":[{"code":"protocol.outdated","args":{"latest":"2026-07-28","version":"2024-11-05"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"dsh-customs-mcp","type":"npm","identifier":"dsh-customs-mcp","withdrawn":false,"score":69,"current":true,"url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp","markdownUrl":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"dsh-customs-mcp"},{"label":"Version","value":"0.1.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"customs_check","title":"Check a declaration ledger for internal inconsistency","description":"Run the customs declaration rule pack over a declaration ledger and return the findings as a Markdown report. The input is a JSON or YAML table: one row per document line, with columns such as 品名 (description), 商品编号 (HS code), 币制 (currency), 毛重/净重 (gross/net weight), 申报日期 (declaration date) and 总价 (total value). Call customs_schema for the exact field names and their aliases. The report lists only literal differences from the declared checks — an HS code that is not ten digits, a currency that is not a 3-letter code, gross weight below net weight, a duplicated document number, a date that does not parse or is in the future, an unfilled placeholder. Each finding carries the clause it rests on, or states that the clause text was not obtained. It does NOT decide whether a declaration is correct, whether goods are misclassified, or whether duty is owed. It performs no writes and needs no credentials. Read the \"未执行的检查\" (checks not executed) section at the end: it names every rule that did not run and why, and a report is only as complete as that list allows.","inputs":[{"name":"material","type":"string","required":true,"description":"The ledger as JSON or YAML text. Either an object with a `rows` array, or a bare array of row objects."},{"name":"onlyRules","type":"array","required":false,"description":"Run only these rule ids, e.g. [\"CD-002\"]. Omit to run the whole pack."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":312},{"name":"customs_read_docx","title":"Extract readable text from a .docx","description":"Extract text from a .docx file so it can be turned into a ledger for customs_check. Paragraphs come out one per line; table rows come out as \"| a | b | c |\" lines. Merged cells are marked \"↔\", meaning \"this cell is merged with the one to its left and holds no value of its own\" — do not read it as a missing value. A vertically merged cell repeats the value above it, which is what a reader of the document sees. Reads exactly the one path given, opens it read-only, and refuses anything larger than 20 MB. No other file is touched, no network is used, nothing is written. Only a path ending in .docx is accepted: legacy .doc/.wps are a different binary format and PDF is not parsed on purpose — a PDF table loses its cell structure, and guessing it produces a ledger that is wrong in ways the check cannot detect.","inputs":[{"name":"path","type":"string","required":true,"description":"Absolute or working-directory-relative path to the .docx file."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":220},{"name":"customs_schema","title":"Show the ledger column contract","description":"Return the column contract for customs_check: the accepted field names, every alias each field answers to (for example 品名 / goodsName, 币制 / currency), and the header-level fields. Call this first when assembling a ledger, because a column name the reader does not recognise is silently dropped and the corresponding rule then reports nothing. Read-only, no parameters, no network, no writes.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":88},{"name":"customs_rulebook","title":"List the rules and how many can quote their source","description":"Return every rule in the pack: id, title, severity, the basis kind (direct clause / derived from principle / local configuration), the document and clause it cites, and whether the pack actually holds the verbatim clause text. The `coverage` object states how many rules carry a verbatim clause and how many record that the clause was not obtained, so a reader can weigh the report instead of trusting it. This is the answer to \"how much of this is actually backed by a quoted regulation\" — the number is computed from the pack, not asserted. Read-only, no parameters, no network, no writes.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":134}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T03:14:40.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":null,"reasonLabel":null,"discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":0,"partial":false,"deprecated":null,"stale":null,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-20","recent":[{"id":"chg_01a19f65-bb80-7044-8e1b-56cd97677e33","kind":"score.total_changed","summary":"Trust score (68 → 69)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a19f65-bb80-7044-8e1b-56cd97677e33"},{"id":"chg_01a1951a-0555-7309-b09c-02de8ef94835","kind":"score.total_changed","summary":"Trust score (67 → 68)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a1951a-0555-7309-b09c-02de8ef94835"},{"id":"chg_01a18acd-13db-75ae-bad4-6b7658b07483","kind":"score.total_changed","summary":"Trust score (66 → 67)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a18acd-13db-75ae-bad4-6b7658b07483"},{"id":"chg_01a18082-c653-7da4-830f-9097d2639043","kind":"score.total_changed","summary":"Trust score (65 → 66)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a18082-c653-7da4-830f-9097d2639043"},{"id":"chg_01a17634-e462-75af-a660-a04b3c746731","kind":"score.total_changed","summary":"Trust score (64 → 65)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a17634-e462-75af-a660-a04b3c746731"},{"id":"chg_01a1710e-4c1c-76c3-8ccc-5373db69ba02","kind":"check.reverified","summary":"Stability (unverified → 0.17)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a1710e-4c1c-76c3-8ccc-5373db69ba02"},{"id":"chg_01a1710e-4c1d-71d6-888b-1a784570394c","kind":"score.total_changed","summary":"Trust score (62 → 64)","materiality":"functional","direction":"improvement","scoreDelta":2,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a1710e-4c1d-71d6-888b-1a784570394c"},{"id":"chg_01a15c74-3cc8-7d7f-b160-c1a514de47d5","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-21","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a15c74-3cc8-7d7f-b160-c1a514de47d5"},{"id":"chg_01a15c74-3cc9-7633-849d-a53d756b14db","kind":"score.total_changed","summary":"Trust score (47 → 62)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-10-21","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a15c74-3cc9-7633-849d-a53d756b14db"},{"id":"chg_01a159f6-a12f-7b7a-845d-c4d015baefce","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp#chg-chg_01a159f6-a12f-7b7a-845d-c4d015baefce"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp","markdown":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp.md","changelogJson":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/perrylink-dsh-customs/dsh-customs-mcp.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/dsh-customs-mcp"},{"label":"Socket report","href":"https://socket.dev/npm/package/dsh-customs-mcp"}]}}