Quickstart · ECZ-ID Plugin Passport™

Plugin quickstart

Give a plugin you publish one free ECZ-ID Plugin Passport across every marketplace it is listed on, declare it in the plugin manifest, and let installers check it.

Live · public

The free Plugin Passport journey, the public record and the relying-party check are live. Commands were measured read-only on 2026-10-10. Availability is read live in TrustOps.

This quickstart gets the machine its identity. To carry it through the whole Accountability Chain (authority, Intent, decision, Receipt and re-verify), follow the Plugin guided flow.

01Know what one Passport covers

You publish a plugin, extension, GPT action, store app or GitHub Action. One Passport is one logical plugin / extension / integration artefact published by the Parent, independent of the marketplace it is listed on.

Law: one plugin -> one Passport across every marketplace; versions, releases, installs and executions are bindings/evidence/events.

Never a new Passport: version, release, install, execution, store_listing, skill_component, action_run, workflow_reference.

02Get the free Passport

Open the Plugin door in TrustOps and sign in once. If your organisation has no Business Passport, a free DECLARED one is created. No payment is taken. Have one of these identifiers ready:

plugin_name: publisher-namespace/plugin-name as declared in the manifest
plugin_manifest_url: the URL of the plugin manifest
repository: host/owner/repo of the source repository
package: ecosystem:name of the published package (no version)

Start the Plugin Passport in TrustOps (opens in a new tab)

03Declare it where your ecosystem looks

The families contract names the place: ecz_id + resolver_backlink in the plugin manifest (.claude-plugin, .cursor-plugin, .codex-plugin, package.json, action.yml). A declaration is a pointer, not proof.

jsonIllustrative declaration in a plugin manifest. Use the values your TrustOps console shows.

{
  "name": "example-plugin",
  "version": "1.4.0",
  "ecz_id": "ECZ-GB-EXAMPL::PLUGIN_PASSPORT-AB12CD",
  "resolver_backlink": "https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::PLUGIN_PASSPORT-AB12CD"
}

04Prove a binding

A binding attaches the Passport to a native identity you control. The binding classes this family defines are: marketplace_listing, openai_gpt_actions, shopify_app_surface, microsoft_app_registration, github_action_reference.

Proof is established through TrustOps and ECZ-ID Core, never on this site. Until a binding is proven, the public record reads binding.state: NO_PUBLIC_PROOF, which is the normal state of a new record. A class being defined is not a claim of a live integration with that provider.

05Let relying parties check it

Anyone can check before relying, with no account. This exact command was run on 2026-10-10:

bashMeasured 2026-10-10: NO_PUBLIC_RESOLVER_PROOF_FOUND, exit 0

npx -y @ecocitizenz/ecz-id-mcp-verifier check --target https://github.com/Ecocitizenz/ecz-id-mcp-verifier --target-type github_repo

The verifier’s own repository holds no Plugin Passport yet. One plugin is one Passport across every marketplace; versions and installs are history, not new identities.

06Next: Intent, decision, Receipt

Live · signed inModel what this machine is authorised to do as an ECZ-ID Intent. Carry Intent
Release-gatedAsk IntentControl for a decision before consequential actions. Request a decision
No public retrievalPlan for Receipts in your records. Verify a Receipt

Go deeper

A free Passport gives a machine a persistent identity. It never means verified, assured, safe, secure, compliant, approved, certified or endorsed. Family facts come from the TrustOps families contract; current state is only ever the live Resolver record.