ECZ-ID MCP Trust

See what your MCP can do. See what changed. Protect the ones that matter.

Free, local-first MCP visibility inside VS Code. Inventory declared MCP servers, inspect credential-shaped environment key names, and see what changed since your previous scan. No account. No telemetry.

Community free forever. Pro when you need more.

One extension. Community stays free. Pro unlocks in place.

MCP Trust Community Free forever

• MCP X-Ray and local server inventory
• configuration posture and transport visibility
• credential-shaped environment key-name warnings
• sanitised endpoint posture
• change detection from your previous scan
• Resolver-reference posture
• no paid account required

MCP Trust Pro £12.99/month or £119/year

Everything in Community, plus:

• Trust Epochs full local history and compare-any-two
• Advanced Tool X-Ray deeper declared capability and schema review
• Secret Shield preview credential-shaped exposure before connection
• Local Trust Gate optional local MCP mediation with truthful live MediationProof
• deterministic local policy
• reviewable remediation
• exportable local evidence

Explore MCP Trust Pro ->

Need MCP + Agent? Explore Developer Trust Pro ->
MCP Trust Pro + Agent Trust Pro under one Developer Trust entitlement £19.99/month or £199/year.

Already purchased? Activate Pro ->

The Marketplace download is free because Community is free forever. Pro is an optional entitlement that unlocks additional capabilities in this same extension.

Community and Pro

Community (free, no sign-in) is everything above: local MCP X-Ray inventory, credential-shaped-name warnings, change alerts, and Resolver / supported-setup routes.

MCP Trust Pro adds runtime-aware protection, all computed on your machine:

• Protect This MCP - repoint a supported server through the local ECZ Trust Gate: a STDIO wrapper process, or a localhost proxy for http:// upstreams. The gate mediates the traffic that genuinely flows through it under a deterministic local policy. Coverage says ENFORCED only while a live gate session is mediating - a stopped gate truthfully drops back to OBSERVED. Stop Protecting restores your original configuration and needs no Pro entitlement.
• Secret Shield - mediated servers launch with a minimized, least-privilege environment; credential-shaped names are removed unless you allowlist them. Values are never displayed, retained, or transmitted - previews show key NAMES only.
• Trust Epochs - retained local history of your MCP posture (tools and schemas as digests, origins, transports, environment key names, policy and coverage), with comparison between any two epochs, deletion, and retention controls.
• Advanced Tool X-Ray - capability-class signals per mediated tool and material-change (rug-pull) indicators across epochs. Signals for your review, never a verdict.
• Deterministic local policy - ALLOW / WARN / REVIEW / BLOCK / QUARANTINE, first-match rules you control. No model authorizes anything.
• Remediation - reviewable config patches: preview, diff, timestamped backup, atomic apply, rollback.

Developer Trust Pro unlocks both MCP Trust Pro and Agent Trust Pro. Community keeps working if a Pro entitlement is absent or expires - only Pro features deactivate, and your locally retained history stays.

Useful for

Useful across many legitimate roles. Commonly used by:

• MCP server and client developers
• AI tooling and platform teams
• Security reviewers of MCP integrations
• Architects standardising MCP across a fleet

Relevant when you are adding or reviewing an MCP server, before relying on an MCP integration, an evaluator asks which servers carry public proof.

What you can do in under a minute

1. Open or scan the workspace - run ECZ-ID MCP Trust: Check MCP Trust.
2. Review findings in plain English - grouped, with neutral posture.
3. Open Resolver guidance or continue supported setup where relevant.

What it looks for

• MCP server configuration (mcp.json, .mcp.json, .vscode/mcp.json, .mcp/, mcp.config.*).
• Known MCP client configs (e.g. claude_desktop_config.json).
• An ecz-mcp.json / .well-known/ecz-mcp.json resolver reference.
• Whether a resolver-verifiable proof reference is missing for a detected server.

