# io.github.RCOLKITT/vaspera-hardening (npm · vaspera-hardening-mcp-server)

Enterprise certification for codebases with multi-agent security, reliability, and quality audits

- Trust score: 62/100 (medium)
- Change this week: +44
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `vaspera-hardening-mcp-server`: 62/100 (this document), [markdown](https://verifymcp.io/servers/rcolkitt-vaspera-hardening/vaspera-hardening-mcp-server.md), [page](https://verifymcp.io/servers/rcolkitt-vaspera-hardening/vaspera-hardening-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `vaspera-hardening-mcp-server`
- Version: `1.0.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 107 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1824 tokens (~65/item across 28 items; 28 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 79% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add rcolkitt-vaspera-hardening -- npx -y vaspera-hardening-mcp-server
```

### Codex

```bash
codex mcp add rcolkitt-vaspera-hardening -- npx -y vaspera-hardening-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rcolkitt-vaspera-hardening": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "vaspera-hardening-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add rcolkitt-vaspera-hardening --command npx --arg -y --arg vaspera-hardening-mcp-server
```

### Hermes

```yaml
mcp_servers:
  rcolkitt-vaspera-hardening:
    command: "npx"
    args: ["-y", "vaspera-hardening-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "rcolkitt-vaspera-hardening": {
      "command": "npx",
      "args": [
        "-y",
        "vaspera-hardening-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, +32)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] Schema quality: unverified → good
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.27
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-02 (score 30, +30)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Tool coverage: unverified → 100

### 2026-08-01 (score 0, −21)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 21, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 39, +21)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 79
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 18)

First indexed and scored.

## MCP tools (28)

### `hardening_list_projects` (~86 tokens)

List Vaspera Projects

Discover all projects in the Vaspera workspace directory. Returns project names, paths, and whether hardening commands are already installed. Set VASPERA_PROJECTS_DIR env var to override the default directory (~/Documents/GitHub).

Input parameters:

- `base_dir` (string): Base directory to scan. Defaults to VASPERA_PROJECTS_DIR or ~/Documents/GitHub

### `hardening_install` (~85 tokens)

Install Hardening Commands

Install the production hardening slash commands into a project's .claude/commands/ directory. After installation, Claude Code can use /audit, /fix-critical, /fix-high, /fix-medium, /fix-rls, /add-tests, /verify, and /harden in that project.

Input parameters:

- `project_path` (string, required): Absolute path to the project root directory

### `hardening_install_all` (~103 tokens)

Install Hardening Commands to All Projects

Install hardening slash commands into every discovered project in the workspace. Scans the base directory, finds all projects, and installs commands to each one. Defaults to dry-run mode for safety - set dry_run: false to apply changes.

Input parameters:

- `base_dir` (string): Base directory. Defaults to VASPERA_PROJECTS_DIR or ~/Documents/GitHub
- `dry_run` (boolean): Preview changes without modifying files. Set to false to apply changes.

### `hardening_get_command` (~74 tokens)

Get Hardening Command Prompt

Retrieve the full prompt text for a specific hardening command. Use this to execute a hardening phase against a project. Available commands: audit, fix-critical, fix-high, fix-medium, fix-rls, add-tests, verify, harden.

Input parameters:

- `command` (string, required): The hardening command to retrieve

### `hardening_read_audit` (~56 tokens)

Read Project Audit Report

Read the AUDIT.md file from a project. Returns the full audit content including severity counts and readiness score. Use after running /audit in a project.

Input parameters:

- `project_path` (string, required): Absolute path to the project root

### `hardening_read_report` (~52 tokens)

Read Hardening Report

Read the HARDENING-REPORT.md from a project. Contains the before/after comparison and deployment checklist. Available after running /verify.

Input parameters:

- `project_path` (string, required): Absolute path to the project root

### `hardening_dashboard` (~76 tokens)

Portfolio Production Readiness Dashboard

Compare production readiness across all Vaspera projects. Shows which projects have been audited, their readiness scores, issue counts, and what phases have been completed. Use to prioritize which project to harden next.

Input parameters:

- `base_dir` (string): Base directory. Defaults to VASPERA_PROJECTS_DIR or ~/Documents/GitHub

### `hardening_list_commands` (~35 tokens)

List Available Hardening Commands

List all available production hardening commands with their descriptions. Use to understand what commands are available and what order to run them.

### `certification_start` (~58 tokens)

Start Enterprise Certification

Initialize an enterprise certification process for a project. Creates certification directory and metadata. Returns certification ID for tracking.

Input parameters:

- `agents` (array): Which agents to run. Defaults to all.
- `project_path` (string, required): Absolute path to the project root

### `certification_status` (~46 tokens)

Get Certification Status

Check the current status of a certification process including which agents have completed.

Input parameters:

- `certification_id` (string, required): Certification ID
- `project_path` (string, required): Absolute path to the project root

### `agent_submit_finding` (~71 tokens)

Submit Agent Finding

Submit a finding from a validation agent during certification. Each finding must have a unique ID, severity, and evidence.

Input parameters:

- `agent` (string, required)
- `certification_id` (string, required): Certification ID
- `finding` (object, required)
- `project_path` (string, required): Absolute path to the project root

### `agent_complete` (~66 tokens)

Complete Agent Run

Signal that an agent has completed its validation run. Must include summary with findings count and confidence score.

Input parameters:

- `agent` (string, required)
- `certification_id` (string, required): Certification ID
- `project_path` (string, required): Absolute path to the project root
- `summary` (object, required)

### `agent_cross_verify` (~100 tokens)

Cross-Verify Finding

Cross-verify a finding from another agent. Increases or decreases confidence based on verification.

