# Emilia Protocol (npm · @emilia-protocol/mcp-server)

Trust & human sign-off for AI agents: approval required before irreversible agent actions

- Trust score: 71/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@emilia-protocol/mcp-server`: 71/100 (this document), [markdown](https://verifymcp.io/servers/emiliaprotocol-mcp-server/emilia-protocol-mcp-server.md), [page](https://verifymcp.io/servers/emiliaprotocol-mcp-server/emilia-protocol-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@emilia-protocol/mcp-server`
- Version: `1.0.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 11 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1989 tokens (~94/item across 21 items; 17 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add emiliaprotocol-mcp-server -- npx -y @emilia-protocol/mcp-server
```

### Codex

```bash
codex mcp add emiliaprotocol-mcp-server -- npx -y @emilia-protocol/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "emiliaprotocol-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@emilia-protocol/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add emiliaprotocol-mcp-server --command npx --arg -y --arg @emilia-protocol/mcp-server
```

### Hermes

```yaml
mcp_servers:
  emiliaprotocol-mcp-server:
    command: "npx"
    args: ["-y", "@emilia-protocol/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "emiliaprotocol-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@emilia-protocol/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 71, +51)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Stability: unverified → 0.27
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional] Licence: Apache-2.0

### 2026-08-02 (score 20, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-08-01 (score 20, −15)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 35, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (17)

### `ep_guard_action` (~260 tokens)

REQUIRED before any irreversible action: payments, wire transfers, fund releases, deletions, record or account changes, or sending messages with real-world effect. Submits the exact action for policy evaluation and human authorization. Returns APPROVED with a receipt the action may proceed under, or BLOCKED with a receipt_id + signoff_id while a named human reviews. Do NOT execute the action without an APPROVED result — if BLOCKED, poll ep_check_signoff with the receipt_id.

Input parameters:

- `action_type` (string, required): Kind of action, e.g. "large_payment_release", "vendor_bank_account_change", "ai_agent_payment_action".
- `amount` (number): Amount, for payments/releases.
- `currency` (string): ISO currency code, e.g. "USD".
- `destination` (string): Where funds or data are going (account, address).
- `organization_id` (string, required): The organization this action belongs to.
- `risk_flags` (array): Optional risk signals, e.g. ["new_destination","after_hours"].
- `summary` (string): One-line, human-readable description the approver will see.
- `target_resource_id` (string, required): What is being acted on — an invoice id, account id, or record id.

### `ep_check_signoff` (~73 tokens)

Poll a pending authorization after ep_guard_action returns BLOCKED. Pass the receipt_id. Returns PENDING, APPROVED (the action may now proceed), or DENIED (with reason). Safe to call repeatedly until a decision is reached.

Input parameters:

- `receipt_id` (string, required): The receipt_id returned by ep_guard_action.

### `ep_verify_receipt` (~83 tokens)

Verify a trust receipt — its signature and Merkle inclusion against the anchored root. Read-only. Returns valid/invalid plus the verified claim (action, approver, outcome) and anchor status; use it to independently confirm a receipt was issued by EP and has not been tampered with.

Input parameters:

- `receipt_id` (string, required): Receipt ID (ep_rcpt_...)

### `ep_install_preflight` (~161 tokens)

BEFORE installing or enabling third-party software an agent depends on — an npm package, GitHub app, browser extension, or MCP server — check it here. Evaluates the software against a fit-for-purpose trust policy and returns allow / review / deny with reasons covering publisher, requested permissions, provenance, and trust history.

Input parameters:

- `context` (object): Install context: { host, install_scope, permission_class, data_sensitivity, execution_mode }
- `entity_id` (string, required): Software entity ID (e.g. github_app:acme/code-helper)
- `policy` (string): Software policy: github_private_repo_safe_v1, npm_buildtime_safe_v1, browser_extension_safe_v1, mcp_server_safe_v1, or standard EP policies

### `ep_list_policies` (~30 tokens)

List all available trust policies with their requirements and families. Use to discover which policy to evaluate against.

### `ep_create_delegation` (~201 tokens)

Create a delegation record. WRITE: persists to the EP ledger that a human or principal authorizes an agent to act on their behalf, with scope, expiry, and optional constraints. Requires auth. Returns a delegation_id that later actions reference (via ep_verify_delegation) to prove authorization. Use when a principal grants an agent standing authority for a bounded set of actions.

Input parameters:

- `agent_entity_id` (string, required): The agent entity being authorized
- `constraints` (object): Additional constraints (geo, merchant_category, etc.)
- `expires_at` (string): ISO8601 expiry timestamp. If omitted, defaults to 24 hours.
- `max_value_usd` (number): Maximum transaction value in USD this delegation authorizes (optional)
- `principal_id` (string, required): The principal (human/org) granting the delegation
- `scope` (array, required): List of permitted action types (e.g. ["purchase", "book", "send_email"])

### `ep_verify_delegation` (~92 tokens)

Verify that an agent currently holds a valid delegation from a principal for a specific action. Use this before accepting a task from an agent claiming to act on behalf of a human. Returns: valid/expired/not_found with scope details.

