Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Tersign Evidence

NPM · TERSIGN · SCANNED SEP 20

Counter-signed evidence records for agent commerce: receipts, verification, dispute envelopes.

Available components

+3 this week 88 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 111 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to tersignhq/tersign-js). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 20 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability69
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1841 tokens (~204/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
  • Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "record_refund" implies "refund" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Tersign Evidence MCP server?

Tersign Evidence runs locally as an npm package, launched with npx -y tersign. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · tersign

# add to Claude Code
claude mcp add tersignhq-evidence -- npx -y tersign
// .cursor/mcp.json
{
  "mcpServers": {
    "tersignhq-evidence": {
      "command": "npx",
      "args": [
        "-y",
        "tersign"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "tersignhq-evidence": {
      "command": "npx",
      "args": [
        "-y",
        "tersign"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add tersignhq-evidence -- npx -y tersign
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tersignhq-evidence": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "tersign"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add tersignhq-evidence --command npx --arg -y --arg tersign
# ~/.hermes/config.yaml
mcp_servers:
  tersignhq-evidence:
    command: "npx"
    args: ["-y", "tersign"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "tersignhq-evidence": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "tersign"
      ]
    }
  }
}
# add to Vellum
assistant mcp add tersignhq-evidence -t stdio -c npx -a -y tersign
// mcp.json
{
  "mcpServers": {
    "tersignhq-evidence": {
      "command": "npx",
      "args": [
        "-y",
        "tersign"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

  • 9 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 6 Sept 26 +1
    • Package version: 0.4.4 → 0.4.11 functional
  • 4 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/tersign@0.4.11

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo tersignhq/tersign-js
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/tersignhq/tersign-js/.github/workflows/publish.yml@refs/tags/v0.4.11
Rekor log index 2647681341
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:17bc24b54ef9b21f5010fcf44c4a2d1aa3a78c2c106c736fc45b06a89307a4a0a31e4ceb71083635c7d9a6f6e3d00da0a5102572ea79d6fc4c7dda21b

Background: How many MCP packages publish verified provenance →

Dependencies 111 packages
Packages resolved 111
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 9 exposed · ~1,841 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
adjudicate_dispute ~125

Trigger deterministic adjudication of an open dispute. The v0 rulebook is public and the verdict is recomputable by anyone from the chain — no discretion, no model in the loop. Side effects: writes a verdict entry, and a refund verdict automatically creates the corresponding refund record. Adjudicating twice is not meaningful; the first verdict stands. Returns the verdict, the rationale naming the rule applied, and the ledger signature over both.

NameTypeReqDescription
disputeDigeststringyes0x-prefixed digest of the open dispute to adjudicate, as returned by open_dispute

No output schema declared.

No examples provided.

get_dispute ~87

Fetch a dispute in full: its state, both sides' evidence references, the verdict and rationale once adjudicated, and the ledger signature over the record. Read-only — one network read, no key required, and safe to poll while a dispute is open.

NameTypeReqDescription
disputeDigeststringyes0x-prefixed digest of the dispute to fetch, as returned by open_dispute

No output schema declared.

No examples provided.

issue_receipt ~388

Issue an x402 offer-receipt (EIP-712) plus a Tersign action record for a payment that has ALREADY settled, and counter-sign both into your hash chain when a ledger is configured. Use this for money that moved; use record_disclosure for a non-payment agent action. Side effects: signs with TERSIGN_SELLER_KEY, and performs ONE network write to the ledger when TERSIGN_LEDGER_URL/_API_KEY/_SELLER_ID are set (without them it signs locally and returns an unchained artifact). Returns the signed receipt artifact, its keccak256 canonical digest, and — when chained — the ledger counter-signature and sequence number.

NameTypeReqDescription
currencystringsettlement currency code, e.g. "USDC" or "USD"
networkstringyessettlement network as CAIP-2, e.g. "eip155:8453" for Base mainnet
payerstringyes0x address that paid — the party who can later open a dispute against this receipt
principalstringthe party on whose authority the paying agent acted (x402 sense: the buyer who delegated). Omit when a human paid directly
resourceUrlstringyesabsolute URL of the resource that was paid for; appears verbatim in the receipt
settledAtintegerunix seconds when settlement occurred; defaults to now. Set it explicitly when back-filling
supplyDescriptionstringyeswhat was supplied, in the seller's own words; the human-readable line an auditor or venue reads
taxSchemestringtax regime the seller is accounting under; recorded, never computed — Tersign does not calculate tax
txHashstringon-chain settlement transaction hash, when one exists; omit for off-chain or fiat settlement

No output schema declared.

No examples provided.

open_dispute ~195

Open an objective dispute against a counter-signed receipt as the PAYER (the configured key must be the receipt payer). Reasons: not_delivered, wrong_content, duplicate_charge. Contested non-mechanical claims escalate to the arbiter; duplicate_charge is decided instantly from ledger arithmetic.

NameTypeReqDescription
claimAmountstringyesamount claimed back, as a decimal STRING in the receipt's settlement currency, e.g. "12.50"; must not exceed the receipt amount
reasonstringyesgrounds: 'not_delivered' nothing arrived · 'wrong_content' delivered but not what was bought · 'duplicate_charge' the same supply was billed twice (decided mechanically from the chain, no arbiter)
receiptDigeststringyes0x-prefixed keccak256 digest of the counter-signed receipt being disputed
statementstringfor humans reading the record — never an adjudication input

No output schema declared.

