Kya Os McpBLOCK
KYA-OS MCP protocol reference implementation — delegation, proof generation, session lifecycle, and cryptographic identity for the Model Context Protocol
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
KYA-OS: agent identity, delegation, and proof. This repo is the MCP binding.
What KYA-OS is
KYA-OS (Know Your Agent Operating System) is an identity, authority, and accountability layer that other agent-facing protocols adopt, so that any time an agent acts you can verify who called (agent identity), under what authority (delegation chain rooted at a Responsible Party, plus consent where required), and what they did (signed proofs composing into audit trails).
The shape of the contribution is roughly analogous to TLS. TLS is not a transport, it is a security layer that transports adopt. KYA-OS is not a transport or a runtime, it is an identity and accountability layer that host protocols embed.
Three jobs, six primitives:
- Identity. Every agent and every server holds a Decentralized Identifier (
did:key,did:web): a stable, cryptographically-controlled identifier that the agent can prove it owns, and that credentials can be issued against. Without this, there is nothing to bind authority to or hold accountable. - Authority. W3C Verifiable Credentials carrying scoped, revocable delega
1a93c144f38fOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add brave-search-mcp-server --env BRAVE_API_KEY=${BRAVE_API_KEY} -- npx -y @brave/[email protected]Exposed tools (21)
17 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
_kyaos | read | |
_kyaos_handshake | read | KYA-OS identity handshake — establishes a cryptographic session |
add | write | |
browse | read | Browse product categories (public — no delegation required) |
check_balance | read | Check your cheqd testnet wallet balance and address. |
checkout | write | Complete a purchase (requires delegation with scope: cart:write) |
delete_record | destructive | A destructive action gated by the policy step-up: returns needs_approval until signed approval grants are supplied in _kyaos_approvals. |
echo | read | |
fetch-docs | read | |
get_report | read | |
greet | read | Returns a greeting with a signed Ed25519 proof |
ping | read | |
query-docs | read | |
read_vault | read | Read the user vault. Protected: returns an authorization challenge on first call; |
report | read | |
resolve-library-id | read | |
restricted-tool | read | |
restricted_greet | read | A protected greeting that requires delegation (scope: greeting:restricted) |
search | read | |
typed | read | |
wallet_send | write | Send CHEQ from your wallet on the cheqd testnet to a recipient. Your |
Trust audit
BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
'-----BEGIN PRIVATE KEY-----\n' +
await handler({ secret: 'never-audit-raw-args' });delete_record
session.ts
.prettierignore
import type { DIDDocument, VerificationMethod } from '../../src/index.js';import { BitstringManager } from '../../src/delegation/bitstring.js';import { canonicalizeJSON } from '../../src/delegation/utils.js';import { NodeCryptoProvider } from '../../src/providers/node-crypto.js';} from '../../src/audit/index.js';
RFC-1918 IP-literal hosts (e.g. `did:web:169.254.169.254`, the cloud-metadata
`RuntimeFetchProvider` resolves `did:web` and fetches StatusList2021 credentials over the network, and the target host is named by counterparty-controlled data — the DID or status-list URL embedded in
link-local (`169.254/16` incl. the `169.254.169.254` cloud-metadata endpoint, `fe80::/10`), CGNAT
`169.254.169.254` explicitly denied, resolve-once-and-pin against DNS rebinding, no cross-origin
expect(await provider.resolveDID('did:web:169.254.169.254')).toBeNull();expect(await provider.fetchStatusList('http://169.254.169.254/status')).toBeNull();expect(didWebToUrl('did:web:127.0.0.1%3A8443')).toBe('https://127.0.0.1:8443/.well-known/did.json');base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;return bytes.fromhex(value[len(prefix):])
expect(() => atob(identity.privateKey)).not.toThrow();
expect(() => atob(identity.publicKey)).not.toThrow();
const header = JSON.parse(atob(encodedHeader.replace(/-/g, '+').replace(/_/g, '/')));
const payload = JSON.parse(atob(encodedPayload.replace(/-/g, '+').replace(/_/g, '/')));
@modelcontextprotocol/sdk, @types/node, tsx, typescript, vitest
@smithery/cli, tsx
Gates applied: critical_finding, no_behavioural_pass.
1a93c144f38ffull audit observations/trust-audit/mcp-server/decentralized-identity__kya-os-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 1a93c144f38f | BLOCK | D | 63 | first audit |
Questions
What is the @kya-os/mcp MCP server?
KYA-OS MCP protocol reference implementation — delegation, proof generation, session lifecycle, and cryptographic identity for the Model Context Protocol
What tools does @kya-os/mcp expose?
21 in total: 17 read-only, 3 that write, and 1 that can delete or overwrite (delete_record). Every one is listed on this page with its risk.
Is @kya-os/mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @kya-os/mcp need?
It reads AUTH_SERVER_URL, BRAVE_API_KEY, CLIENT_IP_ENCRYPTION_KEY and CONTEXT7_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @kya-os/mcp run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @kya-os/mcp at 1.19.0.
How current is this page?
The grade is for one exact copy of the source (1a93c144f38f), read on 2026-10-12. The repository is watched and re-audited when it changes.