MCP SERVERCheck whether an MCP server, skill or plugin has been certified, read the supply-chain and adversarial-testing findings behind the score, and verify a signed artifact against the file you actually have.
LABSCO SUMMARY
A certification is only worth what the verification path costs. get_contract and verify_artifact are the thorough route and need a key; verify_file is deliberately the cheapest thing that still answers the real question, which is whether this file is that file. The split between keyed and unkeyed tools is worth noting for what it says about intent — the lookups and the integrity check are open, and the depth is behind a free registration. One thing to hold in mind when reading any score here: Fidensa certifies capabilities and this server is itself one of them, so the trust signal and the thing being trusted come from the same party.
A client for Fidensa, which certifies AI capabilities — MCP servers, skills, agent rules files, hooks, sub-agents and plugins. Seven tools covering trust lookup, the full certification contract, search and comparison, cryptographic verification and experience reporting.
Four of the seven tools run with no key at all — check_certification, search_capabilities, verify_file and report_experience — and the server prints which ones are active at startup. FIDENSA_API_KEY, free on registration, unlocks get_contract, compare_capabilities and verify_artifact and raises the reporting rate limit.
One command — npm install -g @fidensa/mcp-server
USE CASES
Get the certification status, trust score, grade and supply-chain status before installing — a check that needs no key.
Pull the contract behind it: identity, supply-chain analysis, security scan, adversarial testing findings and behavioural fingerprint, rather than acting on a single number.
Hash the file, pass it with the capability id, and get a yes or no — no artifact to fetch and no key to hold.
Search for certified alternatives, then put the shortlist side by side with a per-signal breakdown rather than comparing headline scores.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
check_certificationQuick trust check for an AI capability (MCP server, skill, plugin, or workflow). Returns certification status, trust score, grade, tier, and supply chain status. No API key required. Use this before invoking any capability to verify it has been independently certified by Fidensa.
compare_capabilitiesSide-by-side comparison of 2-5 certified capabilities. Shows trust scores, grades, tiers, and per-signal breakdowns to help choose between alternatives. Requires a free API key (set FIDENSA_API_KEY).
get_contractRetrieve the full certification contract for a capability, including identity, supply chain analysis, security scan results, adversarial testing findings, behavioral fingerprint, and trust score breakdown. Requires a free API key (set FIDENSA_API_KEY).
report_experienceSubmit an experience report for a certified capability. Reports feed into the social proof signal of the trust score. Requires the content_hash from the .cert.json artifact (proves you've encountered the certified file). API key optional but recommended for higher rate limits.
search_capabilitiesSearch for certified AI capabilities by keyword or description. Use this to discover certified alternatives when a capability is uncertified or scores poorly. Supports filtering by type, tier, and minimum trust score. No API key required.
verify_artifactVerify the cryptographic signature on a Fidensa certification artifact (.cert.json). Checks platform signature, content hash, expiry, and optionally code integrity (git SHA match) and file integrity (file hash match). For true offline verification, pass the .cert.json content from the capability's published package via the content parameter. Requires a free API key (set FIDENSA_API_KEY).
verify_fileQuick file integrity check: pass the SHA-256 hash of a capability file and its capability_id to verify the file matches what Fidensa certified. This is the simplest verification path — no .cert.json needed. No API key required.
BEFORE YOU INSTALL
7 tools when we connected. check_certification, search_capabilities, verify_file and report_experience work without a key; the other three need a free FIDENSA_API_KEY.
npx on PATH
All 5 documented clients run the server on your machine.
CONTEXT COST
Rated by the size of the 7 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
npm install -g @fidensa/mcp-server{
"mcpServers": {
"fidensa": {
"command": "npx",
"args": [
"@fidensa/mcp-server"
],
"env": {
"FIDENSA_API_KEY": "<YOUR_FIDENSA_API_KEY>"
}
}
}
}{
"servers": {
"fidensa": {
"type": "stdio",
"command": "npx",
"args": [
"@fidensa/mcp-server"
],
"env": {
"FIDENSA_API_KEY": "<YOUR_FIDENSA_API_KEY>"
}
}
}
}MCP servers
The-Nexus-Guard
noritaka88ta
vinaybhosle
CSOAI-ORG