databutler-provenance
Live trust signals for domains & packages: age, registrar, typosquat resemblance.
Should I use this
Quality & Safety
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"databutler-provenance": {
"url": "https://databutler.dev/api/mcp/provenance"
}
}
}Remote endpoints
https://databutler.dev/api/mcp/provenancestreamable-httpWhat it can do
Tool inventory
Tools (2)
🟢domain_provenance(domain)
Who runs this domain? Live RDAP lookup: registration date and age, registrar, nameservers, status, whether the registrant is redacted, plus a typosquat check (edit-distance / brand-substring) against high-value brands. A very recently registered domain resembling a bank or big brand is a classic phishing signal — but report it as a signal, not a conclusion.
Input Schema
{
"type": "object",
"properties": {
"domain": {
"type": "string",
"description": "e.g. example.com"
}
},
"required": [
"domain"
]
}🟡package_provenance(ecosystem, name)
Who publishes this package, and is it a typosquat? Live npm or PyPI lookup: first-publish date and age, release count, latest version, maintainers/author, linked repo, plus a typosquat check against popular package names. Use when an agent is about to install or recommend an unfamiliar dependency.
Input Schema
{
"type": "object",
"properties": {
"ecosystem": {
"type": "string",
"enum": [
"npm",
"pypi"
],
"description": "npm or pypi"
},
"name": {
"type": "string",
"description": "package name, e.g. express or requests"
}
},
"required": [
"ecosystem",
"name"
]
}Community
Evidence