# io.github.vdappdev2/data (npm · @verusidx/data-mcp)

MCP server for Verus on-chain data retrieval, decryption, signing, and verification

- Trust score: 66/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@verusidx/data-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/vdappdev2-data/verusidx-data-mcp.md), [page](https://verifymcp.io/servers/vdappdev2-data/verusidx-data-mcp)

## Channel facts

- Registry: `npm`
- Package: `@verusidx/data-mcp`
- Version: `0.1.7`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 84 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1969 tokens (~281/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add vdappdev2-data -- npx -y @verusidx/data-mcp
```

### Codex

```bash
codex mcp add vdappdev2-data -- npx -y @verusidx/data-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vdappdev2-data": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@verusidx/data-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add vdappdev2-data --command npx --arg -y --arg @verusidx/data-mcp
```

### Hermes

```yaml
mcp_servers:
  vdappdev2-data:
    command: "npx"
    args: ["-y", "@verusidx/data-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "vdappdev2-data": {
      "command": "npx",
      "args": [
        "-y",
        "@verusidx/data-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 65, +47)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 18, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, 0)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −18)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 42)

First indexed and scored.

## MCP tools (7)

### `z_listreceivedbyaddress` (~153 tokens)

List transactions and data received at a shielded (z) address. Data transactions appear with amount: 0 and a memo containing the data descriptor (a JSON object keyed by the VDXF datadescriptor address). Use this as step 1 of the data retrieval pipeline: list received data, then pass the descriptor to decryptdata. Value transactions appear with their amount and standard memo.

Input parameters:

- `address` (string, required): The shielded (zs-) address to list received transactions for.
- `chain` (string, required): Chain to query (e.g., "VRSC", "vrsctest")
- `minconf` (number): Only include transactions confirmed at least this many times. Default: 1.

### `decryptdata` (~370 tokens)

Decrypt data stored on-chain. Accepts a data descriptor (from z_listreceivedbyaddress memo), viewing key (EVK or IVK), and optional txid. With retrieve: true, the daemon fetches and decrypts the referenced data. Always pass the EVK (from z_exportviewingkey) — without it the daemon returns still-encrypted data even if the wallet holds the spending key. For encrypted identity content, pass the original encrypted DataDescriptor from signdata (not the on-chain version, which may have modified flags). Alternatively, use iddata to query and decrypt identity content by identityid and vdxfkey.

Input parameters:

- `chain` (string, required): Chain to query (e.g., "VRSC", "vrsctest")
- `datadescriptor` (object): Data descriptor object to decrypt. Typically the JSON object from z_listreceivedbyaddress memo (the value under the i4GC1YGEVD21... VDXF key). Either datadescriptor or iddata is required.
- `evk` (string): Sapling extended full viewing key for decryption. Always pass this — export via z_exportviewingkey. Without it, data is returned still encrypted.
- `iddata` (object): Query identity content and decrypt in one step. Alternative to datadescriptor. Returns an error if the identity has no stored content for the given parameters. Note: may fail for encrypted content st…
- `ivk` (string): Hex incoming viewing key for decryption.
- `retrieve` (boolean): If true, fetch the data from its on-chain reference and decrypt. Default: false.
- `txid` (string): Transaction ID containing the data. Required when retrieve is true and the data references the same transaction.

### `z_exportviewingkey` (~109 tokens)

Export the extended viewing key (EVK) for a shielded address. The viewing key allows decryption of all data encrypted to this z-address without granting spending authority. Share it to grant read-only access. Pass the returned key as the evk parameter to decryptdata.

Input parameters:

- `address` (string, required): The shielded (zs-) address to export the viewing key for.
- `chain` (string, required): Chain to query (e.g., "VRSC", "vrsctest")

### `z_viewtransaction` (~91 tokens)

View detailed shielded transaction information including spends and outputs for a z-transaction in the wallet. Shows addresses, amounts, memos, and output indices. Useful for inspecting data-carrying transactions to understand their structure before decryption.

Input parameters:

- `chain` (string, required): Chain to query (e.g., "VRSC", "vrsctest")
- `txid` (string, required): Transaction ID to inspect.

### `signdata` (~733 tokens)

Sign data with a VerusID or transparent address. Generates a hash of the provided data and signs it. Supports multiple input modes (message, file, hex, base64, pre-computed hash, vdxfdata) and hash algorithms (sha256, sha256D, blake2b, keccak256). Can sign a single piece of data or build a Merkle Mountain Range (MMR) over multiple items. For multi-sig identities, pass an existing partial signature to accumulate signatures. Can also encrypt data to a z-address via encrypttoaddress — returns both plaintext and encrypted versions with an SSK for selective disclosure. Supports vdxfdata input — as a string (equivalent to message) or as a JSON object (VDXF binary serialization, producing a different hash). Use the object form to sign data in the same canonical format as on-chain identity contentmultimap entries. Available in read-only mode — signing does not spend funds or change blockchain/wallet state.

