Agent plugin · Privacy

ECZ-ID API Trust

Privacy

This notice describes how the ECZ-ID API Trust agent plugin — the package eczid-api-trust, version 0.1.1 — handles information. It covers that plugin only.

Everything below describes what the shipped code does, not what we intend it to do. The plugin is open source, and the review script is short enough to read in a few minutes.

Applies to:: eczid-api-trust 0.1.1
Effective date:: 3 September 2026

Summary

The review runs on your machine, on a folder you choose, only when you ask for it.
It reads file names and paths. It does not open, read, parse or transmit the contents of any file — including your API contract and your authentication configuration.
It never contacts an API. No request is sent to any endpoint, in any environment, at any time. There is no HTTP client in the review at all.
This package also declares the ECZ-ID Verifier server. That is a separate, opt-in capability that reads a public record about a target you name — see the Verifier server.
It writes nothing. There is no cache, no log file, no database and no report file unless you redirect the output yourself.
There is no telemetry, no analytics, no crash reporting and no usage counter. No account is required, and none is offered.
EcoCitizenz receives nothing from the review. We cannot see that you ran it, or what it found.

Scope of this notice

This notice applies to the ECZ-ID API Trust agent plugin, published by EcoCitizenz as eczid-api-trust at version 0.1.1. The plugin consists of a manifest, one skill document, one review script, one evidence-class reference and a declaration of one MCP server.

It does not cover, and must not be read as covering:

the agent host or AI platform you run the plugin inside, which is operated by a third party under its own terms;
the free ECZ-ID API Security extension for VS Code, which is a separate product with its own privacy notice and its own capabilities;
the ECZ-ID Verifier package the plugin declares, which is separately published and has its own privacy notice;
EcoCitizenz websites, TrustOps, the Resolver or any other EcoCitizenz service you may visit afterwards by following a link.

It supplements the EcoCitizenz Privacy Policy, which is the general policy for EcoCitizenz services and explains your rights and how to contact us about personal information. Where this notice describes the plugin's behaviour specifically, it is the more specific statement.

What the plugin reads

When you ask the agent to review a workspace, the bundled script walks the directory you named and builds a list of workspace-relative file paths. That list is the entire input to the review.

File names and paths, not contents

Detection is done by matching patterns against the path string — for example, a file named openapi.yaml, a path ending in .graphql, or a path containing oauth. The script does not call any file-reading function. It contains no code capable of opening a file.

For this product the limit is worth stating twice. The review does not read your API contract: it does not learn your paths, your operations, your parameters, your schemas, your servers block or your declared security schemes. It does not read your authentication configuration: it does not learn your issuer, your scopes, your client identifiers or anything resembling key material. It observes that a file with a matching name exists at a path, and reports the path.

And it never contacts the API

This is the statement that matters most for a product with “API” in its name, so it is made without qualification. The review sends no request to any API endpoint. Not to a URL in a contract file, not to a server named in configuration, not to production, staging or localhost. It does not resolve a hostname, open a socket, attempt an authentication or observe a response, because it contains no code that could.

Nothing about your API is therefore exercised, logged by your own infrastructure, or exposed to a third party as a consequence of running the review. It reads a directory listing on your machine.

What is skipped before anything is read

Hidden entries whose name begins with a dot are skipped entirely, apart from a fixed allowlist. For this product that allowlist is the shared three and nothing more — the narrowest of any ECZ-ID review:

.github
.gitlab
.well-known

Being on that list means only that the entry is walked for file names. Nothing in it is opened. Every other dot-entry, including a real .env file and every host or editor directory, is skipped before matching happens.

These directories are never descended into, so build output and installed dependencies are not enumerated:

node_modules
.git
.pnpm-store
dist
out
build
.next
.turbo
.venv
venv
__pycache__
target
coverage

Traversal is also bounded: at most 8 directory levels below the folder you chose, and at most 20,000 files. A directory the script cannot read is skipped silently rather than retried.

What ends up in the result

The review output contains only:

the name of the folder you reviewed — its final path segment, not its full path;
for each evidence class that was observed, the workspace-relative path of the first matching file;
the Review Priority, the reasons for it, and the guidance text for each class;
the time the review ran.

That output is returned to the agent that asked for it, in the session you are already in. Nothing else is produced.

Network behaviour

The review makes no network request. The script imports two standard Node.js modules — the directory-listing and path-handling functions — and nothing else. It contains no HTTP client, no socket, no fetch call and no code that starts another process. You can confirm this by reading review.mjs, which has no dependencies and no build step, so the file you read is the file that runs.

The Verifier server this package also declares

The package ships an mcp.json declaring one server, ecz-id-verifier, launched from @ecocitizenz/ecz-id-mcp-verifier@0.9.0. It is there for one purpose: when the review observes an ECZ-ID public proof reference, or you name an ECZ-ID, you can check the public record without leaving the session.

Two things follow, and both are stated rather than implied. A host that runs local stdio MCP servers will download that package from the npm registry on first launch, through your own package manager. And when you invoke one of its tools, an ordinary HTTPS request goes to the public ECZ-ID Resolver, and for a URL or domain target to that target's own public manifest, carrying the target you asked about and nothing else about you.

Note what that is not: it is a read of a public record about an identifier you typed, not a request to your API. A host that does not run local MCP servers launches nothing, and this capability simply does not exist there. Either way it is separate from the review, which sends nothing. The full description is on the MCP Verifier privacy page.

