{
  "identity": {
    "name": "fidensa-mcp-server",
    "version": "0.4.1",
    "publisher": {
      "name": "Fidensa (https://fidensa.com)"
    },
    "source": "https://github.com/fidensa/mcp-server",
    "license": "MIT",
    "type": "mcp_server"
  },
  "interface_": {
    "transport": [
      "stdio"
    ],
    "tools": [
      {
        "name": "check_certification",
        "description": "Quick trust check for an AI capability (MCP server, skill, plugin, or workflow). Returns certification status, trust score, grade, tier, and supply chain status. No API key required. Use this before invoking any capability to verify it has been independently certified by Fidensa.",
        "input_schema": {
          "type": "object",
          "properties": {
            "capability_id": {
              "type": "string",
              "description": "Capability identifier (e.g. \"mcp-server-filesystem\")"
            },
            "version": {
              "type": "string",
              "description": "Specific version to check (e.g. \"1.0.0\"). Omit for latest."
            }
          },
          "required": [
            "capability_id"
          ],
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      },
      {
        "name": "get_contract",
        "description": "Retrieve the full certification contract for a capability, including identity, supply chain analysis, security scan results, adversarial testing findings, behavioral fingerprint, and trust score breakdown. Requires a free API key (set FIDENSA_API_KEY).",
        "input_schema": {
          "type": "object",
          "properties": {
            "capability_id": {
              "type": "string",
              "description": "Capability identifier"
            },
            "version": {
              "type": "string",
              "description": "Specific version (omit for latest)"
            }
          },
          "required": [
            "capability_id"
          ],
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      },
      {
        "name": "search_capabilities",
        "description": "Search for certified AI capabilities by keyword or description. Use this to discover certified alternatives when a capability is uncertified or scores poorly. Supports filtering by type, tier, and minimum trust score. No API key required.",
        "input_schema": {
          "type": "object",
          "properties": {
            "query": {
              "type": "string",
              "description": "Search query (natural language or keywords)"
            },
            "type": {
              "type": "string",
              "enum": [
                "mcp_server",
                "skill",
                "rules_file",
                "hook",
                "sub_agent",
                "plugin"
              ],
              "description": "Filter by capability type"
            },
            "tier": {
              "type": "string",
              "enum": [
                "certified",
                "verified",
                "evaluated"
              ],
              "description": "Filter by certification tier"
            },
            "min_score": {
              "type": "integer",
              "minimum": 0,
              "maximum": 100,
              "description": "Minimum trust score (0-100)"
            },
            "limit": {
              "type": "integer",
              "minimum": 1,
              "maximum": 50,
              "description": "Maximum number of results (default: 10)"
            }
          },
          "required": [
            "query"
          ],
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      },
      {
        "name": "compare_capabilities",
        "description": "Side-by-side comparison of 2-5 certified capabilities. Shows trust scores, grades, tiers, and per-signal breakdowns to help choose between alternatives. Requires a free API key (set FIDENSA_API_KEY).",
        "input_schema": {
          "type": "object",
          "properties": {
            "capability_ids": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "minItems": 2,
              "maxItems": 5,
              "description": "Array of 2-5 capability IDs to compare"
            }
          },
          "required": [
            "capability_ids"
          ],
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      },
      {
        "name": "report_experience",
        "description": "Submit an experience report for a certified capability. Reports feed into the social proof signal of the trust score. Requires the content_hash from the .cert.json artifact (proves you've encountered the certified file). API key optional but recommended for higher rate limits.",
        "input_schema": {
          "type": "object",
          "properties": {
            "capability_id": {
              "type": "string",
              "description": "Capability identifier"
            },
            "content_hash": {
              "type": "string",
              "description": "SHA-256 content hash from the .cert.json artifact or the certification block. This proves you have the certified file."
            },
            "outcome": {
              "type": "string",
              "enum": [
                "success",
                "failure",
                "partial"
              ],
              "description": "Overall outcome of using the capability"
            },
            "version": {
              "type": "string",
              "description": "Capability version (e.g. \"1.0.0\"). Server defaults to latest if omitted."
