@agentutility/mcp-prooflayer - npm Package Compare versions

Comparing version 0.1.8 to 0.2.0

dist/tools.generated.js

 /** Auto-generated by scripts/generate-mcp-clusters.mjs. Do not edit by hand. */
 export const CLUSTER_SLUG = "prooflayer";
-export const VERSION = "0.1.8";
+export const VERSION = "0.2.0";
 export const TOOLS = [
@@ -14,4 +14,3 @@ {
                 "text": {
-                    "type": "string",
-                    "description": "100-20,000 chars."
+                    "type": "string"
                 }
@@ -25,2 +24,32 @@ },
     {
+        "name": "app-store-rejection-explain",
+        "http_name": "app-store-rejection-explain",
+        "description": "(0.02 USDC/call) App Store rejection explainer / Google Play rejection triage / mobile app review policy checklist. Parses rejection text and app metadata, identifies likely policy areas, extracts deadlines, and returns a policy-clean resubmission checklist plus reviewer-note outline. Does not promise approval or recommend platform-policy evasion.",
+        "method": "POST",
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "rejection_text": {
+                    "type": "string",
+                    "description": "Apple App Review or Google Play rejection text. Max 30k chars."
+                },
+                "platform": {
+                    "type": "string",
+                    "enum": [
+                        "apple",
+                        "google"
+                    ],
+                    "description": "Optional platform hint."
+                },
+                "app_metadata": {
+                    "type": "string",
+                    "description": "Optional app description, screenshots notes, release notes, or metadata excerpt."
+                }
+            },
+            "required": [
+                "rejection_text"
+            ]
+        }
+    },
+    {
         "name": "brand-clearance",
@@ -54,3 +83,3 @@ "http_name": "brand-clearance",
         "http_name": "cve",
-        "description": "(0.005 USDC/call) CVE lookup / vulnerability database. NIST NVD-backed. CVSS v3.1+v2 scores, severity, affected CPEs, CWE, exploit indicators + LLM summary.",
+        "description": "(0.005 USDC/call) CVE lookup / vulnerability lookup / NVD record / CVSS scorer / vuln advisory fetch / exploit-known check / CWE class / patch-priority triage / Log4Shell-style record. Short alias of cve-lookup. Returns NIST NVD record with CVSS v3.1 + v2 vectors, severity, CWE, affected CPE list, references, public-exploit indicator with reference URLs, and a bounded exploitability summary with deterministic fallback. Federal public, no auth.",
         "method": "POST",
@@ -62,3 +91,3 @@ "input_schema": {
                     "type": "string",
-                    "description": "e.g. 'CVE-2021-44228'."
+                    "description": "CVE identifier in 'CVE-YYYY-NNNN[N...]' format. Case-insensitive."
                 }
@@ -74,3 +103,3 @@ },
         "http_name": "cve-lookup",
-        "description": "(0.005 USDC/call) CVE lookup / vulnerability database. NIST NVD-backed. CVSS v3.1 + v2 scores, severity, affected CPEs, CWE class, references, public-exploit indicators. Plus LLM exploitability summary.",
+        "description": "(0.005 USDC/call) CVE lookup / vulnerability database / NVD record fetcher / CVSS scorer / Log4Shell-style advisory inspector / known-exploit checker / CISA KEV adjacent / patch-priority triage / CWE classifier. Pulls the canonical NIST NVD record for a CVE-YYYY-NNNNN identifier and returns description, CVSS v3.1 and v2 vectors plus numeric scores, severity bucket, CWE class, affected CPE list, NVD references, and a public-exploit-known boolean with reference URLs. Includes a bounded plain-English exploitability summary with deterministic fallback. Federal public data, no auth.",
         "method": "POST",
@@ -82,3 +111,3 @@ "input_schema": {
                     "type": "string",
-                    "description": "e.g. 'CVE-2021-44228'."
+                    "description": "CVE identifier in 'CVE-YYYY-NNNN[N...]' format. Case-insensitive. Example 'CVE-2021-44228' (Log4Shell)."
                 }
@@ -130,4 +159,3 @@ },
                 "repo": {
-                    "type": "string",
-                    "description": "owner/name."
+                    "type": "string"
                 }
