MCP servers run code with your credentials. Here's the 60-second gate I put in front of them.

#ai #javascript #mcp #security

You installed an MCP server with npx -y some-mcp-server. That command just ran third-party code with the same filesystem and network access your agent has. There was no review, no gate, no audit trail — and every tools/call your agent makes afterwards is that server's code touching your disk, your env, your credentials.

This is not a hypothetical. When we deep-scanned the most-installed subset of our MCP catalog (9,248 servers at the last full pass):

0.3% were outright malicious — obfuscated payloads, credential harvesting, or destructive commands behind innocuous tool names
11% had undocumented network egress — they call endpoints that appear nowhere in their README or repo

11%. One in nine. The worst ones don't crash your agent — they work perfectly, quietly, and phone home.

The 60-second gate

The fix is boring and old: put a policy gate in front of every tool call. We built one, it's free, zero dependencies, Node >= 16:

npm install @marketnow/trust-gateway

Every tools/call from your agent passes through a configurable check before execution:

const { TrustGateway, withTrustGateway } = require('@marketnow/trust-gateway');

const gateway = new TrustGateway({
  min_trust_score: 5,        // 12-stage pipeline must clear this
  require_pinned_ca: true,   // credential must chain to your pinned CA
});

// Explicit form — decision object: { allowed, reason, trust_score }
const decision = await gateway.check(agentCredential, 'read_file', { path: '.env' });
if (!decision.allowed) console.error('DENY:', decision.reason);

// Or wrap an existing handler in one line — denials throw TRUST_GATEWAY_DENY:<reason>
const secured = withTrustGateway(myToolHandler, gateway);

The 12-stage pipeline verifies the caller's credential (Agent Trust Card / EAT, Ed25519 + canonical JSON), scores trust across stages, and applies your policy — allow, deny, or gate on score. A server that redefines its tools/list surface between calls (the OWASP tool-poisoning scenario) fails the fingerprint stage instead of silently gaining new powers.

Why receipts matter more than the gate

A gate that only blocks is a firewall with no logs — when something goes wrong, you have nothing to show for it. Every allow/deny decision here emits a signed, hash-chained receipt:

const { ReceiptStore } = require('@marketnow/trust-gateway');
const store = new ReceiptStore('/var/log/uta/receipts.jsonl');
// Every decision: Ed25519-signed, each receipt hashes the previous one.
// Tamper with line 40 and lines 41..N stop verifying.

Replay them later to prove what was allowed and why — to yourself, to an auditor, to a customer. "The agent did X because the gate scored Y at time Z, and here's the signed chain" is a very different conversation than "our logs say it was probably fine."

What this is NOT (the honest part)

Not a sandbox. If you run genuinely untrusted servers, put them in a container/VM. The gateway is the policy + audit layer, not isolation.
Not a trust score oracle. A high score doesn't mean "safe"; it means "verified against the stages you configured." Fail-closed by default.
Not a replacement for reading the code. install-risk classification (red/yellow/green in the catalog) tells you what runs code on every start — you still decide.

Verify us, don't trust us

We apply the same standard to ourselves. The full conformance suite — 14 test vectors, stage scoring, curl + node only — is public, and our own claims are anchored to Sigstore Rekor's transparency log so a stranger can re-derive them without an account:

https://www.marketnow.site/uta/conformance/

One ask

agent-trust-card gets ~300 downloads a week and the repo has ~155 unique cloners a month — npm doesn't tell us who you are or what you're building. If you're using UTA in production, we'd genuinely like to know what's working and what's missing. There's a thread for exactly that:

Who's using UTA / agent-trust-card? Introduce yourself and your use case

Every reply there helps prioritize the next format adapters and conformance vectors — and gives other adopters a public list of real use cases instead of a download counter.

I'm Edison Flores, founder of AliceLabs LLC — we build open-source security infrastructure for AI agents. This post is about my own project; the gateway, the receipts library and the conformance suite are free.

Update — 2026-09-20

MarketNow is now dual-licensed MIT OR Apache-2.0 — free for any use, including commercial (see LICENSE-MIT / LICENSE-APACHE).

Also submitted to the Docker MCP Catalog as a remote security server: docker/mcp-registry#5175.

The trust layer stays free forever, no API key: — 9 tools covering credential verification (8 formats), domain scam-checking, and tool-definition fingerprinting (OWASP anti-tool-poisoning).

DEV Community