Purpose
hvtracker-mcp is an MCP server used for supply chain trust checks before connecting AI agents, frameworks, or MCP servers. It aggregates public signals (package provenance, OSSF Scorecard, signed commits, etc.) into well-documented HVTrust scores and verdicts, helping users avoid connecting to AI dependencies of untrusted origin.
Main capabilities
This MCP server provides the following tools:
- verify_mcp_server: gives a pre-connection trust verdict for an MCP server, package, GitHub repository, or agent name.
- check_agent_trust: queries the trust profile of a tracked AI agent or framework, including runtime capabilities (MCP status, provider, plugin surface, provenance drift) as well as the URL of its Ed25519-signed trust credential.
- compare_agents: compares two agents side by side, giving evidence-based verdicts and a link to the published comparison page.
- search_agents: searches the HVTracker registry by name, repository, description, or category.
- scan_stack: performs batch pre-connection trust checks on an entire dependency set—you can paste requirements.txt, package.json, an MCP client configuration, or a plain list to get a trust verdict for each entry and an overall stack summary.
- list_categories: lists HVTracker categories and their agent counts, so you can further retrieve the leaderboard for a category.
- get_leaderboard: top tracked AI agents and MCP servers ranked by HVTrust score, optionally filtered by a single category.
- get_agent_history: queries the trust score, grade, and ranking history of a tracked agent over 90 days, to determine whether its trend is improving or declining.
Usage
This repository provides both a hosted remote server and a local stdio package for clients that prefer package-based installation. It supports connection via MCP client configuration. In GitHub Actions, HVTrust Gate can run the same trust checks: with no configuration required, it reads requirements.txt, pyproject.toml, package.json, and MCP client configuration, and onpull requests that change these files, comments the HVTrust grade of every AI agent and MCP server they depend on.
During testing, you can specify a different HVTracker base URL.
Integration and publishing
The official MCP Registry manifest is server.json. In GitHub Actions, the "Publish MCP Registry" workflow must be run after the npm, PyPI, and GHCR packages for the same version are live. Tagged releases build a .mcpb bundle for Claude Desktop based on manifest.json.
Use cases
Suitable for trust assessment before introducing AI agents, MCP servers, or framework dependencies, and also for continuously checking the security of AI dependencies in CI, as well as comparing and tracking trust change trends of tracked agents.
Limitations
The HVTracker MCP sends user-provided search strings or server identifiers to https://hvtracker.net to retrieve public trust data. It does not require an API key and does not write to the user's system. For current data and methodology, see the HVTracker site; for the repository privacy statement, see PRIVACY.md. Other details regarding fees, pricing, and platform specifics are not provided in the materials.
