io.github.RCOLKITT/vaspera-hardening

NPM · VASPERA-HARDENING-MCP-SERVER · SCANNED AUG 3

Enterprise certification for codebases with multi-agent security, reliability, and quality audits

Available components

+44 this week 62 62 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency19

Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 107 days ago).Pass
Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified

Schema Quality & AI Usability71

AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 1824 tokens (~65/item across 28 items; 28 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage93

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
79% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · vaspera-hardening-mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add rcolkitt-vaspera-hardening -- npx -y vaspera-hardening-mcp-server

# add to Codex CLI

codex mcp add rcolkitt-vaspera-hardening -- npx -y vaspera-hardening-mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rcolkitt-vaspera-hardening": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "vaspera-hardening-mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add rcolkitt-vaspera-hardening --command npx --arg -y --arg vaspera-hardening-mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  rcolkitt-vaspera-hardening:
    command: "npx"
    args: ["-y", "vaspera-hardening-mcp-server"]

// mcp.json

{
  "mcpServers": {
    "rcolkitt-vaspera-hardening": {
      "command": "npx",
      "args": [
        "-y",
        "vaspera-hardening-mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +32
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Schema quality: unverified → good ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.27 ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
2 Aug 26 +30
- Malware scan: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
1 Aug 26 −21
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
28 Jul 26 +21
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 79 functional
- First check of Schema quality: fail functional
- First check of Schema quality: unverified functional
27 Jul 26 18

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 111 packages

111 packages in the resolved dependency tree · 111 deprecated · 34 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 28 exposed · ~1,824 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

agent_complete Complete Agent Run ~66

Signal that an agent has completed its validation run. Must include summary with findings count and confidence score.

Input Output Examples

Name	Type	Req	Description
agent	string	yes	—
certification_id	string	yes	Certification ID
project_path	string	yes	Absolute path to the project root
summary	object	yes	—

No output schema declared.

No examples provided.

agent_cross_verify Cross-Verify Finding ~100

Cross-verify a finding from another agent. Increases or decreases confidence based on verification.

Input Output Examples

Name	Type	Req	Description
adjusted_confidence	number	—	—
certification_id	string	yes	Certification ID
evidence	string	yes	Evidence for the verdict
finding_id	string	yes	ID of the finding to verify
project_path	string	yes	Absolute path to the project root
verdict	string	yes	—
verifying_agent	string	yes	—

No output schema declared.

No examples provided.

agent_submit_finding Submit Agent Finding ~71

Submit a finding from a validation agent during certification. Each finding must have a unique ID, severity, and evidence.

Input Output Examples

Name	Type	Req	Description
agent	string	yes	—
certification_id	string	yes	Certification ID
finding	object	yes	—
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

autofix_apply Apply Auto-Fix for Finding ~83

Apply an automatic fix for a certification finding. Use autofix_preview first to see what will change.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
dry_run	boolean	—	If true, show what would be changed without applying
finding_id	string	yes	Finding ID to fix
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

autofix_list_patterns List Available Fix Patterns ~24

List all available auto-fix patterns that can be applied to findings.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

autofix_preview Preview Auto-Fix for Finding ~66

Preview an automatic fix for a certification finding without applying it. Returns the before/after diff.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
finding_id	string	yes	Finding ID to preview fix for
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_consensus Calculate Certification Consensus ~90

Calculate consensus score and certification level from all agent findings. Requires all requested agents to have completed. Set auto_cross_verify: true (default) to automatically cross-verify critical findings if blocked.

Input Output Examples

Name	Type	Req	Description
auto_cross_verify	boolean	—	Automatically cross-verify critical findings if consensus is blocked
certification_id	string	yes	Certification ID
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_cross_verify Cross-Verify Critical Findings ~119

Batch cross-verify critical findings. In "auto" mode (default), automatically verifies all critical findings based on agent domain overlap. In "manual" mode, verifies only specified finding IDs. Run this after all agents complete to unblock consensus calculation.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
finding_ids	array	—	Specific finding IDs to verify (required for manual mode)
mode	string	—	auto: verify all critical findings; manual: verify specific findings
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_dashboard Certification Dashboard ~47

Portfolio-wide view of enterprise certifications across all projects. Shows certification status, levels, and expiry.

Input Output Examples

Name	Type	Req	Description
base_dir	string	—	Base directory. Defaults to VASPERA_PROJECTS_DIR

No output schema declared.

No examples provided.

certification_export_sarif Export to SARIF Format ~65

Export certification findings to SARIF format for GitHub Security, SonarQube, or other tools.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
format	string	—	Output format
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_filter Filter Certification Findings ~78

Filter certification findings by severity, agent, category, file, or confidence level.

Input Output Examples

Name	Type	Req	Description
agents	array	—	—
categories	array	—	—
certification_id	string	yes	Certification ID
min_confidence	number	—	—
project_path	string	yes	Absolute path to the project root
severity	array	—	—

No output schema declared.

