Support

ECZ-ID API Trust adds one skill, api-trust-review, to an agent host. When you ask which API surfaces a workspace exposes and how they are secured, the agent runs a bundled review script over the folder you point it at, then reports which classes of evidence it found, which it did not, why each matters and what to review next.

The review works from file names and paths only. It looks for these classes of evidence:

• API contract (OpenAPI, GraphQL or AsyncAPI) (primary evidence class)
• Authentication / authorisation configuration (primary evidence class)
• API catalogue / discovery document (supporting evidence class)
• Security policy / disclosure contact (supporting evidence class)
• Contract tests / request collections (supporting evidence class)
• ECZ-ID public proof reference (supporting evidence class)

It does not open any of those files. So it can tell you that an OpenAPI document exists where a reviewer would expect one, and it cannot tell you which paths, operations or security schemes it declares.

Results are reported as EVIDENCE OBSERVED, EVIDENCE NOT OBSERVED, REVIEW RECOMMENDED and REVIEW REQUIRED, with a Review Priority of LOW, NORMAL, ELEVATED, HIGH and the reasons that produced it. The Review Priority is deterministic: the same file listing always gives the same result. It is not a score, a grade, a pass mark or a verdict.

The Privacy page sets out exactly what the plugin reads and what it does not. The Terms page sets out the basis on which you may use it.

The shipped skill says it in one line: it does not test an endpoint or read a secret. That is worth expanding, because “API trust” is exactly the phrase that makes people expect a scanner.

No request is sent to your API. Not to production, not to staging, not to a URL in a contract file. The review has no HTTP client at all. It cannot probe an endpoint, attempt an authentication, fuzz a parameter, enumerate a path or measure a response. It is not a penetration test, a vulnerability scan, a DAST tool or a conformance test, and it must not be used or described as one.

It does not read your contract either. Because it never opens a file, it cannot compare a declared surface against a deployed one, detect drift, evaluate a security scheme or judge whether the authentication configuration it observed is any good. Observing that openapi.yaml exists means exactly that: a file with that name is there.

What it gives you is the reviewer's first pass, done in a second: is the evidence a consumer, platform or auditor will ask for actually present in this repository, and where. Everything after that is your own review.

Most reports we can act on quickly come down to one of these, and each is faster to check than to describe in an email.

• A contract was not observed in a repository that has one. The review skips node_modules, dist, build and similar generated directories, and it ignores hidden dot-directories other than .github, .gitlab and .well-known. This product looks at the narrowest set of hidden entries of any ECZ-ID review, so a specification generated into a build directory or held in a hidden folder will not be observed.
• The specification is generated rather than committed. A contract produced at build time does not exist as a file when the review runs. Point the review at a tree where the generated artefact has been written, or commit it.
• The review stopped short in a large repository. Traversal is bounded by design, so a review cannot run away on a very large tree. Point it at the service you care about rather than at a monorepo root.
• The host cannot find the skill. Confirm the plugin is installed and enabled in that host, and that a Node.js runtime is available — the bundled review script runs on Node and has no other dependency.
• The Verifier tools are not available. This package also declares the ECZ-ID Verifier server, @ecocitizenz/ecz-id-mcp-verifier@0.9.0, which only hosts that run local stdio MCP servers will launch. Without it the review still runs; what you lose is the ability to check a public proof reference it found. See the MCP Verifier support page.
• You want to see exactly what the review did. The script is short, readable and has no build step. Read review.mjs, or run it yourself with --json for the machine-readable projection.

Email support@ecocitizenz.com. This is the support route for every EcoCitizenz product, so please name ECZ-ID API Trust in the subject line.

A report we can act on usually contains:

• the plugin name and version — eczid-api-trust 0.1.1;
• the agent host and its version, and how the plugin was installed there — which marketplace, or a local copy;
• your operating system and Node.js version;
• what you asked the agent to do, and what you expected to happen;
• what actually happened, quoted rather than summarised;
• any error text in full and, if the review ran, the --json output — the single most useful attachment for a detection problem;
• for a detection problem, the file name and path you expected to be observed. The path is enough. We do not need the specification, and we do not want your authentication configuration.

If the repository is private, please do not send it. A redacted directory listing, or a small public example that reproduces the same behaviour, is more useful and safer for both of us. An API contract in particular often names internal hosts; a path is all we need.

Nothing about diagnosing this plugin requires a credential, and we will never ask you for one. Please do not include, in a message, an attachment or a screenshot:

• passwords, passphrases or PINs;
• API keys, access tokens, session cookies or bearer tokens;
• private keys, certificates, keystores or signing material;
• .env files, CI secrets or cloud credentials;
• customer personal data, or confidential source code you are not free to share.

If you believe you have already sent us a secret, rotate it immediately — that is the only reliable remedy — and then tell us, so we can delete the message on our side.

Security reports are handled separately from ordinary support. If you believe you have found a vulnerability in this plugin, in the review script it ships, or in the ECZ-ID Verifier server it declares, or in another EcoCitizenz service, report it to support@ecocitizenz.com with security report in the subject line, rather than raising it in a public issue.

A useful security report describes the affected component and version, the conditions needed to reproduce the issue, the impact you observed, and anything you think we would otherwise miss. Please give us a reasonable opportunity to respond before disclosing publicly, where earlier disclosure would create material risk for users.

EcoCitizenz supports good-faith security research. When testing, please do not access customer data unnecessarily, destroy or alter data, disrupt production systems, perform denial-of-service testing, or exploit an issue beyond what is reasonably required to demonstrate it. Those conditions are set out in the security research section of the Terms.

We do not operate a paid bug-bounty programme for this plugin, and this page offers no reward.

Misuse is not the same as a vulnerability. If you have seen a copied manifest on an unrelated origin, an impersonated operator, a stale or misleading proof reference, or a page imitating ECZ-ID verification, use the abuse report route. Reports are reviewed. They do not by themselves decide truth or change any credential state.

The plugin is open source, so you do not have to take any statement on these pages on trust — you can read every line it runs.

• The published plugin package — manifest, skill, review script and server declaration.
• The ECZ-ID plugins page — how to install this and the other ECZ-ID plugins in your agent host.
• API Passport guidance — how resolvable API identity, authority and evidence work, and what an ECZ-ID API Passport is. Passport issuance happens in TrustOps; it is not a function of this plugin.
• A free VS Code extension, ECZ-ID API Security, reviews API surfaces and their proof posture locally — on the Visual Studio Marketplace and Open VSX. That extension is a separate product with its own release cycle; these pages describe the plugin.

ECZ-ID API Trust is published by EcoCitizenz Ltd, trading as EcoCitizenz, company number 17348848, registered in England and Wales.