Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.vdappdev2/data

NPM · @VERUSIDX/DATA-MCP · SCANNED AUG 3

MCP server for Verus on-chain data retrieval, decryption, signing, and verification

Available components

+24 this week 66 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability60
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1969 tokens (~281/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @verusidx/data-mcp

# add to Claude Code
claude mcp add vdappdev2-data -- npx -y @verusidx/data-mcp
# add to Codex CLI
codex mcp add vdappdev2-data -- npx -y @verusidx/data-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vdappdev2-data": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@verusidx/data-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vdappdev2-data --command npx --arg -y --arg @verusidx/data-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vdappdev2-data:
    command: "npx"
    args: ["-y", "@verusidx/data-mcp"]
// mcp.json
{
  "mcpServers": {
    "vdappdev2-data": {
      "command": "npx",
      "args": [
        "-y",
        "@verusidx/data-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Aug 26 +47
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Tool coverage: 100 → unverified functional
    • Schema quality: unverified → excellent functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Stability: unverified → 0.20 functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Licence: MIT functional
  • 31 Jul 26 −6
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 0
    • Malware scan: pass → unverified security
    • Tool coverage: unverified → 100 functional
  • 28 Jul 26 −18
    • Tool coverage: 100 → unverified functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 42

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@verusidx/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 96 packages

96 packages in the resolved dependency tree · 96 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 7 exposed · ~1,969 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
decryptdata ~370

Decrypt data stored on-chain. Accepts a data descriptor (from z_listreceivedbyaddress memo), viewing key (EVK or IVK), and optional txid. With retrieve: true, the daemon fetches and decrypts the referenced data. Always pass the EVK (from z_exportviewingkey) — without it the daemon returns still-encrypted data even if the wallet holds the spending key. For encrypted identity content, pass the original encrypted DataDescriptor from signdata (not the on-chain version, which may have modified flags). Alternatively, use iddata to query and decrypt identity content by identityid and vdxfkey.

NameTypeReqDescription
chainstringyesChain to query (e.g., "VRSC", "vrsctest")
datadescriptorobjectData descriptor object to decrypt. Typically the JSON object from z_listreceivedbyaddress memo (the value under the i4GC1YGEVD21... VDXF key). Either datadescriptor or iddata is required.
evkstringSapling extended full viewing key for decryption. Always pass this — export via z_exportviewingkey. Without it, data is returned still encrypted.
iddataobjectQuery identity content and decrypt in one step. Alternative to datadescriptor. Returns an error if the identity has no stored content for the given parameters. Note: may fail for encrypted content st…
ivkstringHex incoming viewing key for decryption.
retrievebooleanIf true, fetch the data from its on-chain reference and decrypt. Default: false.
txidstringTransaction ID containing the data. Required when retrieve is true and the data references the same transaction.

No output schema declared.

No examples provided.

signdata ~733

Sign data with a VerusID or transparent address. Generates a hash of the provided data and signs it. Supports multiple input modes (message, file, hex, base64, pre-computed hash, vdxfdata) and hash algorithms (sha256, sha256D, blake2b, keccak256). Can sign a single piece of data or build a Merkle Mountain Range (MMR) over multiple items. For multi-sig identities, pass an existing partial signature to accumulate signatures. Can also encrypt data to a z-address via encrypttoaddress — returns both plaintext and encrypted versions with an SSK for selective disclosure. Supports vdxfdata input — as a string (equivalent to message) or as a JSON object (VDXF binary serialization, producing a different hash). Use the object form to sign data in the same canonical format as on-chain identity contentmultimap entries. Available in read-only mode — signing does not spend funds or change blockchain/wallet state.