            },
            "environment": {
              "type": "object",
              "properties": {
                "agent_platform": {
                  "type": "string",
                  "description": "Agent platform (e.g. \"claude-code\", \"cursor\")"
                },
                "agent_version": {
                  "type": "string",
                  "description": "Agent version"
                },
                "os": {
                  "type": "string",
                  "description": "Operating system"
                },
                "runtime_version": {
                  "type": "string",
                  "description": "Runtime version (e.g. \"node-22.x\")"
                }
              },
              "required": [
                "agent_platform"
              ],
              "additionalProperties": false,
              "description": "Environment context"
            },
            "details": {
              "type": "object",
              "properties": {
                "tools_used": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "description": "Which tools were used"
                },
                "failure_description": {
                  "type": "string",
                  "description": "What went wrong"
                },
                "unexpected_behavior": {
                  "type": "string",
                  "description": "Unexpected behavior observed"
                }
              },
              "additionalProperties": false,
              "description": "Additional details"
            }
          },
          "required": [
            "capability_id",
            "content_hash",
            "outcome"
          ],
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      },
      {
        "name": "verify_artifact",
        "description": "Verify the cryptographic signature on a Fidensa certification artifact (.cert.json). Checks platform signature, content hash, expiry, and optionally code integrity (git SHA match) and file integrity (file hash match). For true offline verification, pass the .cert.json content from the capability's published package via the content parameter. Requires a free API key (set FIDENSA_API_KEY).",
        "input_schema": {
          "type": "object",
          "properties": {
            "content": {
              "type": "string",
              "description": "Base64-encoded .cert.json artifact content. Preferred for independent verification."
            },
            "url": {
              "type": "string",
              "description": "fidensa.com URL to fetch the artifact (convenience, but verification is circular since the artifact comes from the same authority verifying it)."
            },
            "installed_git_sha": {
              "type": "string",
              "description": "Git commit SHA of the installed code (from \"git rev-parse HEAD\"). When provided, verifies that the installed code matches the certified commit."
            },
            "file_hash": {
              "type": "string",
              "description": "SHA-256 hash of the capability file (excluding the residual comment line). When provided, verifies the file matches the certified original."
            }
          },
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      },
      {
        "name": "verify_file",
        "description": "Quick file integrity check: pass the SHA-256 hash of a capability file and its capability_id to verify the file matches what Fidensa certified. This is the simplest verification path — no .cert.json needed. No API key required.",
        "input_schema": {
          "type": "object",
          "properties": {
            "capability_id": {
              "type": "string",
              "description": "Capability identifier"
            },
            "file_hash": {
              "type": "string",
              "description": "SHA-256 hash of the capability file (excluding the residual comment line if present)."
            }
          },
          "required": [
            "capability_id",
            "file_hash"
          ],
          "additionalProperties": false,
          "$schema": "http://json-schema.org/draft-07/schema#"
        }
      }
    ],
    "resources": [],
    "prompts": []
  },
  "dependencies": [
    {
      "type": "runtime",
      "name": "node",
      "version": ">=22.0.0",
      "required": true
    },
    {
      "type": "npm_package",
      "name": "@modelcontextprotocol/sdk",
      "version": "^1.27.0",
      "required": true
    },
    {
      "type": "npm_package",
      "name": "zod",
      "version": "^3.25.0",
      "required": true
    },
    {
      "type": "npm_package",
      "name": "jose",
      "version": "^6.2.0",
      "required": true
    }