MCP X-Ray (local inventory)

For each server declared in a detected MCP configuration, a check shows:

• Server name and source file - which config declares it.
• Transport - declared stdio / http, legacy SSE, or honestly labelled inferred / unknown.
• Command - executable basename only, plus argument count and flag names (argument values are never shown).
• Environment keys - variable NAMES only, with a warning when a name looks credential-shaped. Secret values are never displayed, retained, fingerprinted, reported, or transmitted.
• Sandbox - the declared sandboxEnabled configuration state only (no claim about actual sandbox behaviour).
• Remote - scheme, host, port and path only; URL credentials, query and fragment are always omitted.
• Fingerprint - a local posture fingerprint of the privacy-filtered fields above. Changing only a secret value never changes it.
• Change since your previous local scan - servers added or removed, transport, command, argument shape, environment key set, sandbox declaration or remote endpoint changes. One baseline is kept per workspace, on this machine only, and is replaced on each scan.

Coverage truth: inventory results are OBSERVED (configuration inspected locally) and UNMANAGED - inspection does not mediate or enforce runtime execution, and makes no connection to any MCP server. Coverage reads ENFORCED only while a Pro Local Trust Gate you started is genuinely mediating a session and its live mediation proof holds; when that gate stops, coverage truthfully drops back to OBSERVED / UNMANAGED.

Example result

MCP X-RAY  -  ECZ-ID MCP Trust
Server: github
  Source ............ .vscode/mcp.json
  Transport ......... HTTP - declared
  Remote ............ https://api.example.com/mcp (credentials/query omitted)
  Environment keys .. 2 detected; 1 credential-shaped name
  Sandbox ........... not declared
  Fingerprint ....... a1b2c3d4e5f6 (local posture fingerprint)
  Change ............ unchanged since previous local scan
Coverage: OBSERVED / UNMANAGED

What results mean

Results describe public-proof posture, never a safety, approval, certification or compliance verdict:

resolvable | partial public proof | no public proof reference found yet | review recommended | re-check before reliance | your local policy decides.

There is no "pass/fail". Local policy decides what is sufficient, and you should re-check before reliance.

Recommended next steps

• Inspect the finding - plain-English detail, no verdict.
• Copy verification guidance - a claim-free snippet you can share.
• Open Resolver - read-only public proof lookup.
• Continue supported setup - hand off to TrustOps (metadata only).
• Open documentation - Developer Gateway.
• Re-check later - re-run before you rely on a result.

Privacy & permissions

See the bundled PRIVACY.md for the full notice.

Frequently asked questions

Is this extension free?

Yes. Every local check is free - you never need to sign in or pay to run one.

Does it upload my source code?

No. No source, prompts, secrets or tool payloads ever leave your device, and there is no telemetry.

Does it read my file contents?

The scan itself walks filenames and paths only. When you run a check, the extension additionally reads the contents of detected MCP configuration files (for example .vscode/mcp.json) to build the local X-Ray inventory. That processing stays on your machine: secret values are never displayed, retained, persisted, fingerprinted, reported, or transmitted, and ${input:...} / ${env:...} references are never resolved.

Does a missing proof reference mean something is unsafe?

No. "No public proof reference found yet" is neutral - it is not a verdict of "unsafe". It only means resolver-verifiable public proof was not detected.

What does Resolver do?

Resolver is a read-only public proof lookup. The extension can open it so you can check public proof yourself; the extension never writes, activates or decides anything.

Do I need an ECZ-ID before using the extension?

No. You can run every local check without one. An ECZ-ID is only relevant if you later choose supported setup in TrustOps.

What happens when I continue supported setup?

The extension hands off to TrustOps with metadata only. It runs no checkout itself; TrustOps handles acquisition, setup and lifecycle.

Can this extension make a compliance or approval decision?

No. It surfaces posture and routes you to proof. Local policy decides sufficiency; it never certifies, approves or guarantees.

Which MCP configuration files can it detect?

mcp.json, workspace .mcp.json, .vscode/mcp.json, .mcp/ configurations, claude_desktop_config.json and ecz-mcp.json.

Does it connect to or run my MCP servers?

Community: no. Inventory comes from configuration files only. Community never starts a process, never connects to a server, never makes a tool call, and coverage is always labelled OBSERVED / UNMANAGED.

Pro: only if you explicitly turn it on. When you run Protect This MCP, the Local Trust Gate binds a 127.0.0.1 loopback endpoint (HTTP servers) or spawns a local wrapper process (STDIO servers) and relays that session's traffic to the upstream server you already configured, applying your local policy. That is the whole point of mediation - it cannot be done from outside the call path. It runs only for servers you protect, only while you leave it running, and it talks only to the upstream you had already configured. Stop the gate and the extension is back to reading configuration.

