protogrid

Search / io.github.ndl-systems/kevros

Kevros — Agentic Identity Trust

R0· no sign-in

Agentic identity trust: precision decisioning, cryptographic release tokens, hash-chained proof

v0.3.6 · active · repository · descriptor JSON · versions

An agent can connect right now, no human step.Remote endpoint, no authentication, reachable on the last probe.
Quality91strong
Trust83of 100
Uptime, 30 days100%
Latency p50224 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "kevros": {
      "type": "http",
      "url": "https://governance.taskhawktech.com/mcp/"
    }
  }
}
claude mcp add --transport http kevros https://governance.taskhawktech.com/mcp/
[mcp_servers.kevros]
url = "https://governance.taskhawktech.com/mcp/"
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kevros": {
      "type": "remote",
      "url": "https://governance.taskhawktech.com/mcp/",
      "enabled": true
    }
  }
}
{
  "mcpServers": {
    "kevros": {
      "type": "http",
      "url": "https://governance.taskhawktech.com/mcp/"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=kevros&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZ292ZXJuYW5jZS50YXNraGF3a3RlY2guY29tL21jcC8ifQ%3D%3D"
}
{
  "servers": {
    "kevros": {
      "type": "http",
      "url": "https://governance.taskhawktech.com/mcp/"
    }
  }
}
{
  "mcpServers": {
    "kevros": {
      "httpUrl": "https://governance.taskhawktech.com/mcp/"
    }
  }
}
extensions:
  "kevros":
    enabled: true
    name: "kevros"
    type: streamable_http
    uri: "https://governance.taskhawktech.com/mcp/"
    timeout: 300

Quality 91 / 100strong

protocol75 · weight 25
  • warn
    protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
  • n/a
    protocol.statelessonly applies to 2026-07-28 servers
  • pass
    protocol.transportstreamable HTTP
  • n/a
    protocol.list_ttlonly applies to 2026-07-28 servers
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygiene100 · weight 30
  • pass
    tools.descriptionsevery tool has a description
  • pass
    tools.description_lengthdescriptions are concise
  • pass
    tools.schemasevery tool has an object input schema
  • pass
    tools.annotations9 of 9 tools declare readOnlyHint or destructiveHint
  • pass
    tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
  • pass
    tools.token_costabout 2,046 tokens to load every tool
  • pass
    tools.api_dumptools are not a one-to-one API dump
stability100 · weight 15
  • pass
    stability.changesno tool changes in 30 days
  • pass
    stability.rug_pullno tool changed its meaning under the same name
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

9 tools, about 2,046 tokens to load them all · tool set 5d1af6766aae · checked 2026-10-19 10:20 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 83 / 100

provenance80
liveness100
freshness45
hygiene100

+repository +namespace-matches-repo +reachable +uptime-100% -stale-236d

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://governance.taskhawktech.com/mcp/ streamable-httpnoneyes100%224 ms2025-11-252026-10-19

Tools (9)

attestCreate a hash-chained provenance record for an action you've taken. Each attestation extends the append-only evidence chain. The hash can be independently verified by any third party. Cost: $0.02 per call.
bindDeclare an intent and cryptographically bind it to a command. Proves that the command was issued in service of the declared intent. Use verify-outcome after execution to close the loop. Cost: $0.02 per call.
bundleread-onlyGenerate a certifier-grade compliance evidence bundle. Contains hash-chained provenance, intent bindings, PQC attestations, and verification instructions. Independently verifiable without Kevros access. Cost: $0.05 per call.
check-peerread-onlyCheck another agent's trust score and governance history. Returns trust score (0-100), chain length, attestation count, and tier. Free, no API key needed.
healthread-onlyCheck the governance gateway health status. Free.
statusread-onlyCheck your current usage and quota: calls used, calls remaining, tier, rate limits, and billing status. Free.
verifyVerify an action against policy bounds before executing it. Returns ALLOW (proceed), CONSTRAIN (proceed with modified values; emitted on the wire as the legacy value CLAMP - both refer to the same verdict, CONSTRAIN is the public name), or DENY (stop). Every verification is recorded in a hash-chained provenance ledger. Cost: $0.01 per call.
verify-outcomeVerify that an executed action achieved its declared intent. Closes the loop: intent -> command -> action -> outcome -> verification. Free (included with bind).
verify-tokenread-onlyVerify a release token from another agent. Confirms the token is authentic, was issued by the Kevros gateway, and remains currently authorized after any halt or mode transition. Free, no API key needed.

Schemas: list_tools.

Similar MCP servers

Official server.json
{
  "name": "io.github.ndl-systems/kevros",
  "title": "Kevros — Agentic Identity Trust",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://governance.taskhawktech.com/mcp/",
      "type": "streamable-http"
    }
  ],
  "version": "0.3.6",
  "repository": {
    "url": "https://github.com/ndl-systems/kevros-sdk",
    "source": "github"
  },
  "description": "Agentic identity trust: precision decisioning, cryptographic release tokens, hash-chained proof"
}