{
  "markdown": "# nomue Record Verifier\n\nLocal, issuer-independent verification of nomue Protocol Records for MCP clients.\n\n## Status\n\n`@licklider/nomue-verifier-mcp` is an experimental release-candidate package for Phase 1 local\nuse. It supports **stdio only**. It does not expose an HTTP endpoint, require an account,\nuse an API key, or call a Licklider-hosted service.\n\nThe server is a thin adapter around the exact npm dependency:\n\n```text\n@licklider/nomue-verifier@0.2.1-rc.0\n```\n\nIt does not implement statistical or Protocol semantics independently.\nThe published CLI tarball includes `npm-shrinkwrap.json` in addition to exact direct\ndependency pins, so npm versions that honor dependency-package shrinkwraps can install\nthe reviewed runtime tree.\n\nVersion `0.2.0-rc.0` is the first release candidate under the explicit verifier-MCP\npackage identity. It supersedes the experimental `@licklider/nomue-mcp` package, which\nwill remain historical and will not be repurposed as the future nomue product MCP. The\nuser-facing name remains **nomue Record Verifier**, the client configuration key remains\n`nomue-verify`, and the sole tool remains `verify_nomue_record`. This identity migration\ndoes not expand the scientific scope: the release still accepts only the exact Release 1\nWelch bundle identified below.\n\n## Add it to an MCP client\n\nAdd this one-line entry inside the client's `mcpServers` object:\n\n```json\n\"nomue-verify\":{\"command\":\"npx\",\"args\":[\"--yes\",\"@licklider/nomue-verifier-mcp@0.2.0-rc.0\"]}\n```\n\nA complete configuration file is:\n\n```json\n{\"mcpServers\":{\"nomue-verify\":{\"command\":\"npx\",\"args\":[\"--yes\",\"@licklider/nomue-verifier-mcp@0.2.0-rc.0\"]}}}\n```\n\nThis is the standard shape for macOS, Linux, and MCP clients that resolve `npx`\ndirectly. No environment variables are needed. The first `npx` launch may download npm\ndependencies; after installation, verification itself runs locally and does not require\nnetwork access.\n\nOn Windows, a client that does not resolve npm command shims directly can use this\nequivalent entry:\n\n```json\n\"nomue-verify\":{\"command\":\"cmd.exe\",\"args\":[\"/d\",\"/s\",\"/c\",\"npx --yes @licklider/nomue-verifier-mcp@0.2.0-rc.0\"]}\n```\n\nThe repository CI matrix verifies the installed npm command shim and exercises the\ninstalled package entry point on Windows, macOS, and Linux. A clean-profile launch in\nClaude Desktop, Cursor, and Cline remains a release gate after the repository and npm\nrelease candidate are public.\n\n[Add nomue Record Verifier to Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=nomue-verify&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyItLXllcyIsIkBsaWNrbGlkZXIvbm9tdWUtdmVyaWZpZXItbWNwQDAuMi4wLXJjLjAiXX0)\n\n### Cursor Plugin wrapper\n\nThis repository also contains a Cursor Plugin manifest at\n`.cursor-plugin/plugin.json` and its exact version-pinned `mcp.json`. The wrapper adds\nno rules, prompts, credentials, environment variables, or remote services; it installs\nthe same local stdio server configuration shown above. The manifest identifies the\npackage as a release candidate rather than implying a stable release.\n\nThe checked-in configuration is:\n\n```json\n{\"mcpServers\":{\"nomue-verify\":{\"command\":\"npx\",\"args\":[\"--yes\",\"@licklider/nomue-verifier-mcp@0.2.0-rc.0\"]}}}\n```\n\nThe manifest makes the repository ready for a clean-profile Cursor Plugin test and\nMarketplace review. It is not evidence of a live Cursor Marketplace listing; record\nthat separately only after Cursor accepts the submission.\n\n## Tool\n\n### `verify_nomue_record`\n\nThe tool name is method-neutral because bundle dispatch, rather than the MCP server or\nthe caller, determines which registered verification semantics apply. The current\nrelease supports only the exact Welch bundle below. Unsupported bundles are refused\nwithout fallback or silent method switching.\n\n**Use when:** you already have a complete nomue Record declaring the exact public\nRelease 1 bundle\n`urn:nomue:bundle:itgc-guarantee:0.2.1-draft.1` and need scoped structural, digest,\nadmissibility, computability, or two-sided Welch recomputation checks.\n\n**Do not use when:** you have only raw samples and need a new Welch calculation; need\nmethod selection; need an overall scientific-validity or causal judgment; need paired-t,\nWilcoxon, Mann-Whitney, or another method; or have an unsupported Protocol bundle.\n\nInput:\n\n```json\n{\n  \"record_json\": \"{...complete nomue Record JSON text...