services.gera/mcp-gera-verify
NPM · @GERA-SERVICES/MCP-GERA-VERIFY · SCANNED AUG 3
Verify UK businesses (FSA/CQC) + signed attestations, mandates & receipts for AI agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 40 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1825 tokens (~165/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @gera-services/mcp-gera-verify
claude mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
codex mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"services-gera-mcp-gera-verify": {
"type": "local",
"command": [
"npx",
"-y",
"@gera-services/mcp-gera-verify"
],
"enabled": true
}
}
} openclaw mcp add services-gera-mcp-gera-verify --command npx --arg -y --arg @gera-services/mcp-gera-verify
mcp_servers:
services-gera-mcp-gera-verify:
command: "npx"
args: ["-y", "@gera-services/mcp-gera-verify"] {
"mcpServers": {
"services-gera-mcp-gera-verify": {
"command": "npx",
"args": [
"-y",
"@gera-services/mcp-gera-verify"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +4
- Stability: unverified → 0.23 ▲ functional
- 2 Aug 26 +43
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
- 1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Jul 26 −20
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 38
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@gera-services/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
check_business_trust Proof-of-Real: all verified signals for a business ~209
The flagship "is this real / how trustworthy is this?" check. Given a UK business name (+ optional city/postcode and a hint of its type — food, care, healthcare), returns EVERY real verified signal Gera holds: FSA food-hygiene rating (if it is a food business in our FHRS data), CQC registration (if it is a care provider), and presence in Gera's verified-provider set — each source-attributed with an as-of date. Produces an overall_verification of "verified" (>=1 real signal found), "not_in_our_records" (no signal), so an agent can cite a grounded answer. Never fabricates: missing signals are reported as unknown.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City / town. |
| name | string | yes | Business name to verify. |
| postcode | string | — | Full or partial UK postcode. |
| type | string | — | Optional hint of business type to focus the search; omit to check all. |
No output schema declared.
No examples provided.
get_trust_summary One-line citable trust summary ~98
Aggregate everything Gera can verify about a business into a short, citation-ready sentence (plus the structured signals behind it), so an AI agent can quote a grounded "what we can verify about X" answer. Same real data as check_business_trust, condensed. Never fabricates.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City / town. |
| name | string | yes | Business name. |
| postcode | string | — | Full or partial UK postcode. |
No output schema declared.
No examples provided.
get_vouch_public_key Gera Vouch: get the public key to verify attestations ~52
Returns the Ed25519 public key (and key_id + verification recipe) used to sign Gera Vouch attestations, so any party can independently verify an issue_attestation receipt without trusting the transport.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
issue_attestation Gera Vouch: issue a signed attestation for an agent action ~215
Before an AI agent acts on a subject (book it, pay it, recommend it), call this to get a cryptographically signed attestation receipt grounded in real Gera data. Returns verdict ("pass" = a verifying signal exists in our sources; "unverified" = not in our records — never a guess), the source-attributed signals, and an Ed25519 signature any party can verify with get_vouch_public_key. This is a signed proof-of-diligence receipt; indemnity/underwriting is roadmap and is never implied.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City / town. |
| claim | string | — | The specific claim to attest, e.g. "is a CQC-registered care provider". Optional. |
| intended_action | string | — | What the agent intends to do, recorded in the receipt, e.g. "book an appointment". Optional. |
| postcode | string | — | Full or partial UK postcode. |
| subject | string | yes | Business / provider name the agent is about to act on. |
No output schema declared.
No examples provided.
issue_mandate Gera Agent Mandate: issue a scoped, signed spend mandate ~218
A human or business grants an AI agent scoped, revocable authority ("agent X may spend up to N at category/merchant Y until date Z"). Returns a cryptographically signed mandate any executing party verifies with verify_mandate before honouring an action. Pure authorization — Gera moves no money here.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | yes | Identifier of the agent the mandate is granted to. |
| categories | array | — | Only these spend categories are permitted. Omit for any. |
| currency | string | — | ISO currency code, e.g. "GBP". Defaults to GBP. |
| expires_at | string | — | ISO 8601 expiry. Defaults to 30 days from now. |
| grantor | string | yes | Who is granting authority (person or business). |
| max_amount | number | — | Spend cap per action in the given currency. Omit for no cap. |
| merchant_allowlist | array | — | Only these merchants are permitted. Omit for any. |
| purpose | string | — | Human-readable purpose recorded in the mandate. |
No output schema declared.