@@ -143,3 +171,3 @@ },
         "http_name": "package-risk-npm",
-        "description": "(0.03 USDC/call) npm package risk score / supply-chain scanner / typosquat detector. Maintainer count, weekly downloads, install scripts, dependency depth, deprecation, age, typosquat distance to popular packages. Plus LLM risk summary.",
+        "description": "(0.03 USDC/call) npm package risk score / npm supply-chain scanner / typosquat detector / postinstall-script flagger / npm install pre-flight audit / package.json + pnpm-lock.yaml vetter / Snyk-adjacent / Socket.dev-adjacent / pre-install safety gate. Pulls registry metadata + download stats for an npm package (and optional version), checks maintainer count, weekly downloads, install / postinstall script hooks, dependency tree depth, deprecation flag, package age, last-publish recency, and edit-distance to popular package names (typosquat). Returns a 0-10 score, risk_level bucket, contributing factors, typosquat candidate list, and a Venice plain-English summary.",
         "method": "POST",
@@ -151,3 +179,3 @@ "input_schema": {
                     "type": "string",
-                    "description": "e.g. 'lodash' or '@scope/name'."
+                    "description": "npm package name. Supports scoped names (e.g. '@types/node', '@vercel/next')."
                 },
@@ -187,3 +215,3 @@ "version": {
         "http_name": "pypi-package-risk",
-        "description": "(0.01 USDC/call) PyPI package risk score / Python supply-chain scanner. Age, monthly downloads, install-script hooks (cmdclass/setup.py), dependency depth, deprecation, typosquat distance to 50 popular Python packages. Plus LLM risk summary.",
+        "description": "(0.01 USDC/call) PyPI package risk score / Python supply-chain scanner / pip dependency vetter / typosquat detector / pre-install audit / Python-package safety check / pyproject.toml / requirements.txt vetter / poetry + uv pre-install gate. Pulls metadata + release history from pypi.org for a package (and optional version), evaluates age, recent download volume, maintainer count, post-install hook presence, dependency depth, deprecation flags, last-update recency, and string-distance to popular packages (typosquat). Returns a numeric score (0-10), risk_level bucket, contributing factor list, and a Venice-LLM plain-English risk summary.",
         "method": "POST",
@@ -216,3 +244,47 @@ "input_schema": {
         }
+    },
+    {
+        "name": "vendor-questionnaire-draft",
+        "http_name": "vendor-questionnaire-draft",
+        "description": "(0.08 USDC/call) Vendor security questionnaire draft API / security questionnaire answerer / SOC 2 evidence answer helper / vendor due diligence response builder. Takes questionnaire text plus supplied evidence snippets and drafts only evidence-supported answers. Unsupported questions are marked needs_evidence instead of invented. Useful for founders and agents answering customer security reviews without leaking private repo data or making unsupported compliance claims.",
+        "method": "POST",
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "questionnaire_text": {
+                    "type": "string",
+                    "description": "Questionnaire questions or pasted security review text. Max 30k chars."
+                },
+                "evidence": {
+                    "type": "array",
+                    "description": "Optional supporting snippets. Answers are drafted only from these items.",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "label": {
+                                "type": "string"
+                            },
+                            "text": {
+                                "type": "string"
+                            },
+                            "url": {
+                                "type": "string"
+                            }
+                        },
+                        "required": [
+                            "label",
+                            "text"
+                        ]
+                    }
+                },
+                "company_name": {
+                    "type": "string",
+                    "description": "Optional company/product name for answer wording."
+                }
+            },
+            "required": [
+                "questionnaire_text"
+            ]
+        }
     }
 ];

