Server data from the Official MCP Registry
Permanent identity + encrypted, quantum-ready memory that outlives the session, for any AI agent.
About
Permanent identity + encrypted, quantum-ready memory that outlives the session, for any AI agent.
Security Report
Valid MCP server (2 strong, 3 medium validity signals). 2 known CVEs in dependencies ⚠️ Package registry links to a different repository than scanned source. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.
15 files analyzed · 3 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Environment variable: UUAID_API_KEY
Environment variable: UUAID_VAULT_KEY
Environment variable: UUAID_AGENT
Environment variable: UUAID_BASE_URL
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-uuaid-mcp": {
"env": {
"UUAID_AGENT": "your-uuaid-agent-here",
"UUAID_API_KEY": "your-uuaid-api-key-here",
"UUAID_BASE_URL": "your-uuaid-base-url-here",
"UUAID_VAULT_KEY": "your-uuaid-vault-key-here"
},
"args": [
"-y",
"@uuaid/mcp"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
UUAID
The verifiable identity layer for AI agents — the SSL/CA for agents.
A permanent, portable identity plus encrypted, quantum-ready memory that outlives the session. This monorepo holds the official TypeScript packages; the hosted registry, resolver, and on-chain anchor run at uuaid.org.
Protocol specifications live in uuaid/spec. The design argument, including the vulnerability we found in our own verifier, is at uuaid.org/know-your-agent.
Packages
| Package | npm | What |
|---|---|---|
@uuaid/core | @uuaid/core | UUAID grammar, JCS content hashing, crypto-agile signature envelope, Verifiable Badges (IAASO-0003) |
@uuaid/vault | @uuaid/vault | Client-side memory encryption (AES-256-GCM + hybrid X25519/ML-KEM-768) |
@uuaid/sdk | @uuaid/sdk | Typed client: signup, mint, save/recall memory, verify |
@uuaid/provenance | @uuaid/provenance | Media provenance (IAASO-0004) — bind an image, video or PDF to the agent that made it |
@uuaid/cli | @uuaid/cli | uuaid signup · register · badge · verify-badge · vault … |
@uuaid/mcp | @uuaid/mcp | MCP server — one config line makes any agent persistent |
Quickstart
npx @uuaid/cli signup "my-lab" # free API key, shown once
npx @uuaid/cli register "ci-bot" # permanent ID
import { UuaidClient, generateVaultKey } from "@uuaid/sdk";
const { api_key } = await UuaidClient.signup("My Agent Lab"); // free tier
const uuaid = new UuaidClient({ apiKey: api_key });
const { uuaid: id } = await uuaid.registerAgent({ display_name: "Aria" });
Verifying a badge
The one thing to get right, so it is worth stating before the code: a badge
envelope carries the signer's own public key. Well-formedness, the payload-hash
bind, signature validity, even a valid post-quantum signature — all of them pass
for a badge anybody minted with a fresh keypair and a copied keyId. Pinning the
issuer against a published root is the only step that turns a valid signature
into an identity claim.
verifyBadge therefore fails closed. No pin, no verdict.
import { parseBadgeSvg, verifyBadge } from "@uuaid/core";
const { keys } = await fetch("https://api.uuaid.org/.well-known/uuaid-registry.json").then(r => r.json());
const trustedIssuerKeys = Object.fromEntries(keys.map(k => [k.keyId, k.publicKey]));
const r = verifyBadge(parseBadgeSvg(svg), { trustedIssuerKeys });
r.ok // true only when the issuer pinned and the envelope is intact
r.level // "L1-trusted" | "L0-selfsigned" | "invalid" | …
r.nameVerified // did the registry vouch for the NAME on it? usually false
Omit trustedIssuerKeys and you get ok: false, level: "L0-selfsigned" — the
level a forgery reaches. See
IAASO-0003 §4.3.
Development
pnpm install
pnpm build && pnpm typecheck && pnpm test
Security
Found a badge that verifies and shouldn't? That is the most useful thing you can send us — security@uuaid.org, and see SECURITY.md.
Apache-2.0 — see LICENSE.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption