ECZ-ID Developer Trust
One local trust layerfor both sides of the connection.
An MCP server is one half of the problem. The agent that calls it is the other. Developer Trust covers both, locally, before anything connects or acts — with no account to run a check and no source, prompt or secret value ever leaving your machine.
Both extensions are free forever with no account. Already purchased? Activate
What a server is configured to do, which credential-shaped names it is handed, and what changed since your last scan.
What an agent can actually reach across its declared tools and the MCP servers beside it, and how that reach changed.
One key activates both extensions. One subscription, one renewal, one invoice — and less than the two Pro plans bought separately.
Two extensions, one layer
A server is one half. The agent calling it is the other.
Each extension is free forever and useful on its own. Together they read the same connection from both ends.
ECZ-ID MCP Trust
What each MCP server is configured to do, which credential-shaped names it is handed, where it reaches, and what changed since your last scan.
MCP X-RAY - ECZ-ID MCP Trust Server: github Source ............ .vscode/mcp.json Transport ......... HTTP - declared Remote ............ https://api.example.com/mcp (credentials/query omitted) Environment keys .. 2 detected; 1 credential-shaped name Sandbox ........... not declared Fingerprint ....... a1b2c3d4e5f6 (local posture fingerprint) Change ............ unchanged since previous local scan Coverage: OBSERVED / UNMANAGED
- •Local MCP discovery & inventory
- •Configuration posture
- •Environment key-name exposure
- •Credential-shaped name warnings
ECZ-ID Agent Trust
What each agent declares, which MCP servers sit beside it, which credential-shaped names it is handed, and how that reach changed.
ECZ-ID Agent Trust - 2 agent surfaces - agent.yaml ........... no ecz-agent.json reference found yet - mcp tool config ...... resolver reference present Posture: neutral - local policy decides, re-check before reliance
- •Per-agent inventory (Agent X-Ray)
- •Declared tool visibility
- •Environment key-name exposure
- •Workspace MCP relationships
Plans
Buy one side, or cover both for less.
Every plan below is optional. Both extensions are fully usable free, permanently, with no account.
Community
- •Both extensions, free forever
- •MCP X-Ray and Agent X-Ray
- •Credential-shaped name warnings
- •Change since your previous scan
- •No account, no telemetry, nothing uploaded
MCP Trust Pro
- •Trust Epochs
- •Advanced Tool X-Ray
- •Secret Shield preview
- •Local Trust Gate
- •Remediation
- •Local evidence reports you can export and keep
Secure checkout by Shopify. Cancel any time. Already purchased? Activate here.
Agent Trust Pro
- •Authority Graph
- •Action Chains
- •Authority Epochs
- •Reciprocal Agent-to-MCP view
- •Remediation
- •Local evidence reports you can export and keep
Secure checkout by Shopify. Cancel any time. Already purchased? Activate here.
Developer Trust Pro
- •Everything in MCP Trust Pro and Agent Trust Pro
- •One licence key activates both extensions
- •One subscription, one renewal, one invoice
- •Cheaper than the two Pro plans bought separately
Secure checkout by Shopify. Cancel any time. Already purchased? Activate here.
Two Pro plans bought separately are £12.99 + £12.99 per month. Developer Trust Pro is £19.99/month for both, on one licence key, with one renewal and one invoice.
ECZ-ID MCP Trust 0.4.2 is published on both registries. Install free, in your editor or from the web.
ECZ-ID Agent Trust 0.4.2 is published on both registries. Install free, in your editor or from the web.
Activate the licence from your order confirmation. A Developer Trust Pro bundle key turns on both extensions.
Activate your purchase →Free vs Pro
What a Pro licence actually adds.
Shown here for MCP Trust; Agent Trust follows the same shape, with the Authority Graph and action chains in place of the local gate.
| Capability | Community | MCP Trust Pro |
|---|---|---|
| MCP server discovery and inventory | Full | Full |
| Environment key NAMES + credential-shaped warnings | Full | Full |
| Sanitised remote endpoint and posture fingerprint | Full | Full |
| Change since your previous scan | One baseline | Full history, compare any two |
| Retention you control | — | Yes |
| Advanced Tool X-Ray (declared capability and schema) | — | Yes |
| Secret Shield preview before you connect | — | Yes |
| Local Trust Gate with live mediation proof | — | Yes |
| Remediation with diff, apply and rollback | — | Yes |
| Exportable local evidence reports | — | Yes |
| Runs with no account, no telemetry, nothing uploaded | Always | Always |
See the Agent Trust comparison →
These extensions review evidence and route you to it. They do not issue ECZ-ID proof, activate services, grant access, or make approval, safety, insurance or compliance decisions. Public proof lives in Resolver, and MCP Assurance is a separate, organisation-level product.
Free resource · 10 pages · no email required
Get the Complete MCP + Agent Trust Preflight
Both sides of the connection in one checklist: 20 practical checks covering MCP transports and credential exposure, agent reach and capability chains, and the change review worth running before anything connects or acts. Vendor-neutral, and useful whether or not you install the extensions.
Runs with or without our extensions. Nothing to sign up for.
Questions
Choosing between them.
Which one do I need?
If you are wiring or reviewing MCP servers, start with MCP Trust. If you are granting tool access to an agent, start with Agent Trust. If you do both — and most people building with MCP end up doing both — the bundle covers both sides for less than the two singles.
What does the bundle actually give me?
Everything in MCP Trust Pro and Agent Trust Pro, with one licence key that activates both extensions, and one subscription, renewal and invoice. It costs less than buying the two Pro plans separately.
Can I start free and upgrade later?
Yes, and that is the intended path. Install both free, run real scans on your own workspace, and buy Pro only once you know which side you need history and deeper analysis on.
Is the free version time-limited or a trial?
No. Community is free permanently and needs no account. Pro adds to Community; it never removes anything. If a Pro subscription lapses, only the Pro features deactivate and your locally retained history stays where it is.
Does any of my code or configuration get uploaded?
No. No source, prompts, tool arguments, tool results or secret values leave your machine, and there is no telemetry. Results carry names, counts, states and local fingerprints only.
Does it read my environment variable values?
Never. Environment variable NAMES are inventoried so you can review intended exposure; values are not read into results, displayed, retained or transmitted. The posture fingerprint is deliberately invariant to secret rotation.
I already paid. How do I turn Pro on?
Use the activation page and paste the licence from your order confirmation. The bundle licence activates both extensions. Activation is verified locally with asymmetric cryptography and the token is never displayed or transmitted.
Can I cancel?
Yes, at any time, from your account. Checkout and billing are handled by Shopify; this site runs no checkout of its own.