# services.gera/mcp-gera-verify (npm · @gera-services/mcp-gera-verify)

Verify UK businesses (FSA/CQC) + signed attestations, mandates & receipts for AI agents.

- Trust score: 62/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@gera-services/mcp-gera-verify`: 62/100 (this document), [markdown](https://verifymcp.io/servers/services-gera-mcp-gera-verify/gera-services-mcp-gera-verify.md), [page](https://verifymcp.io/servers/services-gera-mcp-gera-verify/gera-services-mcp-gera-verify)

## Channel facts

- Registry: `npm`
- Package: `@gera-services/mcp-gera-verify`
- Version: `1.2.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 40 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1825 tokens (~165/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
```

### Codex

```bash
codex mcp add services-gera-mcp-gera-verify -- npx -y @gera-services/mcp-gera-verify
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "services-gera-mcp-gera-verify": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@gera-services/mcp-gera-verify"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add services-gera-mcp-gera-verify --command npx --arg -y --arg @gera-services/mcp-gera-verify
```

### Hermes

```yaml
mcp_servers:
  services-gera-mcp-gera-verify:
    command: "npx"
    args: ["-y", "@gera-services/mcp-gera-verify"]
```

### Other

```json
{
  "mcpServers": {
    "services-gera-mcp-gera-verify": {
      "command": "npx",
      "args": [
        "-y",
        "@gera-services/mcp-gera-verify"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 58, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 15, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 0, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 20, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 38)

First indexed and scored.

## MCP tools (11)

### `lookup_food_hygiene` (~186 tokens)

Look up a real FSA food-hygiene rating

Look up the REAL Food Standards Agency food-hygiene rating for a UK food business by name (optionally narrowed by city or postcode). Returns the FHRS rating (0-5; England/Wales/NI) or FHIS status (Pass / Improvement Required; Scotland), the rated establishment, business type, local authority, and rating date — source-attributed to the FSA. If the business is not in our snapshot, says so plainly. Data is a real on-disk snapshot, not a live API call.

Input parameters:

- `city` (string): City or town to narrow the match, e.g. "Birmingham".
- `name` (string, required): Business / establishment name, e.g. "Etci Mehmet Steak House".
- `postcode` (string): Full or partial UK postcode, e.g. "B7 5SA" or "B7".

### `lookup_care_rating` (~199 tokens)

Look up a real CQC care provider

Look up a UK health/social-care provider in the REAL Care Quality Commission (CQC) registry by name (optionally narrowed by city or postcode). Confirms the provider is CQC-registered and returns its registered name, address, service types, last-inspection date, region, and a link to its live CQC profile — source-attributed to the CQC. NOTE: CQC ratings are categorical (Outstanding / Good / Requires improvement / Inadequate), NEVER numeric; our snapshot does not carry the categorical rating, so overall_rating is honestly returned as "unknown" with a link to check it live. If the provider is not registered with CQC in our records, says so plainly.

Input parameters:

- `city` (string): City or local authority to narrow the match.
- `name` (string, required): Care/health provider name, e.g. "Woodlands Health Centre".
- `postcode` (string): Full or partial UK postcode.

### `verify_provider` (~128 tokens)

Check Gera's verified-provider set

Check whether a provider is in Gera's own verified-provider / Passport set — the crawled, source-attributed provider records Gera maintains (currently healthcare providers). Returns the provider type, specialty, location, website, crawl source, and crawl date. If not in the set, says so plainly. This is Gera's first-party verification signal (distinct from third-party FSA/CQC data).

Input parameters:

- `city` (string): City to narrow the match, e.g. "Yerevan".
- `name` (string, required): Provider name, e.g. "Nairi Medical Centre".

### `check_business_trust` (~209 tokens)

Proof-of-Real: all verified signals for a business

The flagship "is this real / how trustworthy is this?" check. Given a UK business name (+ optional city/postcode and a hint of its type — food, care, healthcare), returns EVERY real verified signal Gera holds: FSA food-hygiene rating (if it is a food business in our FHRS data), CQC registration (if it is a care provider), and presence in Gera's verified-provider set — each source-attributed with an as-of date. Produces an overall_verification of "verified" (>=1 real signal found), "not_in_our_records" (no signal), so an agent can cite a grounded answer. Never fabricates: missing signals are reported as unknown.

Input parameters:

- `city` (string): City / town.
- `name` (string, required): Business name to verify.
- `postcode` (string): Full or partial UK postcode.
- `type` (string): Optional hint of business type to focus the search; omit to check all.

### `get_trust_summary` (~98 tokens)

One-line citable trust summary

Aggregate everything Gera can verify about a business into a short, citation-ready sentence (plus the structured signals behind it), so an AI agent can quote a grounded "what we can verify about X" answer. Same real data as check_business_trust, condensed. Never fabricates.

Input parameters:

- `city` (string): City / town.
- `name` (string, required): Business name.
- `postcode` (string): Full or partial UK postcode.

