{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:38:56.671Z","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp","markdownUrl":"https://verifymcp.io/servers/pontivus-com-span/span-mcp.md","server":{"slug":"pontivus-com-span","name":"Span","registryName":"io.github.pontivus-com/span","description":"Codebase understanding with exact evidence, qualified on every read and re-aligned on change.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"span-mcp","type":"pypi","identifier":"span-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp","version":"0.9.4","transport":"stdio","scoredAt":"2026-11-05T08:46:33.287Z"},"score":{"total":48,"tier":"low","status":"scored","weekDelta":15,"history":[{"date":"2026-11-05","total":48},{"date":"2026-11-04","total":33},{"date":"2026-11-03","total":48},{"date":"2026-11-02","total":33},{"date":"2026-11-01","total":48},{"date":"2026-10-31","total":48},{"date":"2026-10-30","total":48},{"date":"2026-10-29","total":33},{"date":"2026-10-28","total":33},{"date":"2026-10-27","total":50},{"date":"2026-10-26","total":35},{"date":"2026-10-25","total":50},{"date":"2026-10-24","total":35}]},"categories":[{"name":"Supply Chain Security","score":94,"verdict":"partial","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","Declares code that runs automatically (setup.py, a custom setup.py cmdclass, build-time code we could not rule out (a Hatch, PDM or setuptools build hook, a dynamic version we could not read statically, shipped VCS metadata or a stray root module)) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does.","1 of 28 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.unreviewed","args":{"hooks":"setup_py,cmdclass,build_hook"}},{"code":"dephealth.assessed","args":{"deps":"28","unhealthy":"1"}}]},{"name":"Provenance & Transparency","score":100,"verdict":"pass","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to pontivus-com/span).","Clear OSI-approved license (Apache-2.0).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"pontivus-com/span"}},{"code":"license.osi","args":{"spdx":"Apache-2.0"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":0,"verdict":"unverified","reasons":["Schema quality not yet verified: this package installed, but its server did not start, so we have no schema to assess."],"codes":[{"code":"schema.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: this package installed, but its server did not start, so we have no schema to compare."],"codes":[{"code":"stability.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Tool Coverage","score":0,"verdict":"unverified","reasons":["Tool coverage not yet verified: this package installed, but its server did not start, so we have no tool definitions to assess."],"codes":[{"code":"toolquality.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Tool Safety","score":0,"verdict":"unverified","reasons":["Tool safety not yet verified: this package installed, but its server did not start, so we have no tool text to scan."],"codes":[{"code":"toolsafety.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Capabilities","score":0,"verdict":"unverified","reasons":["Protocol version not yet verified: this package installed, but its server did not start, so we never saw its MCP handshake."],"codes":[{"code":"cap.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]}],"inconclusive":["Schema quality not yet verified: this package installed, but its server did not start, so we have no schema to assess.","Stability not yet verified: this package installed, but its server did not start, so we have no schema to compare.","Tool coverage not yet verified: this package installed, but its server did not start, so we have no tool definitions to assess.","Tool safety not yet verified: this package installed, but its server did not start, so we have no tool text to scan.","Protocol version not yet verified: this package installed, but its server did not start, so we never saw its MCP handshake."],"malware":[],"components":[{"slug":"span-mcp","type":"pypi","identifier":"span-mcp","withdrawn":false,"score":48,"current":true,"url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp","markdownUrl":"https://verifymcp.io/servers/pontivus-com-span/span-mcp.md"}],"facts":[{"label":"Registry","value":"pypi"},{"label":"Package","value":"span-mcp"},{"label":"Version","value":"0.9.4"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T08:46:33.