Proof of Commitment

Stars lie. Behavioral signals don't.

An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals that are harder to fake than stars, READMEs, or download counts.

$ npx proof-of-commitment axios zod chalk lodash minimatch
Scoring 5 npm packages... done in 3.0s

Package      Risk          Score   Publishers   Downloads      Age    Provenance
chalk        🔴 CRITICAL   72      1            432.9M/wk      14.6y  —
minimatch    🔴 CRITICAL   78      1            634.1M/wk      14.9y  —
lodash       🔴 CRITICAL   80      1            158.9M/wk      14.1y  —
zod          🔴 CRITICAL   83      1            161.2M/wk      6.3y   🔐 verified
axios        🔴 CRITICAL   88      1            115.7M/wk      11.8y  🔐 verified
                ⚠ COMPROMISED — axios token theft (2026-03-30)

⚠  5 CRITICAL packages found.
   CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)

npm audit flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).

The supply chain problem

26 of the 91 npm packages with >10M weekly downloads have a single npm publisher. Together they account for over 3 billion downloads per week. npm audit doesn't surface this. Stars don't either.

Four packages in a typical Node.js project are CRITICAL right now:

• chalk — 432M downloads/week, 1 npm publisher
• zod — 185M downloads/week, 1 npm publisher (30+ GitHub contributors)
• lodash — 156M downloads/week, 1 npm publisher
• axios — 113M downloads/week, 1 npm publisher (attacked March 30, 2026)

They won't appear in your package.json either — but these are in almost every project:

• minimatch — 625M downloads/week, 1 npm publisher
• glob — 366M downloads/week, 1 npm publisher
• cross-spawn — 215M downloads/week, 1 npm publisher

Behavioral signals surface this. Stars and READMEs don't.

Quick install (MCP)

No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.

Claude Desktop

Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:

{
  "mcpServers": {
    "commit": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}

Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.

Cursor

Open ~/.cursor/mcp.json (Cursor MCP docs) and add:

{
  "mcpServers": {
    "commit": {
      "type": "streamable-http",
      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
    }
  }
}

Smithery (once indexed)

npx -y @smithery/cli install proof-of-commitment --client claude

Try it now

Terminal (zero install):

# New in v1.8.0: zero-arg auto-detect — cd into any project, run once:
npx proof-of-commitment
# Picks the highest-coverage manifest in cwd (package-lock.json > yarn.lock >
# pnpm-lock.yaml > pnpm-workspace.yaml > package.json; requirements.txt;
# Cargo.toml; go.sum > go.mod). When multiple ecosystems are present, the
# file with the most recent mtime wins.

# Explicit package list still works:


... [View full README on GitHub](https://github.com/piiiico/proof-of-commitment#readme)