services.gera/mcp-gera-verify
NPM · @GERA-SERVICES/MCP-GERA-VERIFY · SCANNED SEP 25
Verify UK businesses (FSA/CQC) + signed attestations, mandates & receipts for AI agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 93 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1825 tokens (~165/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the services.gera/mcp-gera-verify server?
services.gera/mcp-gera-verify runs locally as an npm package, launched with npx -y @gera-services/mcp-gera-verify. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @gera-services/mcp-gera-verify
claude mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
{
"mcpServers": {
"services-gera-mcp-gera-verify": {
"command": "npx",
"args": [
"-y",
"@gera-services/mcp-gera-verify"
]
}
}
} {
"servers": {
"services-gera-mcp-gera-verify": {
"command": "npx",
"args": [
"-y",
"@gera-services/mcp-gera-verify"
]
}
}
} codex mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"services-gera-mcp-gera-verify": {
"type": "local",
"command": [
"npx",
"-y",
"@gera-services/mcp-gera-verify"
],
"enabled": true
}
}
} openclaw mcp add services-gera-mcp-gera-verify --command npx --arg -y --arg @gera-services/mcp-gera-verify
mcp_servers:
services-gera-mcp-gera-verify:
command: "npx"
args: ["-y", "@gera-services/mcp-gera-verify"] {
"McpServers": {
"services-gera-mcp-gera-verify": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@gera-services/mcp-gera-verify"
]
}
}
} assistant mcp add services-gera-mcp-gera-verify -t stdio -c npx -a -y @gera-services/mcp-gera-verify
{
"mcpServers": {
"services-gera-mcp-gera-verify": {
"command": "npx",
"args": [
"-y",
"@gera-services/mcp-gera-verify"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 −3
- Stability: pass → 0.80 functional
- 23 Sept 26 +1
- Stability: 0.97 → pass security
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.80 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Sept 2026 · Analysed npm/@gera-services/mcp-gera-verify@1.2.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_business_trust Proof-of-Real: all verified signals for a business ~209
The flagship "is this real / how trustworthy is this?" check. Given a UK business name (+ optional city/postcode and a hint of its type — food, care, healthcare), returns EVERY real verified signal Gera holds: FSA food-hygiene rating (if it is a food business in our FHRS data), CQC registration (if it is a care provider), and presence in Gera's verified-provider set — each source-attributed with an as-of date. Produces an overall_verification of "verified" (>=1 real signal found), "not_in_our_records" (no signal), so an agent can cite a grounded answer. Never fabricates: missing signals are reported as unknown.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City / town. |
| name | string | yes | Business name to verify. |
| postcode | string | – | Full or partial UK postcode. |
| type | string | – | Optional hint of business type to focus the search; omit to check all. |
No output schema declared.
No examples provided.
get_trust_summary One-line citable trust summary ~98
Aggregate everything Gera can verify about a business into a short, citation-ready sentence (plus the structured signals behind it), so an AI agent can quote a grounded "what we can verify about X" answer. Same real data as check_business_trust, condensed. Never fabricates.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City / town. |
| name | string | yes | Business name. |
| postcode | string | – | Full or partial UK postcode. |
No output schema declared.
No examples provided.
get_vouch_public_key Gera Vouch: get the public key to verify attestations ~52
Returns the Ed25519 public key (and key_id + verification recipe) used to sign Gera Vouch attestations, so any party can independently verify an issue_attestation receipt without trusting the transport.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
issue_attestation Gera Vouch: issue a signed attestation for an agent action ~215
Before an AI agent acts on a subject (book it, pay it, recommend it), call this to get a cryptographically signed attestation receipt grounded in real Gera data. Returns verdict ("pass" = a verifying signal exists in our sources; "unverified" = not in our records — never a guess), the source-attributed signals, and an Ed25519 signature any party can verify with get_vouch_public_key. This is a signed proof-of-diligence receipt; indemnity/underwriting is roadmap and is never implied.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City / town. |
| claim | string | – | The specific claim to attest, e.g. "is a CQC-registered care provider". Optional. |
| intended_action | string | – | What the agent intends to do, recorded in the receipt, e.g. "book an appointment". Optional. |
| postcode | string | – | Full or partial UK postcode. |
| subject | string | yes | Business / provider name the agent is about to act on. |
No output schema declared.
No examples provided.
issue_mandate Gera Agent Mandate: issue a scoped, signed spend mandate ~218
A human or business grants an AI agent scoped, revocable authority ("agent X may spend up to N at category/merchant Y until date Z"). Returns a cryptographically signed mandate any executing party verifies with verify_mandate before honouring an action. Pure authorization — Gera moves no money here.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | yes | Identifier of the agent the mandate is granted to. |
| categories | array | – | Only these spend categories are permitted. Omit for any. |
| currency | string | – | ISO currency code, e.g. "GBP". Defaults to GBP. |
| expires_at | string | – | ISO 8601 expiry. Defaults to 30 days from now. |
| grantor | string | yes | Who is granting authority (person or business). |
| max_amount | number | – | Spend cap per action in the given currency. Omit for no cap. |
| merchant_allowlist | array | – | Only these merchants are permitted. Omit for any. |
| purpose | string | – | Human-readable purpose recorded in the mandate. |
No output schema declared.