No examples provided.
issue_receipt Gera Ledger: issue a signed receipt for a completed agent action ~274
After an AI agent acts (books, pays, dispatches), mint a cryptographically signed receipt recording what happened, optionally referencing the Vouch attestation and/or Agent Mandate it acted under. Any party verifies it with verify_receipt + the public key from get_vouch_public_key. A verifiable proof-of-action — not a settlement; Gera moves no money here.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | What the agent did, e.g. "booked a cleaner". |
| agent_id | string | yes | Identifier of the acting agent. |
| amount | number | — | Amount involved, if any. |
| attestation_signature | string | — | The Vouch attestation signature relied on (links the receipt to its diligence). |
| currency | string | — | ISO currency code. Defaults to GBP when amount is set. |
| evidence | array | — | Evidence references (URLs, geo/photo/check-in IDs). Stored verbatim, not validated. |
| mandate_signature | string | — | The mandate signature this action was authorised under (links the receipt to its mandate). |
| occurred_at | string | — | ISO 8601 time the action occurred. Defaults to now. |
| outcome | string | — | Action outcome. Defaults to completed. |
| subject | string | yes | Who/what the action was taken on (merchant, provider, counterparty). |
No output schema declared.
No examples provided.
lookup_care_rating Look up a real CQC care provider ~199
Look up a UK health/social-care provider in the REAL Care Quality Commission (CQC) registry by name (optionally narrowed by city or postcode). Confirms the provider is CQC-registered and returns its registered name, address, service types, last-inspection date, region, and a link to its live CQC profile — source-attributed to the CQC. NOTE: CQC ratings are categorical (Outstanding / Good / Requires improvement / Inadequate), NEVER numeric; our snapshot does not carry the categorical rating, so overall_rating is honestly returned as "unknown" with a link to check it live. If the provider is not registered with CQC in our records, says so plainly.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City or local authority to narrow the match. |
| name | string | yes | Care/health provider name, e.g. "Woodlands Health Centre". |
| postcode | string | — | Full or partial UK postcode. |
No output schema declared.
No examples provided.
lookup_food_hygiene Look up a real FSA food-hygiene rating ~186
Look up the REAL Food Standards Agency food-hygiene rating for a UK food business by name (optionally narrowed by city or postcode). Returns the FHRS rating (0-5; England/Wales/NI) or FHIS status (Pass / Improvement Required; Scotland), the rated establishment, business type, local authority, and rating date — source-attributed to the FSA. If the business is not in our snapshot, says so plainly. Data is a real on-disk snapshot, not a live API call.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City or town to narrow the match, e.g. "Birmingham". |
| name | string | yes | Business / establishment name, e.g. "Etci Mehmet Steak House". |
| postcode | string | — | Full or partial UK postcode, e.g. "B7 5SA" or "B7". |
No output schema declared.
No examples provided.
verify_mandate Gera Agent Mandate: verify a mandate before acting ~152
Before honouring an agent action, verify its mandate: checks the Ed25519 signature, expiry, spend cap, and merchant/category scope against the intended action. Fails closed — a forged, expired, over-cap, or out-of-scope mandate returns valid:false with reasons. Never assumes OK.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | — | Intended spend amount to check against the cap. |
| category | string | — | Intended category to check against the permitted set. |
| mandate | object | yes | The mandate object returned by issue_mandate. |
| merchant | string | — | Intended merchant to check against the allowlist. |
| signature_b64url | string | yes | The signature.signature_b64url from issue_mandate. |
No output schema declared.
No examples provided.
verify_provider Check Gera's verified-provider set ~128
Check whether a provider is in Gera's own verified-provider / Passport set — the crawled, source-attributed provider records Gera maintains (currently healthcare providers). Returns the provider type, specialty, location, website, crawl source, and crawl date. If not in the set, says so plainly. This is Gera's first-party verification signal (distinct from third-party FSA/CQC data).
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City to narrow the match, e.g. "Yerevan". |
| name | string | yes | Provider name, e.g. "Nairi Medical Centre". |
No output schema declared.
No examples provided.
verify_receipt Gera Ledger: verify a signed action receipt ~94
Verify a receipt from issue_receipt: checks the Ed25519 signature against the Gera issuer key. Returns signature_valid plus the receipt, so any party can confirm Gera recorded this action without trusting the transport. Fails closed on any alteration.
| Name | Type | Req | Description |
|---|---|---|---|
| receipt | object | yes | The receipt object returned by issue_receipt. |
| signature_b64url | string | yes | The signature.signature_b64url from issue_receipt. |
No output schema declared.
No examples provided.