{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T17:09:04.345Z","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp","markdownUrl":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp.md","server":{"slug":"shafthq-shaft-mcp","name":"shaft-mcp","registryName":"io.github.ShaftHQ/shaft-mcp","description":"SHAFT browser automation, capture, and offline deterministic failure diagnosis","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"ghcr-io-shafthq-shaft-engine-mcp","type":"oci","identifier":"ghcr.io/shafthq/shaft-engine-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp","version":"10.4.20261102","transport":"stdio","scoredAt":"2026-11-05T06:03:40.223Z"},"score":{"total":19,"tier":"low","status":"scored","weekDelta":-1,"history":[{"date":"2026-11-05","total":19},{"date":"2026-11-04","total":20},{"date":"2026-11-03","total":20},{"date":"2026-11-02","total":20},{"date":"2026-11-01","total":20},{"date":"2026-10-31","total":20},{"date":"2026-10-30","total":20},{"date":"2026-10-29","total":20},{"date":"2026-10-28","total":20},{"date":"2026-10-27","total":20},{"date":"2026-10-26","total":20},{"date":"2026-10-25","total":20},{"date":"2026-10-24","total":20},{"date":"2026-10-23","total":20},{"date":"2026-10-22","total":20},{"date":"2026-10-21","total":20},{"date":"2026-10-20","total":20},{"date":"2026-10-19","total":10},{"date":"2026-10-18","total":10},{"date":"2026-10-17","total":10},{"date":"2026-10-16","total":10},{"date":"2026-10-15","total":10},{"date":"2026-10-14","total":10},{"date":"2026-10-13","total":10},{"date":"2026-10-12","total":10},{"date":"2026-10-10","total":10},{"date":"2026-10-07","total":10},{"date":"2026-10-05","total":10},{"date":"2026-10-04","total":10},{"date":"2026-10-03","total":10}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.","Install-script risk not yet assessed.","Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"no_sbom_attached"}},{"code":"installscript.inconclusive","args":{"reason":"no_install_concept"}},{"code":"dephealth.inconclusive","args":{"reason":"no_sbom_attached"}}]},{"name":"Provenance & Transparency","score":97,"verdict":"unverified","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to ShaftHQ/SHAFT_ENGINE).","Clear OSI-approved license (MIT).","Actively maintained (last published 10 days ago).","Security-disclosure policy not yet verified: we couldn't inspect the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"ShaftHQ/SHAFT_ENGINE"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"10"}},{"code":"disclosure.repo_inconclusive","args":{"reason":"repo_unreachable"}}]},{"name":"Schema Quality & AI Usability","score":0,"verdict":"unverified","reasons":["Schema quality not yet verified: this package installed, but its server did not start, so we have no schema to assess."],"codes":[{"code":"schema.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: this package installed, but its server did not start, so we have no schema to compare."],"codes":[{"code":"stability.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Tool Coverage","score":0,"verdict":"unverified","reasons":["Tool coverage not yet verified: this package installed, but its server did not start, so we have no tool definitions to assess."],"codes":[{"code":"toolquality.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Tool Safety","score":0,"verdict":"unverified","reasons":["Tool safety not yet verified: this package installed, but its server did not start, so we have no tool text to scan."],"codes":[{"code":"toolsafety.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]},{"name":"Capabilities","score":0,"verdict":"unverified","reasons":["Protocol version not yet verified: this package installed, but its server did not start, so we never saw its MCP handshake."],"codes":[{"code":"cap.sandbox_failed","args":{"reason":"startup_failure","status":"unreachable"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.","Install-script risk not yet assessed.","Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.","Security-disclosure policy not yet verified: we couldn't inspect the source repository.","Schema quality not yet verified: this package installed, but its server did not start, so we have no schema to assess.","Stability not yet verified: this package installed, but its server did not start, so we have no schema to compare.","Tool coverage not yet verified: this package installed, but its server did not start, so we have no tool definitions to assess.","Tool safety not yet verified: this package installed, but its server did not start, so we have no tool text to scan.","Protocol version not yet verified: this package installed, but its server did not start, so we never saw its MCP handshake."],"malware":[],"components":[{"slug":"ghcr-io-shafthq-shaft-engine-mcp","type":"oci","identifier":"ghcr.io/shafthq/shaft-engine-mcp","withdrawn":false,"score":19,"current":true,"url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp","markdownUrl":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp.md"}],"facts":[{"label":"Registry","value":"oci"},{"label":"Package","value":"ghcr.io/shafthq/shaft-engine-mcp"},{"label":"Version","value":"10.4.20261102"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T06:03:40.