  ],
  "package_description": "Fidensa AI certification authority -- MCP server for trust-aware tool selection",
  "readme_content": "# @fidensa/mcp-server\r\n\r\n[![Fidensa Certified](https://fidensa.com/badges/fidensa-mcp-server.svg)](https://fidensa.com/certifications/fidensa-mcp-server)\r\n\r\nMCP server for [Fidensa](https://fidensa.com) -- the independent AI capability certification authority.\r\n\r\nGives your AI agent structured access to Fidensa certification data through the Model Context Protocol. Check trust scores, search for certified alternatives, compare capabilities side-by-side, verify signed artifacts, check file integrity, and report runtime experience -- all through MCP tool calls.\r\n\r\nFidensa certifies MCP servers, skills, agent rules files, hooks, sub-agents, and plugins.\r\n\r\n## Getting Started\r\n\r\n### 1. Install\r\n\r\n```bash\r\nnpm install -g @fidensa/mcp-server\r\n```\r\n\r\n### 2. Verify it works\r\n\r\nSeveral tools work without an API key (`check_certification`, `search_capabilities`, `verify_file`, and `report_experience`). Start the server and confirm it connects to the production API:\r\n\r\n```bash\r\nfidensa-mcp-server\r\n```\r\n\r\nYou should see:\r\n\r\n```\r\n[fidensa] MCP server started (stdio transport)\r\n[fidensa] No FIDENSA_API_KEY set — check_certification, search_capabilities, verify_file, and report_experience available. Set FIDENSA_API_KEY for full access.\r\n```\r\n\r\nPress Ctrl+C to stop.\r\n\r\n### 3. Get an API key (optional, free)\r\n\r\nThe remaining tools (`get_contract`, `compare_capabilities`, `verify_artifact`) require a free API key. An API key also gives `report_experience` higher rate limits. Register one:\r\n\r\n```bash\r\ncurl -X POST https://fidensa.com/v1/keys \\\r\n  -H \"Content-Type: application/json\" \\\r\n  -d '{\"display_name\": \"My Agent\", \"email\": \"you@example.com\"}'\r\n```\r\n\r\nOr in PowerShell:\r\n\r\n```powershell\r\nInvoke-RestMethod -Uri \"https://fidensa.com/v1/keys\" -Method Post -ContentType \"application/json\" -Body '{\"display_name\": \"My Agent\", \"email\": \"you@example.com\"}'\r\n```\r\n\r\nThe response contains your API key (prefixed `fid_`). Store it securely -- it is shown only once.\r\n\r\n### 4. Add to your agent\r\n\r\nPick your platform and add the MCP server configuration:\r\n\r\n**Claude Desktop / Claude Code**\r\n\r\n```json\r\n{\r\n  \"mcpServers\": {\r\n    \"fidensa\": {\r\n      \"command\": \"npx\",\r\n      \"args\": [\"@fidensa/mcp-server\"],\r\n      \"env\": {\r\n        \"FIDENSA_API_KEY\": \"fid_your_key_here\"\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n**Cursor** (`.cursor/mcp.json`)\r\n\r\n```json\r\n{\r\n  \"mcpServers\": {\r\n    \"fidensa\": {\r\n      \"command\": \"npx\",\r\n      \"args\": [\"@fidensa/mcp-server\"],\r\n      \"env\": {\r\n        \"FIDENSA_API_KEY\": \"fid_your_key_here\"\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n**Windsurf / VS Code**\r\n\r\n```json\r\n{\r\n  \"servers\": {\r\n    \"fidensa\": {\r\n      \"type\": \"stdio\",\r\n      \"command\": \"npx\",\r\n      \"args\": [\"@fidensa/mcp-server\"],\r\n      \"env\": {\r\n        \"FIDENSA_API_KEY\": \"fid_your_key_here\"\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nOmit the `FIDENSA_API_KEY` line if you only need the open-tier tools.\r\n\r\n> **Claude Desktop tip:** Access the config file via Settings → Developer → Edit Config. After saving, fully quit and reopen Claude Desktop (right-click the system tray icon and select Quit — just closing the window isn't enough).\r\n\r\n## Tools\r\n\r\n| Tool | Auth | Description |\r\n|------|------|-------------|\r\n| `check_certification` | None | Quick trust check -- status, score, grade, tier |\r\n| `search_capabilities` | None | Search for certified capabilities by keyword, type, tier, or score |\r\n| `verify_file` | None | Quick file integrity check -- hash a capability file and verify it matches what Fidensa certified |\r\n| `report_experience` | None (API key for higher rate limits) | Submit runtime experience reports for certified capabilities |\r\n| `get_contract` | API key | Full certification contract with all evidence |\r\n| `compare_capabilities` | API key | Side-by-side comparison of 2-5 capabilities |\r\n| `verify_artifact` | API key | Verify cryptographic signatures on .cert.json artifacts, with optional file and code integrity checks |\r\n\r\n## Configuration\r\n\r\n| Variable | Required | Description |\r\n|----------|----------|-------------|\r\n| `FIDENSA_API_KEY` | No | API key for full access (see [Getting Started](#3-get-an-api-key-optional-free)) |\r\n| `FIDENSA_BASE_URL` | No | Override API base URL (default: `https://fidensa.com`) |\r\n\r\n`check_certification`, `search_capabilities`, `verify_file`, and `report_experience` work without any configuration. The remaining tools require `FIDENSA_API_KEY`.