NameTypeReqDescription
addressstringyesVerusID name or R-address to sign with. A R-address produces a simple signature.
boundhashesarrayArray of hex hashes to bind to the signature.
chainstringyesChain to sign on (e.g., "VRSC", "vrsctest")
createmmrbooleanIf true (or if multiple items are provided), returns MMR data and root signature.
datahashstringPre-computed 256-bit hex hash to sign directly.
encrypttoaddressstringSapling z-address to encrypt data to. Returns both encrypted and plaintext versions. The encrypted DataDescriptor can be stored on an identity via updateidentity or sent via sendcurrency.
filenamestringFile path to sign. Requires -enablefileencryption daemon flag.
hashtypestringHash algorithm: "sha256" (default), "sha256D", "blake2b", "keccak256".
messagestringText message to sign.
messagebase64stringBase64-encoded data to sign. Note: may not work in all daemon versions — prefer messagehex if base64 fails.
messagehexstringHex-encoded data to sign.
mmrdataarrayArray of data objects for MMR signing. Each element: {"filename" or "message" or "serializedhex" or "serializedbase64" or "vdxfdata" or "datahash": "value"}.
mmrhashtypestringHash type for MMR: "sha256", "sha256D", "blake2b", "keccak256". Default: "blake2b".
mmrsaltarrayArray of salt strings to protect privacy of MMR leaf nodes.
prefixstringstringExtra string hashed during signing — must be supplied for verification.
signaturestringExisting base64 signature for multi-sig accumulation.
vdxfdataVDXF-encoded structured data. String form hashes the raw string (equivalent to message). Object form performs VDXF binary serialization before hashing — use for canonical signing of VDXF-structured c…
vdxfkeynamesarrayArray of VDXF key names or friendly name IDs (no i-addresses).
vdxfkeysarrayArray of VDXF keys or i-addresses to bind to the signature.

No output schema declared.

No examples provided.

verifysignature ~338

Verify a signature produced by signdata. Checks that the signature is valid for the given data and identity/address. Returns signaturestatus: "verified" or "invalid" — always check this field. By default, validates against the identity's keys at the block height stored in the signature — use checklatest to verify against the identity's current keys instead.

NameTypeReqDescription
addressstringyesVerusID name or R-address to verify against.
boundhashesarrayHashes bound during signing (must match).
chainstringyesChain to verify on (e.g., "VRSC", "vrsctest")
checklatestbooleanIf true, verify against the identity's current keys. Default: false (verify against keys at the signing height stored in the signature).
datahashstringPre-computed 256-bit hex hash that was signed.
filenamestringFile path that was signed.
hashtypestringHash algorithm used during signing. Default: "sha256".
messagestringText message that was signed.
messagebase64stringBase64-encoded data that was signed.
messagehexstringHex-encoded data that was signed.
prefixstringstringPrefix string used during signing (must match).
signaturestringyesBase64-encoded signature to verify.
vdxfkeynamesarrayVDXF key names bound during signing (must match).
vdxfkeysarrayVDXF keys bound during signing (must match).

No output schema declared.

No examples provided.

z_exportviewingkey ~109

Export the extended viewing key (EVK) for a shielded address. The viewing key allows decryption of all data encrypted to this z-address without granting spending authority. Share it to grant read-only access. Pass the returned key as the evk parameter to decryptdata.

NameTypeReqDescription
addressstringyesThe shielded (zs-) address to export the viewing key for.
chainstringyesChain to query (e.g., "VRSC", "vrsctest")

No output schema declared.

No examples provided.

z_importviewingkey ~175

Import a viewing key to enable decryption of data encrypted to another z-address. Grants read-only access without spending authority. The key can be obtained from z_exportviewingkey. After import, decryptdata can decrypt data encrypted to that address without passing the key explicitly. Note: rescan can take minutes if scanning a large block range.

NameTypeReqDescription
chainstringyesChain to import on (e.g., "VRSC", "vrsctest")
rescanstringWhether to rescan the wallet for transactions: "yes", "no", or "whenkeyisnew" (default).
startHeightnumberBlock height to start rescan from. Default: 0.
vkeystringyesThe viewing key to import (from z_exportviewingkey).

No output schema declared.

No examples provided.

z_listreceivedbyaddress ~153

List transactions and data received at a shielded (z) address. Data transactions appear with amount: 0 and a memo containing the data descriptor (a JSON object keyed by the VDXF datadescriptor address). Use this as step 1 of the data retrieval pipeline: list received data, then pass the descriptor to decryptdata. Value transactions appear with their amount and standard memo.

NameTypeReqDescription
addressstringyesThe shielded (zs-) address to list received transactions for.
chainstringyesChain to query (e.g., "VRSC", "vrsctest")
minconfnumberOnly include transactions confirmed at least this many times. Default: 1.

No output schema declared.

No examples provided.

z_viewtransaction ~91

View detailed shielded transaction information including spends and outputs for a z-transaction in the wallet. Shows addresses, amounts, memos, and output indices. Useful for inspecting data-carrying transactions to understand their structure before decryption.

NameTypeReqDescription
chainstringyesChain to query (e.g., "VRSC", "vrsctest")
txidstringyesTransaction ID to inspect.

No output schema declared.

No examples provided.