Atlas / MCP servers / attestedintelligence / aga-mcp-server

aga-mcp-serverBLOCK

Name: aga-mcp-server
Author: attestedintelligence

mcp/attestedintelligence/aga-mcp-server

MCP server by attestedintelligence · ai agents · audit trail · cryptography · Audited 2026-10-11

Signed decision records for agent vendors facing customer evidence reviews. Public reference gateway and static verifier; pre-pilot, with documented limits.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

11 11r · 0w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Verifiable decision records for AI agents: each recorded tool-call decision is a signed, hash-chained receipt, exported in evidence bundles a reviewer can verify offline against the published format. Verification establishes the integrity of the receipts present, not that every action was recorded.

[](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server) [](https://pypi.org/project/aga-governance/) [](https://github.com/attestedintelligence/aga-mcp-server/blob/main/LICENSE)

Status: published reference implementation, before independent pilot validation. Version 3.6.6 reuses one Merkle tree during export and retains the 3.6.5 transport, policy and trust-input hardening; deployment limits remain explicit below. The gateway emits classical Ed25519-SHA256-JCS bundles. The published @attested-intelligence/[email protected] CLI checks that classical profile; on a v2/hybrid bundle it reports FAILED because it does not implement that profile. The package also exposes an ML-DSA-65 + Ed25519 composite as a library profile, and aga-proxy verify can check it. Reference verifiers have their own unsupported-profile behavior. These are different components, not one interchangeable verifier. Build provenance concerns the published build; it is not runtime correctness or an external security audit.

Runtime status. Since 3.5.0, a measurement requested after the active artifact's TTL expires moves it to TERMINATE; delegate_to_subagent also refuses after expiry. Nothing checks the TTL on a schedule, and the exported bundle does not record that transition. Do not downgrade to deprecated 3.3.3 as the evaluation path. Since 3.6.0, aga-proxy honors AGA_GATEWAY_KEY / AGA_GATEWAY_KEY_FILE; through 3.6.4 the stdio upstream c

Read from source at commit 4d5a3d2000d8OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add aga-mcp-server --env AGA_GATEWAY_KEY=${AGA_GATEWAY_KEY} --env AGA_GATEWAY_KEY_FILE=${AGA_GATEWAY_KEY_FILE} --env AGA_SPEC_AUTHORITY=${AGA_SPEC_AUTHORITY} --env RUNTIME_TEST_TOKEN=${RUNTIME_TEST_TOKEN} -- npx -y @attested-intelligence/[email protected]

claude-desktop

{
  "mcpServers": {
    "aga-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@attested-intelligence/[email protected]"
      ],
      "env": {
        "AGA_GATEWAY_KEY": "${AGA_GATEWAY_KEY}",
        "AGA_GATEWAY_KEY_FILE": "${AGA_GATEWAY_KEY_FILE}",
        "AGA_SPEC_AUTHORITY": "${AGA_SPEC_AUTHORITY}",
        "RUNTIME_TEST_TOKEN": "${RUNTIME_TEST_TOKEN}"
      }
    }
  }
}

Exposed tools (11)

11 read · 0 write · 0 destructive.

Tool	Risk	Description
`attest_subject`	read	Attest subject, generate sealed Policy Artifact. Auto-loads into portal.
`generate_evidence_bundle`	read	Export the canonical SEP evidence bundle: signed PERMITTED/DENIED tool-call receipts + Merkle proofs + a mandatory signed checkpoint, for offline third-party verification (verify_bundle_offline, aga-verify, or aga-receipt-spec/verify/verify-sep.mjs). Pin gateway_public_key to prove provenance.
`get_chain_events`	read	Get continuity chain events.
`get_portal_state`	read	Get current portal state, loaded artifact info, and enforcement status.
`get_receipts`	read	Get all signed receipts, optionally filtered by artifact.
`get_server_info`	read	Get AGA server info, public keys, and portal state.
`init_chain`	read	Initialize continuity chain with genesis event.
`list_claims`	read	List available claims with sensitivity levels.
`measure_behavior`	read	Measure behavioral patterns (unauthorized tools, rate violations, forbidden sequences). DETECTIVE-ONLY by default: it records and PROVES drift but does not block. Pass enforce=true to also trip the portal into phantom quarantine on drift (opt-in; off by default). (NIST-2025-0035)
`verify_bundle_offline`	read	Verify a canonical SEP evidence bundle offline (full §6 algorithm: structural floor, receipt signatures, chain+ordering, leaf-recompute + Merkle bijection, signed checkpoint). Pass pinned_public_key to also prove provenance.
`verify_chain`	read	Verify continuity chain integrity.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (9 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

INDEPENDENT_AUDIT_BRIEF.md:93

Non-omission; jailbreak / weight-theft / credential / infrastructure prevention; mandatory mediation

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/sep/receipt.ts

receipt.ts

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

scenarios/ai-agent-governance.ts:77

forbidden_sequences: [['file_read', 'web_search', 'code_execute']], // data exfiltration pattern

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

scenarios/ai-agent-governance.ts:202

driftDetected: true, driftDescription: 'Behavioral drift: forbidden tool sequence (data exfiltration pattern)',

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

scenarios/scada-enforcement.ts:128

const injectedBinary = 'SCADA_CONTROL_BINARY_v3.2.1_COMPROMISED: exfiltrate(read_sensors());';

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

scenarios/scada-enforcement.ts:148

captureInput(q, 'attacker_command', 'exfiltrate /var/scada/readings');

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/adapters/openclaw.ts:103

url: `http://127.0.0.1:${proxyPort}`,

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

fixtures/cross-stack/generate-v2.mjs:21

} from '../../src/sep/index.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

fixtures/cross-stack/generate-v2.mjs:22

import { canonicalize } from '../../src/sep/canonical.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

fixtures/cross-stack/generate.mjs:15

import { SepGateway, signerFromSeed, verifySepBundle, leafHash, merkleRoot, merkleProof, SEP_ALGORITHM, SEP_RECEIPT_VERSION } from '../../src/sep/index.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

fixtures/cross-stack/generate.mjs:16

import { canonicalize } from '../../src/sep/canonical.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/proxy/index.ts:32

const PKG = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')) as { version: string };

LOWNetwork egress · net.beacon_words · CWE-200, CWE-319

fixtures/cross-stack/generate.mjs:268

tool_name: 'exfiltrate_secrets', decision: 'PERMITTED', reason: 'forged', policy_reference: '',

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/proxy/openclaw-adapter.test.ts:78

expect(entry.url).toBe('http://127.0.0.1:18800');

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/proxy/proxy-control.test.ts:79

const res = await fetch(`http://127.0.0.1:${controlPort}/export`);

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/proxy/proxy-control.test.ts:90

const res = await fetch(`http://127.0.0.1:${controlPort}/export`);

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/proxy/proxy-control.test.ts:98

const status = await (await fetch(`http://127.0.0.1:${controlPort}/status`)).json();