Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

services.gera/mcp-gera-verify

NPM · @GERA-SERVICES/MCP-GERA-VERIFY · SCANNED AUG 3

Verify UK businesses (FSA/CQC) + signed attestations, mandates & receipts for AI agents.

+24 this week 62 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
  • Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 40 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1825 tokens (~165/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @gera-services/mcp-gera-verify

# add to Claude Code
claude mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
# add to Codex CLI
codex mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "services-gera-mcp-gera-verify": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@gera-services/mcp-gera-verify"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add services-gera-mcp-gera-verify --command npx --arg -y --arg @gera-services/mcp-gera-verify
# ~/.hermes/config.yaml
mcp_servers:
  services-gera-mcp-gera-verify:
    command: "npx"
    args: ["-y", "@gera-services/mcp-gera-verify"]
// mcp.json
{
  "mcpServers": {
    "services-gera-mcp-gera-verify": {
      "command": "npx",
      "args": [
        "-y",
        "@gera-services/mcp-gera-verify"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +4
    • Stability: unverified → 0.23 functional
  • 2 Aug 26 +43
    • Provenance: unverified → fail security
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Schema quality: unverified → excellent functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Tool coverage: unverified → 100 functional
    • Licence: MIT functional
  • 1 Aug 26 +15
    • Malware scan: unverified → pass security
  • 31 Jul 26 −20
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −18
    • Malware scan: pass → unverified security
  • 27 Jul 26 38

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@gera-services/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 11 exposed · ~1,825 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
check_business_trust ~209

The flagship "is this real / how trustworthy is this?" check. Given a UK business name (+ optional city/postcode and a hint of its type — food, care, healthcare), returns EVERY real verified signal Gera holds: FSA food-hygiene rating (if it is a food business in our FHRS data), CQC registration (if it is a care provider), and presence in Gera's verified-provider set — each source-attributed with an as-of date. Produces an overall_verification of "verified" (>=1 real signal found), "not_in_our_records" (no signal), so an agent can cite a grounded answer. Never fabricates: missing signals are reported as unknown.

NameTypeReqDescription
citystringCity / town.
namestringyesBusiness name to verify.
postcodestringFull or partial UK postcode.
typestringOptional hint of business type to focus the search; omit to check all.

No output schema declared.

No examples provided.

get_trust_summary ~98

Aggregate everything Gera can verify about a business into a short, citation-ready sentence (plus the structured signals behind it), so an AI agent can quote a grounded "what we can verify about X" answer. Same real data as check_business_trust, condensed. Never fabricates.

NameTypeReqDescription
citystringCity / town.
namestringyesBusiness name.
postcodestringFull or partial UK postcode.

No output schema declared.

No examples provided.

get_vouch_public_key ~52

Returns the Ed25519 public key (and key_id + verification recipe) used to sign Gera Vouch attestations, so any party can independently verify an issue_attestation receipt without trusting the transport.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

issue_attestation ~215

Before an AI agent acts on a subject (book it, pay it, recommend it), call this to get a cryptographically signed attestation receipt grounded in real Gera data. Returns verdict ("pass" = a verifying signal exists in our sources; "unverified" = not in our records — never a guess), the source-attributed signals, and an Ed25519 signature any party can verify with get_vouch_public_key. This is a signed proof-of-diligence receipt; indemnity/underwriting is roadmap and is never implied.

NameTypeReqDescription
citystringCity / town.
claimstringThe specific claim to attest, e.g. "is a CQC-registered care provider". Optional.
intended_actionstringWhat the agent intends to do, recorded in the receipt, e.g. "book an appointment". Optional.
postcodestringFull or partial UK postcode.
subjectstringyesBusiness / provider name the agent is about to act on.

No output schema declared.

No examples provided.

issue_mandate ~218

A human or business grants an AI agent scoped, revocable authority ("agent X may spend up to N at category/merchant Y until date Z"). Returns a cryptographically signed mandate any executing party verifies with verify_mandate before honouring an action. Pure authorization — Gera moves no money here.

NameTypeReqDescription
agent_idstringyesIdentifier of the agent the mandate is granted to.
categoriesarrayOnly these spend categories are permitted. Omit for any.
currencystringISO currency code, e.g. "GBP". Defaults to GBP.
expires_atstringISO 8601 expiry. Defaults to 30 days from now.
grantorstringyesWho is granting authority (person or business).
max_amountnumberSpend cap per action in the given currency. Omit for no cap.
merchant_allowlistarrayOnly these merchants are permitted. Omit for any.
purposestringHuman-readable purpose recorded in the mandate.

No output schema declared.

No examples provided.

issue_receipt ~274

After an AI agent acts (books, pays, dispatches), mint a cryptographically signed receipt recording what happened, optionally referencing the Vouch attestation and/or Agent Mandate it acted under. Any party verifies it with verify_receipt + the public key from get_vouch_public_key. A verifiable proof-of-action — not a settlement; Gera moves no money here.

NameTypeReqDescription
actionstringyesWhat the agent did, e.g. "booked a cleaner".
agent_idstringyesIdentifier of the acting agent.
amountnumberAmount involved, if any.
attestation_signaturestringThe Vouch attestation signature relied on (links the receipt to its diligence).
currencystringISO currency code. Defaults to GBP when amount is set.
evidencearrayEvidence references (URLs, geo/photo/check-in IDs). Stored verbatim, not validated.
mandate_signaturestringThe mandate signature this action was authorised under (links the receipt to its mandate).
occurred_atstringISO 8601 time the action occurred. Defaults to now.
outcomestringAction outcome. Defaults to completed.
subjectstringyesWho/what the action was taken on (merchant, provider, counterparty).

No output schema declared.

No examples provided.

lookup_care_rating ~199

Look up a UK health/social-care provider in the REAL Care Quality Commission (CQC) registry by name (optionally narrowed by city or postcode). Confirms the provider is CQC-registered and returns its registered name, address, service types, last-inspection date, region, and a link to its live CQC profile — source-attributed to the CQC. NOTE: CQC ratings are categorical (Outstanding / Good / Requires improvement / Inadequate), NEVER numeric; our snapshot does not carry the categorical rating, so overall_rating is honestly returned as "unknown" with a link to check it live. If the provider is not registered with CQC in our records, says so plainly.

NameTypeReqDescription
citystringCity or local authority to narrow the match.
namestringyesCare/health provider name, e.g. "Woodlands Health Centre".
postcodestringFull or partial UK postcode.

No output schema declared.

No examples provided.

lookup_food_hygiene ~186

Look up the REAL Food Standards Agency food-hygiene rating for a UK food business by name (optionally narrowed by city or postcode). Returns the FHRS rating (0-5; England/Wales/NI) or FHIS status (Pass / Improvement Required; Scotland), the rated establishment, business type, local authority, and rating date — source-attributed to the FSA. If the business is not in our snapshot, says so plainly. Data is a real on-disk snapshot, not a live API call.

NameTypeReqDescription
citystringCity or town to narrow the match, e.g. "Birmingham".
namestringyesBusiness / establishment name, e.g. "Etci Mehmet Steak House".
postcodestringFull or partial UK postcode, e.g. "B7 5SA" or "B7".

No output schema declared.

No examples provided.

verify_mandate ~152

Before honouring an agent action, verify its mandate: checks the Ed25519 signature, expiry, spend cap, and merchant/category scope against the intended action. Fails closed — a forged, expired, over-cap, or out-of-scope mandate returns valid:false with reasons. Never assumes OK.

NameTypeReqDescription
amountnumberIntended spend amount to check against the cap.
categorystringIntended category to check against the permitted set.
mandateobjectyesThe mandate object returned by issue_mandate.
merchantstringIntended merchant to check against the allowlist.
signature_b64urlstringyesThe signature.signature_b64url from issue_mandate.

No output schema declared.

No examples provided.

verify_provider ~128

Check whether a provider is in Gera's own verified-provider / Passport set — the crawled, source-attributed provider records Gera maintains (currently healthcare providers). Returns the provider type, specialty, location, website, crawl source, and crawl date. If not in the set, says so plainly. This is Gera's first-party verification signal (distinct from third-party FSA/CQC data).

NameTypeReqDescription
citystringCity to narrow the match, e.g. "Yerevan".
namestringyesProvider name, e.g. "Nairi Medical Centre".

No output schema declared.

No examples provided.

verify_receipt ~94

Verify a receipt from issue_receipt: checks the Ed25519 signature against the Gera issuer key. Returns signature_valid plus the receipt, so any party can confirm Gera recorded this action without trusting the transport. Fails closed on any alteration.

NameTypeReqDescription
receiptobjectyesThe receipt object returned by issue_receipt.
signature_b64urlstringyesThe signature.signature_b64url from issue_receipt.

No output schema declared.

No examples provided.