{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T18:59:19.263Z","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr","markdownUrl":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr.md","server":{"slug":"theluckystrike-expenses","name":"io.github.theluckystrike/expenses","registryName":"io.github.theluckystrike/expenses","description":"Log expenses, receipts and mileage from chat: categorise, split VAT, summarise, export.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr","type":"mcpb","identifier":"https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/expense-tracker.mcpb","withdrawn":false,"url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr","version":"0.22.5","transport":"stdio","scoredAt":"2026-11-05T09:55:35.034Z"},"score":{"total":5,"tier":"low","status":"scored","weekDelta":0,"history":[{"date":"2026-11-05","total":5},{"date":"2026-11-04","total":5},{"date":"2026-11-03","total":5},{"date":"2026-11-02","total":5},{"date":"2026-11-01","total":5},{"date":"2026-10-31","total":5},{"date":"2026-10-30","total":5},{"date":"2026-10-29","total":5},{"date":"2026-10-28","total":5},{"date":"2026-10-27","total":5},{"date":"2026-10-26","total":5},{"date":"2026-10-25","total":5},{"date":"2026-10-24","total":5},{"date":"2026-10-23","total":5},{"date":"2026-10-22","total":5},{"date":"2026-10-21","total":5},{"date":"2026-10-20","total":5},{"date":"2026-10-19","total":5},{"date":"2026-10-18","total":5},{"date":"2026-10-17","total":5},{"date":"2026-10-16","total":5},{"date":"2026-10-15","total":5},{"date":"2026-10-14","total":5},{"date":"2026-10-13","total":56},{"date":"2026-10-12","total":56},{"date":"2026-10-10","total":55},{"date":"2026-10-04","total":58},{"date":"2026-10-03","total":58},{"date":"2026-10-02","total":57},{"date":"2026-10-01","total":57}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Install-script risk could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Dependency health could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"bundle_digest_mismatch"}},{"code":"installscript.inconclusive","args":{"reason":"bundle_digest_mismatch"}},{"code":"dephealth.inconclusive","args":{"reason":"bundle_digest_mismatch"}}]},{"name":"Provenance & Transparency","score":26,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Build provenance could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Licence could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Maintenance history could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.inconclusive","args":{"reason":"bundle_digest_mismatch"}},{"code":"license.inconclusive","args":{"reason":"bundle_digest_mismatch"}},{"code":"maintenance.inconclusive","args":{"reason":"bundle_digest_mismatch"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":0,"verdict":"unverified","reasons":["Schema quality not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no schema to assess."],"codes":[{"code":"schema.sandbox_failed","args":{"reason":"bundle_digest_mismatch","status":"unsupported"}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no schema to compare."],"codes":[{"code":"stability.sandbox_failed","args":{"reason":"bundle_digest_mismatch","status":"unsupported"}}]},{"name":"Tool Coverage","score":0,"verdict":"unverified","reasons":["Tool coverage not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no tool definitions to assess."],"codes":[{"code":"toolquality.sandbox_failed","args":{"reason":"bundle_digest_mismatch","status":"unsupported"}}]},{"name":"Tool Safety","score":0,"verdict":"unverified","reasons":["Tool safety not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no tool text to scan."],"codes":[{"code":"toolsafety.sandbox_failed","args":{"reason":"bundle_digest_mismatch","status":"unsupported"}}]},{"name":"Capabilities","score":0,"verdict":"unverified","reasons":["Protocol version not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we never saw its MCP handshake."],"codes":[{"code":"cap.sandbox_failed","args":{"reason":"bundle_digest_mismatch","status":"unsupported"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Install-script risk could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Dependency health could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Build provenance could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Licence could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Maintenance history could not be checked: the bundle we downloaded does not match the SHA-256 its registry entry declares, so we did not read it. Either the file changed after that digest was published or the digest is wrong; check the file before you install it.","Schema quality not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no schema to assess.","Stability not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no schema to compare.","Tool coverage not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no tool definitions to assess.","Tool safety not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we have no tool text to scan.","Protocol version not yet verified: the bundle we downloaded does not match the SHA-256 its registry entry declares, and we do not run a bundle that fails that check, so we never saw its MCP handshake."],"malware":[],"components":[{"slug":"https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr","type":"mcpb","identifier":"https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/expense-tracker.mcpb","withdrawn":false,"score":5,"current":true,"url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr","markdownUrl":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr.md"}],"facts":[{"label":"Registry","value":"mcpb"},{"label":"Package","value":"https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/expense-tracker.mcpb"},{"label":"Version","value":"0.22.5"},{"label":"Transport","value":"stdio"},{"label":"SHA-256","value":"cb32253318fb895825b8ee44160998fc9fcafe7e3a0551af85625182208c8f6a"}],"install":{"available":true,"bundleSha256":"cb32253318fb895825b8ee44160998fc9fcafe7e3a0551af85625182208c8f6a"},"tools":[],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T09:55:35.