Agent Passport System MCP Server
agent-passport-system-mcp
npm
v6.0.1
Source verified
Published by aeoess — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
MCP server for the Agent Passport System - protocol-layer tools only. 150 tools (132 protocol + 10 gateway deprecation stubs). Identity, delegation, reputation, attestation, coordination, commerce, attribution primitive, attribution settlement. Tracks SDK
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Package runs install-time scripts MTC-SUP-010 | supply-chain |
2. Client adoption risk — 99 − 3 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
medium Hardcoded egress to an external endpoint (build/index.js)MTC-SRC-003
In the server's implementation (`build/index.js:2011`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch('https://api.github.com/repos/aeoess/aeoess_web/issues', { method: 'POST',
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/index.js
low Package runs install-time scripts (postinstall)MTC-SUP-010
"agent-passport-system-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.
Evidence: echo '\n🔑 Agent Passport MCP installed! Run: npx agent-passport-system-mcp setup\n Or for zero-install remote: npx agent-passport-system-mcp setup --remote\n
Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.
Location: package agent-passport-system-mcp
Tools 152
Each tool and what it can reach — statically extracted from the published source.
send_messagenetwork egressaccept_assignmentno sensitive capabilityactivate_emergencyno sensitive capabilityadd_approval_signatureno sensitive capabilityadd_principal_reportno sensitive capabilityapply_reputation_downgradeno sensitive capabilityaps_aggregate_settlementno sensitive capabilityaps_attribution_receipt_idno sensitive capabilityaps_build_contributor_queryno sensitive capabilityaps_capability_evaluate_authorityno sensitive capability
Show 142 more tools ↓
aps_capability_issue_challengeno sensitive capabilityaps_capability_mint_receiptno sensitive capabilityaps_capability_sign_effectno sensitive capabilityaps_check_artifact_citationsno sensitive capabilityaps_check_escalation_requiredno sensitive capabilityaps_check_projection_consistencyno sensitive capabilityaps_compute_attribution_action_refno sensitive capabilityaps_compute_compute_axis_weightsno sensitive capabilityaps_compute_data_axis_weightsno sensitive capabilityaps_construct_attribution_primitiveno sensitive capabilityaps_create_attribution_receiptno sensitive capabilityaps_create_provisionalno sensitive capabilityaps_project_attributionno sensitive capabilityaps_promote_statementno sensitive capabilityaps_record_owner_confirmationno sensitive capabilityaps_sign_attribution_consentno sensitive capabilityaps_verify_attribution_consentno sensitive capabilityaps_verify_attribution_primitiveno sensitive capabilityaps_verify_attribution_projectionno sensitive capabilityaps_verify_promotionno sensitive capabilityaps_verify_settlementno sensitive capabilityaps_withdraw_provisionalno sensitive capabilityassign_agentno sensitive capabilityattest_to_floorno sensitive capabilitybroadcastno sensitive capabilitycheck_aggregate_constraintsno sensitive capabilitycheck_combination_permittedno sensitive capabilitycheck_jurisdiction_transferno sensitive capabilitycheck_messagesno sensitive capabilitycheck_purpose_permittedno sensitive capabilitycheck_retention_expiredno sensitive capabilitycheck_tierno sensitive capabilitycheck_usage_permittedno sensitive capabilityclassify_evidence_qualityno sensitive capabilitycommerce_preflightno sensitive capabilitycompare_timestampsno sensitive capabilitycomplete_actionno sensitive capabilitycomplete_taskno sensitive capabilitycompute_action_refno sensitive capabilitycompute_governance_taintno sensitive capabilitycreate_access_receiptno sensitive capabilitycreate_access_snapshotno sensitive capabilitycreate_agent_contextno sensitive capabilitycreate_approval_requestno sensitive capabilitycreate_artifact_provenanceno sensitive capabilitycreate_chained_governance_blockno sensitive capabilitycreate_charterno sensitive capabilitycreate_data_enforcement_gateno sensitive capabilitycreate_decision_lineage_receiptno sensitive capabilitycreate_delegationno sensitive capabilitycreate_derivation_receiptno sensitive capabilitycreate_disclosureno sensitive capabilitycreate_gatewayno sensitive capabilitycreate_hybrid_timestampno sensitive capabilitycreate_intentno sensitive capabilitycreate_outcome_recordno sensitive capabilitycreate_policy_contextno sensitive capabilitycreate_principalno sensitive capabilitycreate_reserve_attestationno sensitive capabilitycreate_task_briefno