Commit — Supply Chain Risk Scoring
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
Connect it
Settings → Connectors → Add custom connector
URL: https://poc-backend.amdal-dev.workers.dev/mcpSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://poc-backend.amdal-dev.workers.dev/mcp{
"mcpServers": {
"proof-of-commitment": {
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp{
"servers": {
"proof-of-commitment": {
"type": "http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"mcpServers": {
"proof-of-commitment": {
"command": "npx",
"args": [
"-y",
"proof-of-commitment@1.36.0"
]
}
}
}claude mcp add proof-of-commitment -- npx -y proof-of-commitment@1.36.012 tools, verified live
query_commitmentQuery verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement â harder to fake than reviews or content.
lookup_businessSearch for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers â free, verified, unfakeable.
lookup_business_by_orgLook up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.
lookup_github_repoGet a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments â harder to fake than README claims or marketing copy. Useful for: vetting open-source dependencies, evaluating AI tools
lookup_npm_packageGet a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also returns publisherLifecycle â cross-referencing current maintainers against per-version publish history to flag dormant p
lookup_pypi_packageGet a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages â LiteLLM (97M downloads/mo) was compromised via stolen PyPI token in March 2026. Behavioral signals reveal what star counts hide. Useful for: vetting
lookup_cargo_crateGet a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply chain risks apply to Cargo too â crate owners with publish access are the attack surface. A single owner on a high-down
lookup_go_moduleGet a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contributors (the closest equivalent to "publishers" since Go has no centralized publisher concept â git push access is the pu
audit_dependenciesBatch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concentration risk) - HIGH: new package (<1yr) + high downloads (unproven, rapid adoption = supply chain risk) - WARN: no releas
audit_github_repoAudit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project â just provide the GitHub URL or owner/repo slug, and get a full risk table in seconds. Risk flags: - CRITICAL: single publisher/maintainer/owner + >10M weekl
audit_dependency_treeMap the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph â showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (sole publisher + >10M weekly downloads) often lurk 1-2 levels deep. Risk flags: - CRITICAL: singl
get_api_keyCreate a free Commit API key instantly â no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring (weekly alerts when your dependencies get riskier). After creating the key, configure your MCP client t
Alternatives in Developer Tools
Compare →NENetdataA
Real-time infrastructure monitoring with metrics, logs, alerts, and ML-based anomaly detection.
OMOmnaraA
Deploy durable AI agents with Omnara, an open-source managed-agent platform.
RDRevoGrid DataGrid MCPA
Token-free MCP server for structured RevoGrid Core, Pro, and Enterprise knowledge retrieval.
RDRevoGrid DataGrid MCP ProA
Hosted Pro MCP server for RevoGrid DataGrid docs, examples, feature checks, and migration guidance.
LALabelhead Artist MomentumA
Trending hip-hop artist momentum scores across four cultural dimensions.
TLTldrawA
Draw and visually collaborate with your agents on tldraw's canvas.