Emilia Protocol MCP server

Read from the package source without running it. The installed server may list more.

• ep_add_presentation

  Add an identity presentation (proof) to an active handshake. WRITE: appends the party's identity claims to the handshake for evaluation against its policy; supports full, selective, or zero-knowledge disclosure. Requires auth. Returns the updated presentation count and handshake state. Call after ep_initiate_handshake and before ep_verify_handshake.

• ep_appeal_dispute

  Appeal a dispute resolution. Only dispute participants can appeal. Requires the dispute to be in upheld, reversed, or dismissed state. "Trust must never be more powerful than appeal."

• ep_batch_submitwrite action

  Submit multiple receipts atomically. All receipts share the same submitter (your API key). Useful for bulk reconciliation or recording a session of agent-entity interactions. Returns per-receipt success/failure. Max 50 receipts per batch.

• ep_bind_receipt_to_commit

  Bind a post-action receipt to a commit, completing the commit-execute-receipt cycle. Links the behavioral outcome back to the signed authorization token.

• ep_check_signoff

  Poll a pending authorization after ep_guard_action returns BLOCKED. Pass the receipt_id. Returns PENDING, APPROVED_PENDING_CONSUME, CONSUMED, or DENIED. Approval alone is not permission to execute: the executor must match action_hash and atomically consume the receipt at its own choke point.

• ep_configure_auto_receipt

  Enable or disable automatic receipt generation for this session. When enabled, every EP tool call generates a behavioral receipt automatically. Privacy-preserving: sensitive fields (passwords, tokens, API keys) are redacted before storage. Receipts are marked unilateral \u2014 they cannot be bilateral without counterparty confirmation. Auto-receipt is opt-in and disabled by default.

• ep_create_delegationwrite action

  Create a delegation record. WRITE: persists to the EP ledger that a human or principal authorizes an agent to act on their behalf, with scope, expiry, and optional constraints. Requires auth. Returns a delegation_id that later actions reference (via ep_verify_delegation) to prove authorization. Use when a principal grants an agent standing authority for a bounded set of actions.

• ep_delegation_judgment

  Get a principal's delegation authority \u2014 how well they choose and authorize agents. High judgment principals consistently authorize well-behaved agents. Low judgment principals frequently authorize agents that fail, dispute, or abandon tasks. This signal is deliberately weak (0.15 weight per outcome): a single bad delegation should not define a principal, but a pattern of them should be legib

• ep_dispute_file

  File a dispute against a receipt. Any affected party can challenge. Reasons: fraudulent_receipt, inaccurate_signals, identity_dispute, context_mismatch, duplicate_transaction, coerced_receipt, other. The receipt submitter has 7 days to respond.

• ep_dispute_status

  Look up the current state of a dispute by id. Read-only, public (no auth) \u2014 transparency is a protocol value. Returns the dispute status (open, under_review, upheld, rejected), the entity it concerns, and any resolution.

• ep_domain_score

  Get an entity's trust score broken down by behavioral domain. Trust is not a scalar \u2014 an agent excellent at financial transactions may be unreliable at creative tasks. Domains: financial, code_execution, communication, delegation, infrastructure, content_creation, data_access. Returns per-domain confidence, evidence count, and behavioral rates.

• ep_generate_zk_proof

  Generate a privacy-preserving commitment proof. Proves a trust claim (e.g., score > 0.85 in the financial domain, or > 50 verified receipts) WITHOUT revealing receipt contents, counterparty identities, or transaction details. Uses HMAC-SHA256 commitments + Merkle trees. Returns a proof_id you can share publicly \u2014 verifiers call ep_verify_zk_proof with only the proof_id and learn nothing about

• ep_get_commit_status

  Get the current state of a pre-action commit by id. Read-only. Returns one of active, revoked, expired, or fulfilled, plus the bound action hash and expiry \u2014 poll this to learn whether a commit may still be consumed.

• ep_get_handshake

  Get the full state of a handshake including parties, presentations, binding, and result. Use this to check handshake progress or review completed exchanges.

• ep_guard_action

  Request authorization before an irreversible action: payments, wire transfers, fund releases, deletions, record or account changes, or sending messages with real-world effect. Submits the exact action for policy evaluation and human authorization. This MCP tool does not itself sit at the executor choke point: even after approval, the executor MUST match the returned action_hash and atomically cons

• ep_initiate_handshake

  Initiate an EP Handshake \u2014 a structured identity exchange between parties. The handshake coordinates mutual presentation of identity proofs before a trust decision. Requires at least 2 parties and a governing trust policy.

• ep_install_preflight

  BEFORE installing or enabling third-party software an agent depends on \u2014 an npm package, GitHub app, browser extension, or MCP server \u2014 check it here. Evaluates the software against a fit-for-purpose trust policy and returns allow / review / deny with reasons covering publisher, requested permissions, provenance, and trust history.

• ep_issue_commit

  Issue a signed EP Commit before a high-stakes action. Returns a commit_id, decision (allow/deny/review), expiry, scope, and appeal path. The commit binds the agent to a specific action type, entity, and policy before execution.