Input parameters:

- `address` (string, required): VerusID name or R-address to sign with. A R-address produces a simple signature.
- `boundhashes` (array): Array of hex hashes to bind to the signature.
- `chain` (string, required): Chain to sign on (e.g., "VRSC", "vrsctest")
- `createmmr` (boolean): If true (or if multiple items are provided), returns MMR data and root signature.
- `datahash` (string): Pre-computed 256-bit hex hash to sign directly.
- `encrypttoaddress` (string): Sapling z-address to encrypt data to. Returns both encrypted and plaintext versions. The encrypted DataDescriptor can be stored on an identity via updateidentity or sent via sendcurrency.
- `filename` (string): File path to sign. Requires -enablefileencryption daemon flag.
- `hashtype` (string): Hash algorithm: "sha256" (default), "sha256D", "blake2b", "keccak256".
- `message` (string): Text message to sign.
- `messagebase64` (string): Base64-encoded data to sign. Note: may not work in all daemon versions — prefer messagehex if base64 fails.
- `messagehex` (string): Hex-encoded data to sign.
- `mmrdata` (array): Array of data objects for MMR signing. Each element: {"filename" or "message" or "serializedhex" or "serializedbase64" or "vdxfdata" or "datahash": "value"}.
- `mmrhashtype` (string): Hash type for MMR: "sha256", "sha256D", "blake2b", "keccak256". Default: "blake2b".
- `mmrsalt` (array): Array of salt strings to protect privacy of MMR leaf nodes.
- `prefixstring` (string): Extra string hashed during signing — must be supplied for verification.
- `signature` (string): Existing base64 signature for multi-sig accumulation.
- `vdxfdata`: VDXF-encoded structured data. String form hashes the raw string (equivalent to message). Object form performs VDXF binary serialization before hashing — use for canonical signing of VDXF-structured c…
- `vdxfkeynames` (array): Array of VDXF key names or friendly name IDs (no i-addresses).
- `vdxfkeys` (array): Array of VDXF keys or i-addresses to bind to the signature.

### `verifysignature` (~338 tokens)

Verify a signature produced by signdata. Checks that the signature is valid for the given data and identity/address. Returns signaturestatus: "verified" or "invalid" — always check this field. By default, validates against the identity's keys at the block height stored in the signature — use checklatest to verify against the identity's current keys instead.

Input parameters:

- `address` (string, required): VerusID name or R-address to verify against.
- `boundhashes` (array): Hashes bound during signing (must match).
- `chain` (string, required): Chain to verify on (e.g., "VRSC", "vrsctest")
- `checklatest` (boolean): If true, verify against the identity's current keys. Default: false (verify against keys at the signing height stored in the signature).
- `datahash` (string): Pre-computed 256-bit hex hash that was signed.
- `filename` (string): File path that was signed.
- `hashtype` (string): Hash algorithm used during signing. Default: "sha256".
- `message` (string): Text message that was signed.
- `messagebase64` (string): Base64-encoded data that was signed.
- `messagehex` (string): Hex-encoded data that was signed.
- `prefixstring` (string): Prefix string used during signing (must match).
- `signature` (string, required): Base64-encoded signature to verify.
- `vdxfkeynames` (array): VDXF key names bound during signing (must match).
- `vdxfkeys` (array): VDXF keys bound during signing (must match).

### `z_importviewingkey` (~175 tokens)

Import a viewing key to enable decryption of data encrypted to another z-address. Grants read-only access without spending authority. The key can be obtained from z_exportviewingkey. After import, decryptdata can decrypt data encrypted to that address without passing the key explicitly. Note: rescan can take minutes if scanning a large block range.

Input parameters:

- `chain` (string, required): Chain to import on (e.g., "VRSC", "vrsctest")
- `rescan` (string): Whether to rescan the wallet for transactions: "yes", "no", or "whenkeyisnew" (default).
- `startHeight` (number): Block height to start rescan from. Default: 0.
- `vkey` (string, required): The viewing key to import (from z_exportviewingkey).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/vdappdev2-data/verusidx-data-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 65
- 2026-08-01: 18
- 2026-07-31: 18
- 2026-07-30: 24
- 2026-07-28: 24
- 2026-07-27: 42

## Links

- npm package: https://www.npmjs.com/package/@verusidx/data-mcp
- Socket report: https://socket.dev/npm/package/@verusidx/data-mcp
- Repository: https://github.com/vdappdev2/verusidx-mcp
- Changelog RSS feed: https://verifymcp.io/servers/vdappdev2-data/verusidx-data-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/vdappdev2-data/verusidx-data-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/vdappdev2-data/verusidx-data-mcp