}\"\n}\n```\n\n`record_json` is JSON **text**, not a parsed object. Empty and malformed strings are\naccepted by the adapter and passed to the verifier. Preserving the original text keeps\nstrict JSON parsing, duplicate-member rejection, digest verification, and resource-limit\nbehavior inside the verifier. An MCP string cannot represent a malformed UTF-8 byte\nsequence; test that byte-level refusal directly with the npm verifier CLI.\n\n## Result contract\n\nThe first MCP text content block is the exact stdout emitted by the pinned verifier CLI\nimplementation, including its final newline. `structuredContent` contains the same\nparsed verifier artifact without a new adapter verdict. MCP result metadata carries:\n\n- the verifier exit code;\n- a SHA-256 digest of the exact input JSON text encoded as UTF-8;\n- a SHA-256 digest of the exact stdout bytes; and\n- the exact verifier npm package identity; and\n- the verifier-generated field (`generated_at`) that changes on independent replay.\n\nThese metadata fields describe the invocation and replay evidence; they are not a new\nverdict or guarantee.\n\nVerifier exit codes retain their existing meanings:\n\n| Code | Meaning |\n| --- | --- |\n| `0` | A report exists and every applicable scoped check outcome is `pass`. |\n| `2` | A scoped check failed, or a parse/canonicalization refusal occurred. |\n| `3` | Routing failure or unsupported bundle; no report exists. |\n| `4` | Resource-limit safe refusal. |\n| `5` | Internal verifier refusal. |\n\nCodes `2` through `5` remain normal, machine-readable verifier artifacts. The MCP call\nis marked as a tool error only when the adapter itself cannot produce a verifier report\nor refusal.\n\nThere is no blanket `VERIFIED` field. Read each scoped check, its version and reason\ncodes, plus `guarantee_boundary`. A clean report does not establish scientific truth or\nscientific validity.\n\n### Exactness and replay\n\nThe MCP response preserves the bytes from the **same underlying verifier invocation**;\nthe input and output SHA-256 metadata make that preservation testable. A separate replay\nwith `@licklider/nomue-verifier@0.2.1-rc.0` reproduces the substantive artifact exactly, but\nthe verifier intentionally creates a fresh top-level `generated_at` timestamp on each\nrun. Therefore two separate invocations cannot honestly be described as byte-identical.\nTests require equality of every other field and byte-for-byte preservation within the\nMCP invocation.\n\nTo replay independently, save the same `record_json` text and run:\n\n```bash\nnpx --yes @licklider/nomue-verifier@0.2.1-rc.0 verify ./record.json --format json-compact\n```\n\n## Supported environment\n\n| Transport | Operating systems | Node.js | Authentication | Runtime network |\n| --- | --- | --- | --- | --- |\n| stdio | Linux, macOS, Windows | 20 or 22 | None | Not required |\n\nThe package declares `node >=20`; the release CI matrix is configured to exercise Node.js\n20 and 22 on all three operating systems. Do not claim an operating-system/client pair\nas release-tested until that public CI job and the corresponding clean-profile client\ncheck have passed.\n\n## Registry metadata\n\n`server.json` and the package `mcpName` are aligned for the official MCP Registry:\n\n```text\nio.github.licklider-ai/nomue-verifier-mcp\n```\n\nThe registry artifact advertises only the npm package and stdio transport. Hosted HTTP,\nSLA, authentication, logging, and rate limiting are intentionally outside Phase 1.\nPrepared publication and directory-submission steps are in\n[`registry/SUBMISSIONS.md`](registry/SUBMISSIONS.md).\n\n## Development\n\nFrom this directory:\n\n```bash\nnpm ci\nnpm test\nnpm run test:cursor-plugin\nnpm run test:package\n```\n\nThe package smoke test packs and installs the tarball at a path containing spaces,\nstarts its generated npm executable shim, lists the tool, calls valid, mismatched, and\nempty Records, checks output preservation, and enforces the 10-second startup budget.\nThat budget covers MCP process startup and tool discovery only. Each verifier call is\na separate resource-bounded child process with a 60-second fail-closed ceiling so a\ncold Node.js/tsx launch on a supported host is not misclassified as an MCP startup\nfailure.\n\n## Security, non-claims, and license\n\nSee [SECURITY.md](SECURITY.md), [NON-CLAIMS.md](NON-CLAIMS.md), and\n[LICENSE](LICENSE).\n",
  "bytes": 8677,
  "sha": "50c2d91fd3c4f0a9ebe44ad58e4b749973e2d434e7c920bdb461e1d39f4f7e43",
  "repo_slug": "licklider-ai/nomue-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_licklider_ai_nomue_mcp_41001d76/readme"
}