No examples provided.
issue_receipt Gera Ledger: issue a signed receipt for a completed agent action ~274
After an AI agent acts (books, pays, dispatches), mint a cryptographically signed receipt recording what happened, optionally referencing the Vouch attestation and/or Agent Mandate it acted under. Any party verifies it with verify_receipt + the public key from get_vouch_public_key. A verifiable proof-of-action — not a settlement; Gera moves no money here.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | What the agent did, e.g. "booked a cleaner". |
| agent_id | string | yes | Identifier of the acting agent. |
| amount | number | – | Amount involved, if any. |
| attestation_signature | string | – | The Vouch attestation signature relied on (links the receipt to its diligence). |
| currency | string | – | ISO currency code. Defaults to GBP when amount is set. |
| evidence | array | – | Evidence references (URLs, geo/photo/check-in IDs). Stored verbatim, not validated. |
| mandate_signature | string | – | The mandate signature this action was authorised under (links the receipt to its mandate). |
| occurred_at | string | – | ISO 8601 time the action occurred. Defaults to now. |
| outcome | string | – | Action outcome. Defaults to completed. |
| subject | string | yes | Who/what the action was taken on (merchant, provider, counterparty). |
No output schema declared.
No examples provided.
lookup_care_rating Look up a real CQC care provider ~199
Look up a UK health/social-care provider in the REAL Care Quality Commission (CQC) registry by name (optionally narrowed by city or postcode). Confirms the provider is CQC-registered and returns its registered name, address, service types, last-inspection date, region, and a link to its live CQC profile — source-attributed to the CQC. NOTE: CQC ratings are categorical (Outstanding / Good / Requires improvement / Inadequate), NEVER numeric; our snapshot does not carry the categorical rating, so overall_rating is honestly returned as "unknown" with a link to check it live. If the provider is not registered with CQC in our records, says so plainly.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City or local authority to narrow the match. |
| name | string | yes | Care/health provider name, e.g. "Woodlands Health Centre". |
| postcode | string | – | Full or partial UK postcode. |
No output schema declared.
No examples provided.
lookup_food_hygiene Look up a real FSA food-hygiene rating ~186
Look up the REAL Food Standards Agency food-hygiene rating for a UK food business by name (optionally narrowed by city or postcode). Returns the FHRS rating (0-5; England/Wales/NI) or FHIS status (Pass / Improvement Required; Scotland), the rated establishment, business type, local authority, and rating date — source-attributed to the FSA. If the business is not in our snapshot, says so plainly. Data is a real on-disk snapshot, not a live API call.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City or town to narrow the match, e.g. "Birmingham". |
| name | string | yes | Business / establishment name, e.g. "Etci Mehmet Steak House". |
| postcode | string | – | Full or partial UK postcode, e.g. "B7 5SA" or "B7". |
No output schema declared.
No examples provided.
verify_mandate Gera Agent Mandate: verify a mandate before acting ~152
Before honouring an agent action, verify its mandate: checks the Ed25519 signature, expiry, spend cap, and merchant/category scope against the intended action. Fails closed — a forged, expired, over-cap, or out-of-scope mandate returns valid:false with reasons. Never assumes OK.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Intended spend amount to check against the cap. |
| category | string | – | Intended category to check against the permitted set. |
| mandate | object | yes | The mandate object returned by issue_mandate. |
| merchant | string | – | Intended merchant to check against the allowlist. |
| signature_b64url | string | yes | The signature.signature_b64url from issue_mandate. |
No output schema declared.
No examples provided.
verify_provider Check Gera's verified-provider set ~128
Check whether a provider is in Gera's own verified-provider / Passport set — the crawled, source-attributed provider records Gera maintains (currently healthcare providers). Returns the provider type, specialty, location, website, crawl source, and crawl date. If not in the set, says so plainly. This is Gera's first-party verification signal (distinct from third-party FSA/CQC data).
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City to narrow the match, e.g. "Yerevan". |
| name | string | yes | Provider name, e.g. "Nairi Medical Centre". |
No output schema declared.
No examples provided.
verify_receipt Gera Ledger: verify a signed action receipt ~94
Verify a receipt from issue_receipt: checks the Ed25519 signature against the Gera issuer key. Returns signature_valid plus the receipt, so any party can confirm Gera recorded this action without trusting the transport. Fails closed on any alteration.
| Name | Type | Req | Description |
|---|---|---|---|
| receipt | object | yes | The receipt object returned by issue_receipt. |
| signature_b64url | string | yes | The signature.signature_b64url from issue_receipt. |
No output schema declared.
No examples provided.
What is the services.gera/mcp-gera-verify server?
services.gera/mcp-gera-verify is listed in the public MCP registry as services.gera/mcp-gera-verify. Verify UK businesses (FSA/CQC) + signed attestations, mandates & receipts for AI agents. This page covers its npm package (@gera-services/mcp-gera-verify).
Is the services.gera/mcp-gera-verify server safe to use?
services.gera/mcp-gera-verify scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the services.gera/mcp-gera-verify server expose?
services.gera/mcp-gera-verify exposes 11 tools: lookup_food_hygiene, lookup_care_rating, verify_provider, check_business_trust, get_trust_summary, and 6 more. Their descriptions and schemas cost roughly 1,825 tokens of context every time the server is loaded.
Is the services.gera/mcp-gera-verify server still maintained?
services.gera/mcp-gera-verify is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the services.gera/mcp-gera-verify server under?
services.gera/mcp-gera-verify declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.