proof-of-commitment
About
Cryptographic proof-of-commitment protocol for MCP. Make verifiable commitments before posting/acting, preventing post-hoc narrative changes.
Details
- Author
- piiiico
- GitHub stars
- 7
- Downloads
- 123
- Categories
- Other, Security
Jump to
- Detects publish‑access concentration risk (single NPM publisher >10M weekly downloads)
- Supports npm, PyPI, Rust crates, Go modules, and GitHub repos
- CLI with zero‑arg auto‑detect and lock‑file scanning (package‑lock, yarn.lock, go.sum, etc.)
- CI integration with --fail-on=critical and GitHub Action (PR comments, step summary)
- SARIF output for GitHub Code Scanning (Security tab)
- IDE hooks for Cursor, Claude Code, and Windsurf to block critical packages
- Monitoring plan with weekly/daily alerts and package score degradation detection
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
proof-of-commitmentCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Add the server to any MCP-compatible AI tool using the URL https://poc-backend.amdal-dev.workers.dev/mcp via a streamable-http transport. Use the CLI with npx proof-of-commitment (zero‑arg auto‑detect in a project directory, or explicit package names and --file flags). For CI, use --fail-on=critical or the dedicated GitHub Action piiiico/commit-action@v1. Install IDE hooks with poc hook to block critical packages before install.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"proof-of-commitment": {
"proof-of-commitment": {
"command": "npx",
"args": [
"-y",
"@smithery/cli",
"install",
"proof-of-commitment",
"--client",
"claude"
]
}
}
}
}McpServers
{
"proof-of-commitment": {
"command": "npx",
"args": [
"-y",
"@smithery/cli",
"install",
"proof-of-commitment",
"--client",
"claude"
]
}
}Proof of Commitment
> Stars lie. Behavioral signals don't.
An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals that are harder to fake than stars, READMEs, or download counts.
$ npx proof-of-commitment axios zod chalk lodash minimatch
Scoring 5 npm packages... done in 3.0s
Package Risk Score Publishers Downloads Age Provenance
chalk 🔴 CRITICAL 72 1 432.9M/wk 14.6y —
minimatch 🔴 CRITICAL 78 1 634.1M/wk 14.9y —
lodash 🔴 CRITICAL 80 1 158.9M/wk 14.1y —
zod 🔴 CRITICAL 83 1 161.2M/wk 6.3y 🔐 verified
axios 🔴 CRITICAL 88 1 115.7M/wk 11.8y 🔐 verified
⚠ COMPROMISED — axios token theft (2026-03-30)
⚠ 5 CRITICAL packages found.
CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)
npm audit flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).
The supply chain problem
26 of the 91 npm packages with >10M weekly downloads have a single npm publisher. Together they account for over 3 billion downloads per week. npm audit doesn't surface this. Stars don't either.
Four packages in a typical Node.js project are CRITICAL right now:
- chalk — 432M downloads/week, 1 npm publisher
- zod — 185M downloads/week, 1 npm publisher (30+ GitHub contributors)
- lodash — 156M downloads/week, 1 npm publisher
- axios — 113M downloads/week, 1 npm publisher (attacked March 30, 2026)
They won't appear in your package.json either — but these are in almost every project:
- minimatch — 625M downloads/week, 1 npm publisher
- glob — 366M downloads/week, 1 npm publisher
- cross-spawn — 215M downloads/week, 1 npm publisher
Behavioral signals surface this. Stars and READMEs don't.
Quick install (MCP)
No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.
Claude Desktop
Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.
Cursor
Open ~/.cursor/mcp.json (Cursor MCP docs) and add:
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
Smithery (once indexed)
npx -y @smithery/cli install proof-of-commitment --client claude
---
Try it now
Terminal (zero install):
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