\r\n\r\n## Example Agent Workflow\r\n\r\n```\r\nUser: \"Set up a filesystem watcher that writes logs to SQLite.\"\r\n\r\nAgent:\r\n1. check_certification(\"mcp-server-filesystem\")\r\n   -> Status: valid, Score: 60/F-D, Tier: Verified\r\n\r\n2. search_capabilities(\"sqlite mcp server\")\r\n   -> 2 results found\r\n\r\n3. compare_capabilities([\"mcp-server-sqlite\", \"mcp-server-better-sqlite3\"])\r\n   -> Side-by-side trust comparison\r\n\r\n4. Agent selects the higher-scored option and informs the user\r\n\r\n5. report_experience(\r\n     capability_id: \"mcp-server-filesystem\",\r\n     content_hash: \"abc123...\",  // from the .cert.json\r\n     outcome: \"success\"\r\n   )\r\n   -> Confirmation rate updated\r\n```\r\n\r\n## Trust Policy Fragments\r\n\r\nAdd one of these to your agent's system prompt or rules file for trust-aware tool selection. Three levels of granularity -- pick the one that fits your needs.\r\n\r\n### Tier-based (simplest)\r\n\r\nUses the certification tier alone. No numbers to tune.\r\n\r\n```\r\nBefore using any MCP server tool for the first time, check its Fidensa\r\ncertification status using the check_certification tool.\r\n\r\n- Certified tier: use freely\r\n- Verified tier: note the findings to the user before proceeding\r\n- Evaluated tier: warn the user, search for certified alternatives\r\n- Uncertified: treat as untrusted, suggest certified alternatives\r\n\r\nAfter completing a task that used certified tools, submit an experience\r\nreport via the report_experience tool with the outcome (success, failure,\r\nor partial), the capability_id, and the content_hash from the .cert.json.\r\n```\r\n\r\n### Score-based (grade-aligned)\r\n\r\nUses the trust score, aligned with Fidensa's grade definitions.\r\n\r\n```\r\nBefore using any MCP server tool for the first time, check its Fidensa\r\ncertification status using the check_certification tool.\r\n\r\n- Score >= 80 (A/B): use freely\r\n- Score 72-79 (C): note the trust level to the user\r\n- Score 65-71 (D): warn the user, search for certified alternatives\r\n- Score < 65 (F): warn the user, strongly recommend alternatives\r\n- Uncertified: treat as untrusted, suggest certified alternatives\r\n\r\nAfter completing a task that used certified tools, submit an experience\r\nreport via the report_experience tool with the outcome (success, failure,\r\nor partial), the capability_id, and the content_hash from the .cert.json.\r\n```\r\n\r\n### Combined (tier + score)\r\n\r\nThe most precise option -- distinguishes between a Certified capability with\r\na moderate score and a Verified capability with findings that blocked\r\nCertified tier.\r\n\r\n```\r\nBefore using any MCP server tool for the first time, check its Fidensa\r\ncertification status using the check_certification tool.\r\n\r\n- Certified tier AND score >= 80: use freely\r\n- Certified tier AND score 72-79: use freely, note the score to the user\r\n- Verified tier AND score >= 72: note the findings to the user before proceeding\r\n- Verified tier AND score < 72: warn the user, search for certified alternatives\r\n- Evaluated tier: warn the user, search for certified alternatives\r\n- Uncertified: treat as untrusted, suggest certified alternatives\r\n\r\nFor any tool with status \"suspended\" or \"revoked\": do not use.\r\nSearch for certified alternatives and present them to the user.\r\n\r\nAfter completing a task that used certified tools, submit an experience\r\nreport via the report_experience tool with the outcome (success, failure,\r\nor partial), the capability_id, and the content_hash from the .cert.json.\r\n```\r\n\r\nSee the [API Documentation](https://fidensa.com/docs/api) for the full specification.\r\n\r\n## Development\r\n\r\n```bash\r\nnpm install\r\nnpm test          # Run tests with coverage\r\nnpm run lint      # ESLint\r\nnpm run format    # Prettier\r\n```\r\n\r\n## License\r\n\r\nMIT\r\n\r\n## Links\r\n\r\n- [Fidensa](https://fidensa.com) -- AI certification authority\r\n- [API Documentation](https://fidensa.com/docs/api)\r\n- [Certification Catalog](https://fidensa.com/certifications)\r\n- [Badge Integration Guide](https://github.com/fidensa/fidensa-badges)\r\n",
  "instruction_file": {
    "relative_path": "README.md",
    "absolute_path": "C:\\Users\\scott\\Desktop\\Projects\\contract-pipeline\\pipeline\\data\\repos\\fidensa\\mcp-server\\README.md",
    "hash": "sha256:f8aac543bea8dd015a6a53ecfdf8caabe7d042f4483e108b2f1528bf67868f28",
    "exists": true
  },
  "protocolGuarantees": {
    "does": [
