# Proof Of Commitment

> Supply chain security risk scorer for npm, PyPI, Cargo, and Go — behavioral signals that can't be faked

- **Type:** MCP server
- **Install:** `agentstack add mcp-piiiico-proof-of-commitment`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [piiiico](https://agentstack.voostack.com/s/piiiico)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [piiiico](https://github.com/piiiico)
- **Source:** https://github.com/piiiico/proof-of-commitment
- **Website:** https://getcommit.dev/audit

## Install

```sh
agentstack add mcp-piiiico-proof-of-commitment
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Proof of Commitment

[](https://getcommit.dev/audit?packages=proof-of-commitment)
[](https://www.npmjs.com/package/proof-of-commitment)
[](https://github.com/punkpeye/awesome-mcp-servers)

> **Stars lie. Behavioral signals don't.**

An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on **behavioral commitment** — signals that are harder to fake than stars, READMEs, or download counts.

```text
$ npx proof-of-commitment axios zod chalk lodash minimatch
Scoring 5 npm packages... done in 3.0s

Package      Risk          Score   Publishers   Downloads      Age    Provenance
chalk        🔴 CRITICAL   72      1            432.9M/wk      14.6y  —
minimatch    🔴 CRITICAL   78      1            634.1M/wk      14.9y  —
lodash       🔴 CRITICAL   80      1            158.9M/wk      14.1y  —
zod          🔴 CRITICAL   83      1            161.2M/wk      6.3y   🔐 verified
axios        🔴 CRITICAL   88      1            115.7M/wk      11.8y  🔐 verified
                ⚠ COMPROMISED — axios token theft (2026-03-30)

⚠  5 CRITICAL packages found.
   CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)
```

`npm audit` flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).

## The supply chain problem

26 of the 91 npm packages with >10M weekly downloads have a **single npm publisher**. Together they account for over 3 billion downloads per week. `npm audit` doesn't surface this. Stars don't either.

Four packages in a typical Node.js project are CRITICAL right now:
- **chalk** — 432M downloads/week, **1 npm publisher**
- **zod** — 185M downloads/week, **1 npm publisher** (30+ GitHub contributors)
- **lodash** — 156M downloads/week, **1 npm publisher**
- **axios** — 113M downloads/week, **1 npm publisher** (attacked March 30, 2026)

They won't appear in your `package.json` either — but these are in almost every project:
- **minimatch** — 625M downloads/week, **1 npm publisher**
- **glob** — 366M downloads/week, **1 npm publisher**
- **cross-spawn** — 215M downloads/week, **1 npm publisher**

Behavioral signals surface this. Stars and READMEs don't.

## Quick install (MCP)

No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.

**Claude Desktop**

Open `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS ([config file reference](https://modelcontextprotocol.io/quickstart/user)) or `%APPDATA%\Claude\claude_desktop_config.json` on Windows, then add:

```json
{
  "mcpServers": {
    "commit": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}
```

Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your `package.json`.

**Cursor**

Open `~/.cursor/mcp.json` ([Cursor MCP docs](https://cursor.com/docs/mcp)) and add:

```json
{
  "mcpServers": {
    "commit": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}
```

**Smithery** (once indexed)

```bash
npx -y @smithery/cli install proof-of-commitment --client claude
```

---

## Try it now

**Terminal (zero install):**
```bash
# New in v1.8.0: zero-arg auto-detect — cd into any project, run once:
npx proof-of-commitment
# Picks the highest-coverage manifest in cwd (package-lock.json > yarn.lock >
# pnpm-lock.yaml > pnpm-workspace.yaml > package.json; requirements.txt;
# Cargo.toml; go.sum > go.mod). When multiple ecosystems are present, the
# file with the most recent mtime wins.

