Atlas / MCP servers / csigelo / sigelo

sigeloBLOCK

mcp/csigelo/sigelo

Portable, offline-verifiable identity for AI agents: Ed25519 DIDs, signed attestations any world checks without a server, a Monero keeper that holds the money so the agent never does. Draft, wire sigelo/0.

Verdict
BLOCK
Grade
F
Trust score
50 /100
Exposed tools
2 2r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Portable, offline-verifiable identity for AI agents. An agent's DID is the hash of a genesis document holding an Ed25519 key; worlds sign attestations about it; anyone verifies the bundle offline — no server, registry or chain. Draft v0.1, wire format sigelo/0; nothing is stable before v1.0.

Site: sigelo.io (llms.txt). MCP server: sigelo-mcp (io.github.csigelo/sigelo). Why an agent would use it: WHY.md. [](https://mcpservers.org/servers/csigelo/sigelo)

Built and operated by an AI agent (Claude, did:sigelo:zDRrj7eGWXQtmzPUKF3zPDjhUkH7FebKRGj8rf96SdoLa) under a human owner, csigelo. No third party has audited it yet.

Use it

  • As an agent: QUICKSTART.md (seven steps), or plug in through

integrations/ (MCP server, Claude Code plugin, configs for other harnesses).

  • As a world admitting agents: accept/ — challenge(did, ctx) and

accept(challenge, answer, bundle) for node, Python and Go; sh accept/test.sh runs them. Live example: world/.

  • As an implementer: SPEC.md and test-vectors.json;

check yours with sigelo-verify --conformance test-vectors.json --impl (go/).

Requirements: Node ≥ 22.18, Go ≥ 1.27; optional age (root ceremony) and monero-wallet-rpc (keeper). Linux, macOS, Windows on x86_64 and arm64 (docs-test/PORTABILITY.md); on Windows file modes such as 0600 are ignored, so keep secret files under your own profile.

Build and test

In CI order (.github/workflows/conformance.yml); each line ends in ALL PASS.

(cd ts && npm ci && npx tsc)                                          # TypeScript library → ts/dist
(cd ts && node dist/gen_vectors.js | diff -u
Read from source at commit 1d5de396a662OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add sigelo-mcp --env SIGELO_WALLET_TOKEN=${SIGELO_WALLET_TOKEN} -- npx -y [email protected]
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
generalreadGeneral-purpose conversational agent
sigeloreadPortable, offline-verifiable identity for AI agents.
04

Trust audit

BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (10 observation(s))
Network
declared (6 observation(s))
Shell
declared (10 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
crosscheck/crosscheck.py:541
exec(compile(body, 'rfc8032-section6', 'exec'), ns)  # noqa: S102 — the RFC's published code
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
docs-test/grade.mjs:74
return new Function('fs', 'path', 'dir', 'readJSON', src.slice(a, b) + '\nreturn { check };')(fs, path, schemaDir, readJSON);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
world/test.mjs:83
const r = existsSync(built) ? await exec(built, [p, '--now', String(now)])
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
world/test.mjs:158
const run = existsSync(built) ? await exec(built, implArgs)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
world/test.mjs:202
const stdio = await exec(process.execPath, [join(ROOT, 'integrations/mcp/server.mjs')], { input: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}\n', env: { ...process.env, SIGELO_IDENTITY: join(dir, '
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
spend/cli.ts:119
console.log(token);
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
accept/test.sh:25
set -- node=http://127.0.0.1:$pn python=http://127.0.0.1:$pp go=http://127.0.0.1:$pg ${1:+"$1"}
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
accept/test.sh:28
set -- "$1" "$2" "$3" python-remote=http://127.0.0.1:$pr
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
adapters/hermes/test.py:87
cfg += f"model:\n  provider: custom\n  base_url: http://127.0.0.1:{serve(LLM)}/v1\n  default: scripted\n"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
adapters/moadim/test.ts:346
url: 'http://127.0.0.1:1', token: 'tok-secret-shown-once', shown_once: '...', fund: null };
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
spend/service.ts:504
const md5 = (s: string): string => createHash('md5').update(s, 'utf8').digest('hex');
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
site/deploy/server-setup.sh:588
touch /var/lib/sigelo/.ssh/authorized_keys
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
site/deploy/server-setup.sh:589
if grep -qxF "$key" /var/lib/sigelo/.ssh/authorized_keys; then echo "key already authorized"
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
site/deploy/server-setup.sh:590
else printf '+ append the deploy key to /var/lib/sigelo/.ssh/authorized_keys\n'; printf '%s\n' "$key" >> /var/lib/sigelo/.ssh/authorized_keys; fi
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
site/deploy/server-setup.sh:591
run chown sigelo:sigelo /var/lib/sigelo/.ssh/authorized_keys
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
site/deploy/server-setup.sh:592
run chmod 0600 /var/lib/sigelo/.ssh/authorized_keys
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
adapters/hermes/pairing/gen.mjs:12
import { attest, challenge, keygen, rotate } from '../../../ts/dist/sigelo.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
adapters/hermes/pairing/test.mjs:12
import { Contacts, pair } from '../../../accept/node/sigelo-pair.mjs';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
adapters/hermes/pairing/test.mjs:13
import { sign } from '../../../ts/dist/sigelo.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
adapters/hermes/pairing/test.mjs:15
const HERE = dirname(fileURLToPath(import.meta.url)), REPO = join(HERE, '../../..');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crosscheck/run.sh:71
ln -sfn ../../ts/node_modules "$W/node_modules"
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
MONERO.md:296
"wallet": { "rpc": "http://127.0.0.1:38083/json_rpc", "login": "user:pass" },
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
QUICKSTART.md:224
`sigelo-spend init --wallet-rpc http://127.0.0.1:38083 --allow bob=<address>`, then
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
adapters/hermes/pairing/test.py:43
key = Ed25519PrivateKey.from_private_bytes(bytes.fromhex(fx['seeds']['A0']))  # seed(label) is the Ed25519 secret
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
crosscheck/crosscheck.py:613
spend, view = unhexlify(v[3]), unhexlify(v[4])

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 1d5de396a662full audit observations/trust-audit/mcp-server/csigelo__sigelo.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-111d5de396a662BLOCKF50first audit
06

Questions

What is the sigelo MCP server?

Portable, offline-verifiable identity for AI agents: Ed25519 DIDs, signed attestations any world checks without a server, a Monero keeper that holds the money so the agent never does. Draft, wire sigelo/0.

What tools does sigelo expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is sigelo safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (50/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does sigelo need?

It reads SIGELO_WALLET_TOKEN and SIGELO_WORLD_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does sigelo run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as sigelo at 0.1.1.

How current is this page?

The grade is for one exact copy of the source (1d5de396a662), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement