{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T18:48:21.756Z","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust","markdownUrl":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust.md","server":{"slug":"pipeworx-io-hathitrust","name":"Hathitrust","registryName":"io.github.pipeworx-io/hathitrust","description":"HathiTrust Bibliographic API MCP.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"pipeworx-mcp-hathitrust","type":"npm","identifier":"@pipeworx/mcp-hathitrust","withdrawn":false,"url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust","version":"0.2.1","transport":"stdio","scoredAt":"2026-11-06T00:18:02.337Z"},"score":{"total":83,"tier":"high trust","status":"scored","weekDelta":3,"history":[{"date":"2026-11-06","total":83},{"date":"2026-11-05","total":83},{"date":"2026-11-04","total":82},{"date":"2026-11-03","total":82},{"date":"2026-11-02","total":55},{"date":"2026-11-01","total":80},{"date":"2026-10-31","total":80},{"date":"2026-10-30","total":80},{"date":"2026-10-29","total":80}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"pass","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","No production dependencies, so there is no dependency health to assess."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.no_dependencies","args":{"deps":"0","unhealthy":"0"}}]},{"name":"Provenance & Transparency","score":97,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to pipeworx-io/mcp-hathitrust).","Clear OSI-approved license (MIT).","Actively maintained (last published 3 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"pipeworx-io/mcp-hathitrust"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"3"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":68,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 513 tokens (~171/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"171","items":"3","tools":"3","tokens":"513","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":27,"verdict":"partial","reasons":["Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"8"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"hathitrust-mcp","type":"remote","identifier":"https://gateway.pipeworx.io/hathitrust/mcp","withdrawn":false,"score":87,"current":false,"url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/hathitrust-mcp","markdownUrl":"https://verifymcp.io/servers/pipeworx-io-hathitrust/hathitrust-mcp.md"},{"slug":"pipeworx-mcp-hathitrust","type":"npm","identifier":"@pipeworx/mcp-hathitrust","withdrawn":false,"score":83,"current":true,"url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust","markdownUrl":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"@pipeworx/mcp-hathitrust"},{"label":"Version","value":"0.2.1"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"lookup_by_identifier","title":null,"description":"Look up HathiTrust's digitized-book holdings by a standard identifier (OCLC, LCCN, ISSN, ISBN, HathiTrust item id, or catalog record number). Returns the bibliographic record(s) plus every scanned copy, each flagged full-view (readable online) or limited (search-only) based on its rights code. Keyless — covers 18M+ volumes. Requires a free Pipeworx account (https://pipeworx.io/signup); anonymous and X-API-Key-only calls are refused.","inputs":[{"name":"id","type":"string","required":true,"description":"The identifier value, e.g. \"424023\" for an OCLC number, \"9780030110405\" for an ISBN."},{"name":"id_type","type":"string","required":true,"description":"Identifier type. One of: oclc, lccn, issn, isbn, htid, recordnumber."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":183},{"name":"get_record","title":null,"description":"Get a single HathiTrust catalog record by its record number, with the full structured bibliographic metadata (titles, ISBNs, ISSNs, OCLCs, LCCNs, publish dates, record URL) and the complete list of scanned copies flagged full-view vs limited. e.g. record_number \"009166282\" (\"A manual for the study of insects\"). Keyless. Requires a free Pipeworx account (https://pipeworx.io/signup); anonymous and X-API-Key-only calls are refused.","inputs":[{"name":"record_number","type":"string","required":true,"description":"A HathiTrust catalog record number, e.g. \"009166282\". Obtain one from lookup_by_identifier (the record_number field)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":148},{"name":"check_full_view","title":null,"description":"Convenience check: given an identifier, report whether a readable (full-view) scanned copy exists on HathiTrust, how many copies are readable, and direct reading URLs. Keyless. Requires a free Pipeworx account (https://pipeworx.io/signup); anonymous and X-API-Key-only calls are refused.","inputs":[{"name":"id","type":"string","required":true,"description":"The identifier value, e.g. \"2364951\" for an OCLC number."},{"name":"id_type","type":"string","required":true,"description":"Identifier type. One of: oclc, lccn, issn, isbn, htid, recordnumber."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":129}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-06T00:18:02.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":0,"partial":false,"deprecated":null,"stale":null,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-29","recent":[{"id":"chg_01a1a91b-55c3-763a-934b-0d4bf49667d3","kind":"score.total_changed","summary":"Trust score (82 → 83)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a1a91b-55c3-763a-934b-0d4bf49667d3"},{"id":"chg_01a19ec5-0078-79c3-8638-d2e487362c5a","kind":"check.reverified","summary":"Dependency health (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19ec5-0078-79c3-8638-d2e487362c5a"},{"id":"chg_01a19ec5-0073-7961-bb6b-75dcc3295ee1","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19ec5-0073-7961-bb6b-75dcc3295ee1"},{"id":"chg_01a19ec5-0078-7235-88a8-d7ccc515b1cf","kind":"check.reverified","summary":"Known CVEs (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19ec5-0078-7235-88a8-d7ccc515b1cf"},{"id":"chg_01a19ec5-0079-7413-8b89-13328894bae1","kind":"score.total_changed","summary":"Trust score (55 → 82)","materiality":"functional","direction":"improvement","scoreDelta":27,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19ec5-0079-7413-8b89-13328894bae1"},{"id":"chg_01a19a63-f5a1-78c6-a3c9-99cb0fd58049","kind":"score.total_changed","summary":"Trust score (80 → 55)","materiality":"functional","direction":"regression","scoreDelta":-25,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19a63-f5a1-78c6-a3c9-99cb0fd58049"},{"id":"chg_01a19a63-f5a0-7748-89ad-1582e8120957","kind":"check.unverifiable","summary":"Dependency health (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19a63-f5a0-7748-89ad-1582e8120957"},{"id":"chg_01a19a63-f5a0-7de6-88bf-4a305287444b","kind":"check.reverified","summary":"Stability (unverified → 0.13)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19a63-f5a0-7de6-88bf-4a305287444b"},{"id":"chg_01a19a63-f5a0-715c-9ad5-e77b1e72e984","kind":"check.unverifiable","summary":"Known CVEs (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19a63-f5a0-715c-9ad5-e77b1e72e984"},{"id":"chg_01a19a63-f59f-7183-ad2d-e8fd8daaeaf7","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19a63-f59f-7183-ad2d-e8fd8daaeaf7"},{"id":"chg_01a19a63-f5a1-73cd-b9d6-d8baafbbb12e","kind":"package.version_changed","summary":"Package version (0.2.0 → 0.2.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a19a63-f5a1-73cd-b9d6-d8baafbbb12e"},{"id":"chg_01a18a23-0f42-7125-bb13-ca493e0f4714","kind":"check.reverified","summary":"Security disclosure (unverified → fail)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a18a23-0f42-7125-bb13-ca493e0f4714"},{"id":"chg_01a186a9-834e-793f-af06-056ddefc3c3b","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust#chg-chg_01a186a9-834e-793f-af06-056ddefc3c3b"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust/changelog.json"},"links":{"html":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust","markdown":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust.md","changelogJson":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust/changelog.json","changelogRss":"https://verifymcp.io/servers/pipeworx-io-hathitrust/pipeworx-mcp-hathitrust.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/@pipeworx/mcp-hathitrust"},{"label":"Socket report","href":"https://socket.dev/npm/package/@pipeworx/mcp-hathitrust"},{"label":"Repository","href":"https://github.com/pipeworx-io/mcp-hathitrust"},{"label":"Website","href":"https://pipeworx.io/packs/hathitrust"}]}}