• ep_leaderboard

  List the top entities ranked by trust confidence. Read-only. Returns up to the requested limit (default 10, max 50) with scores, optionally filtered by entity_type. For discovery and benchmarking \u2014 for a go/no-go decision on a specific action, use ep_guard_action instead.

• ep_lineage

  View entity lineage \u2014 predecessors, successors, continuity decisions, and whitewashing flags. Use to check if an entity has suspicious continuity gaps.

• ep_list_policies

  List all available trust policies with their requirements and families. Use to discover which policy to evaluate against.

• ep_principal_lookup

  Look up a principal \u2014 the enduring actor behind entities. Returns bindings, controlled entities, and continuity history.

• ep_register_entitywrite action

  Create a new entity in the EP registry. SIDE EFFECT: persists the entity and returns its API key once \u2014 store it, it cannot be retrieved later. Public, no auth required. Use to onboard an agent or service before it submits receipts or is evaluated.

• ep_report_trust_issue

  Report a trust issue as a human. No authentication required. For when someone is wrongly downgraded, harmed by a trusted entity, or sees fraud. EP must never make trust more powerful than appeal.

• ep_revoke_commit

  Revoke an active pre-action commit before it is fulfilled or expires. SIDE EFFECT: terminally cancels the commit \u2014 it can never be consumed after this, and the change is irreversible. Requires auth. Returns the revoked status; use when a pending action should be called off.

• ep_revoke_handshake

  Revoke an active handshake. Only parties to the handshake may revoke it. Revocation is terminal \u2014 the handshake cannot be reopened.

• ep_search_entities

  Search the EP registry for entities by name, capability, or category. Read-only, no side effects. Returns a list of matching entities with their ids, types, and current trust scores \u2014 use it to discover an entity before evaluating or referencing it.

• ep_submit_receiptwrite action

  Submit a transaction receipt to the EP ledger. Requires an API key. Receipts are append-only, cryptographically hashed, and chain-linked. transaction_ref is REQUIRED. agent_behavior is the strongest signal.

• ep_trust_evaluate

  Evaluate an entity against a trust policy. Returns a Trust Decision (allow/review/deny) with specific failure reasons. Built-in policies: "strict" (high-value), "standard" (normal), "permissive" (low-risk), "discovery" (allow unevaluated). Accepts optional context for context-aware evaluation. Use this to make routing and payment decisions.

• ep_trust_gate

  Trust gate: check if an entity meets the required trust threshold BEFORE executing a high-stakes action. This is the canonical pre-action check. Always call this before: payments, sending messages on behalf of users, installing software, or any irreversible action. Returns allow/review/deny with reason.

• ep_trust_profile

  Get an entity's full trust profile. This is the CANONICAL way to check trust in EP. Returns behavioral rates (completion, retry, abandon, dispute), signal breakdowns, provenance composition, consistency, anomaly alerts, current confidence, historical establishment, and dispute summary. Use this before transacting with any counterparty or installing any software.

• ep_verify_commit

  Verify a pre-action commit \u2014 read-only, no side effects. Checks its signature, status, and validity and returns valid/invalid plus the current status, decision, and expiry. Use before relying on or consuming a commit to confirm it is genuine and still active.

• ep_verify_delegation

  Verify that an agent currently holds a valid delegation from a principal for a specific action. Use this before accepting a task from an agent claiming to act on behalf of a human. Returns: valid/expired/not_found with scope details.

• ep_verify_handshake

  Evaluate all presentations in a handshake against its governing policy \u2014 read-only, no mutation. Returns accepted (all requirements met), rejected (policy violations), or partial (awaiting presentations), each with reason_codes explaining the outcome. Call after the parties have added their presentations to decide whether the handshake clears.

• ep_verify_receipt

  Ask the configured EMILIA service to verify a stored trust receipt and report its hash and anchor status. Read-only, but not an offline verifier: the result is the service response for the supplied receipt_id.

• ep_verify_zk_proof

  Verify a privacy-preserving commitment proof by proof_id. Returns whether the claim is currently valid \u2014 without revealing anything about the entity's transaction history, counterparties, or receipt contents. The proof holder shares only the proof_id. You verify without learning who they transacted with. Use this to accept trust claims from entities in privacy-sensitive industries (healthcare

• Code scan3 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 1 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

Emilia Protocol: common questions

Is Emilia Protocol MCP server safe?

Mostly: it is graded B (74/100). Read the Emilia Protocol safety report

How do I install Emilia Protocol?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Emilia Protocol need an API key?

Yes. The registry entry asks for EP_API_KEY.

Is Emilia Protocol maintained?

The last commit was in the last day (2026-09-21). The latest release is v2.1.1.

What can I use instead of Emilia Protocol?

Servers from other publishers that do the same job: MCP server, three.ws Provenance MCP server and Protect MCP server. Compare all Emilia Protocol alternatives.