Links in the result

A review ends with at most three suggested next steps and one optional discovery link, chosen from a fixed list according to what was observed. These are ordinary web addresses printed as text. Nothing is requested unless you choose to open one, and no information about your workspace is appended to them: no query parameters, no identifiers, no tracking parameters.

What your agent may do next is not the plugin

One boundary deserves its own heading, because it is easy to blur and a reviewer will ask about it.

The skill's guidance suggests useful next steps for a human — for example, checking that every path and operation in the contract is intended, or that each security scheme has matching configuration. If you ask your agent to do that, it may open those files, using the file-reading tools its host gives it. Those tools are your agent host's, not ours.

That is a real difference in effect and this page will not pretend otherwise: what the plugin reads and what your session ends up containing are two different things. The plugin reads names. Your agent, if you ask, may read contents, and whatever it reads becomes part of a conversation held by the platform under its own terms. We do not receive any of it either way.

Storage and retention

The plugin stores nothing. The script has no code that writes a file, creates a directory or opens a database. It keeps no cache, no history and no record of previous reviews.

The result exists as output in your agent session. If you want to keep it, you have to save it yourself — for example by redirecting the command output to a file. That copy is yours, in a location you chose, and this notice does not govern what you do with it.

Because nothing is transmitted by the review and nothing is stored by us, there is no retention period, no archive, no backup and no server-side copy of anything it observed.

What EcoCitizenz receives

Nothing from the review. It transmits no data to EcoCitizenz, so we do not receive and cannot hold:

your name, email address, account identifier or organisation;
the name, path or contents of any file in your workspace;
your API contract, your endpoints, your hostnames or your authentication settings;
the results of any review, or the Review Priority it produced;
the fact that you installed the plugin, or that you ran it;
your IP address, machine identifier, operating system or agent host;
usage counts, timings, feature analytics or crash reports.

There are no advertising, tracking or data-broker integrations, because there is no data path to integrate. The two ways we learn anything are if you use the Verifier tools, in which case a public read-only surface of ours receives a request naming the target you chose, and if you email support, in which case we hold that message and whatever you put in it. The Support page sets out what is useful to send and what should never be sent.

Secrets and credentials

The plugin never asks for a credential, has no field in which you could enter one, and needs none to run. It performs no authentication against your API or anything else, and holds no token.

Because it does not read file contents, it cannot read a secret value out of a .env file, a keystore, a JWKS document or an authentication configuration. Every dot-entry other than the three allow-listed directories is skipped before matching, so credential files in the usual hidden locations are not even listed.

One consequence is worth stating plainly: an evidence class can be reported as OBSERVED together with the path of the matching file. A path is not a secret value, but the path of an auth directory can still be revealing. You see that path before anyone else does, and you decide whether to share the result.

Your agent host is a separate matter

This is the distinction that matters most, and we would rather over-explain it than let it be assumed.

What this notice covers

The plugin: what the review reads, what it computes, and what it sends — which, as set out above, is nothing, and never a request to your API.

Where you invoke the Verifier tools this package declares, it also covers what those tools send: a read of a public record about a target you named.

What this notice does not cover

You run this plugin inside an agent host — a coding agent, an assistant, a CLI or an AI platform — operated by a third party. That platform decides what your conversation contains, what it transmits to its own servers, how long it retains it and what it does with it. That typically includes your prompts, the agent's replies, and the review output the agent shows you, since the output becomes part of the conversation.

EcoCitizenz has no control over, and no visibility into, that processing. We do not operate those platforms, we are not a party to your agreement with them, and we cannot make commitments on their behalf. Their handling of your data is governed by their own privacy policy and terms, which you should read if that matters to you.

The practical point: choosing a local-first, read-only plugin does not by itself make your session private. It means this plugin adds no data flow of its own to whatever your platform already does.

Children

The plugin is a developer tool. It is not directed at children and knowingly collects information from nobody, because it collects information from nobody at all.

Changes to this notice

If the plugin's handling of information changes, this page is updated before or alongside the release that changes it, and the effective date is revised. Where the plugin is distributed through a marketplace listing, the updated notice is the one linked from that listing.

The version this notice applies to is stated at the top of the page. If you are running an older version, read the notice published with it.

Contact

Questions about this notice, or about privacy in relation to this plugin, can be sent to support@ecocitizenz.com. The same address is the route for data-protection requests under the general EcoCitizenz Privacy Policy.

See also the Support and Terms pages for this plugin, and the source if you would rather check than be told.

What this notice does not claim

Local and read-only is a description of behaviour, not a security guarantee. We do not claim the plugin is secure in any absolute sense, and no statement here is a security or compliance certification.
The review does not certify, approve or guarantee any API, repository, product or organisation. EVIDENCE NOT OBSERVED does not mean unsafe, and EVIDENCE OBSERVED does not mean adequate.
Not contacting your API is a privacy property and a hard limit on the product at the same time: it is why nothing here can tell you whether your deployed API matches the contract you committed.
We describe what the plugin does. We make no representation about what your agent host, operating system, editor or any other software on your machine does at the same time.

Publisher

ECZ-ID API Trust is published by EcoCitizenz Ltd, trading as EcoCitizenz, company number 17348848, registered in England and Wales.

66 Paul StreetLondon EC2A 4NAUnited KingdomContact: support@ecocitizenz.com