Commit — Supply Chain Risk Scoring is an MCP server with 12 tools an agent can call, among them audit_dependencies, audit_dependency_tree, audit_github_repo. It answers at https://poc-backend.amdal-dev.workers.dev/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 23 October 2026, succeeded.
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
audit_dependencies | Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M we Inputs: packages, ecosystem |
audit_dependency_tree | Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also w Inputs: package, depth |
audit_github_repo | Audit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — Inputs: repo |
get_api_key | Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate li Inputs: email |
lookup_business | Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Inputs: query |
lookup_business_by_org | Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre. Inputs: orgNumber |
lookup_cargo_crate | Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owner Inputs: crate |
lookup_github_repo | Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social pro Inputs: repo |
lookup_go_module | Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version Inputs: module |
lookup_npm_package | Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor cou Inputs: package |
lookup_pypi_package | Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python pack Inputs: package |
query_commitment | Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content. Inputs: domain |
Every block below points at https://poc-backend.amdal-dev.workers.dev/mcp. Pick your client and copy.
claude mcp add --transport http commit-supply-chain-risk-scoring https://poc-backend.amdal-dev.workers.dev/mcp
{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://poc-backend.amdal-dev.workers.dev/mcp"]
}
}
}{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"servers": {
"commit-supply-chain-risk-scoring": {
"type": "http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"context_servers": {
"commit-supply-chain-risk-scoring": {
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"serverUrl": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}name: Commit — Supply Chain Risk Scoring
version: 0.0.1
schema: v1
mcpServers:
- name: Commit — Supply Chain Risk Scoring
type: streamable-http
url: https://poc-backend.amdal-dev.workers.dev/mcp{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"httpUrl": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"type": "http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fpoc-backend.amdal-dev.workers.dev%2Fmcp&type=streamable_http&id=commit-supply-chain-risk-scoring&name=Commit%20%E2%80%94%20Supply%20Chain%20Risk%20Scoring
It answered our last check on 23 October 2026 in 121 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
12, as returned by the server's own tools/list on 17 September 2026: audit_dependencies, audit_dependency_tree, audit_github_repo, get_api_key, lookup_business, lookup_business_by_org, lookup_cargo_crate, lookup_github_repo, and 4 more.
It answered our last check on 23 October 2026 in 121 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://poc-backend.amdal-dev.workers.dev/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.piiiico. Endpoint host: poc-backend.amdal-dev.workers.dev. ARD identifier: urn:air:io.github.piiiico:mcp:proof-of-commitment.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.