No examples provided.

record_disclosure ~227

One-call disclosure evidence (EU AI Act Art 50 dialect): digests the disclosure text LOCALLY, signs an action record with your key, and the public ledger counter-signs it into your per-signer hash chain. No API key needed — first call self-provisions a free signer-keyed account.

NameTypeReqDescription
agentIdstringyesstable identifier for the disclosing agent — keep it constant across calls so one chain accumulates per agent
kindstringwhat was disclosed: 'ai-interaction' = the user was told they are talking to an AI; 'synthetic-content' = output was marked machine-generated. Defaults to 'ai-interaction'
mediumstringchannel: 'chat' | 'api' | 'voice' | 'ui' …
resourceUrlstringabsolute URL of the surface the disclosure was presented on, when there is one
textstringthe disclosure text as presented — digested locally, never transmitted
textDigeststringpre-computed digest (wins over text)

No output schema declared.

No examples provided.

record_refund ~236

Record a refund against an already-chained receipt, as the SELLER. The refund becomes its own counter-signed entry that references the original — nothing is edited or deleted, so the chain stays append-only and both the charge and the refund remain visible. Requires ledger configuration (TERSIGN_LEDGER_URL/_API_KEY/_SELLER_ID) and performs one network write; errors if the original digest is not on your chain. This RECORDS a refund you have already made — it moves no money. Returns the refund record, its digest, the ledger counter-signature and sequence number.

NameTypeReqDescription
amountstringyesrefunded amount as a decimal STRING in the original settlement currency, e.g. "12.50". A string, not a number, so no precision is lost. Partial refunds are allowed
originalDigeststringyes0x-prefixed keccak256 digest of the receipt being refunded — the digest returned by issue_receipt, and it must already exist on your chain
reasonstringyeswhy the refund was issued, in your own words; recorded verbatim for whoever reads the chain later

No output schema declared.

No examples provided.

submit_dispute_evidence ~142

Submit signed evidence to an open dispute. Claimant evidence must be signed by the payer key; respondent evidence additionally requires the seller API key (TERSIGN_LEDGER_API_KEY).

NameTypeReqDescription
artifactsarrayyesat least one evidence reference; submit every artifact you want considered in a single call
disputeDigeststringyes0x-prefixed digest of the open dispute, as returned by open_dispute
rolestringyeswhich side you are filing as: 'claimant' = the payer who opened it (payer key) · 'respondent' = the seller answering it (also needs TERSIGN_LEDGER_API_KEY)

No output schema declared.

No examples provided.

verify_compliance_record ~260

Verify a Tersign action record against its attestation: recompute the record's canonical digest, confirm the attestation commits to that exact digest, and recover the signature. Fully OFFLINE — no network, no API key, no account. Use this for an action record (a disclosure or other non-payment agent action); use verify_receipt for a payment receipt. PASS proves integrity and internal consistency only. Authorship needs an out-of-band signer address: pass expectedSigner, or the identity is whatever the artifact claims about itself. Returns { valid, signer, digest }; on mismatch, valid:false plus the recovered signer and the recomputed digest.

NameTypeReqDescription
attestationobjectyesthe attestation that accompanies the record: the signature over the record digest, as returned alongside it at issuance
expectedSignerstring0x address the record MUST be signed by, obtained out-of-band (for the public ledger: https://tersign.ai/v1/ledger). Omit to recover the signer without enforcing it
recordobjectyesthe action record object as issued (ComplianceRecordV1 shape). Pass the object, not a JSON string; any field edit changes the digest and fails verification — which is the point

No output schema declared.

No examples provided.

verify_receipt ~181

Verify an offer-receipt artifact: recover the EIP-712 signature and confirm the payload digest binds to it. Fully OFFLINE — no network, no API key, no account; verifying someone else's receipt is the intended use. Use this for a receipt (money); use verify_compliance_record for an action record (a non-payment action). Returns { valid, signer, digest } and, when expectedSigner is supplied and does not match, valid:false with the recovered signer so you can see who actually signed.

NameTypeReqDescription
artifactobjectyesthe receipt artifact exactly as issued: { format, payload, signature }. Pass the object, not a JSON string
expectedSignerstring0x address the receipt MUST be signed by — obtain it out-of-band, never from the artifact. Omit to recover the signer without enforcing it

No output schema declared.

No examples provided.

Common questions

What is the Tersign Evidence MCP server?

Tersign Evidence is an MCP server listed in the public MCP registry as io.github.tersignhq/evidence. Counter-signed evidence records for agent commerce: receipts, verification, dispute envelopes. This page covers its npm package (tersign).

Is the Tersign Evidence MCP server safe to use?

Tersign Evidence scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Tersign Evidence MCP server expose?

Tersign Evidence exposes 9 tools: issue_receipt, verify_receipt, record_disclosure, verify_compliance_record, record_refund, and 4 more. Their descriptions and schemas cost roughly 1,841 tokens of context every time the server is loaded.

Is the Tersign Evidence MCP server still maintained?

Tersign Evidence is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Tersign Evidence MCP server under?

Tersign Evidence declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.