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[{"hook":"build_backend","tier":"allowlisted"},{"hook":"setup_py","tier":"unreviewed"},{"hook":"cmdclass","tier":"unreviewed"},{"hook":"build_hook","tier":"unreviewed"}],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":28,"partial":false,"deprecated":null,"stale":null,"noRepo":1}},"mismatches":[],"changelog":{"trackingSince":"2026-10-24","recent":[{"id":"chg_01a1aae3-6b5e-7ecc-80ee-69516762e5aa","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1aae3-6b5e-7ecc-80ee-69516762e5aa"},{"id":"chg_01a1aae3-6b60-7051-927b-4d070ef57bb5","kind":"check.reverified","summary":"Security disclosure (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1aae3-6b60-7051-927b-4d070ef57bb5"},{"id":"chg_01a1aae3-6b60-76a5-a924-bc21392deb0f","kind":"score.total_changed","summary":"Trust score (33 → 48)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1aae3-6b60-76a5-a924-bc21392deb0f"},{"id":"chg_01a1a630-7423-792b-93e1-598e64621bf1","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a630-7423-792b-93e1-598e64621bf1"},{"id":"chg_01a1a630-7425-745d-8422-ef3914686a88","kind":"package.version_changed","summary":"Package version (0.9.1 → 0.9.4)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a630-7425-745d-8422-ef3914686a88"},{"id":"chg_01a1a630-7425-7a09-8fe1-c0953b2e60b1","kind":"score.total_changed","summary":"Trust score (48 → 33)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a630-7425-7a09-8fe1-c0953b2e60b1"},{"id":"chg_01a1a51e-a3e5-7d8a-af48-d09e14aa594b","kind":"check.unverifiable","summary":"Security disclosure (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a51e-a3e5-7d8a-af48-d09e14aa594b"},{"id":"chg_01a1a51e-a3e6-7dc0-bb8e-69f2d30501e3","kind":"package.version_changed","summary":"Package version (0.9.1 → 0.9.2)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a51e-a3e6-7dc0-bb8e-69f2d30501e3"},{"id":"chg_01a1a05d-4e89-7e5c-bd09-6ce98a2db7be","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a05d-4e89-7e5c-bd09-6ce98a2db7be"},{"id":"chg_01a1a05d-4e8b-79d2-9468-8e9adaf85e2f","kind":"package.version_changed","summary":"Package version (0.9.0 → 0.9.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a05d-4e8b-79d2-9468-8e9adaf85e2f"},{"id":"chg_01a1a05d-4e8c-7113-884a-eb4e1d2100ad","kind":"score.total_changed","summary":"Trust score (33 → 48)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1a05d-4e8c-7113-884a-eb4e1d2100ad"},{"id":"chg_01a19b9f-145e-729b-bd7a-58f34b067cbf","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a19b9f-145e-729b-bd7a-58f34b067cbf"},{"id":"chg_01a19b9f-145f-7de0-8cfe-e9f5193f4ed3","kind":"score.total_changed","summary":"Trust score (48 → 33)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a19b9f-145f-7de0-8cfe-e9f5193f4ed3"},{"id":"chg_01a1927a-50b5-7201-9fae-cf75f3bc9fff","kind":"package.version_changed","summary":"Package version (0.8.3 → 0.9.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1927a-50b5-7201-9fae-cf75f3bc9fff"},{"id":"chg_01a1927a-50ca-7712-9f0e-4aafa353f37c","kind":"score.total_changed","summary":"Trust score (33 → 48)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a1927a-50ca-7712-9f0e-4aafa353f37c"},{"id":"chg_01a19151-ecbc-77bb-8fff-2c9606b6654b","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a19151-ecbc-77bb-8fff-2c9606b6654b"},{"id":"chg_01a19151-ecbd-7783-bd33-7c89fdc397ba","kind":"score.total_changed","summary":"Trust score (48 → 33)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a19151-ecbd-7783-bd33-7c89fdc397ba"},{"id":"chg_01a18b8d-cf68-7a97-b24a-3b419181165f","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a18b8d-cf68-7a97-b24a-3b419181165f"},{"id":"chg_01a18b8d-cf69-7eba-bdf5-3192dce1c9b9","kind":"score.total_changed","summary":"Trust score (33 → 48)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a18b8d-cf69-7eba-bdf5-3192dce1c9b9"},{"id":"chg_01a181d1-8ca2-739d-bb2f-d1b81c32ba14","kind":"check.verdict","summary":"Install scripts (pass → partial)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/pontivus-com-span/span-mcp#chg-chg_01a181d1-8ca2-739d-bb2f-d1b81c32ba14"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/pontivus-com-span/span-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/pontivus-com-span/span-mcp","markdown":"https://verifymcp.io/servers/pontivus-com-span/span-mcp.md","changelogJson":"https://verifymcp.io/servers/pontivus-com-span/span-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/pontivus-com-span/span-mcp.xml","external":[{"label":"PyPI project","href":"https://pypi.org/project/span-mcp/"},{"label":"Socket report","href":"https://socket.dev/pypi/package/span-mcp"},{"label":"Repository","href":"https://github.com/pontivus-com/span"},{"label":"Website","href":"https://rolfstreefkerk.com/article/span-mcp"}]}}