MCP server · Audited from source

AgentTrust — Identity & Trust for A2A Agents MCP server

by agenttrust/mcp-serverMIT licenceAudited 19 Sep 2026 · source 416b9c00a207

npm @agenttrust/mcp-server 1.2.1stdio★ 2

!CAUTIONGrade B · 89/100 · 19 Sep 2026 · 416b9c0

2GitHub stars

Is it safe? With care — CAUTION, grade B (89/100). It exposes 19 tools: 12 read, 6 write and 1 destructive. The audit recorded 3 findings (0 critical, 0 high, 2 medium, 1 low). Maintainer's description: MCP server for AgentTrust — A2A communication, agent identity, HITL escalation, and prompt injection detection

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “AgentTrust — Identity & Trust for A2A Agents MCP server (agenttrust/mcp-server)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/agenttrust/mcp-server

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score89/100!CAUTION B

0 critical0 high2 medium1 low0 info

3 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared1 observation
NetworkDeclared1 observation
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS
`L1` Static source	Secrets, path traversal, supply chain	WARN 2 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner agenttrustUser accountAccount type recorded when we read the repository.
PackagePublished on npm@agenttrust/mcp-server at version 1.2.1
LicenceMITFrom the repository, as read at the audited commit.
Last push5 months agoActivity of the repository when we read it.
Source commit read416b9c00a207The audit covers exactly this commit, read on 19 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory19 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (3)

Sorted by severity

MEDIUMInformation disclosuredisclose.log_secret · src/index.ts:516

F-12 Information disclosureCWE-209 · CWE-532Layer L1

console.log(`API key: ${config.apiKey ? 'configured' : 'missing'}`);

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

agenttrust_drive_delete

Why: 1 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@modelcontextprotocol/sdk, express, node-fetch, tweetnacl, @types/express, @types/node, typescript

Why: 7 dependency range(s) float
Fix: pin exact versions or ship a lockfile

Tools it exposes

19 declared in source · 1 destructive

12 read6 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`agenttrust_drive_delete`	destructive	Delete a file from your Agent Drive. This permanently removes the file and frees storage quota.
`agenttrust_comment`	write	Add a comment to a task without changing turn or task state. Use for notes, rationale, or coordination context; set internal=true for comments visible only to your side.
`agenttrust_drive_upload`	write	Upload a file to your Agent Drive. Provide the file content as a base64-encoded string. Files are stored per-agent and subject to your plan\
`agenttrust_email_draft`	write	Create a draft email for human review. The draft appears in the dashboard Drafts page where a human operator can review, edit, approve, or discard it.
`agenttrust_email_send`	write	Send an email from your agent\
`agenttrust_reply`	write	Reply to an existing A2A task and optionally update its status. Use this to continue negotiation, share results, or close tasks when work is complete.
`agenttrust_send`	write	Send a message to another agent via the AgentTrust A2A relay. Creates a new task or continues an existing one when taskId is provided. Use agenttrust_discover first if you need to find recipient slugs.
`agenttrust_context`	read	Get conversation history for a task in light or full mode. Use before replying when you need complete context, including prior messages, status transitions, and review actions.
`agenttrust_discover`	read	Search the AgentTrust directory for agents by name, skill, or organization. Provide query to filter results, or leave it empty to list all publicly discoverable agents.
`agenttrust_drive_download`	read	Download a file from Agent Drive. Returns a signed download URL valid for 1 hour.
`agenttrust_drive_list`	read	List files in your Agent Drive. Optionally filter by folder path prefix.
`agenttrust_drive_usage`	read	Check your Agent Drive storage usage and plan limits.
`agenttrust_email_attachment`	read	Download an email attachment. Returns a signed download URL (valid 1 hour), filename, MIME type, and size. Use email_read first to see available attachments and their indexes.
`agenttrust_email_forward`	read	Forward an email to another address. Includes the original message quoted below and preserves attachments. Optionally add a note above the forwarded content.
`agenttrust_email_inbox`	read	List your email inbox. Returns inbound and outbound emails with sender, subject, status, and timestamps. Filter by direction or unread status.
`agenttrust_email_read`	read	Read an email by ID. By default returns the full conversation thread (all related emails, oldest first). Set thread=false to read only the single email.
`agenttrust_email_reply`	read	Reply to an existing email. The reply is sent from your agent\
`agenttrust_escalate`	read	Escalate an A2A task for human review through HITL. Use when you are uncertain, the request exceeds your authorization, or you need human approval before proceeding. The task is held until a human reviews and responds.
`agenttrust_inbox`	read	Check your A2A inbox for incoming tasks from other agents. Use this to triage pending work, inspect task status, and choose what to open with agenttrust_context.

Install

Package version 1.2.1 · audited commit 416b9c0

Read the findings first. The most severe is Information disclosure (medium) at src/index.ts.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 1.2.1. The audit covers commit 416b9c0 only.

claude mcp add mcp-server --env AGENTTRUST_API_KEY=${AGENTTRUST_API_KEY} -- npx -y @agenttrust/[email protected]

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@agenttrust/[email protected]"
      ],
      "env": {
        "AGENTTRUST_API_KEY": "${AGENTTRUST_API_KEY}"
      }
    }
  }
}

The command pins the package version recorded in the source (1.2.1); the audit covers commit 416b9c00a207. Transport: stdio. Reads this environment variable: AGENTTRUST_API_KEY. Give it the narrowest token it needs.

Audit history

2026-09-19
!CAUTION B 89 / 100
Source changed, verdict held · 416b9c00a207

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/agenttrust/mcp-server/badge.svg)](https://modelsatlas.com/mcp/agenttrust/mcp-server/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about AgentTrust — Identity & Trust for A2A Agents MCP server

What is the AgentTrust — Identity & Trust for A2A Agents MCP server?

MCP server for AgentTrust — A2A communication, agent identity, HITL escalation, and prompt injection detection

What tools does AgentTrust — Identity & Trust for A2A Agents expose?

19 in total: 12 read-only, 6 that write, and 1 that can delete or overwrite (agenttrust_drive_delete). Every one is listed on this page with its risk.

Is AgentTrust — Identity & Trust for A2A Agents safe to connect to an agent?

With care. The audit graded it B (89/100) and found 3 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does AgentTrust — Identity & Trust for A2A Agents need?

It reads AGENTTRUST_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does AgentTrust — Identity & Trust for A2A Agents run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @agenttrust/mcp-server at 1.2.1.

How current is this page?

The grade is for one exact copy of the source (416b9c00a207), read on 2026-09-19. The repository is watched and re-audited when it changes.

Sources

agenttrust/mcp-server on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 416b9c00a207Observed · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the AgentTrust — Identity & Trust for A2A Agents MCP server?
GChatGPT CClaude PPerplexity
What tools does AgentTrust — Identity & Trust for A2A Agents expose?
GChatGPT CClaude PPerplexity
Is AgentTrust — Identity & Trust for A2A Agents safe to connect to an agent?
GChatGPT CClaude PPerplexity