MCP server exposing Credda's verifiable, bias-free trust layer to AI agents: check a counterparty's Credda trust before transacting, verify a credential they present to you, and mint your own to present back. Wraps existing public /verify endpoints; no sc
Credda-io/credda-mcp is an MCP server distributed on github, maintained by Credda-io, tracked here since August 2026. It has shipped 9 releases (currently 0.2.0) and exposes 17 tools. Tools include get_api_health, get_investigation, get_latest_resolution, get_repository, get_resolution, get_validation, and 11 more. Its composite risk grade is B — an inferred review prompt computed from observed signals, not a verdict.
Reading the source raised 2 review prompts — exfiltration combo and toxic flow (lethal trifecta) — each a pattern worth a human look rather than a finding of fault.
Since the previous scan on 2026-09-12: 34 tools added and 26 tools removed.
full security breakdown →-
get_api_healthReadiness of the API this server reads from. No arguments. -
get_investigationOne run: the reported issue, ranked hypotheses, any patches (unified diff, files changed, rationale) and any verification runs over them. -
get_latest_resolutionThe newest record for one investigation, or {"resolution": null} when it has produced none. -
get_repositoryOne repository by id: name, clone source, default branch. Resolves the repositoryId every other row carries. -
get_resolutionThe whole record: reproduction and its captured failure signature, root cause, fix, verification signals, regression protection before/afte… -
get_validationOne validation, its environment and change impact, and the counts of checks, findings and evidence. -
list_investigation_eventsThe run's timeline, cursor-paged with since / nextSince / hasMore. Debug events omitted unless includeDebug. -
list_investigation_evidenceThe observations a conclusion rests on: type, phase, strength, summary, artifact pointer. -
list_investigationsThe investigation queue: state, outcome, duration, event and evidence counts. Filter by repository, signal, state, outcome. -
list_repositoriesThe repositories in your organisation. Start here to get an id. -
list_repository_learningsWhat Credda has learned about one repository, anchored to a file or symbol, with an observation count and an ordinal weight. -
list_resolutionsResolution records: what was reported, whether it reproduced, the verification verdict, regression status, and the confidence class with it… -
list_validation_checksThe executed plan, in sequence. baseStatus is the load-bearing field. -
list_validation_eventsThe validation's timeline, cursor-paged with since / nextSince / hasMore. Debug events omitted unless includeDebug. -
list_validation_evidenceThe evidence behind a validation's checks, filterable by type. -
list_validation_findingsSeverity, confidence, expected vs observed behaviour, reproduction, affected area, likely source. Narrow with severity and status. -
list_validationsValidation runs over a change: state, outcome, commits compared, environment status.
| version | date | src |
|---|---|---|
| 0.2.0 | 2026-08-19 | npm |
| 0.1.7 | 2026-08-14 | npm |
| 0.1.6 | 2026-08-08 | npm |
| 0.1.5 | 2026-08-08 | npm |
| 0.1.4 | 2026-08-08 | npm |
| 0.1.3 | 2026-07-24 | npm |
| 0.1.2 | 2026-07-24 | npm |
| 0.1.1 | 2026-07-21 | npm |
| 0.1.0 | 2026-07-21 | npm |