sensitive capabilitycreate_v2_delegationno sensitive capabilitydeclare_reidentification_riskno sensitive capabilitydefine_emergency_pathwayno sensitive capabilitydetect_purpose_driftno sensitive capabilityendorse_agentno sensitive capabilityevaluate_intentno sensitive capabilityevaluate_revocation_impactno sensitive capabilityexecute_with_contextno sensitive capabilityfile_data_disputeno sensitive capabilitygateway_approveno sensitive capabilitygateway_process_tool_callno sensitive capabilitygateway_statsno sensitive capabilitygenerate_aps_txtno sensitive capabilitygenerate_governance_blockno sensitive capabilitygenerate_keysno sensitive capabilitygenerate_settlementno sensitive capabilityget_agora_by_topicno sensitive capabilityget_agora_threadno sensitive capabilityget_agora_topicsno sensitive capabilityget_behavioral_sequenceno sensitive capabilityget_commerce_spendno sensitive capabilityget_digestno sensitive capabilityget_evidenceno sensitive capabilityget_fleet_statusno sensitive capabilityget_my_roleno sensitive capabilityget_passport_gradeno sensitive capabilityget_promotion_historyno sensitive capabilityget_task_detailno sensitive capabilitygovernance_360no sensitive capabilityhandoff_evidenceno sensitive capabilityidentifyno sensitive capabilityis_evidence_freshno sensitive capabilityis_key_activeno sensitive capabilityissue_passportno sensitive capabilitylist_agentsno sensitive capabilitylist_issuance_recordsno sensitive capabilitylist_profilesno sensitive capabilitylist_tasksno sensitive capabilitylist_tools_for_scopeno sensitive capabilityload_values_floorno sensitive capabilitymutualAuthBuildCertificateno sensitive capabilitymutualAuthDeriveSessionno sensitive capabilitymutualAuthVerifyAttestno sensitive capabilitymutualAuthVerifyTrustBundleno sensitive capabilityparse_governance_block_htmlno sensitive capabilitypost_agora_messageno sensitive capabilitypropose_amendmentno sensitive capabilityquery_contributionsno sensitive capabilityregister_agora_agentno sensitive capabilityregister_agora_publicno sensitive capabilityregister_data_sourceno sensitive capabilityremove_intent_cardno sensitive capabilityrequest_human_approvalno sensitive capabilityrequest_introno sensitive capabilityresolve_authorityno sensitive capabilityresolve_lineageno sensitive capabilityresolve_path_termsno sensitive capabilityresolve_rights_propagationno sensitive capabilityrespond_to_introno sensitive capabilityreview_evidenceno sensitive capabilityreview_promotionno sensitive capabilityrevoke_delegationno sensitive capabilityrevoke_endorsementno sensitive capabilityrotate_keyno sensitive capabilitysearch_matchesno sensitive capabilitysign_amendmentno sensitive capabilitysign_charterno sensitive capabilitysub_delegateno sensitive capabilitysubmit_deliverableno sensitive capabilitysubmit_evidenceno sensitive capabilitysupersede_v2_delegationno sensitive capabilityupdate_reputationno sensitive capabilityvalidate_temporal_rightsno sensitive capabilityverify_amendmentno sensitive capabilityverify_aps_txtno sensitive capabilityverify_charterno sensitive capabilityverify_delegationno sensitive capabilityverify_endorsementno sensitive capabilityverify_governance_blockno sensitive capabilityverify_issuerno sensitive capabilityverify_rotation_chainno sensitive capabilityvouch_reputationno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (152 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 7
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v6.0.1 latest |
A 96/100 | 2 | 1.13.0 | 2026-09-08 |
v6.0.0 |
A 96/100 | 2 | 1.13.0 | 2026-09-05 |
v5.0.2 |
A 96/100 | 2 | 1.13.0 | 2026-09-04 |
v5.0.0 |
A 95/100 | 2 | 1.13.0 | 2026-09-01 |
v4.0.0 |
A 95/100 | 2 | 1.12.1 | 2026-08-20 |
Show 2 more versions ↓
v3.4.0 |
A 95/100 | 2 | 1.12.1 | 2026-07-31 |
v3.3.1 |
A 95/100 | 2 | 1.10.0 | 2026-07-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan agent-passport-system-mcp --onlineMore in AI & Agents
Authenticated MCP transport with HTTP Signatures for AAuth agents
Local-first MCP server for parallel AI coding agents to claim file ownership before edits, preventing stomping on each other in the same worktree.
Agent-agnostic intercommunication system — sessions, messaging, channels, shared state, and real-time events
MCP server for AI agent task communication and delegation with diagnostic lifecycle visibility
Programmatic add/link/unlink for MCP servers across 23 AI coding agents (Claude Code, Claude Desktop, Cursor, VS Code, Codex, Gemini CLI, Zed, Cline, OpenCode, Goose, Kiro, Windsurf, and more). Functional API with dry-run support.
MCP server layer exposing agent-mesh orchestrator as an MCP agent