MCP server · Audited from source

Agentic Terminal Directory MCP server

by observer-protocol/at-directoryMIT licenceAudited 19 Sep 2026 · source 383a38d4ea7c

npm @at-directory/skillstdiostreamable-http★ 1

!CAUTIONGrade B · 87/100 · 19 Sep 2026 · 383a38d

1GitHub stars

Is it safe? With care — CAUTION, grade B (87/100). It exposes 7 tools: 6 read, 1 write and 0 destructive. The audit recorded 20 findings (0 critical, 0 high, 2 medium, 17 low). Maintainer's description: Agent commerce directory for Lightning, BOLT12, L402, and USDT merchants. Merchants self-register and land self-attested; an Observer Protocol attestation tier records what has been checked on each.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Agentic Terminal Directory MCP server (observer-protocol/at-directory)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/observer-protocol/directory

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score87/100!CAUTION B

0 critical0 high2 medium17 low1 info

20 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared12 observations
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 2 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 18 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner observer-protocolOrganizationAccount type recorded when we read the repository.
PackagePublished on npm@at-directory/skill, no version recorded
LicenceMITFrom the repository, as read at the audited commit.
Last push3 days agoActivity of the repository when we read it.
Source commit read383a38d4ea7cThe audit covers exactly this commit, read on 19 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory7 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (20)

Sorted by severity

MEDIUMNetwork egressnet.raw_ip · deploy/mcp-server/Dockerfile:25

F-04 Network egressCWE-200 · CWE-319Layer L1

CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8099)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · packages/mcp-server/src/dev/mock-verifier.ts:60

F-04 Network egressCWE-200 · CWE-319Layer L1

process.stderr.write(`[mock-verifier] listening on http://127.0.0.1:${PORT}\n`);

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .prettierrc.json

F-13 Inventory / provenanceCWE-1104Layer L0

.prettierrc.json

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · apps/web/app/marketplace/page.tsx:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { allListings } from '../../lib/data';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · apps/web/app/marketplace/page.tsx:8

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

} from '../../lib/display-policy';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · apps/web/app/marketplace/page.tsx:9

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { MarketplaceBrowser } from '../../components/MarketplaceBrowser';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · scripts/crawl/lib/candidate.ts:16

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { Merchant, RailName } from '../../../packages/core/src/types.ts';

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.metadata_ip · packages/mcp-server/src/verify/guarded-request.test.ts:28

F-04 Network egressCWE-200 · CWE-319Layer L1

['169.254.169.254', /link-local.*cloud metadata/],

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWNetwork egressnet.metadata_ip · packages/mcp-server/src/verify/guarded-request.test.ts:38

F-04 Network egressCWE-200 · CWE-319Layer L1

['::ffff:169.254.169.254', /link-local/],

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWNetwork egressnet.metadata_ip · packages/mcp-server/src/verify/guarded-request.test.ts:154

F-04 Network egressCWE-200 · CWE-319Layer L1

res.writeHead(302, { Location: 'https://169.254.169.254/latest/meta-data/' });

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWNetwork egressnet.metadata_ip · packages/mcp-server/src/verify/guarded-request.test.ts:170

F-04 Network egressCWE-200 · CWE-319Layer L1

expect(res.headers.location).toBe('https://169.254.169.254/latest/meta-data/');

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWNetwork egressnet.raw_ip · README.md:59

F-04 Network egressCWE-200 · CWE-319Layer L1

AT_VERIFIER_URL=http://127.0.0.1:8787 \

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · deploy/mcp-server/DEPLOY.md:127

F-04 Network egressCWE-200 · CWE-319Layer L1

service: http://100.86.223.47:8443

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · packages/mcp-server/src/auth.test.ts:43

F-04 Network egressCWE-200 · CWE-319Layer L1

if (addr && typeof addr === 'object') url = `http://127.0.0.1:${addr.port}/verify`;

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · scripts/merchant-trust/signing.py:66

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

return Ed25519PrivateKey.from_private_bytes(bytes.fromhex(hex_str.strip()))

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · apps/web/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

next, react, react-dom, @types/node, @types/react, @types/react-dom, tsx, typescript

Why: 8 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@types/node, prettier, tsx, typescript, vitest

