Proof Of Commitment

Proof of Commitment

[](https://getcommit.dev/audit?packages=proof-of-commitment) [](https://www.npmjs.com/package/proof-of-commitment) [](https://github.com/punkpeye/awesome-mcp-servers)

> Stars lie. Behavioral signals don't.

An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals that are harder to fake than stars, READMEs, or download counts.

$ npx proof-of-commitment axios zod chalk lodash minimatch
Scoring 5 npm packages... done in 3.0s

Package      Risk          Score   Publishers   Downloads      Age    Provenance
chalk        🔴 CRITICAL   72      1            432.9M/wk      14.6y  —
minimatch    🔴 CRITICAL   78      1            634.1M/wk      14.9y  —
lodash       🔴 CRITICAL   80      1            158.9M/wk      14.1y  —
zod          🔴 CRITICAL   83      1            161.2M/wk      6.3y   🔐 verified
axios        🔴 CRITICAL   88      1            115.7M/wk      11.8y  🔐 verified
                ⚠ COMPROMISED — axios token theft (2026-03-30)

⚠  5 CRITICAL packages found.
   CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)

npm audit flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).

The supply chain problem

26 of the 91 npm packages with >10M weekly downloads have a single npm publisher. Together they account for over 3 billion downloads per week. npm audit doesn't surface this. Stars don't either.

Four packages in a typical Node.js project are CRITICAL right now:

• chalk — 432M downloads/week, 1 npm publisher
• zod — 185M downloads/week, 1 npm publisher (30+ GitHub contributors)
• lodash — 156M downloads/week, 1 npm publisher
• axios — 113M downloads/week, 1 npm publisher (attacked March 30, 2026)

They won't appear in your package.json either — but these are in almost every project:

• minimatch — 625M downloads/week, 1 npm publisher
• glob — 366M downloads/week, 1 npm publisher
• cross-spawn — 215M downloads/week, 1 npm publisher

Behavioral signals surface this. Stars and READMEs don't.

Quick install (MCP)

No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.

Claude Desktop

Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:

{
  "mcpServers": {
    "commit": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}

Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.

Cursor

Open ~/.cursor/mcp.json (Cursor MCP docs) and add:

{
  "mcpServers": {
    "commit": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}

Smithery (once indexed)

npx -y @smithery/cli install proof-of-commitment --client claude

---

Try it now

Terminal (zero install):

# New in v1.8.0: zero-arg auto-detect — cd into any project, run once:
npx proof-of-commitment
# Picks the highest-coverage manifest in cwd (package-lock.json > yarn.lock >
# pnpm-lock.yaml > pnpm-workspace.yaml > package.json; requirements.txt;
# Cargo.toml; go.sum > go.mod). When multiple ecosystems are present, the
# file with the most recent mtime wins.

# Explicit package list still works:
npx proof-of-commitment axios zod chalk

# Or point at a specific file:
npx proof-of-commitment --file package.json
npx proof-of-commitment --file package-lock.json   # npm (transitive)
npx proof-of-commitment --file yarn.lock           # yarn
npx proof-of-commitment --file pnpm-lock.yaml      # pnpm
npx proof-of-commitment --file pnpm-workspace.yaml # pnpm monorepo
npx proof-of-commitment --pypi litellm langchain requests
npx proof-of-commitment --cargo serde tokio reqwest
npx proof-of-commitment --golang github.com/gin-gonic/gin golang.org/x/net
npx proof-of-commitment --file go.mod
npx proof-of-commitment --file go.sum              # full transitive Go set

# JSON output for downstream tools:
npx proof-of-commitment --file package-lock.json --json | jq '.criticalCount'

CI integration (v1.8.0+)

--fail-on= turns the CLI into a one-line CI gate. No GitHub Action required.

# .github/workflows/supply-chain.yml
name: Supply Chain
on: [pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npx -y proof-of-commitment --fail-on=critical

Levels:

| --fail-on | Exit 1 when… | |---|---| | critical | any package is flagged CRITICAL (publish-access concentration) | | risky | any package is CRITICAL or HIGH (score results.sarif

• uses: github/codeql-action/upload-sarif@v3

if: always() with: sarif_file: results.sarif category: commit-supply-chain

CRITICAL and HIGH packages show as alerts in the repo's Security tab. Compromised packages (in the Commit incident registry) get a separate alert. `--fail-on` still controls the exit code independently — use `--fail-on=critical` to also block the PR.

**Web demo (no install):** [getcommit.dev/audit](https://getcommit.dev/audit) — paste your packages, see risk scores in seconds.

