74
grade C
10 days ago
glama
Agent Receipts
Cryptographic accountability for AI agents. Ed25519-signed receipts for every MCP tool call. Constraints, chains, AI judgment, invoicing, and local dashboard included.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: RECEIPT_SIGNING_PRIVATE_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
AGENT_RECEIPTS_AGENT_ID— Default agent ID local-agentconfig
AGENT_RECEIPTS_DATA_DIR— Data directory path ~/.agent-receiptsconfig
AGENT_RECEIPTS_ENVIRONMENT— Environment label (development, production, staging, test) productionconfig
AGENT_RECEIPTS_ORG_ID— Organization ID local-orgconfig
DEMO_MODEconfig
NEXT_PUBLIC_APP_URLconfig
NEXT_PUBLIC_DEMO_MODEconfig
PORT🔐 secret
RECEIPT_SIGNING_PRIVATE_KEY— Ed25519 private key (hex) Auto-generated// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/webaesbyamin-agent-receipts-qqucnb)commit: 1b1da611768dfd5aa17c049ad6c5215bd54ac1dc
code hash: f9496bd67f4376674580e980972fbad96a3920d5f92ad45bbaf81698e1512664
verified: 4/11/2026, 2:19:51 PM