# com.dominionobservatory/observatory Trust checks for MCP servers: trust scores, tool-drift detection, signed diligence receipts. Free. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** com.dominionobservatory - **License:** Unknown - **Endpoints:** streamable-http https://dominionobservatory.com/mcp - **Source:** https://dominionobservatory.com - **Endpoint health:** reachable (last checked 2026-09-12T11:15:48.169Z, 4 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-12T11:15:48.169Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `check_trust` tool: Links to undeclared domain: example.workers.dev ## Tools 15 declared. Observed from a live `tools/list` probe. - `check_trust` — Get the trust score and reliability metrics for any MCP server. Use this BEFORE calling an unknown MCP server to assess if it's reliable. Returns trust_score (0 - `clawhub_skill_trust` — Check the supply-chain trust of a ClawHub (OpenClaw) skill BEFORE installing or invoking it. After the Feb-2026 ClawHavoc supply-chain attack, third-party skill - `verify_before_call` — Run a signed pre-invocation verification immediately before an agent sends money, credentials, private data, or write access to an MCP server. The first 3 verif - `paid_trust_verdict` — Get the PREMIUM behavioral trust verdict for an MCP server, with a signed, citable, tamper-evident attestation receipt. This is a paid x402 service: call WITHOU - `verify_attestation` — Cryptographically verify a Dominion signed attestation (JWS) — e.g. a trust-verdict receipt, gateway attestation, or MCP Verified badge. Stateless: checks the E - `preflight_check` — Run a PRE-FLIGHT due-diligence check on an MCP server BEFORE your agent invokes it. Returns a verdict (PASS/UNCERTAIN/FAIL/UNRATED) plus a SIGNED, timestamped d - `report_interaction` — Report the outcome of calling an MCP server. Call this AFTER you use any MCP server to contribute to the trust network. Your report helps other agents make bett - `get_leaderboard` — Get the top-rated MCP servers, optionally filtered by category. Use this to discover the most reliable MCP servers in the ecosystem. Categories include: weather - `get_baselines` — Get behavioral baselines for a tool category. Shows what 'normal' looks like — average latency, success rates, typical call patterns. Use this to evaluate wheth - `check_anomaly` — Check if observed behavior from an MCP server is anomalous compared to baselines. Use this when a server seems slow, unreliable, or returns unexpected results. - `register_server` — Register a new MCP server in the observatory. Server owners can register their servers to start building a trust score. Registration is free. - `get_server_history` — Get daily trust score and performance history for a server over the last 30 days. Use this to see trends — is the server improving or degrading? - `observatory_stats` — Get overall statistics about the Dominion Observatory — total servers tracked, total interactions recorded, coverage by category, and data freshness. Use this t - `get_compliance_report` — Export a compliance-ready audit trail of all recorded interactions. Formatted for EU AI Act Article 12 and Singapore IMDA Agentic AI Governance Framework. Filte - `get_mica_attestation` — Generate an EU AI Act Article 12-style behavioral audit attestation for an MCP server — timestamped, auditable interaction records for record-keeping/traceabili ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"observatory\": {\n \"type\": \"http\",\n \"url\": \"https://dominionobservatory.com/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.dominionobservatory%2Fobservatory - Install plan: https://forgeregistry.com/api/v1/packages/com.dominionobservatory%2Fobservatory/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.dominionobservatory%2Fobservatory - HTML page: https://forgeregistry.com/registry/com.dominionobservatory%2Fobservatory - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.