## IDE Hooks (Cursor + Claude Code + Windsurf)

`poc hook` installs a supply chain gate for **Cursor** ([`beforeShellExecution`](https://docs.cursor.com/context/hooks)), **Claude Code** ([`PreToolUse`](https://code.claude.com/docs/en/hooks)), and **Windsurf** ([`pre_run_command`](https://docs.windsurf.com/windsurf/cascade/hooks)) in one command. The same hook script intercepts package installs from any agent, auto-detects which client called it, and blocks CRITICAL packages before they run.

```bash
# Install for the current project (writes .cursor/hooks.json + .claude/settings.json + .windsurf/hooks.json):
poc hook

# Or protect every project for your user:
poc hook --global

# Narrow to one client:
poc hook --cursor          # only .cursor/hooks.json
poc hook --claude-code     # only .claude/settings.json
poc hook --windsurf        # only .windsurf/hooks.json

# Remove (cleans all three):
poc hook --uninstall

The hook writes .cursor/hooks.json, .claude/settings.json, and .windsurf/hooks.json (project) or the equivalents under ~/ (with --global). When Cursor, Claude Code, or Windsurf runs npm install axios, pip install litellm, cargo add serde, or go get github.com/gin-gonic/gin, the hook calls the Commit API and either blocks, warns, or allows — in under 500ms.

What gets intercepted:

| Package manager | Example command | |---|---| | npm / npx | npm install , npm add | | pnpm | pnpm add | | yarn | yarn add | | pip / pip3 / uv | pip install | | cargo | cargo add , cargo install | | go | go get , go install |

Why this matters: Supply chain attacks now happen in minutes. The Shai-Hulud worm (May 2026) compromised 637 packages in 39 minutes and specifically targeted AI coding assistants — planting persistence hooks in .claude/settings.json and .vscode/tasks.json. When your AI assistant installs a dependency, it bypasses the human review that used to be the last line of defense. poc hook puts a gate back in — same gate, whether Cursor, Claude Code, or Windsurf is driving.

Default behavior: CRITICAL packages (sole npm publisher + >10M downloads/week — the exact LiteLLM/axios attack profile) are blocked. HIGH packages trigger an "ask user" prompt (Cursor/Claude Code) or are blocked with a message (Windsurf). Set COMMIT_HOOK_SEVERITY_BLOCK=HIGH to block both.

With an API key: poc login sk_commit_… before running poc hook — the key is embedded in the hook config and lifts the rate limit.

---

Get notified before the next attack

The CLI tells you what's risky today. A free API key unlocks monitoring — score recomputation across the packages you depend on, with alerts when one degrades (publisher drops, release stalls, score falls ≥10 points).

• Open (free): Watch 3 packages · weekly digest every Monday
• Developer ($15/mo): Watch 15 packages · daily scans · instant email alerts

Get a free API key → (no card, 30 seconds · 200 audits/day included)

npm install -g proof-of-commitment   # then:
poc watch axios --email you@company.com  # free key + monitoring in one step
poc watch chalk                          # add more packages (3 free)
poc init                                 # add CI gate to this repo

GitHub Action

Add supply chain auditing to any CI pipeline in 30 seconds — auto-detects packages from package.json or requirements.txt, posts results as a PR comment, writes to GitHub Step Summary, and optionally fails on CRITICAL packages.

Use the dedicated action at piiiico/commit-action:

# .github/workflows/supply-chain.yml
name: Supply Chain Audit
on:
  pull_request:
    paths: ['package.json', 'package-lock.json', 'bun.lock']

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: piiiico/commit-action@v1
        with:
          fail-on-critical: true   # blocks merges on CRITICAL packages
          comment-on-pr: true      # posts results as a PR comment

When comment-on-pr: true (default), the action automatically posts the audit table as a comment on the pull request — and updates the same comment on re-run, so you don't get comment spam. Reviewers see the risk table without leaving the PR.

Inputs:

| Input | Default | Description | |-------|---------|-------------| | packages | (auto) | Comma-separated package names (auto-detected from package.json/requirements.txt if not set) | | packages-file | (auto) | Path to package.json or requirements.txt (default: auto-detect in workspace root) | | fail-on-critical | true | Fail the workflow if CRITICAL packages are found | | max-packages | 20 | Max packages to audit when auto-detecting | | include-dev-dependencies | false | Include devDependencies from package.json | | comment-on-pr | true | Post audit results as a PR comment (requires pull-requests: write permission) | | api-key | (none) | Commit Pro API key — enables batch requests and 10K requests/month | | api-url | (prod)_ | Override API endpoint (useful for self-hosting) |