Is MCP Registry presence treated as proof?

No. Registry presence is not treated as resolver-verifiable public proof. Re-check before reliance.

Does this create or host an MCP server?

It never creates, hosts or publishes an MCP server of its own, and it never becomes a server you or anyone else can connect to from outside your machine. Community only inspects local configuration and resolver-reference posture. Pro's Local Trust Gate does bind a local 127.0.0.1 endpoint (or spawn a local wrapper process) while you have it running, purely to sit between your client and the server you already configured.

What does "Protect This MCP" actually do (Pro)?

It rewrites a supported server entry in your MCP configuration to point at the local ECZ Trust Gate - a STDIO wrapper process or a 127.0.0.1 proxy - after showing you a Secret Shield preview and a config diff, and after writing a timestamped backup. Your MCP client then talks to the gate, which applies your deterministic local policy to the traffic and passes the rest through to the original server. Nothing leaves your machine.

When does coverage say ENFORCED (Pro)?

Only while a live local gate session is genuinely mediating that server's traffic. A dead, stopped, stale or mismatched gate is never shown as ENFORCED - it reads OBSERVED. ENFORCED can never be produced by inspection alone.

Does Pro certify or verify a server?

No. Pro applies your local policy to traffic you route through the local gate. It makes no approval, certification or compliance claim. Organization-level MCP Assurance is a separate product, and Resolver public proof stays separate from local policy.

What happens to Pro features when my entitlement expires?

Pro features deactivate on the next verification; Community continues in full and your locally retained history is kept. Entitlements are verified locally with asymmetric (ES256) cryptography; the entitlement token is never displayed or transmitted by this extension.

What it does not do

• No source / prompt / secret upload, and no telemetry.
• Provides local evidence review and guidance only - it does not issue ECZ-ID proof, activate services, grant access, or make approval, safety, insurance or compliance decisions.
• Makes no safety, approval, certification or compliance claim. Registry presence is not proof, and this extension makes no remote-runtime claim. Resolver is the only public proof surface.
• Runs no checkout or payment - commercial actions happen only in TrustOps.

Install & first use

1. In your editor's Extensions view, search for ECZ-ID MCP Trust (publisher EcoCitizenz) and install it.
2. Open a project and trust the workspace.
3. Run ECZ-ID MCP Trust: Check MCP Trust and review the grouped findings.

Free vs Pro vs supported setup

• Community (free, local-first): detected MCP configuration with posture, missing-proof findings, MCP X-Ray, change alerts, and Resolver re-check / supported-setup routes - no sign-in and no purchase to run a check.
• MCP Trust Pro (paid, still local): Protect This MCP with truthful ENFORCED coverage, Secret Shield, Trust Epochs history, Advanced Tool X-Ray with rug-pull indicators, deterministic local policy and reviewable remediation. Activate with a Developer Trust entitlement; the Developer Trust Pro bundle unlocks Agent Trust Pro too.
• Supported setup (TrustOps): maintained ECZ-ID identity, public proof and lifecycle for MCP server identity and public proof - relevant when you need a resolver-verifiable result others can check, not just local review.
• You never need to buy anything to get local value; Pro and supported setup are separate, optional steps.

Python / CLI

Prefer Python, CI or terminal automation?

python -m pip install ecz-id-mcp
ecz-id-mcp --help

• Open the matching Python package: https://pypi.org/project/ecz-id-mcp/
• Explore all 10 ECZ-ID Python tools: https://developers.ecocitizenz.com/python

The Python tools run locally and inspect, explain and route only - the same role boundary as this extension. They do not issue an ECZ-ID, create public proof or replace Resolver proof.

Machine-readable facts

Need help choosing the right ECZ-ID route?

Use ECZ-ID GPT guidance: https://trustops.ecocitizenz.com/start#gpt-guidance

Route guidance only. TrustOps handles setup; Backend/Core writes truth; Resolver proves public state. Local policy decides reliance. Re-check before reliance.

Links & support

• Resolver (read-only proof): https://resolver.ecocitizenz.org
• TrustOps (supported setup): https://trustops.ecocitizenz.com/start
• Developer Gateway (docs & support): https://developers.ecocitizenz.com
• Privacy: see the bundled PRIVACY.md file