# Explicit package list still works:
npx proof-of-commitment axios zod chalk

# Or point at a specific file:
npx proof-of-commitment --file package.json
npx proof-of-commitment --file package-lock.json   # npm (transitive)
npx proof-of-commitment --file yarn.lock           # yarn
npx proof-of-commitment --file pnpm-lock.yaml      # pnpm
npx proof-of-commitment --file pnpm-workspace.yaml # pnpm monorepo
npx proof-of-commitment --pypi litellm langchain requests
npx proof-of-commitment --cargo serde tokio reqwest
npx proof-of-commitment --golang github.com/gin-gonic/gin golang.org/x/net
npx proof-of-commitment --file go.mod
npx proof-of-commitment --file go.sum              # full transitive Go set

# JSON output for downstream tools:
npx proof-of-commitment --file package-lock.json --json | jq '.criticalCount'
```

### CI integration (v1.8.0+)

`--fail-on=` turns the CLI into a one-line CI gate. No GitHub Action required.

```yaml
# .github/workflows/supply-chain.yml
name: Supply Chain
on: [pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npx -y proof-of-commitment --fail-on=critical
```

Levels:

| `--fail-on` | Exit 1 when… |
|---|---|
| `critical` | any package is flagged CRITICAL (publish-access concentration) |
| `risky` | any package is CRITICAL **or** HIGH (score  results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif
          category: commit-supply-chain
```

CRITICAL and HIGH packages show as alerts in the repo's Security tab. Compromised packages (in the Commit incident registry) get a separate alert. `--fail-on` still controls the exit code independently — use `--fail-on=critical` to also block the PR.

**Web demo (no install):** [getcommit.dev/audit](https://getcommit.dev/audit) — paste your packages, see risk scores in seconds.

## IDE Hooks (Cursor + Claude Code + Windsurf)

`poc hook` installs a supply chain gate for **Cursor** ([`beforeShellExecution`](https://docs.cursor.com/context/hooks)), **Claude Code** ([`PreToolUse`](https://code.claude.com/docs/en/hooks)), and **Windsurf** ([`pre_run_command`](https://docs.windsurf.com/windsurf/cascade/hooks)) in one command. The same hook script intercepts package installs from any agent, auto-detects which client called it, and blocks CRITICAL packages before they run.

```bash
# Install for the current project (writes .cursor/hooks.json + .claude/settings.json + .windsurf/hooks.json):
poc hook

# Or protect every project for your user:
poc hook --global

# Narrow to one client:
poc hook --cursor          # only .cursor/hooks.json
poc hook --claude-code     # only .claude/settings.json
poc hook --windsurf        # only .windsurf/hooks.json

# Remove (cleans all three):
poc hook --uninstall
```

The hook writes `.cursor/hooks.json`, `.claude/settings.json`, and `.windsurf/hooks.json` (project) or the equivalents under `~/` (with `--global`). When Cursor, Claude Code, or Windsurf runs `npm install axios`, `pip install litellm`, `cargo add serde`, or `go get github.com/gin-gonic/gin`, the hook calls the Commit API and either blocks, warns, or allows — in under 500ms.

**What gets intercepted:**

| Package manager | Example command |
|---|---|
| npm / npx | `npm install `, `npm add ` |
| pnpm | `pnpm add ` |
| yarn | `yarn add ` |
| pip / pip3 / uv | `pip install ` |
| cargo | `cargo add `, `cargo install ` |
| go | `go get `, `go install ` |

**Why this matters:** Supply chain attacks now happen in minutes. The Shai-Hulud worm (May 2026) compromised 637 packages in 39 minutes and specifically targeted AI coding assistants — planting persistence hooks in `.claude/settings.json` and `.vscode/tasks.json`. When your AI assistant installs a dependency, it bypasses the human review that used to be the last line of defense. `poc hook` puts a gate back in — same gate, whether Cursor, Claude Code, or Windsurf is driving.

**Default behavior:** CRITICAL packages (sole npm publisher + >10M downloads/week — the exact LiteLLM/axios attack profile) are blocked. HIGH packages trigger an "ask user" prompt (Cursor/Claude Code) or are blocked with a message (Windsurf). Set `COMMIT_HOOK_SEVERITY_BLOCK=HIGH` to block both.

**With an API key:** `poc login sk_commit_…` before running `poc hook` — the key is embedded in the hook config and lifts the rate limit.

---

## Get notified before the next attack

The CLI tells you what's risky today. A free API key unlocks **monitoring** — score recomputation across the packages you depend on, with alerts when one degrades (publisher drops, release stalls, score falls ≥10 points).

- **Open (free):** Watch 3 packages · weekly digest every Monday
- **Developer ($15/mo):** Watch 15 packages · daily scans · instant email alerts

[**Get a free API key →**](https://getcommit.dev/get-started?ref=readme-monitoring) (no card, 30 seconds · 200 audits/day included)

```bash
npm install -g proof-of-commitment   # then:
poc watch axios --email you@company.com  # free key + monitoring in one step
poc watch chalk                          # add more packages (3 free)
poc init                                 # add CI gate to this repo
```

## GitHub Action

Add supply chain auditing to any CI pipeline in 30 seconds — auto-detects packages from `package.json` or `requirements.txt`, **posts results as a PR comment**, writes to GitHub Step Summary, and optionally fails on CRITICAL packages.

Use the dedicated action at [piiiico/commit-action](https://github.com/piiiico/commit-action):

```yaml
# .github/workflows/supply-chain.yml
name: Supply Chain Audit
on:
  pull_request:
    paths: ['package.json', 'package-lock.json', 'bun.lock']

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: piiiico/commit-action@v1
        with:
          fail-on-critical: true   # blocks merges on CRITICAL packages
          comment-on-pr: true      # posts results as a PR comment
```

When `comment-on-pr: true` (default), the action automatically posts the audit table as a comment on the pull request — and **updates the same comment** on re-run, so you don't get comment spam. Reviewers see the risk table without leaving the PR.

**Inputs:**

| Input | Default | Description |
|-------|---------|-------------|
| `packages` | _(auto)_ | Comma-separated package names (auto-detected from `package.json`/`requirements.txt` if not set) |
| `packages-file` | _(auto)_ | Path to `package.json` or `requirements.txt` (default: auto-detect in workspace root) |
| `fail-on-critical` | `true` | Fail the workflow if CRITICAL packages are found |
| `max-packages` | `20` | Max packages to audit when auto-detecting |
| `include-dev-dependencies` | `false` | Include `devDependencies` from `package.json` |
| `comment-on-pr` | `true` | Post audit results as a PR comment (requires `pull-requests: write` permission) |
| `api-key` | _(none)_ | [Commit Pro](https://getcommit.dev/pricing) API key — enables batch requests and 10K requests/month |
| `api-url` | _(prod)_ | Override API endpoint (useful for self-hosting) |

**Outputs:** `has-critical`, `critical-count`, `audit-summary` (markdown table, also written to Step Summary).

**Free vs Pro:** Without an API key, packages are audited one at a time (with delays to respect rate limits). With a Pro API key, all packages are audited in a single batch request — faster and with higher monthly limits.

Example PR comment / Step Summary output:

```
| Package | Risk        | Score | Publishers | Downloads/wk | Age   |
|---------|-------------|-------|------------|--------------|-------|
| chalk   | 🔴 CRITICAL | 75    | 1          | 380M         | 12.7y |
| zod     | 🔴 CRITICAL | 83    | 1          | 133M         | 6.1y  |
| axios   | 🔴 CRITICAL | 89    | 1          | 93M          | 11.6y |
```

## README Badges

Add a Commit Trust badge to any npm package you maintain or depend on:

```markdown

```

Examples:

| Package | Badge URL |
|---------|-----------|
| chalk | `` |
| react | `` |
| express | `` |
| @babel/core | `` |

Grades: 🟢 OK (75+) · 🟠 WARNING (40–74) · 🔴 CRITICAL ( Both axios (8.1/10 Scorecard) and chalk (3.6/10 Scorecard) score CRITICAL on behavioral signals. They measure different attack surfaces — Scorecard catches process gaps, behavioral signals catch publisher concentration.

**Risk flags:**
- `CRITICAL` — single npm publisher + >10M weekly downloads (exact LiteLLM/axios attack profile)
- `HIGH` — package <1yr old + rapid adoption
- `WARN` — no release in 12+ months

## Real data points

```
# packages you know about:
chalk       — score 75, 1 publisher, 432M/week  ⚑ CRITICAL
zod         — score 83, 1 publisher, 185M/week  ⚑ CRITICAL  (30+ GitHub contributors)
lodash      — score 81, 1 publisher, 156M/week  ⚑ CRITICAL
axios       — score 88, 1 publisher, 113M/week  ⚑ CRITICAL  (attacked Mar 30 2026)
express     — score 90, 5 publishers, 95M/week

# packages probably not in your package.json, definitely in your lock file:
minimatch   — score 78, 1 publisher, 625M/week  ⚑ CRITICAL
glob        — score 80, 1 publisher, 366M/week  ⚑ CRITICAL
cross-spawn — score 72, 1 publisher, 215M/week  ⚑ CRITICAL

# post-attack:
litellm     — score 74, 1 publisher            ⚑ CRITICAL  (supply chain attack Mar 2026)

# Rust crates (new in v1.3.0):
serde       — score 78, 1 owner,  13M/week  ⚑ CRITICAL  (dtolnay sole owner)
tokio       — score 89, 2 owners, 10M/week
reqwest     — score 85, 1 owner,   8M/week  ⚑ HIGH
```

## Why behavioral signals

The LiteLLM attack (March 2026) and axios attack (March 30, 2026) followed the same pattern: stolen credentials → malicious package pushed → 97M+ machines exposed. Both packages scored CRITICAL by these metrics *before* the attacks.

Declarative signals (stars, README quality, CI badges) don't capture this risk. Behavioral commitment does.

## Blog

- [The LinkedIn Backdoor: Why npm audit Missed a 250-Line Attack](https://getcommit.dev/blog/linkedin-recruiter-npm-backdoor/) — A fake recruiter clone attack hid malware in test files and ran it via npm lifecycle scripts. npm audit: silent. What behavioral signals would have flagged.
- [Axios Attack Prediction](https://getcommit.dev/blog/axios-attack-prediction/) — We flagged axios as CRITICAL (sole npm publisher, 113M downloads/week) before the March 30, 2026 token theft.

## Stack

| Layer | Technology |
|-------|-----------|
| Backend | Cloudflare Workers + D1 |
| MCP | Model Context Protocol SDK |
| Data | npm registry, PyPI, crates.io, proxy.golang.org, deps.dev, GitHub API, Brønnøysund (NO) |
| Landing | Astro + Cloudflare Pages |

## Roadmap

Planned, not promised. The project is early-stage — contributions welcome on any of these.

| Feature | Status | Notes |
|---------|--------|-------|
| **Cargo (Rust) registry support** | ✅ Live | MCP tool, REST API, badge endpoint — `ecosystem: "cargo"` |
| **Go modules support** | ✅ Live | proxy.golang.org + deps.dev + GitHub-primary scoring — `ecosystem: "golang"` |
| **Score breakdown visualization** | Planned | Chart component for the 5 dimensions on getcommit.dev/audit |
| **`--json` flag for CLI** | ✅ Live | `npx proof-of-commitment --file package-lock.json --json \| jq '.criticalCount'` |
| **pnpm workspace monorepo support** | ✅ Live | `--file pnpm-workspace.yaml` or auto-detected from `pnpm-lock.yaml` |
| **Historical score tracking** | Planned | Trend charts — was this package getting riskier over time? |
| **Org-level dashboards** | Planned | Aggregate risk view across all repos in a GitHub org |

See [open issues](https://github.com/piiiico/proof-of-commitment/issues) for things you can help with today.

## The broader vision

Supply chain auditing is the first tool. The underlying primitive is a **commitment graph** — behavioral signals that replace content-based trust across any domain.

When content is free to fake (reviews, stars, READMEs), commitment becomes the signal. A publisher who has shipped 847 releases over 12 years is a different kind of commitment than one who published once in 2023.

The same logic appli

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [piiiico](https://github.com/piiiico)
- **Source:** [piiiico/proof-of-commitment](https://github.com/piiiico/proof-of-commitment)
- **License:** MIT
- **Homepage:** https://getcommit.dev/audit

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** yes
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-piiiico-proof-of-commitment
- Seller: https://agentstack.voostack.com/s/piiiico
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.