Why: 5 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/core/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

ajv, ajv-formats, @types/node, typescript, vitest

Why: 5 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/mcp-server/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@modelcontextprotocol/sdk, zod, @types/node, esbuild, typescript, vitest

Why: 6 dependency range(s) float
Fix: pin exact versions or ship a lockfile

INFOInventory / provenanceinv.oversize · apps/web/public/logos/maxi-0001.png

F-13 Inventory / provenanceCWE-1104Layer L0

apps/web/public/logos/maxi-0001.png

Why: 1190074 bytes not read
Fix: —

Tools it exposes

7 declared in source · 0 destructive

6 read1 write0 destructive

Tool	Risk	What it does
`verify_payment_endpoint`	write	Run a live check against a merchant
`Beta`	read	sells eSIMs
`get_merchant`	read	Get the full record for one merchant including all rails, payment endpoints, and OP attestation. Tier 2+ requires an AT credential.
`list_categories`	read	List the category taxonomy with merchant counts.
`list_rails`	read	List supported payment rails and their current merchant counts.
`search_merchants`	read	Search OP-verified merchants by rail, chain, category, agent-callable tier, trust tier, and free text. Ranked by trust tier then verification recency.
`whoami`	read	Report the resolved credential state and rate limits for the calling agent.

Install

audited commit 383a38d

Read the findings first. The most severe is Network egress (medium) at deploy/mcp-server/Dockerfile.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit 383a38d only.

claude mcp add skill --env AT_CREDENTIAL=${AT_CREDENTIAL} --env AT_MERCHANT_DID_SERVICE_KEY=${AT_MERCHANT_DID_SERVICE_KEY} --env AT_MERCHANT_VC_SIGNING_KEY=${AT_MERCHANT_VC_SIGNING_KEY} --env TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY} -- npx -y @at-directory/[email protected]

{
  "mcpServers": {
    "skill": {
      "command": "npx",
      "args": [
        "-y",
        "@at-directory/[email protected]"
      ],
      "env": {
        "AT_CREDENTIAL": "${AT_CREDENTIAL}",
        "AT_MERCHANT_DID_SERVICE_KEY": "${AT_MERCHANT_DID_SERVICE_KEY}",
        "AT_MERCHANT_VC_SIGNING_KEY": "${AT_MERCHANT_VC_SIGNING_KEY}",
        "TURNSTILE_SECRET_KEY": "${TURNSTILE_SECRET_KEY}"
      }
    }
  }
}

The command does not pin a version; the audit covers commit 383a38d4ea7c. Transport: stdio · streamable-http. Reads these environment variables: AT_CREDENTIAL, AT_MERCHANT_DID_SERVICE_KEY, AT_MERCHANT_VC_SIGNING_KEY, TURNSTILE_SECRET_KEY. Give it the narrowest token it needs.

Audit history

2026-09-19
!CAUTION B 87 / 100
Source changed, verdict held · 383a38d4ea7c

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/observer-protocol/directory/badge.svg)](https://modelsatlas.com/mcp/observer-protocol/directory/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Agentic Terminal Directory MCP server

What is the Agentic Terminal Directory MCP server?

Agent commerce directory for Lightning, BOLT12, L402, and USDT merchants. Merchants self-register and land self-attested; an Observer Protocol attestation tier records what has been checked on each.

What tools does Agentic Terminal Directory expose?

7 in total: 6 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Agentic Terminal Directory safe to connect to an agent?

With care. The audit graded it B (87/100) and found 20 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Agentic Terminal Directory need?

It reads AT_CREDENTIAL, AT_MERCHANT_DID_SERVICE_KEY, AT_MERCHANT_VC_SIGNING_KEY and TURNSTILE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Agentic Terminal Directory run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @at-directory/skill at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (383a38d4ea7c), read on 2026-09-19. The repository is watched and re-audited when it changes.

Sources

observer-protocol/at-directory on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 383a38d4ea7cObserved · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Agentic Terminal Directory MCP server?
GChatGPT CClaude PPerplexity
What tools does Agentic Terminal Directory expose?
GChatGPT CClaude PPerplexity
Is Agentic Terminal Directory safe to connect to an agent?
GChatGPT CClaude PPerplexity