Input parameters:

- `adjusted_confidence` (number)
- `certification_id` (string, required): Certification ID
- `evidence` (string, required): Evidence for the verdict
- `finding_id` (string, required): ID of the finding to verify
- `project_path` (string, required): Absolute path to the project root
- `verdict` (string, required)
- `verifying_agent` (string, required)

### `certification_cross_verify` (~119 tokens)

Cross-Verify Critical Findings

Batch cross-verify critical findings. In "auto" mode (default), automatically verifies all critical findings based on agent domain overlap. In "manual" mode, verifies only specified finding IDs. Run this after all agents complete to unblock consensus calculation.

Input parameters:

- `certification_id` (string, required): Certification ID
- `finding_ids` (array): Specific finding IDs to verify (required for manual mode)
- `mode` (string): auto: verify all critical findings; manual: verify specific findings
- `project_path` (string, required): Absolute path to the project root

### `redteam_challenge` (~98 tokens)

Red Team Challenge

Red team challenges an area marked clean by another agent. Used to dispute false negatives.

Input parameters:

- `area` (string, required): The area being challenged
- `certification_id` (string, required): Certification ID
- `challenge_type` (string, required)
- `evidence` (string, required): Evidence for the challenge
- `project_path` (string, required): Absolute path to the project root
- `severity_if_valid` (string, required)
- `target_agent` (string, required)

### `certification_consensus` (~90 tokens)

Calculate Certification Consensus

Calculate consensus score and certification level from all agent findings. Requires all requested agents to have completed. Set auto_cross_verify: true (default) to automatically cross-verify critical findings if blocked.

Input parameters:

- `auto_cross_verify` (boolean): Automatically cross-verify critical findings if consensus is blocked
- `certification_id` (string, required): Certification ID
- `project_path` (string, required): Absolute path to the project root

### `certification_finalize` (~46 tokens)

Finalize Certification

Finalize certification and generate CERTIFICATION.md and CERTIFICATION.json artifacts.

Input parameters:

- `certification_id` (string, required): Certification ID
- `project_path` (string, required): Absolute path to the project root

### `certification_dashboard` (~47 tokens)

Certification Dashboard

Portfolio-wide view of enterprise certifications across all projects. Shows certification status, levels, and expiry.

Input parameters:

- `base_dir` (string): Base directory. Defaults to VASPERA_PROJECTS_DIR

### `autofix_preview` (~66 tokens)

Preview Auto-Fix for Finding

Preview an automatic fix for a certification finding without applying it. Returns the before/after diff.

Input parameters:

- `certification_id` (string, required): Certification ID
- `finding_id` (string, required): Finding ID to preview fix for
- `project_path` (string, required): Absolute path to the project root

### `autofix_apply` (~83 tokens)

Apply Auto-Fix for Finding

Apply an automatic fix for a certification finding. Use autofix_preview first to see what will change.

Input parameters:

- `certification_id` (string, required): Certification ID
- `dry_run` (boolean): If true, show what would be changed without applying
- `finding_id` (string, required): Finding ID to fix
- `project_path` (string, required): Absolute path to the project root

### `autofix_list_patterns` (~24 tokens)

List Available Fix Patterns

List all available auto-fix patterns that can be applied to findings.

### `certification_summary` (~51 tokens)

Get Certification Summary

Get a progressive disclosure summary of certification findings grouped by severity, agent, file, and category.

Input parameters:

- `certification_id` (string, required): Certification ID
- `project_path` (string, required): Absolute path to the project root

### `certification_filter` (~78 tokens)

Filter Certification Findings

Filter certification findings by severity, agent, category, file, or confidence level.

Input parameters:

- `agents` (array)
- `categories` (array)
- `certification_id` (string, required): Certification ID
- `min_confidence` (number)
- `project_path` (string, required): Absolute path to the project root
- `severity` (array)

### `certification_export_sarif` (~65 tokens)

Export to SARIF Format

Export certification findings to SARIF format for GitHub Security, SonarQube, or other tools.

Input parameters:

- `certification_id` (string, required): Certification ID
- `format` (string): Output format
- `project_path` (string, required): Absolute path to the project root

### `rules_load` (~40 tokens)

Load Custom Rules

Load custom validation rules from .vaspera/hardening-rules.yaml or .json

Input parameters:

- `project_path` (string, required): Absolute path to the project root

### `rules_templates` (~22 tokens)

List Rule Templates

List built-in rule templates that can be used in custom rule configuration.

### `rules_generate_config` (~38 tokens)

Generate Sample Rules Config

Generate a sample .vaspera/hardening-rules.yaml configuration file.

Input parameters:

- `project_path` (string, required): Absolute path to the project root

### `rules_check_file` (~49 tokens)

Check File Against Custom Rules

Run custom rules against a specific file and return matches.

Input parameters:

- `file_path` (string, required): Relative path to the file to check
- `project_path` (string, required): Absolute path to the project root

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/rcolkitt-vaspera-hardening/vaspera-hardening-mcp-server#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 30
- 2026-08-01: 0
- 2026-07-31: 21
- 2026-07-30: 39
- 2026-07-28: 39
- 2026-07-27: 18

## Links

- npm package: https://www.npmjs.com/package/vaspera-hardening-mcp-server
- Socket report: https://socket.dev/npm/package/vaspera-hardening-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/rcolkitt-vaspera-hardening/vaspera-hardening-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/rcolkitt-vaspera-hardening/vaspera-hardening-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/rcolkitt-vaspera-hardening/vaspera-hardening-mcp-server