Skip to content

v1.28.0 - MCP Receipts

Choose a tag to compare

View all tags
@KryptosAI KryptosAI released this 06 Jul 21:54
v1.28.0
1ee9644
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MCP Receipts: portable trust evidence for agent dependencies

This release makes MCP Receipts a canonical public trust artifact for MCP Observatory.

A scan finds facts. A report explains facts. A receipt makes those facts portable, reproducible, citable, and actionable for CI gates, Safety Index entries, maintainers, agents, and buyers.

Highlights

  • New receipt CLI command for standalone JSON or Markdown MCP Receipts.
  • New audit --receipt <file> output path to emit receipts alongside JSON, Markdown, or SARIF reports.
  • Receipt verdicts with explicit action states: allow, gate, rerun, quarantine, and escalate.
  • Buyer-ready and maintainer-ready CTAs inside receipt artifacts.
  • Government and enterprise pilot artifacts: procurement one-pager, security due diligence, public guidance crosswalk, and commercial boundary docs.
  • Private telemetry command center improvements for growth direction, stale-version adoption, and paid-intent tracking.
  • Stronger test coverage around receipt generation, artifact hashing, action receipts, and release behavior.

Try it

npx @kryptosai/mcp-observatory@latest audit npx -y <server-package> --receipt receipt.md --format markdown --output report.md
npx @kryptosai/mcp-observatory@latest receipt npx -y <server-package> --output receipt.json

Next step after a clean receipt

npx @kryptosai/mcp-observatory@latest setup-ci --all --sarif --schedule weekly

Notes

This is safe-mode evidence generation only. MCP Observatory does not execute destructive payloads, exfiltrate secrets, or contact attacker-controlled callbacks.

Assets 2
Loading