package.json

 {
   "name": "@agentutility/mcp-prooflayer",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "MCP server for the @agentutility prooflayer cluster — pay-per-call x402 tools, no API keys, USDC on Base.",
@@ -5,0 +5,0 @@ "license": "MIT",

README.md

@@ -25,3 +25,3 @@ # @agentutility/mcp-prooflayer
 
-Restart Claude Desktop. 13 tools appear in the tool palette.
+Restart Claude Desktop. 15 tools appear in the tool palette.
 
@@ -50,3 +50,3 @@ ## Install — Cursor
 
-## Tools (13)
+## Tools (15)
 
@@ -56,5 +56,6 @@ | Tool | Description |
 | `ai-content-detector` | (0.03 USDC/call) AI content detector / GPT detector / ChatGPT plagiarism checker. Calibrated probability (0-1), verdict, suspicious phrases, per-axis style signals (em-dash overuse, hedge phrases, formulaic transitions). |
+| `app-store-rejection-explain` | (0.02 USDC/call) App Store rejection explainer / Google Play rejection triage / mobile app review policy checklist. Parses rejection text and app metadata, identifies likely policy areas, extracts deadlines, and returns a policy-clean resubmission checklist plus reviewer-note outline. Does not promise approval or recommend platform-policy evasion. |
 | `brand-clearance` | (0.25 USDC/call) Brand clearance aggregator / name screening / product-name vetting / startup-brand pre-flight. Given a candidate brand name, returns a single composite clearance signal an agent can act on. Calls four checks in parallel (in-process, no x402 self-billing): USPTO TM name search, domain availability across requested TLDs (default .com .ai .dev .io .co), Wikipedia presence, Hacker News mention scan. Returns risk_level (clear|soft|moderate|hard), risk_score 0-100, sub-scores per signal, the raw hits, and a one-line recommendation. Designed for AI agents self-screening project / product / startup names before committing. Screening tool only — not legal advice. |
-| `cve` | (0.005 USDC/call) CVE lookup / vulnerability database. NIST NVD-backed. CVSS v3.1+v2 scores, severity, affected CPEs, CWE, exploit indicators + LLM summary. |
-| `cve-lookup` | (0.005 USDC/call) CVE lookup / vulnerability database. NIST NVD-backed. CVSS v3.1 + v2 scores, severity, affected CPEs, CWE class, references, public-exploit indicators. Plus LLM exploitability summary. |
+| `cve` | (0.005 USDC/call) CVE lookup / vulnerability lookup / NVD record / CVSS scorer / vuln advisory fetch / exploit-known check / CWE class / patch-priority triage / Log4Shell-style record. Short alias of cve-lookup. Returns NIST NVD record with CVSS v3.1 + v2 vectors, severity, CWE, affected CPE list, references, public-exploit indicator with reference URLs, and a bounded exploitability summary with deterministic fallback. Federal public, no auth. |
+| `cve-lookup` | (0.005 USDC/call) CVE lookup / vulnerability database / NVD record fetcher / CVSS scorer / Log4Shell-style advisory inspector / known-exploit checker / CISA KEV adjacent / patch-priority triage / CWE classifier. Pulls the canonical NIST NVD record for a CVE-YYYY-NNNNN identifier and returns description, CVSS v3.1 and v2 vectors plus numeric scores, severity bucket, CWE class, affected CPE list, NVD references, and a public-exploit-known boolean with reference URLs. Includes a bounded plain-English exploitability summary with deterministic fallback. Federal public data, no auth. |
 | `db-migration-risk` | (0.02 USDC/call) DB migration risk audit / SQL migration safety check / DROP COLUMN detector / unsafe ALTER TABLE detector / Postgres CREATE INDEX CONCURRENTLY check / Alembic op.drop_* detector / TRUNCATE/DELETE WHERE detector / foreign key NOT VALID check / pre-deploy DB gate. Walks `migrations/`, `prisma/migrations/`, `db/migrate/`, `supabase/migrations/`, `alembic/versions/` and flags destructive DDL, lock-heavy ALTER TABLE, NOT NULL without DEFAULT, plain CREATE INDEX (vs CONCURRENTLY), unbounded TRUNCATE/DELETE, and FK validation without NOT VALID. Returns 0-100 score, per-finding kind/severity/path/line/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} for public GitHub or {files: [{path, content}, …]} for private / agent-workspace use. |
@@ -64,7 +65,8 @@ | `dep-risk-summary` | (0.03 USDC/call) repo dependency risk audit / package.json + lockfile vetter / unpinned dep detector / transitive dep counter / requirements.txt audit / pyproject dep risk / repo-level supply-chain risk score / Snyk-adjacent / deprecated dep detector / install-script dep detector. Best-effort scan of package.json, pnpm-lock.yaml, package-lock.json, yarn.lock, bun.lock (JS); requirements.txt, pyproject.toml, poetry.lock (Python); go.mod, go.sum (Go). Samples 10 alphabetically-first direct deps via npm/PyPI registry for deprecation + install-script signals. Returns 0-100 score, per-finding kind/severity/path/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} or {files: [{path, content}, …]}. |
 | `github-repo-health` | (0.03 USDC/call) GitHub repo health score / open-source maintainability checker. 0-100 score + grade (abandoned/stale/okay/healthy/thriving). Commit activity, contributors, license, CI, tests. Plus LLM verdict. |
