# Commit — Supply Chain Risk Scoring

An MCP server that scores npm, PyPI, Cargo and Go packages by behavioural signals instead of stars or download counts.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: piiiico
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/piiiico/proof-of-commitment
- Updated: 2026-10-06
- HTML: https://affpapa.org/en/nevibecode/mcp/commit-supply-chain-risk-scoring

## What it does

What the server looks at is harder to fake than a README or a download counter: how many people actually publish a package, how old it is, whether provenance is verified. Nine tools ship with it. Each result carries a risk level, a score, publisher count, weekly downloads, package age and a provenance mark.

There is a CLI too. Run `npx proof-of-commitment` with no arguments and it picks the manifest in the current directory on its own; you can also name a file or list packages. In a pipeline, `--fail-on=critical` turns the run into a gate that fails when a package shows publish-access concentration. `--sarif` writes output you can upload to GitHub Code Scanning next to CodeQL.

No login, no API key. The hosted server lives at `https://poc-backend.amdal-dev.workers.dev/mcp`; the local one starts with `npx -y proof-of-commitment`. Behind a proxy or a private mirror, set that in your environment or the tool's config file rather than on the install line.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://poc-backend.amdal-dev.workers.dev/mcp`

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http proof-of-commitment https://poc-backend.amdal-dev.workers.dev/mcp
```

2. **Platform CLI**
```bash
claude mcp add commit-supply-chain-risk-scoring -- npx -y proof-of-commitment
```

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add commit-supply-chain-risk-scoring --url https://poc-backend.amdal-dev.workers.dev/mcp
```

2. **Platform CLI**
```bash
codex mcp add commit-supply-chain-risk-scoring -- npx -y proof-of-commitment
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "commit-supply-chain-risk-scoring": {
            "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "commit-supply-chain-risk-scoring": {
            "command": "npx",
            "args": [
                "-y",
                "proof-of-commitment"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "commit-supply-chain-risk-scoring": {
            "type": "http",
            "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "commit-supply-chain-risk-scoring": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "proof-of-commitment"
            ]
        }
    }
}
```

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http commit-supply-chain-risk-scoring https://poc-backend.amdal-dev.workers.dev/mcp
```

2. **Platform CLI**
```bash
gemini mcp add commit-supply-chain-risk-scoring npx -y proof-of-commitment
```

## When to use it
- spot packages where a single person holds publish rights
- audit transitive dependencies in `package-lock.json`
- fail a pull request that pulls in a critical package
- push findings into GitHub Code Scanning
- compare risk across ecosystems in one report

## Example prompts
- Audit the `package.json` in this project and list the critical packages
- Run Commit over `requirements.txt` and explain what each risk level means
- Score the packages in `go.sum` and write the result as SARIF

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md