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"referrers","discoveryLabel":"OCI referrers API","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-09-30","recent":[{"id":"chg_01a1aa4e-4ba4-70b1-b499-e8a875bee2ca","kind":"score.total_changed","summary":"Trust score (20 → 19)","materiality":"functional","direction":"regression","scoreDelta":-1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1aa4e-4ba4-70b1-b499-e8a875bee2ca"},{"id":"chg_01a1aa4e-4ba1-741f-b9d0-04c451102589","kind":"check.unverifiable","summary":"Security disclosure (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1aa4e-4ba1-741f-b9d0-04c451102589"},{"id":"chg_01a1987c-942b-74a6-b771-4494aa664bbd","kind":"package.version_changed","summary":"Package version (10.4.20261031 → 10.4.20261102)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1987c-942b-74a6-b771-4494aa664bbd"},{"id":"chg_01a197d7-ca7a-7855-bf39-30be0747a236","kind":"check.reason","summary":"Tool coverage (Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a197d7-ca7a-7855-bf39-30be0747a236"},{"id":"chg_01a197d7-ca7a-7e31-bd63-00b9dbee601d","kind":"check.reason","summary":"Schema quality (Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a197d7-ca7a-7e31-bd63-00b9dbee601d"},{"id":"chg_01a197d7-ca7b-7434-8028-a79a3653d3d0","kind":"package.version_changed","summary":"Package version (10.4.20261031 → 10.4.20261101)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a197d7-ca7b-7434-8028-a79a3653d3d0"},{"id":"chg_01a197d7-ca7a-70d1-bfa2-d7dff9188cf9","kind":"check.reason","summary":"Capabilities (Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a197d7-ca7a-70d1-bfa2-d7dff9188cf9"},{"id":"chg_01a197d7-ca75-786b-a81e-df555bd6b9e4","kind":"check.reason","summary":"Tool safety (Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a197d7-ca75-786b-a81e-df555bd6b9e4"},{"id":"chg_01a197d7-ca79-78f8-b667-47918fe19714","kind":"check.reason","summary":"Stability (Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a197d7-ca79-78f8-b667-47918fe19714"},{"id":"chg_01a19192-ff4b-7c3b-a60c-d8f5cd3da456","kind":"package.version_changed","summary":"Package version (10.4.20261029 → 10.4.20261031)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a19192-ff4b-7c3b-a60c-d8f5cd3da456"},{"id":"chg_01a1882e-0e32-767a-afb7-077c62d80f12","kind":"check.reason","summary":"Tool coverage (Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1882e-0e32-767a-afb7-077c62d80f12"},{"id":"chg_01a1882e-0e2e-7d99-bf29-7af6eaadc71e","kind":"check.reason","summary":"Tool safety (Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1882e-0e2e-7d99-bf29-7af6eaadc71e"},{"id":"chg_01a1882e-0e30-7bdc-bb3c-0e93714c8766","kind":"check.reason","summary":"Stability (Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1882e-0e30-7bdc-bb3c-0e93714c8766"},{"id":"chg_01a1882e-0e31-72ee-912b-db85281b95b0","kind":"check.reason","summary":"Capabilities (Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1882e-0e31-72ee-912b-db85281b95b0"},{"id":"chg_01a1882e-0e33-75bc-98c4-1b19b7b68ca7","kind":"check.reason","summary":"Schema quality (Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1882e-0e33-75bc-98c4-1b19b7b68ca7"},{"id":"chg_01a1882e-0e34-78dc-8b40-897444b64a66","kind":"package.version_changed","summary":"Package version (10.4.20261024 → 10.4.20261029)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a1882e-0e34-78dc-8b40-897444b64a66"},{"id":"chg_01a16bc7-fe67-7606-b9af-d3b08dba97c8","kind":"package.version_changed","summary":"Package version (10.4.20261020 → 10.4.20261024)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a16bc7-fe67-7606-b9af-d3b08dba97c8"},{"id":"chg_01a158b2-0594-76f2-8d30-88f0a97d2646","kind":"score.total_changed","summary":"Trust score (10 → 20)","materiality":"functional","direction":"improvement","scoreDelta":10,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a158b2-0594-76f2-8d30-88f0a97d2646"},{"id":"chg_01a158b2-0592-703e-8585-278ad1f11e0c","kind":"check.verdict","summary":"Provenance (fail → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a158b2-0592-703e-8585-278ad1f11e0c"},{"id":"chg_01a158b2-0593-7b03-8207-a22189c21290","kind":"provenance.repo_changed","summary":"The attested source repository moved (ShaftHQ/SHAFT_ENGINE)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp#chg-chg_01a158b2-0593-7b03-8207-a22189c21290"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp","markdown":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp.md","changelogJson":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/shafthq-shaft-mcp/ghcr-io-shafthq-shaft-engine-mcp.xml","external":[{"label":"GitHub Container Registry","href":"https://ghcr.io/shafthq/shaft-engine-mcp"},{"label":"Repository","href":"https://github.com/ShaftHQ/SHAFT_ENGINE"},{"label":"Website","href":"https://shafthq.github.io/"}]}}