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"inconclusive","label":"Inconclusive","reason":"bundle_digest_mismatch","reasonLabel":"Bundle differs from the registry digest","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[{"kind":"bundle_digest","title":"Bundle digest","declared":"cb32253318fb895825b8ee44160998fc9fcafe7e3a0551af85625182208c8f6a","observed":"The bundle hashes to a different SHA-256 (the observed digest is not recorded)","consequence":"The bundle we downloaded does not hash to the SHA-256 the registry entry declares, so we did not read it or look for an attestation. This is a fact about the published file.","evidenceUrl":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#diagnostics-provenance"}],"changelog":{"trackingSince":"2026-09-07","recent":[{"id":"chg_01a19684-2a15-753e-9693-d8a3eca88c5f","kind":"package.version_changed","summary":"Package version (0.21.0 → 0.22.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a19684-2a15-753e-9693-d8a3eca88c5f"},{"id":"chg_01a18c37-771d-785a-8563-7c4ae9827437","kind":"package.version_changed","summary":"Package version (0.21.0 → 0.22.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a18c37-771d-785a-8563-7c4ae9827437"},{"id":"chg_01a181e6-f591-70a6-b2d9-9e96a9e86062","kind":"package.version_changed","summary":"Package version (0.21.0 → 0.22.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a181e6-f591-70a6-b2d9-9e96a9e86062"},{"id":"chg_01a17cbd-12b2-7b36-9c57-20f75e6f38ac","kind":"package.version_changed","summary":"Package version (0.21.0 → 0.22.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a17cbd-12b2-7b36-9c57-20f75e6f38ac"},{"id":"chg_01a15383-7b57-7acd-8e2d-5171c2286163","kind":"package.version_changed","summary":"Package version (0.21.0 → 0.22.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-19","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a15383-7b57-7acd-8e2d-5171c2286163"},{"id":"chg_01a13c42-757c-7dbd-bb94-63bded07fae7","kind":"check.unverifiable","summary":"Capabilities (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a13c42-757c-7dbd-bb94-63bded07fae7"},{"id":"chg_01a13c42-757c-7005-9f8f-4c5f9403b4d6","kind":"check.unverifiable","summary":"Tool coverage (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a13c42-757c-7005-9f8f-4c5f9403b4d6"},{"id":"chg_01a13c42-7578-7c87-a873-398b15d1b74b","kind":"check.unverifiable","summary":"Tool safety (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a13c42-7578-7c87-a873-398b15d1b74b"},{"id":"chg_01a13c42-7577-7790-9dc3-973c4dd6f324","kind":"check.unverifiable","summary":"Stability (0.73 → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a13c42-7577-7790-9dc3-973c4dd6f324"},{"id":"chg_01a13c42-757f-74d5-bbb0-997ec6fb78d5","kind":"check.unverifiable","summary":"Schema quality (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a13c42-757f-74d5-bbb0-997ec6fb78d5"},{"id":"chg_01a1392f-e2f5-7964-8fa8-634e12deacbf","kind":"check.unverifiable","summary":"Maintenance (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f5-7964-8fa8-634e12deacbf"},{"id":"chg_01a1392f-e2f6-774a-a218-a38e53121458","kind":"score.total_changed","summary":"Trust score (56 → 5)","materiality":"functional","direction":"regression","scoreDelta":-51,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f6-774a-a218-a38e53121458"},{"id":"chg_01a1392f-e2f6-732c-9113-b5f92e082569","kind":"package.version_changed","summary":"Package version (0.21.0 → 0.22.5)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f6-732c-9113-b5f92e082569"},{"id":"chg_01a1392f-e2f0-7415-9c54-3cd38047a4ff","kind":"check.unverifiable","summary":"Install scripts (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f0-7415-9c54-3cd38047a4ff"},{"id":"chg_01a1392f-e2f0-7f3c-ac46-e907f67b7eb7","kind":"check.unverifiable","summary":"Dependency health (0.80 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f0-7f3c-ac46-e907f67b7eb7"},{"id":"chg_01a1392f-e2f3-78d9-8da9-3fb0fa978e90","kind":"check.unverifiable","summary":"Capabilities (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f3-78d9-8da9-3fb0fa978e90"},{"id":"chg_01a1392f-e2f3-7edf-b8d6-be31be703249","kind":"check.unverifiable","summary":"License (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f3-7edf-b8d6-be31be703249"},{"id":"chg_01a1392f-e2f4-75d1-bd91-5573971c1e45","kind":"check.unverifiable","summary":"Tool coverage (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f4-75d1-bd91-5573971c1e45"},{"id":"chg_01a1392f-e2f5-7443-aa88-9c8161c41c94","kind":"check.unverifiable","summary":"Schema quality (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f5-7443-aa88-9c8161c41c94"},{"id":"chg_01a1392f-e2f5-7d9a-b17d-1e0c66e39bc4","kind":"license.changed","summary":"Licence (MIT)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr#chg-chg_01a1392f-e2f5-7d9a-b17d-1e0c66e39bc4"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr/changelog.json"},"links":{"html":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr","markdown":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr.md","changelogJson":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr/changelog.json","changelogRss":"https://verifymcp.io/servers/theluckystrike-expenses/https-github-com-theluckystrike-mcp-servers-releases-download-v0-21-0-expense-tr.xml","external":[{"label":"Repository","href":"https://github.com/theluckystrike/mcp-servers"},{"label":"Website","href":"https://mcp.zovo.one/s/expense-tracker"}]}}