aipou-mcp-server

MCP@0xddneto
v0.5.00xddnetoMITUpdated 2mo agonpmGitHub

MCP server for private, signed AI task receipts and optional validated AIPOU claims.

Works in
ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

@0xddneto
Identity-verified publisher GitHub@0xddneto
Verified Jul 14, 2026
436Downloads/wk
2mo agoLast update
Package
Author0xddneto
LicenseMIT
Version0.5.0
Sourcenpm+mcp-registry
npmaipou-mcp-server
GitHub0xddneto/AI-Proof-of-Us
SBOMCycloneDX 1.6 ↓
Trust Status
A
100/100Trusted
✓Listed in Forge index+10/10
✓Publisher identity verified+20/20
✓Ed25519 publish signature+5/5
✓Domain verification+5/5
✓npm Trusted Publishing (Sigstore)+5/5
✓npm maintainer match+5/5
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
StatusIdentity verified
Publisher@0xddneto
Signature✓ Signed · Ed25519
Domain✓ 0xddneto.github.io
Provenance✓ Sigstore-verified · 5ede988
Dependencies✓ 15 resolved · none vulnerable
Tool surface—
Security scan✓ Cleanv0.5.0 · 1mo agoHow well does this scan work?
EvalsNone
IndexedJul 2, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

No tool declarations found in the source1mo ago

Forge read 55 source files from the published package tarball and matched no MCP tool registrations. Extraction is pattern-based over shipped source: a server that builds its tool list at runtime, or that ships only bundled or minified code, registers nothing this can see. Treat it as “not detected”, not as “exposes none”.

About

MCP server for private, signed AI task receipts and optional validated AIPOU claims.

Keywords
mcpmodel-context-protocolai-agentsai-receiptsprovenancebaseaipou
Alternatives
Comparing tool surfaces…

Dependency tree

What one Forge scan resolved from npm metadata on 2026-08-28 — observed resolution, not a publisher declaration.

15 packages resolved · 4 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.