No examples provided.

certification_finalize Finalize Certification ~46

Finalize certification and generate CERTIFICATION.md and CERTIFICATION.json artifacts.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_start Start Enterprise Certification ~58

Initialize an enterprise certification process for a project. Creates certification directory and metadata. Returns certification ID for tracking.

Input Output Examples

Name	Type	Req	Description
agents	array	—	Which agents to run. Defaults to all.
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_status Get Certification Status ~46

Check the current status of a certification process including which agents have completed.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

certification_summary Get Certification Summary ~51

Get a progressive disclosure summary of certification findings grouped by severity, agent, file, and category.

Input Output Examples

Name	Type	Req	Description
certification_id	string	yes	Certification ID
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

hardening_dashboard Portfolio Production Readiness Dashboard ~76

Compare production readiness across all Vaspera projects. Shows which projects have been audited, their readiness scores, issue counts, and what phases have been completed. Use to prioritize which project to harden next.

Input Output Examples

Name	Type	Req	Description
base_dir	string	—	Base directory. Defaults to VASPERA_PROJECTS_DIR or ~/Documents/GitHub

No output schema declared.

No examples provided.

hardening_get_command Get Hardening Command Prompt ~74

Retrieve the full prompt text for a specific hardening command. Use this to execute a hardening phase against a project. Available commands: audit, fix-critical, fix-high, fix-medium, fix-rls, add-tests, verify, harden.

Input Output Examples

Name	Type	Req	Description
command	string	yes	The hardening command to retrieve

No output schema declared.

No examples provided.

hardening_install Install Hardening Commands ~85

Install the production hardening slash commands into a project's .claude/commands/ directory. After installation, Claude Code can use /audit, /fix-critical, /fix-high, /fix-medium, /fix-rls, /add-tests, /verify, and /harden in that project.

Input Output Examples

Name	Type	Req	Description
project_path	string	yes	Absolute path to the project root directory

No output schema declared.

No examples provided.

hardening_install_all Install Hardening Commands to All Projects ~103

Install hardening slash commands into every discovered project in the workspace. Scans the base directory, finds all projects, and installs commands to each one. Defaults to dry-run mode for safety - set dry_run: false to apply changes.

Input Output Examples

Name	Type	Req	Description
base_dir	string	—	Base directory. Defaults to VASPERA_PROJECTS_DIR or ~/Documents/GitHub
dry_run	boolean	—	Preview changes without modifying files. Set to false to apply changes.

No output schema declared.

No examples provided.

hardening_list_commands List Available Hardening Commands ~35

List all available production hardening commands with their descriptions. Use to understand what commands are available and what order to run them.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

hardening_list_projects List Vaspera Projects ~86

Discover all projects in the Vaspera workspace directory. Returns project names, paths, and whether hardening commands are already installed. Set VASPERA_PROJECTS_DIR env var to override the default directory (~/Documents/GitHub).

Input Output Examples

Name	Type	Req	Description
base_dir	string	—	Base directory to scan. Defaults to VASPERA_PROJECTS_DIR or ~/Documents/GitHub

No output schema declared.

No examples provided.

hardening_read_audit Read Project Audit Report ~56

Read the AUDIT.md file from a project. Returns the full audit content including severity counts and readiness score. Use after running /audit in a project.

Input Output Examples

Name	Type	Req	Description
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

hardening_read_report Read Hardening Report ~52

Read the HARDENING-REPORT.md from a project. Contains the before/after comparison and deployment checklist. Available after running /verify.

Input Output Examples

Name	Type	Req	Description
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

redteam_challenge Red Team Challenge ~98

Red team challenges an area marked clean by another agent. Used to dispute false negatives.

Input Output Examples

Name	Type	Req	Description
area	string	yes	The area being challenged
certification_id	string	yes	Certification ID
challenge_type	string	yes	—
evidence	string	yes	Evidence for the challenge
project_path	string	yes	Absolute path to the project root
severity_if_valid	string	yes	—
target_agent	string	yes	—

No output schema declared.

No examples provided.

rules_check_file Check File Against Custom Rules ~49

Run custom rules against a specific file and return matches.

Input Output Examples

Name	Type	Req	Description
file_path	string	yes	Relative path to the file to check
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

rules_generate_config Generate Sample Rules Config ~38

Generate a sample .vaspera/hardening-rules.yaml configuration file.

Input Output Examples

Name	Type	Req	Description
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

rules_load Load Custom Rules ~40

Load custom validation rules from .vaspera/hardening-rules.yaml or .json

Input Output Examples

Name	Type	Req	Description
project_path	string	yes	Absolute path to the project root

No output schema declared.

No examples provided.

rules_templates List Rule Templates ~22

List built-in rule templates that can be used in custom rule configuration.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug