github JavaScript analyzed 129bbb2

Credda-io/credda-mcp

v0.2.0
github

MCP server exposing Credda's verifiable, bias-free trust layer to AI agents: check a counterparty's Credda trust before transacting, verify a credential they present to you, and mint your own to present back. Wraps existing public /verify endpoints; no sc

maintainer
Credda-io
licence
MIT
first seen
2026-08-08
last seen
2026-09-16
releases · 30d
1
short id

Credda-io/credda-mcp is an MCP server distributed on github, maintained by Credda-io, tracked here since August 2026. It has shipped 9 releases (currently 0.2.0) and exposes 17 tools. Tools include get_api_health, get_investigation, get_latest_resolution, get_repository, get_resolution, get_validation, and 11 more. Its composite risk grade is B — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 2 review prompts — exfiltration combo and toxic flow (lethal trifecta) — each a pattern worth a human look rather than a finding of fault.

Its 17 tools appear to reach filesystem, network and untrusted content, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

Since the previous scan on 2026-09-12: 34 tools added and 26 tools removed.

full security breakdown →
tools 17
  • get_api_health Readiness of the API this server reads from. No arguments.
  • get_investigation One run: the reported issue, ranked hypotheses, any patches (unified diff, files changed, rationale) and any verification runs over them.
  • get_latest_resolution The newest record for one investigation, or {"resolution": null} when it has produced none.
  • get_repository One repository by id: name, clone source, default branch. Resolves the repositoryId every other row carries.
  • get_resolution The whole record: reproduction and its captured failure signature, root cause, fix, verification signals, regression protection before/afte…
  • get_validation One validation, its environment and change impact, and the counts of checks, findings and evidence.
  • list_investigation_events The run's timeline, cursor-paged with since / nextSince / hasMore. Debug events omitted unless includeDebug.
  • list_investigation_evidence The observations a conclusion rests on: type, phase, strength, summary, artifact pointer.
  • list_investigations The investigation queue: state, outcome, duration, event and evidence counts. Filter by repository, signal, state, outcome.
  • list_repositories The repositories in your organisation. Start here to get an id.
  • list_repository_learnings What Credda has learned about one repository, anchored to a file or symbol, with an observation count and an ordinal weight.
  • list_resolutions Resolution records: what was reported, whether it reproduced, the verification verdict, regression status, and the confidence class with it…
  • list_validation_checks The executed plan, in sequence. baseStatus is the load-bearing field.
  • list_validation_events The validation's timeline, cursor-paged with since / nextSince / hasMore. Debug events omitted unless includeDebug.
  • list_validation_evidence The evidence behind a validation's checks, filterable by type.
  • list_validation_findings Severity, confidence, expected vs observed behaviour, reproduction, affected area, likely source. Narrow with severity and status.
  • list_validations Validation runs over a change: state, outcome, commits compared, environment status.
release cadence · 90d 9 releases
06-20 00:00 08-03 00:00 now
recent releases last 9
version date src
0.2.0 2026-08-19 npm
0.1.7 2026-08-14 npm
0.1.6 2026-08-08 npm
0.1.5 2026-08-08 npm
0.1.4 2026-08-08 npm
0.1.3 2026-07-24 npm
0.1.2 2026-07-24 npm
0.1.1 2026-07-21 npm
0.1.0 2026-07-21 npm

view all →