{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:27:48.777Z","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp","markdownUrl":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp.md","server":{"slug":"yugantm-hvtracker-mcp","name":"HVTracker MCP","registryName":"io.github.YugantM/hvtracker-mcp","description":"Pre-connect trust checks for AI agents and MCP servers using HVTracker's public trust registry.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"ghcr-io-yugantm-hvtracker-mcp","type":"oci","identifier":"ghcr.io/yugantm/hvtracker-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp","version":"v0.4.0","transport":"stdio","scoredAt":"2026-11-05T04:32:11.205Z"},"score":{"total":46,"tier":"low","status":"scored","weekDelta":-5,"history":[{"date":"2026-11-05","total":46},{"date":"2026-11-04","total":46},{"date":"2026-11-03","total":51},{"date":"2026-11-02","total":51},{"date":"2026-11-01","total":51},{"date":"2026-10-31","total":51},{"date":"2026-10-30","total":51},{"date":"2026-10-29","total":51},{"date":"2026-10-28","total":51},{"date":"2026-10-27","total":50},{"date":"2026-10-26","total":50},{"date":"2026-10-25","total":49},{"date":"2026-10-24","total":49},{"date":"2026-10-23","total":48},{"date":"2026-10-22","total":48},{"date":"2026-10-21","total":47},{"date":"2026-10-20","total":47},{"date":"2026-10-19","total":46},{"date":"2026-10-18","total":46},{"date":"2026-10-17","total":46},{"date":"2026-10-16","total":45},{"date":"2026-10-15","total":9},{"date":"2026-10-14","total":9},{"date":"2026-10-13","total":9},{"date":"2026-10-12","total":9},{"date":"2026-10-10","total":9},{"date":"2026-10-04","total":37},{"date":"2026-10-03","total":37},{"date":"2026-10-02","total":37},{"date":"2026-10-01","total":37}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.","Install-script risk not yet assessed.","Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"no_sbom_attached"}},{"code":"installscript.inconclusive","args":{"reason":"no_install_concept"}},{"code":"dephealth.inconclusive","args":{"reason":"no_sbom_attached"}}]},{"name":"Provenance & Transparency","score":45,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (MIT).","Actively maintained (last published 36 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"36"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":69,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Tool/resource definitions use about 450 tokens (~56/item across 8 items; 8 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_lean","args":{"avg":"56","items":"8","tools":"8","tokens":"450","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":67,"verdict":"partial","reasons":["Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"20"}}]},{"name":"Tool Coverage","score":71,"verdict":"fail","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","0% of tool parameters carry a description.","Structured output schemas are declared (100% of tools); any adoption earns full credit."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"0"}},{"code":"toolquality.output_present","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"8"}},{"code":"toolsafety.manipulation_clean","args":{"units":"9","judged":"9"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.","Install-script risk not yet assessed.","Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read."],"malware":[],"components":[{"slug":"hvtracker","type":"remote","identifier":"https://hvtracker.net/mcp","withdrawn":false,"score":84,"current":false,"url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/hvtracker","markdownUrl":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/hvtracker.md"},{"slug":"hvtracker-mcp","type":"npm","identifier":"hvtracker-mcp","withdrawn":false,"score":92,"current":false,"url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/hvtracker-mcp","markdownUrl":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/hvtracker-mcp.md"},{"slug":"ghcr-io-yugantm-hvtracker-mcp","type":"oci","identifier":"ghcr.io/yugantm/hvtracker-mcp","withdrawn":false,"score":46,"current":true,"url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp","markdownUrl":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp.md"},{"slug":"hvtracker-mcp-2","type":"pypi","identifier":"hvtracker-mcp","withdrawn":false,"score":75,"current":false,"url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/hvtracker-mcp-2","markdownUrl":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/hvtracker-mcp-2.md"}],"facts":[{"label":"Registry","value":"oci"},{"label":"Package","value":"ghcr.io/yugantm/hvtracker-mcp"},{"label":"Version","value":"v0.4.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"verify_mcp_server","title":"Verify MCP Server","description":"Pre-connect trust verdict for an MCP server or AI agent.\n\n    Pass a GitHub owner/repo, GitHub URL, npm/PyPI package, display name, slug,\n    or MCP server URL. Unknown servers return trusted=false because HVTracker has\n    no independent evidence, not because harm is proven.","inputs":[{"name":"server","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":81},{"name":"check_agent_trust","title":"Check Agent Trust","description":"Get the HVTracker trust profile for a tracked AI agent or framework,\n    including its runtime capability surface and the URL of its Ed25519-signed\n    trust credential (verifiable offline).","inputs":[{"name":"name_or_repo","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":58},{"name":"compare_agents","title":"Compare Agents","description":"Compare two tracked AI agents side by side: both trust profiles, an\n    evidence-based one-line verdict, and the HVTracker compare-page URL when\n    one is published.","inputs":[{"name":"a","type":"string","required":true,"description":null},{"name":"b","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":58},{"name":"search_agents","title":"Search Agents","description":"Search tracked AI agents and frameworks by name, repo, or description.","inputs":[{"name":"category","type":"string","required":false,"description":null},{"name":"limit","type":"integer","required":false,"description":null},{"name":"query","type":"string","required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":43},{"name":"scan_stack","title":"Scan Stack","description":"Bulk pre-connect trust check for a whole dependency set. Paste a\n    requirements.txt, package.json, MCP client config, or a