ECZ-ID MCP Server Inspection

ecz-id-mcp statically inspects MCP server manifests for ECZ-ID configuration posture, transport posture and identity. Part of the ECZ-ID PyPI family. It inspects, explains and routes only.

It never starts an MCP server, never executes a configured command, never connects to a transport, and never creates another MCP identity or Official MCP Registry entry. It never issues or activates an ECZ-ID, never prices or carts, and never certifies. It is not a safety/compliance/insurance/premium decision and not a security, capability or behavioural proof. Missing public proof is neutral. Local policy decides. Re-check before reliance.

One-command first run

$ ecz-id-mcp inspect ./my-mcp-server
ECZ-ID inspection: ./my-mcp-server [ecz-id-mcp]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
...
local policy decides; re-check before reliance

Supported inputs

• A directory or manifest file (static JSON only). Recognised surfaces, each labelled with the configuration dialect it came from: .vscode/mcp.json, .mcp.json, .cursor/mcp.json, .claude/mcp.json, Copilot / user-level MCP config, claude_desktop_config.json, ecz-mcp.json (and .well-known/), mcp_server_manifest.json, mcp.json / .mcp/*.json, and the Official MCP Registry server.json publication manifest.
• Observes server name, declared tools (and read-only markers), declared stdio / remote transport posture, invocation command and args (never executed), remote endpoints (never connected, credentials and query string omitted), and registry / package / repository identity.
• Observes pinned-vs-floating invocation (version pin present or not) and compares declared package identity with a co-located pyproject.toml.

Protocol generation awareness

Converged onto ECZ-BASELINE-2026-08-13. MCP 2026-07-28 is the current generation; earlier generations stay explicitly supported.

• Records the declared protocol generation and its support status: CURRENT, SUPPORTED, DEPRECATED, UNRECOGNISED or INVALID.
• Deprecated does not mean broken. A deprecated generation or transport (for example legacy SSE) is reported as ecosystem direction, never as a failure.
• An unrecognised generation is neutral — it may simply be newer than this build. It is never reported as invalid.
• Records declared stateless (modern) vs stateful (legacy) session posture, and declared capability surfaces where present: Tasks, subscriptions, cache semantics, extensions, routing metadata, result types, MRTR, authorization posture, server/discover and JSON Schema 2020-12.
• Registry metadata is recorded as declared; registry presence is never treated as verified or as public proof.

Every protocol observation is a declaration, not independent proof (reason code ECZ-6006), and static inspection performs no behavioural conformance (ECZ-6011). Active conformance is a separate, explicitly opt-in lane; its record contract ships in ecz_id_mcp.conformance, and the execution engine is not implemented in this release.

On Python < 3.11, the pyproject.toml comparison needs a TOML backport: pip install ecz-id-mcp[toml]. Without it, that one observation degrades to a neutral note instead of failing.

Privacy boundaries

Static JSON inspection; never starts, connects to or executes anything. Bounded, symlink-refusing enumeration. No telemetry, no uploads. Secrets redacted on every export. Offline mode (--offline / ECZ_ID_OFFLINE=1) skips all network.

Explicit non-claims

Not a safety / certification / compliance / insurance / premium decision. Not a security, capability or behavioural proof. Does not start, connect to or execute any MCP server. Does not create another MCP identity or registry entry. Does not price or cart.

Python API

from ecz_id_mcp import inspect

result = inspect("./my-mcp-server")
print(result.configuration_evidence.posture.value)   # PRESENT / PARTIAL / ABSENT / INVALID

CI / test example

$ ecz-id-mcp inspect . --json > ecz-id-mcp.json   # exit 0 for any completed inspection
$ ecz-id-mcp doctor --json

Routes

• Resolver: https://resolver.ecocitizenz.org
• TrustOps: https://trustops.ecocitizenz.com/start
• Developer Gateway: https://developers.ecocitizenz.com
• Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json

Re-check

$ ecz-id-mcp recheck ./my-mcp-server --json

Machine-readable integration

Machine Interface · Manifest · Resolver · Operator setup · Developer guidance

Each installation includes structured machine-readable metadata for automation, CI and supported integrations. Every JSON report embeds a compact machine_interface object with the canonical roots and safe, read-only actions.

The package runs locally to inspect, explain and route. It does not issue an ECZ-ID, write canonical truth, create public proof, price a cart, or replace Resolver proof.

$ ecz-id-mcp manifest --json
$ ecz-id-mcp compare ./old ./new --json    # neutral drift
$ ecz-id-mcp inspect . --sarif             # SARIF for code scanning
$ uvx ecz-id-mcp inspect .                 # or: pipx run ecz-id-mcp inspect .

• Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
• Resolver (read-only public proof): https://resolver.ecocitizenz.org
• Operator setup (TrustOps): https://trustops.ecocitizenz.com/start
• Developer Gateway: https://developers.ecocitizenz.com

Need help choosing the right ECZ-ID route?

Use ECZ-ID GPT guidance: https://trustops.ecocitizenz.com/start#gpt-guidance

Route guidance only. TrustOps handles setup; Backend/Core writes truth; Resolver proves public state. Local policy decides reliance. Re-check before reliance.

Continue with ECZ-ID

• Operator setup: https://trustops.ecocitizenz.com/start
• Developer guidance: https://developers.ecocitizenz.com
• Public Resolver proof: https://resolver.ecocitizenz.org
• Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
• EcoCitizenz: https://www.ecocitizenz.com
• Specifications and governance: https://www.ecocitizenz.org
• ECZ-ID on Visual Studio Marketplace: https://marketplace.visualstudio.com/publishers/ecocitizenz
• ECZ-ID on Open VSX: https://open-vsx.org/namespace/ecocitizenz
• Explore the ECZ-ID Python tool family: https://pypi.org/search/?q=ecz-id

Licence and trademarks

Apache-2.0 (see LICENSE, NOTICE). The code licence grants no trademark rights; “ECZ-ID” and “EcoCitizenz” are trademarks of their owner(s) — see TRADEMARKS.md. Changelog: CHANGELOG.md. Security: SECURITY.md.

CLI: ecz-id-mcp  |  Import: ecz_id_mcp  |  Plugin group: ecz_id.plugins