DEPENDENCY EVIDENCE

Know what changed before you depend on it.

For teams using external agents and MCP servers: inspect measured evidence, watch changes, and keep a record of what your team accepted. Unknown evidence stays explicit.

Have a client configuration? Extract and check its public endpoints locally. Maintaining integrations for clients? Explore the agency pilot.

io.github.joshrotenberg/hexpm-mcp

Runtime observation: 2026-10-21T01:44:16.221117+00:00 · State: live

Watch availability, tools and parameter schemas, authentication access, endpoint changes and lifecycle notices. Only complete observed schemas are compared. OAuth scope and consent-screen changes are not currently measured.

Sign in to watch this MCP server

Sign-in required. Agent and MCP watches share the existing Free / Pro / Enterprise budget. Manage watches.

Current recorded evidence
{
  "auth": "anonymous",
  "availability": "live",
  "endpoint": "https://hexpm-mcp.fly.dev/mcp",
  "legal_identity": null,
  "lifecycle": null,
  "observed_at": "2026-10-21T01:44:16.221117+00:00",
  "registry_status": null,
  "subject": {
    "id": "io.github.joshrotenberg/hexpm-mcp",
    "kind": "mcp"
  },
  "tools": {
    "names": [
      "alternatives",
      "audit",
      "audit_mix_deps",
      "compare",
      "dep_tree",
      "dependencies",
      "doc_item",
      "docs",
      "downloads",
      "features",
      "health",
      "info",
      "owners",
      "readme",
      "release",
      "search",
      "search_docs",
      "toolbox_category",
      "toolbox_group",
      "toolbox_groups",
      "toolbox_search",
      "toolbox_trending",
      "upgrade_check",
      "versions"
    ],
    "names_truncated": false,
    "sha256": "12d3304b89b13cf0c61b0479bdde3f167619cade022bd356bac23f694a4a6434"
  },
  "tools_complete": true,
  "tools_observed_at": "2026-10-21T01:44:16.221117+00:00",
  "version": null
}

Pin and review

Keep an accepted snapshot in agents.lock.json. CI compares it with current evidence and returns allow, review or block with reasons, before/after data and policy hashes.

Default gaps require review. Configure stricter handling explicitly. A lock records your acceptance; it is not a supplier attestation.

API reference

Test an explicit task

Verified domain owners can publish up to five exact-match sandbox fixtures and opt in to a test run. Results include fixture version, latency, output hashes and comparable regressions. Cost remains unknown when unobserved.

Run with POST /api/v1/dependencies/task-checks?domain=… while signed in. Read the schema and example in the integration guide.

Optional SealKeeper evidence

Verify issuer signatures, subject and credential freshness using the public key document. Keep its task evidence categories separate from Agenstry measurements.

A valid SEAL does not establish domain ownership, legal identity, key possession or execution permission.

Credential verification API · Issuer documentation

Smithery endpoint migration · Agent monitoring · Methodology