Outputs: has-critical, critical-count, audit-summary (markdown table, also written to Step Summary).

Free vs Pro: Without an API key, packages are audited one at a time (with delays to respect rate limits). With a Pro API key, all packages are audited in a single batch request — faster and with higher monthly limits.

Example PR comment / Step Summary output:

| Package | Risk        | Score | Publishers | Downloads/wk | Age   |
|---------|-------------|-------|------------|--------------|-------|
| chalk   | 🔴 CRITICAL | 75    | 1          | 380M         | 12.7y |
| zod     | 🔴 CRITICAL | 83    | 1          | 133M         | 6.1y  |
| axios   | 🔴 CRITICAL | 89    | 1          | 93M          | 11.6y |

README Badges

Add a Commit Trust badge to any npm package you maintain or depend on:

Examples:

| Package | Badge URL | |---------|-----------| | chalk | ` | | react | | | express | | | @babel/core | ` |

Grades: 🟢 OK (75+) · 🟠 WARNING (40–74) · 🔴 CRITICAL ( Both axios (8.1/10 Scorecard) and chalk (3.6/10 Scorecard) score CRITICAL on behavioral signals. They measure different attack surfaces — Scorecard catches process gaps, behavioral signals catch publisher concentration.

Risk flags:

• CRITICAL — single npm publisher + >10M weekly downloads (exact LiteLLM/axios attack profile)
• HIGH — package <1yr old + rapid adoption
• WARN — no release in 12+ months

Real data points

# packages you know about:
chalk       — score 75, 1 publisher, 432M/week  ⚑ CRITICAL
zod         — score 83, 1 publisher, 185M/week  ⚑ CRITICAL  (30+ GitHub contributors)
lodash      — score 81, 1 publisher, 156M/week  ⚑ CRITICAL
axios       — score 88, 1 publisher, 113M/week  ⚑ CRITICAL  (attacked Mar 30 2026)
express     — score 90, 5 publishers, 95M/week

# packages probably not in your package.json, definitely in your lock file:
minimatch   — score 78, 1 publisher, 625M/week  ⚑ CRITICAL
glob        — score 80, 1 publisher, 366M/week  ⚑ CRITICAL
cross-spawn — score 72, 1 publisher, 215M/week  ⚑ CRITICAL

# post-attack:
litellm     — score 74, 1 publisher            ⚑ CRITICAL  (supply chain attack Mar 2026)

# Rust crates (new in v1.3.0):
serde       — score 78, 1 owner,  13M/week  ⚑ CRITICAL  (dtolnay sole owner)
tokio       — score 89, 2 owners, 10M/week
reqwest     — score 85, 1 owner,   8M/week  ⚑ HIGH

Why behavioral signals

The LiteLLM attack (March 2026) and axios attack (March 30, 2026) followed the same pattern: stolen credentials → malicious package pushed → 97M+ machines exposed. Both packages scored CRITICAL by these metrics before the attacks.

Declarative signals (stars, README quality, CI badges) don't capture this risk. Behavioral commitment does.

Blog

• The LinkedIn Backdoor: Why npm audit Missed a 250-Line Attack — A fake recruiter clone attack hid malware in test files and ran it via npm lifecycle scripts. npm audit: silent. What behavioral signals would have flagged.
• Axios Attack Prediction — We flagged axios as CRITICAL (sole npm publisher, 113M downloads/week) before the March 30, 2026 token theft.

Stack

| Layer | Technology | |-------|-----------| | Backend | Cloudflare Workers + D1 | | MCP | Model Context Protocol SDK | | Data | npm registry, PyPI, crates.io, proxy.golang.org, deps.dev, GitHub API, Brønnøysund (NO) | | Landing | Astro + Cloudflare Pages |

Roadmap

Planned, not promised. The project is early-stage — contributions welcome on any of these.

| Feature | Status | Notes | |---------|--------|-------| | Cargo (Rust) registry support | ✅ Live | MCP tool, REST API, badge endpoint — ecosystem: "cargo" | | Go modules support | ✅ Live | proxy.golang.org + deps.dev + GitHub-primary scoring — ecosystem: "golang" | | Score breakdown visualization | Planned | Chart component for the 5 dimensions on getcommit.dev/audit | | --json flag for CLI | ✅ Live | npx proof-of-commitment --file package-lock.json --json \| jq '.criticalCount' | | pnpm workspace monorepo support | ✅ Live | --file pnpm-workspace.yaml or auto-detected from pnpm-lock.yaml | | Historical score tracking | Planned | Trend charts — was this package getting riskier over time? | | Org-level dashboards | Planned | Aggregate risk view across all repos in a GitHub org |

See open issues for things you can help with today.

The broader vision

Supply chain auditing is the first tool. The underlying primitive is a commitment graph — behavioral signals that replace content-based trust across any domain.

When content is free to fake (reviews, stars, READMEs), commitment becomes the signal. A publisher who has shipped 847 releases over 12 years is a different kind of commitment than one who published once in 2023.

The same logic appli

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: piiiico
• Source: piiiico/proof-of-commitment
• License: MIT
• Homepage: https://getcommit.dev/audit

Install and usage instructions live in the source repository linked above.