Skip to content
Agentmart
Submit a tool

Commit — Supply Chain Risk Scoring

Supply chain risk scoring for npm, PyPI, Cargo, and Go.

Connector by piiiico · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)Remote (HTTP)★ 8
Write a review

Install

Works with Claude Code, VS Code, Codex, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/piiiico-proof-of-commitment

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://poc-backend.amdal-dev.workers.dev/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
11 read · 0 write · 0 delete · 1 not yet classified
Secrets
None asked for
Install scripts
None found
Runs as
Node.js package

Tools by what they do 12

From the running server's own tool list (tools/list) on Oct 25, 2026.

Read 11 · Look things up without changing anything.

  • audit_dependencies
  • audit_dependency_tree
  • audit_github_repo
  • lookup_business
  • lookup_business_by_org
  • lookup_cargo_crate
  • lookup_github_repo
  • lookup_go_module
  • lookup_npm_package
  • lookup_pypi_package
  • query_commitment

Not yet classified 1 · We could not tell from the name and description.

  • get_api_key

Network hosts it talks to 23

  • api.cloudflare.com · found in code
  • api.deps.dev · found in code
  • api.etherscan.io · found in code
  • api.github.com · found in code
  • api.resend.com · found in code
  • api.securityscorecards.dev · found in code
  • api.stripe.com · found in code
  • data.brreg.no · found in code
  • ethereum.reth.rs · found in code
  • getcommit.dev · found in code
  • github.com · found in code
  • glama.ai · found in code
  • id.worldcoin.org · found in code
  • json.schemastore.org · found in code
  • poc-backend.amdal-dev.workers.dev · found in remote endpoint, install command, code
  • prover.certora.com · found in code
  • pypistats.org · found in code
  • raw.githubusercontent.com · found in code
  • reth-ethereum.ithaca.xyz · found in code
  • sepolia-rollup.arbitrum.io · found in code
  • sepolia.optimism.io · found in code
  • socket.dev · found in code
  • unpkg.com · found in code

Files it touches

  • /dev/stdin
  • Your home directory (~)

Tools (12)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • audit_dependencies

    Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concentration risk) - HIGH: new package (<1yr) + high downloads (unproven, rapid adoption = supply chain risk) - WARN: no release in 12+ months (potential abandonware) - WARN: dormant publishers with current scope access — contributors who stopped publishing but retain npm tokens (Mastra-incident vector, June 2026) Perfect fo…

  • audit_dependency_tree

    Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (sole publisher + >10M weekly downloads) often lurk 1-2 levels deep. Risk flags: - CRITICAL: single npm publisher + >10M weekly downloads — sole point of failure for a massive attack surface - HIGH: sole publisher + >1M/wk, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (p…

  • audit_github_repo

    Audit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — just provide the GitHub URL or owner/repo slug, and get a full risk table in seconds. Risk flags: - CRITICAL: single publisher/maintainer/owner + >10M weekly downloads (publish-access concentration risk) - HIGH: sole publisher/maintainer + >1M/wk downloads, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (potential abandonware) E…

  • get_api_key

    Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring (weekly alerts when your dependencies get riskier). After creating the key, configure your MCP client to pass it: Authorization: Bearer sk_commit_<your-key> Example: get_api_key({ email: "dev@company.com" }) One key per email. 3 keys per IP per day (anti-abuse).

  • lookup_business

    Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free, verified, unfakeable.

  • lookup_business_by_org

    Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.

  • lookup_cargo_crate

    Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply chain risks apply to Cargo too — crate owners with publish access are the attack surface. A single owner on a high-download crate is the same risk pattern as npm. Useful for: vetting Rust dependencies before adding to Cargo.toml, identifying abandonware, supply chain risk assessment. Examples: "serde", "tokio", "reqwes…

  • lookup_github_repo

    Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments — harder to fake than README claims or marketing copy. Useful for: vetting open-source dependencies, evaluating AI tools/frameworks, assessing vendor reliability, due diligence on any GitHub project. Examples: "vercel/next.js", "facebook/react", "https://github.com/piiiico/proof-of-commitment"

  • lookup_go_module

    Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contributors (the closest equivalent to "publishers" since Go has no centralized publisher concept — git push access is the publish equivalent), GitHub stars, OpenSSF Scorecard score. The Go ecosystem has no centralized download counter, so this profile is GitHub-primary — the linked source repository's activity, contributor …

  • lookup_npm_package

    Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also returns publisherLifecycle — cross-referencing current maintainers against per-version publish history to flag dormant publishers who still hold npm scope access. The Mastra incident (June 2026) exploited exactly this: a contributor dormant since 2024 with never-revoked scope access. Why behavioral signals matter: downl…

  • lookup_pypi_package

    Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was compromised via stolen PyPI token in March 2026. Behavioral signals reveal what star counts hide. Useful for: vetting Python dependencies, identifying abandonware, supply chain risk due diligence. Examples: "langchain", "litellm", "openai", "anthropic", "requests", "fastapi", "pydantic"

  • query_commitment

    Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content.

Compare and alternatives

    Featured in

    Signals

    Stars
    8
    Forks
    0
    Open issues
    0
    Last commit
    Oct 6, 2026 (23 days ago)
    Last release
    Jun 20, 2026 (4 months ago)

    From GitHub (fetched Oct 24, 2026).

    Details

    Registry name
    io.github.piiiico/proof-of-commitment
    Version
    1.36.0
    Auth
    Auth not stated
    Packages
    npm proof-of-commitment
    License
    MIT
    Repository
    github.com/piiiico/proof-of-commitment
    Website
    getcommit.dev
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql

    More from piiiico

    Cite this page

    Commit — Supply Chain Risk Scoring MCP server. Agent Mart. https://agentmart.dev/connectors/piiiico-proof-of-commitment (last updated 2026-10-24)