bots.st/commit-supply-chain-risk-scoring
Commit — Supply Chain Risk Scoring
Supply chain risk scoring for packages and repos
551 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 12
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://poc-backend.amdal-dev.workers.dev/mcp - npm
npx -y proof-of-commitmentReleased 20 Jun 2026, version 1.36.0
What it can do
| Tool | What it says it does |
|---|---|
audit_dependencies | Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concentration risk)… |
audit_dependency_tree | Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages… |
audit_github_repo | Audit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — just provide the GitHub URL or owner/repo slug, and get a… |
get_api_key | Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring… |
lookup_business | Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free, verified… |
lookup_business_by_org | Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre. |
lookup_cargo_crate | Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply chain risks apply… |
lookup_github_repo | Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments — harder to fake than… |
lookup_go_module | Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contributors (the closest… |
lookup_npm_package | Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also returns… |
lookup_pypi_package | Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was compromised via… |
query_commitment | Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content. |
In its maker's words
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
- Website
- getcommit.dev
- Source
- github.com/piiiico/proof-of-commitment
- Publisher
- piiiico (3 listings in the registry)
- Listed from
- the official MCP Registry as
io.github.piiiico/proof-of-commitment - Version
- 1.36.0, updated 20 Jun 2026
- Kinds of work
- Security and trust, Search and research, Code and developer tools
The domain it lives on
- getcommit.dev
- registered 29 Mar 2026 (7 months ago), at Porkbun LLC, its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 551 ms | |
| Answered | 1021 ms | |
| Answered | 113 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.