Support

ECZ-ID MCP Verifier answers one question: does an MCP server, agent, API, package, domain or business have public ECZ-ID Resolver proof? It adds one skill, ecz-id-verify, and declares one local MCP server so that a host which supports them can offer three read-only tools.

Every result it can report is evidence about public proof. None of it is a verdict about safety. Absence of public proof is neutral: it means nothing was found in the public record, not that anything is wrong.

This is the first thing to establish, because it decides what the plugin can honestly do for you. The skill is written to check it before anything else.

Hosts that run local MCP servers — the tools route

The package ships an mcp.json declaring one stdio server named ecz-id-verifier, which the host launches as:

npx -y @ecocitizenz/ecz-id-mcp-verifier@0.9.0 ecz-id-mcp-server

Where that happens, three read-only tools become available:

• ecz_check_target — Classifies a target — an ECZ-ID, a URL, a domain, a package name or an MCP server name — and reports a deterministic result: the target type, the ResultState, the ReasonCodes, a Resolver URL and routing fields.
• ecz_explain_result — Takes a result you already have and returns the plain-English meaning of its ResultState and each of its ReasonCodes.
• ecz_recheck_resolver — Re-reads the public Resolver for the same target, so a decision is never taken on a stale result.

Hosts that do not — the explanation route

Some hosts accept skills but do not launch local MCP servers, and some distributions of this plugin carry the skill alone. In those hosts there is no server, no tool and no check. The skill is instructed to say so in one line and then explain instead: what the ResultStates and ReasonCodes mean, what a result would and would not establish, and where you can read the public record yourself.

It is also instructed never to invent the missing result. In its own words: never simulate a tool result, never guess a ResultState, and never state that a target does or does not have public proof without a result actually obtained. If you ever see this plugin report a verification outcome in a host that has no Verifier tools configured, that is a defect — please tell us.

A result carries a ResultState and one or more ReasonCodes. The ResultState is the broad public state; the ReasonCodes are the granular explanation. Both vocabularies are published and fixed, so a result means the same thing wherever you read it:

• The canonical ResultStates — every state an ECZ-ID verifier may report, and what reliance each supports.
• The canonical ReasonCodes — the granular reasons that accompany a state.

A check runs under a local policy mode, which you choose. The mode does not change what is observed; it changes what your side does about it:

• OPEN — Report and continue where the caller permits.
• PREFER — Prefer suitable Resolver proof, but follow the caller’s local policy.
• REQUIRE — Fail closed when suitable proof is unavailable or invalid.

ECZ-ID does not impose a universal allow-or-block decision. Local policy decides, and a result should be re-checked before anything is relied on.

Most reports we can act on quickly come down to one of these, and each is faster to check than to describe in an email.

• The tools are not there. Confirm your host runs local stdio MCP servers and has read the plugin's mcp.json. A host that only loads skills will never show the tools, and that is expected rather than broken.
• The server will not start. The declaration launches npx, so a Node.js runtime and first-run access to the npm registry are needed. On a machine with no registry access, install @ecocitizenz/ecz-id-mcp-verifier@0.9.0 ahead of time.
• A target reports no public proof. That is a result, not a failure. It means the public record held nothing for that target. It does not mean the target is unsafe, and your local policy decides what to do about it.
• You want to check the record yourself. The Resolver is public and read-only. Nothing about this plugin is needed to read it.
• You want the same check in CI. The verifier also ships as a GitHub Action, Ecocitizenz/ecz-id-mcp-verifier@v0.9.0 — documentation.

Email support@ecocitizenz.com. This is the support route for every EcoCitizenz product, so please name ECZ-ID MCP Verifier in the subject line.

A report we can act on usually contains:

• the plugin name and version — eczid-mcp-verifier 0.1.1;
• the agent host and its version, and how the plugin was installed there — which marketplace, or a local copy;
• whether the three Verifier tools were available in that host, and if so the server package version reported;
• your operating system and Node.js version;
• what you asked the agent to do, and what you expected to happen;
• what actually happened, quoted rather than summarised;
• any error text in full, and the result JSON if a tool returned one — the single most useful attachment for a checking problem;
• the target you checked, if you are free to share it. A public target is enough; we do not need anything private.

If the target is not public, please do not send us internal detail about it. A description of the shape of the problem, or a public target that reproduces the same behaviour, is more useful and safer for both of us.

Nothing about diagnosing this plugin requires a credential, and we will never ask you for one. Please do not include, in a message, an attachment or a screenshot:

• passwords, passphrases or PINs;
• API keys, access tokens, session cookies or bearer tokens;
• private keys, certificates, keystores or signing material;
• .env files, CI secrets or cloud credentials;
• customer personal data, or confidential source code you are not free to share.

If you believe you have already sent us a secret, rotate it immediately — that is the only reliable remedy — and then tell us, so we can delete the message on our side.

Security reports are handled separately from ordinary support. If you believe you have found a vulnerability in this plugin, in the skill it ships, or in the ECZ-ID Verifier server it declares, or in another EcoCitizenz service, report it to support@ecocitizenz.com with security report in the subject line, rather than raising it in a public issue.

A useful security report describes the affected component and version, the conditions needed to reproduce the issue, the impact you observed, and anything you think we would otherwise miss. Please give us a reasonable opportunity to respond before disclosing publicly, where earlier disclosure would create material risk for users.

EcoCitizenz supports good-faith security research. When testing, please do not access customer data unnecessarily, destroy or alter data, disrupt production systems, perform denial-of-service testing, or exploit an issue beyond what is reasonably required to demonstrate it. Those conditions are set out in the security research section of the Terms.

We do not operate a paid bug-bounty programme for this plugin, and this page offers no reward.

Misuse is not the same as a vulnerability. If you have seen a copied manifest on an unrelated origin, an impersonated operator, a stale or misleading proof reference, or a page imitating ECZ-ID verification, use the abuse report route. Reports are reviewed. They do not by themselves decide truth or change any credential state.

The plugin is open source, so you do not have to take any statement on these pages on trust — you can read every line of it, and it is short.

• The published plugin package — manifest, skill document and MCP server declaration.
• The ECZ-ID Verifier repository — the separately published server and command-line tool the declaration launches.
• MCP Verifier documentation — the verifier in full: command line, CI, policy modes and limits.
• The ECZ-ID plugins page — how to install this and the other ECZ-ID plugins in your agent host.

ECZ-ID MCP Verifier is published by EcoCitizenz Ltd, trading as EcoCitizenz, company number 17348848, registered in England and Wales.