-| `package-risk-npm` | (0.03 USDC/call) npm package risk score / supply-chain scanner / typosquat detector. Maintainer count, weekly downloads, install scripts, dependency depth, deprecation, age, typosquat distance to popular packages. Plus LLM risk summary. |
+| `package-risk-npm` | (0.03 USDC/call) npm package risk score / npm supply-chain scanner / typosquat detector / postinstall-script flagger / npm install pre-flight audit / package.json + pnpm-lock.yaml vetter / Snyk-adjacent / Socket.dev-adjacent / pre-install safety gate. Pulls registry metadata + download stats for an npm package (and optional version), checks maintainer count, weekly downloads, install / postinstall script hooks, dependency tree depth, deprecation flag, package age, last-publish recency, and edit-distance to popular package names (typosquat). Returns a 0-10 score, risk_level bucket, contributing factors, typosquat candidate list, and a Venice plain-English summary. |
 | `production-readiness-score` | (0.10 USDC/call) production readiness score / AI app deploy gate / Prooflayer cluster aggregator / repo prod-risk composite / one-call audit / unified production readiness API / vibe-coded app safety scan. Calls all 5 Prooflayer component scanners (secrets-exposure-check, deploy-config-risk, db-migration-risk, dep-risk-summary, prompt-injection-surface) in parallel in-process and rolls findings into a weighted composite score (default weights: secrets 0.30, migrations 0.20, deps 0.20, deploy 0.15, prompt 0.15). Returns composite 0-100, production_grade (production-ready | needs-review | risky | do-not-ship), per-component sub-scores, top-N deduped findings sorted by severity + score_contribution, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} or {files: [{path, content}, …]}. Optional 'weights' override (each in [0,0.5], proportionally normalized) and 'max_findings' (default 10, cap 50). |
 | `prompt-injection-surface` | (0.03 USDC/call) AI prompt injection surface scanner / LLM call-site audit / unsanitized user input in prompts detector / system-message mixing flag / unbounded completion detector / AI app safety scan / pre-deploy AI risk gate. Walks .ts/.tsx/.js/.jsx/.py/.mjs/.cjs source files, locates LLM SDK call sites (anthropic, openai, @ai-sdk/*, google generative), and flags user input flowing into prompts without sanitization, calls without max_tokens caps, system/user prompt mixing, and LLM output used unvalidated in fetch/exec/eval. Returns 0-100 score, per-finding kind/severity/path/line/evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} (tree-walk, capped 500 files) or {files: [{path, content}, …]}. |
-| `pypi-package-risk` | (0.01 USDC/call) PyPI package risk score / Python supply-chain scanner. Age, monthly downloads, install-script hooks (cmdclass/setup.py), dependency depth, deprecation, typosquat distance to 50 popular Python packages. Plus LLM risk summary. |
+| `pypi-package-risk` | (0.01 USDC/call) PyPI package risk score / Python supply-chain scanner / pip dependency vetter / typosquat detector / pre-install audit / Python-package safety check / pyproject.toml / requirements.txt vetter / poetry + uv pre-install gate. Pulls metadata + release history from pypi.org for a package (and optional version), evaluates age, recent download volume, maintainer count, post-install hook presence, dependency depth, deprecation flags, last-update recency, and string-distance to popular packages (typosquat). Returns a numeric score (0-10), risk_level bucket, contributing factor list, and a Venice-LLM plain-English risk summary. |
 | `secrets-exposure-check` | (0.02 USDC/call) secrets exposure scan / hardcoded API key detector / .env-committed-key audit / Next.js client env leak detector / pre-deploy secret gate. Fetches top-level config files (.env*, wrangler.toml, vercel.json, next.config.*, package.json, etc.) and scans for hardcoded AWS/OpenAI/Anthropic/Stripe/GitHub keys, private keys, DB URLs with passwords, JWT secrets, weak values in .env.example, and server-only env vars accidentally exposed via NEXT_PUBLIC_. Returns 0-100 score, per-finding kind/severity/path/line/redacted-evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} for public GitHub or {files: [{path, content}, …]} for private / agent-workspace use. |
+| `vendor-questionnaire-draft` | (0.08 USDC/call) Vendor security questionnaire draft API / security questionnaire answerer / SOC 2 evidence answer helper / vendor due diligence response builder. Takes questionnaire text plus supplied evidence snippets and drafts only evidence-supported answers. Unsupported questions are marked needs_evidence instead of invented. Useful for founders and agents answering customer security reviews without leaking private repo data or making unsupported compliance claims. |
 
@@ -90,2 +92,2 @@ ## How it works
 
-**Version:** 0.1.8 · **License:** MIT
+**Version:** 0.2.0 · **License:** MIT

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

34181

27.62%

Lines of code

389

26.3%

Number of lines in readme file

89

2.3%

No dependency changes