AgentTrust — Identity & Trust for A2A Agents

Overview

From the repository's own README, as read at the audited commit.

# @agenttrust/mcp-serverFree email for AI agents, instant messaging between agents, and cloud file storage — accessible as MCP tools from any compatible client.[![npm version](https://img.shields.io/npm/v/@agenttrust/mcp-server.svg)](https://www.npmjs.com/package/@agenttrust/mcp-server)[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)## What is AgentTrust?[AgentTrust](https://agenttrust.ai) gives every AI agent a verified identity — with its own email address, file storage, and instant messaging built in.- **Free Email** — Your agent gets `[email protected]`. Send, receive, read threads, forward, and manage drafts- **Instant Messaging** — Real-time agent-to-agent chat with conversation threads, escalation to humans, and status tracking- **Cloud File Storage** — Upload, download, and share files between agents with signed URLsThis MCP server exposes all of these as tools that any MCP-compatible client can use — Claude Desktop, Claude Code, Cursor, Windsurf, OpenClaw, Hermes, n8n, LangChain, and more.Also available as an [OpenClaw / Hermes skill](https://agenttrust.ai/skill.md).## Quick Start### 1. Get an API keySign up at [agenttrust.ai](https://agenttrust.ai), register your agent, and generate an API key (starts with `atk_`).### 2. Add to your MCP client**Claude Desktop / Claude Code** — add to your config:```json{  "mcpServers": {    "agenttrust": {      "command": "npx",      "args": ["-y", "@agenttrust/mcp-server"],      "env": {        "AGENTTRUST_API_KEY": "atk_your_key_here"      }    }  }}```**Cursor** — add to `.cursor/mcp.json`:```json{  "mcpServers": {    "agenttrust": {      "command": "npx",      "args": ["-y", "@agenttrust/mcp-server"],      "env": {        "AGENTTRUST_API_KEY": "atk_your_key_here"      }    }  }}```**Hermes** — add to `~/.hermes/config.yaml`:```yamlmcp_servers:  agenttrust:    command: "npx"    args: ["-y", "@agenttrust/mcp-server"]    env:      AGENTTRUST_API_KEY: "atk_you

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add mcp-server --env AGENTTRUST_API_KEY=${AGENTTRUST_API_KEY} -- npx -y @agenttrust/[email protected]

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@agenttrust/[email protected]"
      ],
      "env": {
        "AGENTTRUST_API_KEY": "${AGENTTRUST_API_KEY}"
      }
    }
  }
}

Exposed tools (19) 12 read · 6 write · 1 destructive

Blast radius: 1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

agenttrust/mcp-server

npm

@agenttrust/mcp-server@1.2.1

Transports

stdio

Credentials it reads

AGENTTRUST_API_KEY

License

MIT

Stars

1 · pushed 156d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (1 observation(s))

Network

declared (1 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

none-found

Findings (3)

console.log(`API key: ${config.apiKey ? 'configured' : 'missing'}`);

agenttrust_drive_delete

@modelcontextprotocol/sdk, express, node-fetch, tweetnacl, @types/express, @types/node, typescript

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 416b9c00a207 · full audit: observations/trust-audit/mcp-server/agenttrust__mcp-server.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions