
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
stillos-notary-mcp
Advanced tools
Independent attestation infrastructure for the agentic economy. Every claim is cryptographically signed (Ed25519) and settled against verifiable external ground truth — on-chain state, GitHub, market data, or structured API responses — producing an audit-
Verification infrastructure for the agentic economy. An agent submits a claim; the notary returns an Ed25519-signed, hash-chained verdict, settled against real external ground truth, not model output. Free tier, no account, no card.
Every tool call in this package settles against the live public notary over
HTTPS (nolawealthfinancial.com/notary). No local or internal-only code path
exists — behavior is identical regardless of runtime.
npx stillos-notary-mcp mcp
Or add to an MCP client config:
{
"mcpServers": {
"stillos-notary": { "command": "npx", "args": ["-y", "stillos-notary-mcp", "mcp"] }
}
}
claim_verdictSubmits a claim and a resolver specification. Returns CONFIRMED, REFUTED, or ERROR — never a forced guess — signed and hash-chained.
Supported resolver types: github_pr, onchain_tx, url_json, http_status,
kalshi_market.
stillos-notary-mcp claim "your-agent" "example.com returns 200" \
'{"type":"http_status","url":"https://example.com","expect_code":200}'
verify_receiptIndependently verifies any receipt by hash: confirms the hash chain is intact and the signature is valid.
stillos-notary-mcp verify <receipt_hash>
file_disputeFiles a bonded dispute against a verdict receipt. The disputed verdict is re-resolved immediately, against the identical resolver specification that produced it — independent re-run, not a re-vote, not a human appeal queue. An upheld dispute overturns the verdict and queues a slashable payout against the notary's on-chain correctness bond ($10 USDC, Base). Dispute window: 48 hours from the original receipt's timestamp.
Paid: $1.00 USDC (Base) via x402 — no free tier. A call without an
attached x402 payment returns the payment requirement (price, payTo, asset),
not a verdict. This package holds no wallet and executes no payment itself;
the calling agent's own client bears that capability.
stillos-notary-mcp dispute "your-agent" <receipt_hash>
screen_entityOFAC SDN sanctions name screen, with a source_as_of freshness timestamp,
Ed25519-signed.
Paid: $0.001 USDC (Base) via x402 — no free tier.
stillos-notary-mcp screen "your-agent" "Acme Corp"
distress_scoreValidated corporate distress-foresight score for a single equity ticker: Altman Z-score from live SEC XBRL filings, backtested 71% sensitivity / 100% specificity with a ~109-day median lead time, Ed25519-signed.
Paid: $0.15 USDC (Base) via x402 — no free tier.
stillos-notary-mcp distress "your-agent" AAPL
Most verification is one model checking another model's output — the same failure mode, with no independence introduced. This architecture settles every claim against a source neither counterparty controls, signs the outcome regardless of direction, and publishes confirmed and refuted verdicts to the same ledger. Fail-closed: an unresolvable claim returns ERROR, never a plausible-sounding guess.
FAQs
Independent attestation infrastructure for the agentic economy. Every claim is cryptographically signed (Ed25519) and settled against verifiable external ground truth — on-chain state, GitHub, market data, or structured API responses — producing an audit-
The npm package stillos-notary-mcp receives a total of 236 weekly downloads. As such, stillos-notary-mcp popularity was classified as not popular.
We found that stillos-notary-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.