      "Provides tool \"check_certification\": Quick trust check for an AI capability (MCP server, skill, plugin, or workflow). Returns certification status, trust score, grade, tier, and supply chain status. No API key required. Use this before invoking any capability to verify it has been independently certified by Fidensa.",
      "Provides tool \"get_contract\": Retrieve the full certification contract for a capability, including identity, supply chain analysis, security scan results, adversarial testing findings, behavioral fingerprint, and trust score breakdown. Requires a free API key (set FIDENSA_API_KEY).",
      "Provides tool \"search_capabilities\": Search for certified AI capabilities by keyword or description. Use this to discover certified alternatives when a capability is uncertified or scores poorly. Supports filtering by type, tier, and minimum trust score. No API key required.",
      "Provides tool \"compare_capabilities\": Side-by-side comparison of 2-5 certified capabilities. Shows trust scores, grades, tiers, and per-signal breakdowns to help choose between alternatives. Requires a free API key (set FIDENSA_API_KEY).",
      "Provides tool \"report_experience\": Submit an experience report for a certified capability. Reports feed into the social proof signal of the trust score. Requires the content_hash from the .cert.json artifact (proves you've encountered the certified file). API key optional but recommended for higher rate limits.",
      "Provides tool \"verify_artifact\": Verify the cryptographic signature on a Fidensa certification artifact (.cert.json). Checks platform signature, content hash, expiry, and optionally code integrity (git SHA match) and file integrity (file hash match). For true offline verification, pass the .cert.json content from the capability's published package via the content parameter. Requires a free API key (set FIDENSA_API_KEY).",
      "Provides tool \"verify_file\": Quick file integrity check: pass the SHA-256 hash of a capability file and its capability_id to verify the file matches what Fidensa certified. This is the simplest verification path — no .cert.json needed. No API key required."
    ],
    "does_not": [],
    "scope_boundaries": {
      "modifies_files": false,
      "creates_files": false,
      "deletes_files": false,
      "makes_network_requests": false,
      "accesses_env_variables": false,
      "invokes_external_tools": false
    },
    "edge_cases": [],
    "source": "protocol"
  },
  "readmeGuarantees": {
    "does": [
      "Provides structured access to Fidensa certification data through MCP tool calls",
      "Checks trust scores of capabilities",
      "Searches for certified alternatives",
      "Compares capabilities side-by-side",
      "Verifies signed artifacts",
      "Checks file integrity by hashing capability files and verifying against Fidensa certified versions",
      "Reports runtime experience",
      "Provides check_certification tool for quick trust check with status, score, grade, tier",
      "Provides search_capabilities tool to search for certified capabilities by keyword, type, tier, or score",
      "Provides verify_file tool for quick file integrity check",
      "Provides report_experience tool to submit runtime experience reports",
      "Provides get_contract tool for full certification contract with all evidence (requires API key)",
      "Provides compare_capabilities tool for side-by-side comparison of 2-5 capabilities (requires API key)",
      "Provides verify_artifact tool to verify cryptographic signatures on .cert.json artifacts with optional file and code integrity checks (requires API key)",
      "Works with some tools without API key (check_certification, search_capabilities, verify_file, and report_experience)",
      "Provides higher rate limits for report_experience with API key",
      "Connects to production API at https://fidensa.com by default"
    ],
    "does_not": [
      "Does not show API keys more than once during registration"
    ],
    "scope_boundaries": {
      "modifies_files": false,
      "creates_files": false,
      "deletes_files": false,
      "makes_network_requests": true,
      "accesses_env_variables": true,
      "invokes_external_tools": false
    },
    "edge_cases": [
      "Some tools require API key while others work without any configuration",
      "API key provides higher rate limits for report_experience tool",
      "Server shows different startup messages depending on whether FIDENSA_API_KEY is set"
    ],
    "confidence": 0.9,
    "source": "author"
  },
  "sourceHash": "sha256:ae06d639e05803b76b5040cd4fe9d32f2a55eb1314332abab5769f630cfece17",
  "buildStatus": {
    "installed": true,
    "built": true,
    "buildError": null
  },
  "extractedAt": "2026-03-29T17:50:03.156Z",
  "extractionMethod": "mcp_client",
  "durationMs": 8698,
  "gitSha": "c39fcc1d1a92511afa5402f44dd1a94f9b173bbb"
}