io.github.vdappdev2/data
NPM · @VERUSIDX/DATA-MCP · SCANNED AUG 3
MCP server for Verus on-chain data retrieval, decryption, signing, and verification
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 84 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability60
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1969 tokens (~281/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @verusidx/data-mcp
claude mcp add vdappdev2-data -- npx -y @verusidx/data-mcp
codex mcp add vdappdev2-data -- npx -y @verusidx/data-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vdappdev2-data": {
"type": "local",
"command": [
"npx",
"-y",
"@verusidx/data-mcp"
],
"enabled": true
}
}
} openclaw mcp add vdappdev2-data --command npx --arg -y --arg @verusidx/data-mcp
mcp_servers:
vdappdev2-data:
command: "npx"
args: ["-y", "@verusidx/data-mcp"] {
"mcpServers": {
"vdappdev2-data": {
"command": "npx",
"args": [
"-y",
"@verusidx/data-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +47
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.20 ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
- 31 Jul 26 −6
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- Malware scan: pass → unverified ▼ security
- Tool coverage: unverified → 100 ▲ functional
- 28 Jul 26 −18
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 42
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@verusidx/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 96 packages
96 packages in the resolved dependency tree · 96 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
decryptdata ~370
Decrypt data stored on-chain. Accepts a data descriptor (from z_listreceivedbyaddress memo), viewing key (EVK or IVK), and optional txid. With retrieve: true, the daemon fetches and decrypts the referenced data. Always pass the EVK (from z_exportviewingkey) — without it the daemon returns still-encrypted data even if the wallet holds the spending key. For encrypted identity content, pass the original encrypted DataDescriptor from signdata (not the on-chain version, which may have modified flags). Alternatively, use iddata to query and decrypt identity content by identityid and vdxfkey.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | yes | Chain to query (e.g., "VRSC", "vrsctest") |
| datadescriptor | object | — | Data descriptor object to decrypt. Typically the JSON object from z_listreceivedbyaddress memo (the value under the i4GC1YGEVD21... VDXF key). Either datadescriptor or iddata is required. |
| evk | string | — | Sapling extended full viewing key for decryption. Always pass this — export via z_exportviewingkey. Without it, data is returned still encrypted. |
| iddata | object | — | Query identity content and decrypt in one step. Alternative to datadescriptor. Returns an error if the identity has no stored content for the given parameters. Note: may fail for encrypted content st… |
| ivk | string | — | Hex incoming viewing key for decryption. |
| retrieve | boolean | — | If true, fetch the data from its on-chain reference and decrypt. Default: false. |
| txid | string | — | Transaction ID containing the data. Required when retrieve is true and the data references the same transaction. |
No output schema declared.
No examples provided.
signdata ~733
Sign data with a VerusID or transparent address. Generates a hash of the provided data and signs it. Supports multiple input modes (message, file, hex, base64, pre-computed hash, vdxfdata) and hash algorithms (sha256, sha256D, blake2b, keccak256). Can sign a single piece of data or build a Merkle Mountain Range (MMR) over multiple items. For multi-sig identities, pass an existing partial signature to accumulate signatures. Can also encrypt data to a z-address via encrypttoaddress — returns both plaintext and encrypted versions with an SSK for selective disclosure. Supports vdxfdata input — as a string (equivalent to message) or as a JSON object (VDXF binary serialization, producing a different hash). Use the object form to sign data in the same canonical format as on-chain identity contentmultimap entries. Available in read-only mode — signing does not spend funds or change blockchain/wallet state.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | VerusID name or R-address to sign with. A R-address produces a simple signature. |
| boundhashes | array | — | Array of hex hashes to bind to the signature. |
| chain | string | yes | Chain to sign on (e.g., "VRSC", "vrsctest") |
| createmmr | boolean | — | If true (or if multiple items are provided), returns MMR data and root signature. |
| datahash | string | — | Pre-computed 256-bit hex hash to sign directly. |
| encrypttoaddress | string | — | Sapling z-address to encrypt data to. Returns both encrypted and plaintext versions. The encrypted DataDescriptor can be stored on an identity via updateidentity or sent via sendcurrency. |
| filename | string | — | File path to sign. Requires -enablefileencryption daemon flag. |
| hashtype | string | — | Hash algorithm: "sha256" (default), "sha256D", "blake2b", "keccak256". |
| message | string | — | Text message to sign. |
| messagebase64 | string | — | Base64-encoded data to sign. Note: may not work in all daemon versions — prefer messagehex if base64 fails. |
| messagehex | string | — | Hex-encoded data to sign. |
| mmrdata | array | — | Array of data objects for MMR signing. Each element: {"filename" or "message" or "serializedhex" or "serializedbase64" or "vdxfdata" or "datahash": "value"}. |
| mmrhashtype | string | — | Hash type for MMR: "sha256", "sha256D", "blake2b", "keccak256". Default: "blake2b". |
| mmrsalt | array | — | Array of salt strings to protect privacy of MMR leaf nodes. |
| prefixstring | string | — | Extra string hashed during signing — must be supplied for verification. |
| signature | string | — | Existing base64 signature for multi-sig accumulation. |
| vdxfdata | — | — | VDXF-encoded structured data. String form hashes the raw string (equivalent to message). Object form performs VDXF binary serialization before hashing — use for canonical signing of VDXF-structured c… |
| vdxfkeynames | array | — | Array of VDXF key names or friendly name IDs (no i-addresses). |
| vdxfkeys | array | — | Array of VDXF keys or i-addresses to bind to the signature. |
No output schema declared.