### `issue_attestation` (~215 tokens)

Gera Vouch: issue a signed attestation for an agent action

Before an AI agent acts on a subject (book it, pay it, recommend it), call this to get a cryptographically signed attestation receipt grounded in real Gera data. Returns verdict ("pass" = a verifying signal exists in our sources; "unverified" = not in our records — never a guess), the source-attributed signals, and an Ed25519 signature any party can verify with get_vouch_public_key. This is a signed proof-of-diligence receipt; indemnity/underwriting is roadmap and is never implied.

Input parameters:

- `city` (string): City / town.
- `claim` (string): The specific claim to attest, e.g. "is a CQC-registered care provider". Optional.
- `intended_action` (string): What the agent intends to do, recorded in the receipt, e.g. "book an appointment". Optional.
- `postcode` (string): Full or partial UK postcode.
- `subject` (string, required): Business / provider name the agent is about to act on.

### `get_vouch_public_key` (~52 tokens)

Gera Vouch: get the public key to verify attestations

Returns the Ed25519 public key (and key_id + verification recipe) used to sign Gera Vouch attestations, so any party can independently verify an issue_attestation receipt without trusting the transport.

### `issue_mandate` (~218 tokens)

Gera Agent Mandate: issue a scoped, signed spend mandate

A human or business grants an AI agent scoped, revocable authority ("agent X may spend up to N at category/merchant Y until date Z"). Returns a cryptographically signed mandate any executing party verifies with verify_mandate before honouring an action. Pure authorization — Gera moves no money here.

Input parameters:

- `agent_id` (string, required): Identifier of the agent the mandate is granted to.
- `categories` (array): Only these spend categories are permitted. Omit for any.
- `currency` (string): ISO currency code, e.g. "GBP". Defaults to GBP.
- `expires_at` (string): ISO 8601 expiry. Defaults to 30 days from now.
- `grantor` (string, required): Who is granting authority (person or business).
- `max_amount` (number): Spend cap per action in the given currency. Omit for no cap.
- `merchant_allowlist` (array): Only these merchants are permitted. Omit for any.
- `purpose` (string): Human-readable purpose recorded in the mandate.

### `verify_mandate` (~152 tokens)

Gera Agent Mandate: verify a mandate before acting

Before honouring an agent action, verify its mandate: checks the Ed25519 signature, expiry, spend cap, and merchant/category scope against the intended action. Fails closed — a forged, expired, over-cap, or out-of-scope mandate returns valid:false with reasons. Never assumes OK.

Input parameters:

- `amount` (number): Intended spend amount to check against the cap.
- `category` (string): Intended category to check against the permitted set.
- `mandate` (object, required): The mandate object returned by issue_mandate.
- `merchant` (string): Intended merchant to check against the allowlist.
- `signature_b64url` (string, required): The signature.signature_b64url from issue_mandate.

### `issue_receipt` (~274 tokens)

Gera Ledger: issue a signed receipt for a completed agent action

After an AI agent acts (books, pays, dispatches), mint a cryptographically signed receipt recording what happened, optionally referencing the Vouch attestation and/or Agent Mandate it acted under. Any party verifies it with verify_receipt + the public key from get_vouch_public_key. A verifiable proof-of-action — not a settlement; Gera moves no money here.

Input parameters:

- `action` (string, required): What the agent did, e.g. "booked a cleaner".
- `agent_id` (string, required): Identifier of the acting agent.
- `amount` (number): Amount involved, if any.
- `attestation_signature` (string): The Vouch attestation signature relied on (links the receipt to its diligence).
- `currency` (string): ISO currency code. Defaults to GBP when amount is set.
- `evidence` (array): Evidence references (URLs, geo/photo/check-in IDs). Stored verbatim, not validated.
- `mandate_signature` (string): The mandate signature this action was authorised under (links the receipt to its mandate).
- `occurred_at` (string): ISO 8601 time the action occurred. Defaults to now.
- `outcome` (string): Action outcome. Defaults to completed.
- `subject` (string, required): Who/what the action was taken on (merchant, provider, counterparty).

### `verify_receipt` (~94 tokens)

Gera Ledger: verify a signed action receipt

Verify a receipt from issue_receipt: checks the Ed25519 signature against the Gera issuer key. Returns signature_valid plus the receipt, so any party can confirm Gera recorded this action without trusting the transport. Fails closed on any alteration.

Input parameters:

- `receipt` (object, required): The receipt object returned by issue_receipt.
- `signature_b64url` (string, required): The signature.signature_b64url from issue_receipt.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/services-gera-mcp-gera-verify/gera-services-mcp-gera-verify#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 58
- 2026-08-01: 15
- 2026-07-31: 0
- 2026-07-30: 20
- 2026-07-28: 38
- 2026-07-27: 38

## Links

- npm package: https://www.npmjs.com/package/@gera-services/mcp-gera-verify
- Socket report: https://socket.dev/npm/package/@gera-services/mcp-gera-verify
- Website: https://gera.services/
- Changelog RSS feed: https://verifymcp.io/servers/services-gera-mcp-gera-verify/gera-services-mcp-gera-verify/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/services-gera-mcp-gera-verify/gera-services-mcp-gera-verify/changelog.json
- HTML version of this page: https://verifymcp.io/servers/services-gera-mcp-gera-verify/gera-services-mcp-gera-verify