
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
MCP server for Veritas Acta — contribute, challenge, verify, and query contestable public records from AI coding tools.
Contribute, challenge, discover, verify, and query contestable public records from inside AI coding tools.
Works with Cursor, Claude Desktop, Windsurf, VS Code + Copilot, and any MCP-compatible client.
Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"acta": {
"command": "npx",
"args": ["-y", "acta-mcp"]
}
}
}
Add to claude_desktop_config.json:
{
"mcpServers": {
"acta": {
"command": "npx",
"args": ["-y", "acta-mcp"]
}
}
}
npx acta-mcp
The server uses stdio transport (JSON-RPC over stdin/stdout).
| Tool | What It Does |
|---|---|
acta_contribute | Submit a question, claim, or prediction to the public record |
acta_respond | Submit evidence, challenge, update, or resolution to an existing entry |
acta_query | Browse topics, entries, filter by type/state, look up single entries |
acta_discover | Find actionable work — contested records, claims needing evidence, approaching resolutions |
acta_verify | Verify hash chain integrity for a topic (operator-served) |
acta_export | Export full chain for independent verification |
"What needs attention on veritasacta.com?"
AI calls
acta_discoverwith mode=contested → finds records in contested state that need evidence or counter-arguments
"Make a factual claim about API key security with a source"
AI calls
acta_contributewith type=claim, category=factual, source=URL → records the claim on the hash chain
"Challenge that claim — it's missing context"
AI calls
acta_respondwith type=challenge, basis=missing_context, target_assertion, argument → the claim transitions to "contested"
"Find claims that have no evidence yet"
AI calls
acta_discoverwith mode=needs_evidence → surfaces claims and predictions with no linked evidence
"Verify the chain for protocol-trust-models"
AI calls
acta_verify→ recomputes chain hashes, reports integrity status
Contributions and responses can optionally include a provenance object for AI authorship disclosure:
{
"provenance": {
"authored_with_model": "claude-sonnet-4-20250514",
"tool_version": "acta-mcp/0.2.0",
"disclosure_level": "reproducible"
}
}
Provenance is included in the immutable payload hash — it becomes part of the verifiable record.
Uses X-Device-Id header by default. Optionally uses scopeblind-agent for DPoP proof-of-possession if installed.
| Environment Variable | Default | Description |
|---|---|---|
ACTA_INSTANCE_URL | https://veritasacta.com | The Acta instance to connect to |
ACTA_DEVICE_ID | Auto-generated | Device identity for budget/rate limiting |
MIT
FAQs
MCP server for Veritas Acta — contribute, challenge, verify, and query contestable public records from AI coding tools.
We found that acta-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.