No examples provided.
verifysignature ~338
Verify a signature produced by signdata. Checks that the signature is valid for the given data and identity/address. Returns signaturestatus: "verified" or "invalid" — always check this field. By default, validates against the identity's keys at the block height stored in the signature — use checklatest to verify against the identity's current keys instead.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | VerusID name or R-address to verify against. |
| boundhashes | array | — | Hashes bound during signing (must match). |
| chain | string | yes | Chain to verify on (e.g., "VRSC", "vrsctest") |
| checklatest | boolean | — | If true, verify against the identity's current keys. Default: false (verify against keys at the signing height stored in the signature). |
| datahash | string | — | Pre-computed 256-bit hex hash that was signed. |
| filename | string | — | File path that was signed. |
| hashtype | string | — | Hash algorithm used during signing. Default: "sha256". |
| message | string | — | Text message that was signed. |
| messagebase64 | string | — | Base64-encoded data that was signed. |
| messagehex | string | — | Hex-encoded data that was signed. |
| prefixstring | string | — | Prefix string used during signing (must match). |
| signature | string | yes | Base64-encoded signature to verify. |
| vdxfkeynames | array | — | VDXF key names bound during signing (must match). |
| vdxfkeys | array | — | VDXF keys bound during signing (must match). |
No output schema declared.
No examples provided.
z_exportviewingkey ~109
Export the extended viewing key (EVK) for a shielded address. The viewing key allows decryption of all data encrypted to this z-address without granting spending authority. Share it to grant read-only access. Pass the returned key as the evk parameter to decryptdata.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The shielded (zs-) address to export the viewing key for. |
| chain | string | yes | Chain to query (e.g., "VRSC", "vrsctest") |
No output schema declared.
No examples provided.
z_importviewingkey ~175
Import a viewing key to enable decryption of data encrypted to another z-address. Grants read-only access without spending authority. The key can be obtained from z_exportviewingkey. After import, decryptdata can decrypt data encrypted to that address without passing the key explicitly. Note: rescan can take minutes if scanning a large block range.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | yes | Chain to import on (e.g., "VRSC", "vrsctest") |
| rescan | string | — | Whether to rescan the wallet for transactions: "yes", "no", or "whenkeyisnew" (default). |
| startHeight | number | — | Block height to start rescan from. Default: 0. |
| vkey | string | yes | The viewing key to import (from z_exportviewingkey). |
No output schema declared.
No examples provided.
z_listreceivedbyaddress ~153
List transactions and data received at a shielded (z) address. Data transactions appear with amount: 0 and a memo containing the data descriptor (a JSON object keyed by the VDXF datadescriptor address). Use this as step 1 of the data retrieval pipeline: list received data, then pass the descriptor to decryptdata. Value transactions appear with their amount and standard memo.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The shielded (zs-) address to list received transactions for. |
| chain | string | yes | Chain to query (e.g., "VRSC", "vrsctest") |
| minconf | number | — | Only include transactions confirmed at least this many times. Default: 1. |
No output schema declared.
No examples provided.
z_viewtransaction ~91
View detailed shielded transaction information including spends and outputs for a z-transaction in the wallet. Shows addresses, amounts, memos, and output indices. Useful for inspecting data-carrying transactions to understand their structure before decryption.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | yes | Chain to query (e.g., "VRSC", "vrsctest") |
| txid | string | yes | Transaction ID to inspect. |
No output schema declared.
No examples provided.