Proof Of Commitment MCP Server

Most developer tooling work still happens through a UI a human drives. Proof Of Commitment MCP server moves it into the conversation instead. An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals that are harder to fake than stars, READMEs, or download counts.

The tools it exposes

The server publishes 12 tools. What each one is for:

• audit_dependencies — Batch risk audit for up to 20 npm/PyPI/Cargo/Go packages
• audit_github_repo — Fetch a repo's package.json/requirements.txt and audit every dep
• audit_dependency_tree — Map an npm package's full dependency tree (incl. transitive CRITICAL deps)
• lookup_npm_package — Single npm package behavioral profile
• lookup_pypi_package — Single PyPI package behavioral profile
• lookup_cargo_crate — Single Rust crate behavioral profile (crates.io)
• lookup_go_module — Single Go module behavioral profile (proxy.golang.org + GitHub)
• lookup_github_repo — GitHub repo commitment score (longevity, commit frequency, contributor depth)
• lookup_business — Norwegian business register — operating years, employees, financials
• lookup_business_by_org — Same, by org number
• query_commitment — Browser extension behavioral data (unique verified visitors, repeat rate)
• get_api_key — Create a free API key in-chat — no browser needed, key returned instantly

Getting it running

proof-of-commitment on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

What it needs from you

Configuration is passed through the environment: COMMIT_API_KEY, COMMIT_TEST_API_KEY. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

How it compares

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Proof Of Commitment's toolset — audit_dependencies, audit_github_repo, audit_dependency_tree and 9 more — is a fair guide to whether it matches your workflow. It is maintained by piiiico; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 12 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Proof Of Commitment.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.