piiiico/proof-of-commitment

> **Stars lie. Behavioral signals don't.**
An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on **behavioral commitment** — signals that are harder to fake than stars, READMEs, or download counts.
npm audit flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).
The supply chain problem
26 of the 91 npm packages with >10M weekly downloads have a **single npm publisher**. Together they account for over 3 billion downloads per week. npm audit doesn't surface this. Stars don't either.
Four packages in a typical Node.js project are CRITICAL right now:
- **chalk** — 432M downloads/week, **1 npm publisher**
- **zod** — 185M downloads/week, **1 npm publisher** (30+ GitHub contributors)
- **lodash** — 156M downloads/week, **1 npm publisher**
- **axios** — 113M downloads/week, **1 npm publisher** (attacked March 30, 2026)
They won't appear in your package.json either — but these are in almost every project:
- **minimatch** — 625M downloads/week, **1 npm publisher**
- **glob** — 366M downloads/week, **1 npm publisher**
- **cross-spawn** — 215M downloads/week, **1 npm publisher**
Behavioral signals surface this. Stars and READMEs don't.
Quick install (MCP)
No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.
**Claude Desktop**
Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:
Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.
**Cursor**
Open ~/.cursor/mcp.json (Cursor MCP docs) and add:
**Smithery** (once indexed)
---
Try it now
**Terminal (zero install):**
CI integration (v1.8.0+)
--fail-on= turns the CLI into a one-line CI gate. No GitHub Action required.
Levels:
| --fail-on | Exit 1 when… |
|---|---|
| critical | any package is flagged CRITICAL (publish-access concentration) |
| risky | any package is CRITICAL **or** HIGH (score results.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: results.sarif
category: commit-supply-chain
bash
Install for the current project (writes .cursor/hooks.json + .claude/settings.json + .windsurf/hooks.json):
poc hook
Or protect every project for your user:
poc hook --global
Narrow to one client:
poc hook --cursor # only .cursor/hooks.json
poc hook --claude-code # only .claude/settings.json
poc hook --windsurf # only .windsurf/hooks.json
Remove (cleans all three):
poc hook --uninstall
bash
npm install -g proof-of-commitment # then:
poc watch axios --email you@company.com # free key + monitoring in one step
poc watch chalk # add more packages (3 free)
poc init # add CI gate to this repo
yaml
.github/workflows/supply-chain.yml
name: Supply Chain Audit