get_trust_signals
Read-onlyIdempotent
Aggregate non-CVE trust signals for a package—maintainer trust, OpenSSF Scorecard, quality metrics, and SLSA/Sigstore provenance—to deep-vet packages for hardened, regulated, or compliance-driven environments.
Instructions
One-call aggregate of ALL non-CVE supply-chain trust signals: maintainer trust (bus factor, ownership changes), OpenSSF Scorecard, quality (criticality, release velocity, publish security), and SLSA/Sigstore provenance. USE WHEN: deep-vetting a package beyond CVEs (hardened/regulated env, SBOM/compliance, small-pkg ownership review, choosing between healthy candidates). Runs 4 backend endpoints in parallel. RETURNS: {maintainer, scorecard, quality, provenance} — each may be null if its backend call failed.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ecosystem | Yes | ||
| package | Yes |
Implementation Reference
- mcp-server/tools.js:749-760 (handler)Handler for the get_trust_signals tool. Fires 4 parallel backend API calls (maintainers, scorecard, quality, provenance) with error isolation (each failing call returns null). Returns aggregated {maintainer, scorecard, quality, provenance} object.
case "get_trust_signals": { const pkg = args.package; const eco = args.ecosystem; const safe = (p) => gJ(p).catch(() => null); const [maintainer, scorecard, quality, provenance] = await Promise.all([ safe(`/api/maintainers/${eco}/${pkg}`), safe(`/api/scorecard/${eco}/${pkg}`), safe(`/api/quality/${eco}/${pkg}`), safe(`/api/provenance/${eco}/${pkg}`), ]); return ok({ maintainer, scorecard, quality, provenance }); } - mcp-server/tools.js:448-468 (schema)Tool definition and inputSchema for get_trust_signals. Declares name, description, annotations (readOnlyHint, idempotentHint), and inputSchema requiring 'ecosystem' (enum from ECOSYSTEMS) and 'package' (string).
// ── 7. Supply-chain deep signals ──────────────────────────────────── { name: "get_trust_signals", description: "One-call aggregate of ALL non-CVE supply-chain trust signals: maintainer trust (bus factor, ownership changes), OpenSSF Scorecard, quality (criticality, release velocity, publish security), and SLSA/Sigstore provenance. USE WHEN: deep-vetting a package beyond CVEs (hardened/regulated env, SBOM/compliance, small-pkg ownership review, choosing between healthy candidates). Runs 4 backend endpoints in parallel. RETURNS: {maintainer, scorecard, quality, provenance} — each may be null if its backend call failed.", annotations: { title: "get_trust_signals", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, }, inputSchema: { type: "object", properties: { ecosystem: { type: "string", enum: ECOSYSTEMS }, package: { type: "string" }, }, required: ["ecosystem", "package"], }, }, - mcp-server/tools.js:565-570 (registration)The handleToolCall function is the central dispatcher where get_trust_signals is registered in the switch statement at line 749. It's exported and consumed by both index.js (stdio) and http-server.js (Streamable HTTP), which register it via CallToolRequestSchema.
export async function handleToolCall(name, args) { // Tool-scoped helpers that auto-forward the MCP tool name to the backend // via X-MCP-Tool header (enriches api_usage.source = "mcp:<tool>"). const gJ = (path) => getJson(path, name); const gT = (path) => getText(path, name); const pJ = (path, body) => postJson(path, body, name);