getcommit.dev valid

Commit — Supply Chain Trust Scoring

Score npm, PyPI, Cargo, and Go packages on behavioral signals that stars,

For agents: Trust scoring for npm, PyPI, Cargo and Go packages based on behavioral signals rather than stars. Summary is truncated; limited detail.

supply chain securitypackage trust scoringnpmpypiopen source packages

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T18:38:16.239Z. Cached copy · Source on getcommit.dev

# Commit — Supply Chain Trust Scoring

> Score npm, PyPI, Cargo, and Go packages on behavioral signals that stars,
> READMEs, and vulnerability databases miss. Free CLI, API, MCP server,
> GitHub Action, and IDE hooks.

## What it does

Commit scores packages 0–100 on behavioral commitment: publisher depth,
release consistency, download trends, maintenance longevity, and OpenSSF
Scorecard data. Packages with a single npm publisher controlling millions
of weekly downloads are flagged CRITICAL — the exact pattern behind the
axios (March 30 2026) and LiteLLM (March 2026) supply chain attacks.

## Why it matters

26 npm packages with 10M+ weekly downloads have a single publisher.
`npm audit` and Dependabot don't flag this. Scorecard measures process
security, not credential-concentration risk. Commit fills the gap.

## Quick start

CLI (zero install):
  npx proof-of-commitment axios chalk zod

CI gate:
  npx proof-of-commitment --fail-on=critical

File scan (auto-detects npm/yarn/pnpm/pip/cargo/go):
  npx proof-of-commitment --file package-lock.json

## Key URLs

- Homepage:    https://getcommit.dev
- Audit:       https://getcommit.dev/audit
- Rankings:    https://getcommit.dev/rankings
- Pricing:     https://getcommit.dev/pricing
- Quickstart:  https://getcommit.dev/quickstart
- Docs:        https://getcommit.dev/docs
- Blog:        https://getcommit.dev/blog
- GitHub:      https://github.com/piiiico/proof-of-commitment
- npm:         https://www.npmjs.com/package/proof-of-commitment

## API

POST https://poc-backend.amdal-dev.workers.dev/api/audit
Content-Type: application/json

  {"packages": ["axios", "zod", "chalk"]}

Returns: score, maintainers, weeklyDownloads, ageYears, trend, riskFlags,
scorecardScore, scoreBreakdown for each package.

Anonymous (no key): 15 requests/day per IP — often shared via corporate
NAT / CGN / CI runners, so this caps quickly. A free API key
(https://getcommit.dev/pricing) lifts the limit to 200/day, no card.
Send `Accept: application/json` for the JSON response (default returns
human-readable text suitable for CLIs).

## MCP Server
…

Related sites

Other listed sites in Cybersecurity. See the whole category →

Machine-readable: GET /v1/resolve?q=getcommit.dev · GET /v1/domain/getcommit.dev · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for getcommit.dev:
1. POST https://agentwebmap.com/v1/sites/getcommit.dev/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://getcommit.dev/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/getcommit.dev/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/getcommit.dev).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.