Metadata-Version: 2.4
Name: ecz-id-mcp
Version: 0.1.1
Summary: Inspects MCP server manifests for ECZ-ID configuration and public evidence posture.
Project-URL: Documentation, https://developers.ecocitizenz.com
Project-URL: Machine Interface, https://machine.ecocitizenz.org/.well-known/ecz-machine.json
Project-URL: Resolver, https://resolver.ecocitizenz.org
Project-URL: Operator Setup, https://trustops.ecocitizenz.com/start
Project-URL: Developer Guidance, https://developers.ecocitizenz.com
Author-email: Ecocitizenz <ecocitizenz@gmail.com>
License-Expression: Apache-2.0
License-File: LICENSE
License-File: NOTICE
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Python: >=3.10
Requires-Dist: ecz-id
Provides-Extra: toml
Requires-Dist: tomli>=2; (python_version < '3.11') and extra == 'toml'
Description-Content-Type: text/markdown

# ECZ-ID MCP Server Inspection

`ecz-id-mcp` statically inspects MCP server manifests for **ECZ-ID
configuration posture**, transport posture and identity. Part of the ECZ-ID
PyPI family. It **inspects, explains and routes only**.

It **never starts an MCP server**, never executes a configured command,
never connects to a transport, and never creates another MCP identity or
Official MCP Registry entry. It never issues or activates an ECZ-ID, never
prices or carts, and never certifies. It is **not** a
safety/compliance/insurance/premium decision and **not** a security,
capability or behavioural proof. Missing public proof is neutral. **Local
policy decides. Re-check before reliance.**

## One-command first run

```console
$ ecz-id-mcp inspect ./my-mcp-server
ECZ-ID inspection: ./my-mcp-server [ecz-id-mcp]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
...
local policy decides; re-check before reliance
```

## Supported inputs

* A directory or manifest file. Recognised names: `server.json`,
  `mcp_server_manifest.json`, `mcp.json`, `.mcp.json` (static JSON only).
* Observes server name, declared tools (and read-only markers), declared
  stdio / remote transport posture, invocation command and args (**never
  executed**), remote endpoints (**never connected**), and registry /
  package / repository identity.
* Observes pinned-vs-floating invocation (version pin present or not) and
  compares declared package identity with a co-located `pyproject.toml`.

On Python < 3.11, the `pyproject.toml` comparison needs a TOML backport:
`pip install ecz-id-mcp[toml]`. Without it, that one observation degrades to
a neutral note instead of failing.

## Privacy boundaries

Static JSON inspection; never starts, connects to or executes anything.
Bounded, symlink-refusing enumeration. No telemetry, no uploads. Secrets
redacted on every export. Offline mode (`--offline` / `ECZ_ID_OFFLINE=1`)
skips all network.

## Explicit non-claims

Not a safety / certification / compliance / insurance / premium decision.
Not a security, capability or behavioural proof. Does not start, connect to
or execute any MCP server. Does not create another MCP identity or registry
entry. Does not price or cart.

## Python API

```python
from ecz_id_mcp import inspect

result = inspect("./my-mcp-server")
print(result.configuration_evidence.posture.value)   # PRESENT / PARTIAL / ABSENT / INVALID
```

## CI / test example

```console
$ ecz-id-mcp inspect . --json > ecz-id-mcp.json   # exit 0 for any completed inspection
$ ecz-id-mcp doctor --json
```

## Routes

* **Resolver**: https://resolver.ecocitizenz.org
* **TrustOps**: https://trustops.ecocitizenz.com/start
* **Developer Gateway**: https://developers.ecocitizenz.com
* **Central Machine Interface**: https://machine.ecocitizenz.org/.well-known/ecz-machine.json

## Re-check

```console
$ ecz-id-mcp recheck ./my-mcp-server --json
```

## Machine-readable integration

Machine Interface · Manifest · Resolver · Operator setup · Developer guidance

Each installation includes structured machine-readable metadata for automation,
CI and supported integrations. Every JSON report embeds a compact
`machine_interface` object with the canonical roots and safe, read-only actions.

The package runs locally to inspect, explain and route. It does not issue an
ECZ-ID, write canonical truth, create public proof, price a cart, or replace
Resolver proof.

```console
$ ecz-id-mcp manifest --json
$ ecz-id-mcp compare ./old ./new --json    # neutral drift
$ ecz-id-mcp inspect . --sarif             # SARIF for code scanning
$ uvx ecz-id-mcp inspect .                 # or: pipx run ecz-id-mcp inspect .
```

- Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
- Resolver (read-only public proof): https://resolver.ecocitizenz.org
- Operator setup (TrustOps): https://trustops.ecocitizenz.com/start
- Developer Gateway: https://developers.ecocitizenz.com

## Continue with ECZ-ID

- Operator setup: https://trustops.ecocitizenz.com/start
- Developer guidance: https://developers.ecocitizenz.com
- Public Resolver proof: https://resolver.ecocitizenz.org
- Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
- EcoCitizenz: https://www.ecocitizenz.com
- Specifications and governance: https://www.ecocitizenz.org
- ECZ-ID on Visual Studio Marketplace: https://marketplace.visualstudio.com/publishers/ecocitizenz
- ECZ-ID on Open VSX: https://open-vsx.org/namespace/ecocitizenz
- Explore the ECZ-ID Python tool family: https://pypi.org/search/?q=ecz-id

## Licence and trademarks

Apache-2.0 (see `LICENSE`, `NOTICE`). The code licence grants no trademark
rights; “ECZ-ID” and “EcoCitizenz” are trademarks of their owner(s) — see
`TRADEMARKS.md`. Changelog: `CHANGELOG.md`. Security: `SECURITY.md`.

CLI: `ecz-id-mcp` &nbsp;|&nbsp; Import: `ecz_id_mcp` &nbsp;|&nbsp; Plugin group: `ecz_id.plugins`