newline/comma list;\n    each item is returned with a trust verdict plus a stack summary.","inputs":[{"name":"input","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":61},{"name":"list_categories","title":"List Categories","description":"List HVTracker categories with agent counts (most-populated first), so you\n    can then pull a category's leaderboard.","inputs":[],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":33},{"name":"get_leaderboard","title":"Get Leaderboard","description":"Top tracked AI agents and MCP servers by HVTrust score, optionally scoped\n    to one category (exact name from list_categories).","inputs":[{"name":"category","type":"string","required":false,"description":null},{"name":"limit","type":"integer","required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":50},{"name":"get_agent_history","title":"Get Agent History","description":"90-day trust-score, grade, and rank history for one tracked agent — is it\n    improving or declining? Accepts the same identifiers as check_agent_trust.","inputs":[{"name":"name_or_repo","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":53}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T04:32:11.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-09-29","recent":[{"id":"chg_01a1a4cf-031f-75eb-9ddc-405e23ab7894","kind":"check.verdict","summary":"Stability (pass → 0.63)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1a4cf-031f-75eb-9ddc-405e23ab7894"},{"id":"chg_01a1a4cf-0325-7318-bc61-20b4575e2ecc","kind":"score.total_changed","summary":"Trust score (51 → 46)","materiality":"functional","direction":"regression","scoreDelta":-5,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1a4cf-0325-7318-bc61-20b4575e2ecc"},{"id":"chg_01a185e8-3c96-7d30-ba4a-3adf718b5e89","kind":"check.verdict","summary":"Stability (0.97 → pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a185e8-3c96-7d30-ba4a-3adf718b5e89"},{"id":"chg_01a180c0-bf33-7778-b61e-ab5752831d2e","kind":"score.total_changed","summary":"Trust score (50 → 51)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a180c0-bf33-7778-b61e-ab5752831d2e"},{"id":"chg_01a17673-b383-79e2-a06c-b1812f15493a","kind":"score.total_changed","summary":"Trust score (49 → 50)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a17673-b383-79e2-a06c-b1812f15493a"},{"id":"chg_01a16c26-0627-78ae-8829-62223b13d273","kind":"score.total_changed","summary":"Trust score (48 → 49)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-24","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a16c26-0627-78ae-8829-62223b13d273"},{"id":"chg_01a161ec-49eb-7ee4-8b76-1ac12539d69c","kind":"score.total_changed","summary":"Trust score (47 → 48)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a161ec-49eb-7ee4-8b76-1ac12539d69c"},{"id":"chg_01a1578b-fe06-78d9-9019-5f90d2f83646","kind":"score.total_changed","summary":"Trust score (46 → 47)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1578b-fe06-78d9-9019-5f90d2f83646"},{"id":"chg_01a14814-bf34-786d-9100-4ef2767f89e4","kind":"score.total_changed","summary":"Trust score (45 → 46)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-17","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a14814-bf34-786d-9100-4ef2767f89e4"},{"id":"chg_01a144f8-59e9-73e0-a350-66d83fd07ac9","kind":"score.total_changed","summary":"Trust score (9 → 45)","materiality":"functional","direction":"improvement","scoreDelta":36,"occurredOn":"2026-10-16","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a144f8-59e9-73e0-a350-66d83fd07ac9"},{"id":"chg_01a144f8-59e8-75ef-9fb4-e2caae4f93a8","kind":"check.reverified","summary":"Tool coverage (unverified → 100)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-16","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a144f8-59e8-75ef-9fb4-e2caae4f93a8"},{"id":"chg_01a144f8-59e7-7656-be0b-edc03d69d56a","kind":"check.reverified","summary":"Injection markers (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-16","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a144f8-59e7-7656-be0b-edc03d69d56a"},{"id":"chg_01a144f8-59e8-7ed5-a9df-2a3da3cf2b7f","kind":"check.reverified","summary":"MCP protocol (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-16","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a144f8-59e8-7ed5-a9df-2a3da3cf2b7f"},{"id":"chg_01a144f8-59e8-7a81-9bda-8c6a10ab0367","kind":"check.reverified","summary":"Stability (unverified → 0.57)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-16","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a144f8-59e8-7a81-9bda-8c6a10ab0367"},{"id":"chg_01a1264b-36e9-763d-8549-b76fcfa3e45b","kind":"check.appeared","summary":"First check of Schema quality (unverified)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1264b-36e9-763d-8549-b76fcfa3e45b"},{"id":"chg_01a1264b-36e0-73df-83dd-581e859e5774","kind":"check.unverifiable","summary":"Capabilities (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1264b-36e0-73df-83dd-581e859e5774"},{"id":"chg_01a1264b-36e3-71d8-869c-19fdfb7331e6","kind":"check.unverifiable","summary":"Tool coverage (100 → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1264b-36e3-71d8-869c-19fdfb7331e6"},{"id":"chg_01a1264b-36ea-7d8d-a2f4-691f218867d2","kind":"score.total_changed","summary":"Trust score (37 → 9)","materiality":"functional","direction":"regression","scoreDelta":-28,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1264b-36ea-7d8d-a2f4-691f218867d2"},{"id":"chg_01a1264b-36cf-7d35-8e1e-2d6b89023dd6","kind":"check.unverifiable","summary":"Tool safety (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1264b-36cf-7d35-8e1e-2d6b89023dd6"},{"id":"chg_01a1264b-36df-7b4e-a44e-e51eb4fbbc4f","kind":"check.reason","summary":"Stability (Stability not yet verified: this package installed, but its server did not start, so we have no schema to compare.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-10","url":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp#chg-chg_01a1264b-36df-7b4e-a44e-e51eb4fbbc4f"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp","markdown":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp.md","changelogJson":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/yugantm-hvtracker-mcp/ghcr-io-yugantm-hvtracker-mcp.xml","external":[{"label":"GitHub Container Registry","href":"https://ghcr.io/yugantm/hvtracker-mcp"},{"label":"Repository","href":"https://github.com/YugantM/hvtracker-mcp"}]}}