Commit — Supply Chain Risk Scoring: MCP server
An MCP server that scores npm, PyPI, Cargo and Go packages by behavioural signals instead of stars or download counts.
claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcpWhat Commit — Supply Chain Risk Scoring does
What the server looks at is harder to fake than a README or a download counter: how many people actually publish a package, how old it is, whether provenance is verified. Nine tools ship with it. Each result carries a risk level, a score, publisher count, weekly downloads, package age and a provenance mark.
There is a CLI too. Run npx proof-of-commitment with no arguments and it picks the manifest in the current directory on its own; you can also name a file or list packages. In a pipeline, --fail-on=critical turns the run into a gate that fails when a package shows publish-access concentration. --sarif writes output you can upload to GitHub Code Scanning next to CodeQL.
No login, no API key. The hosted server lives at https://poc-backend.amdal-dev.workers.dev/mcp; the local one starts with npx -y proof-of-commitment. Behind a proxy or a private mirror, set that in your environment or the tool's config file rather than on the install line.
What it helps with
- spot packages where a single person holds publish rights
- audit transitive dependencies in
package-lock.json - fail a pull request that pulls in a critical package
- push findings into GitHub Code Scanning
- compare risk across ecosystems in one report
Example prompts for the agent
- Audit the
package.jsonin this project and list the critical packages - Run Commit over
requirements.txtand explain what each risk level means - Score the packages in
go.sumand write the result as SARIF
How to install Commit — Supply Chain Risk Scoring
1Platform CLI: remote server
claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp2Platform CLI
claude mcp add commit-supply-chain-risk-scoring -- npx -y proof-of-commitment1Platform CLI: remote server
codex mcp add commit-supply-chain-risk-scoring --url https://poc-backend.amdal-dev.workers.dev/mcp2Platform CLI
codex mcp add commit-supply-chain-risk-scoring -- npx -y proof-of-commitmentConfig file
{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"command": "npx",
"args": [
"-y",
"proof-of-commitment"
]
}
}
}Config file
{
"servers": {
"commit-supply-chain-risk-scoring": {
"type": "http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"servers": {
"commit-supply-chain-risk-scoring": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"proof-of-commitment"
]
}
}
}1Platform CLI: remote server
gemini mcp add -t http commit-supply-chain-risk-scoring https://poc-backend.amdal-dev.workers.dev/mcp2Platform CLI
gemini mcp add commit-supply-chain-risk-scoring npx -y proof-of-commitmentStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Commit — Supply Chain Risk Scoring
How do I install Commit — Supply Chain Risk Scoring in Claude Code?
Run claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp. No login or key is required.
What does Commit — Supply Chain Risk Scoring do?
It rates npm, PyPI, Cargo and Go packages on behavioural signals: publisher count, age, weekly downloads, provenance history. Nine tools return a score and a risk level.
How is this different from npm audit?
npm audit reports known vulnerabilities. Commit surfaces publish-access concentration — a package with millions of weekly downloads released by one person.
