Quickstart · ECZ-ID MCP Passport™

MCP quickstart

Give an MCP server you operate a free ECZ-ID MCP Passport, declare it at your operator origin and in the MCP Registry, and let hosts check it before they connect.

Live · public

The free MCP Passport journey, the public record and the relying-party check are live. Commands were measured read-only on 2026-10-10. Availability is read live in TrustOps.

This quickstart gets the machine its identity. To carry it through the whole Accountability Chain (authority, Intent, decision, Receipt and re-verify), follow the MCP guided flow.

01Know what one Passport covers

You operate an MCP server, local or remote. One Passport is one logical MCP server operated by the Parent.

Law: one server -> one Passport; tools inside a server are never Passports.

Never a new Passport: tool, endpoint, deployment, replica.

02Get the free Passport

Open the MCP door in TrustOps and sign in once. If your organisation has no Business Passport, a free DECLARED one is created. No payment is taken. Have one of these identifiers ready:

mcp_endpoint: the MCP server endpoint URL
registry_server_name: the MCP Registry server name, e.g. com.ecocitizenz/trust-mcp
repository: host/owner/repo of the source repository
package: ecosystem:name of the published package (no version)

Start the MCP Passport in TrustOps (opens in a new tab)

03Declare it where your ecosystem looks

The families contract names the place: .well-known/ecz-mcp.json; MCP Registry pointer; A2A publication (C12). A declaration is a pointer, not proof.

jsonA live declaration, as served today: the first-party Trust MCP server (abridged). Fetch it with curl.

$ curl -s https://developers.ecocitizenz.com/.well-known/ecz-mcp.json
{
  "manifest_type": "ecz-mcp",
  "operator_ecz_id": "ECZ-GB-RBS1NW",
  "resolver_url": "https://resolver.ecocitizenz.org/p/ECZ-GB-RBS1NW",
  "machine_proof_url": "https://api.ecocitizenz.com/api/p/ECZ-GB-RBS1NW.json",
  "mcp_server": {
    "name": "com.ecocitizenz/trust-mcp",
    "transport": "streamable-http",
    "endpoint": "https://trust-mcp.ecocitizenz.com/mcp"
  }
}

04Prove a binding

A binding attaches the Passport to a native identity you control. The binding classes this family defines are: mcp_registry_entry, mcpb_desktop_bundle, mcp_remote_http, mcp_local_stdio.

Proof is established through TrustOps and ECZ-ID Core, never on this site. Until a binding is proven, the public record reads binding.state: NO_PUBLIC_PROOF, which is the normal state of a new record. A class being defined is not a claim of a live integration with that provider.

05Let relying parties check it

Anyone can check before relying, with no account. This exact command was run on 2026-10-10:

bashMeasured 2026-10-10: NO_PUBLIC_RESOLVER_PROOF_FOUND, exit 0

npx -y @ecocitizenz/ecz-id-mcp-verifier check --target https://trust-mcp.ecocitizenz.com/mcp --target-type mcp_server

The first-party server is bound to its operator by declaration and listed in the Official MCP Registry, but it does not hold an MCP Passport of its own. The verifier says exactly that.

06Next: Intent, decision, Receipt

Live · signed inModel what this machine is authorised to do as an ECZ-ID Intent. Carry Intent
Release-gatedAsk IntentControl for a decision before consequential actions. Request a decision
No public retrievalPlan for Receipts in your records. Verify a Receipt

Go deeper

A free Passport gives a machine a persistent identity. It never means verified, assured, safe, secure, compliant, approved, certified or endorsed. Family facts come from the TrustOps families contract; current state is only ever the live Resolver record.