Input parameters:

- `action_type` (string): The action type to check (must be in delegation scope)
- `delegation_id` (string, required): Delegation ID (ep_dlg_...)

### `ep_issue_commit` (~193 tokens)

Issue a signed EP Commit before a high-stakes action. Returns a commit_id, decision (allow/deny/review), expiry, scope, and appeal path. The commit binds the agent to a specific action type, entity, and policy before execution.

Input parameters:

- `action_type` (string, required): Action type: install, connect, delegate, transact
- `context` (object): Additional context metadata (optional)
- `counterparty_entity_id` (string): Counterparty entity ID (optional)
- `delegation_id` (string): Delegation ID if acting under delegation (optional)
- `entity_id` (string, required): Entity requesting the commit
- `max_value_usd` (number): Maximum value in USD (optional)
- `policy` (string): Trust policy to enforce (default: standard)
- `principal_id` (string): Principal authorizing the action (optional)
- `scope` (array): Action scope list (optional)

### `ep_verify_commit` (~76 tokens)

Verify a pre-action commit — read-only, no side effects. Checks its signature, status, and validity and returns valid/invalid plus the current status, decision, and expiry. Use before relying on or consuming a commit to confirm it is genuine and still active.

Input parameters:

- `commit_id` (string, required): Commit ID (epc_...)

### `ep_get_commit_status` (~71 tokens)

Get the current state of a pre-action commit by id. Read-only. Returns one of active, revoked, expired, or fulfilled, plus the bound action hash and expiry — poll this to learn whether a commit may still be consumed.

Input parameters:

- `commit_id` (string, required): Commit ID (epc_...)

### `ep_revoke_commit` (~93 tokens)

Revoke an active pre-action commit before it is fulfilled or expires. SIDE EFFECT: terminally cancels the commit — it can never be consumed after this, and the change is irreversible. Requires auth. Returns the revoked status; use when a pending action should be called off.

Input parameters:

- `commit_id` (string, required): Commit ID to revoke (epc_...)
- `reason` (string, required): Reason for revocation

### `ep_bind_receipt_to_commit` (~76 tokens)

Bind a post-action receipt to a commit, completing the commit-execute-receipt cycle. Links the behavioral outcome back to the signed authorization token.

Input parameters:

- `commit_id` (string, required): Commit ID to bind to (epc_...)
- `receipt_id` (string, required): Receipt ID to bind (ep_rcpt_...)

### `ep_initiate_handshake` (~131 tokens)

Initiate an EP Handshake — a structured identity exchange between parties. The handshake coordinates mutual presentation of identity proofs before a trust decision. Requires at least 2 parties and a governing trust policy.

Input parameters:

- `binding` (object): Optional binding constraints
- `interaction_id` (string): Optional external interaction reference
- `mode` (string, required): Handshake mode: "mutual", "one-way", "delegated"
- `parties` (array, required): Parties in the handshake (min 2). Each: { entity_ref, role }
- `policy_id` (string, required): Trust policy governing the handshake

### `ep_add_presentation` (~173 tokens)

Add an identity presentation (proof) to an active handshake. WRITE: appends the party's identity claims to the handshake for evaluation against its policy; supports full, selective, or zero-knowledge disclosure. Requires auth. Returns the updated presentation count and handshake state. Call after ep_initiate_handshake and before ep_verify_handshake.

Input parameters:

- `claims` (object, required): Identity claims being presented
- `disclosure_mode` (string): Disclosure mode: "full", "selective", "zk"
- `handshake_id` (string, required): Handshake ID to present to
- `issuer_ref` (string): Optional credential issuer reference
- `party_role` (string, required): Role of the presenting party
- `presentation_type` (string, required): Type: "verifiable_credential", "ep_trust_profile", "attestation"

### `ep_verify_handshake` (~82 tokens)

Evaluate all presentations in a handshake against its governing policy — read-only, no mutation. Returns accepted (all requirements met), rejected (policy violations), or partial (awaiting presentations), each with reason_codes explaining the outcome. Call after the parties have added their presentations to decide whether the handshake clears.

Input parameters:

- `handshake_id` (string, required): Handshake ID to verify

### `ep_get_handshake` (~51 tokens)

Get the full state of a handshake including parties, presentations, binding, and result. Use this to check handshake progress or review completed exchanges.

Input parameters:

- `handshake_id` (string, required): Handshake ID to retrieve

### `ep_revoke_handshake` (~61 tokens)

Revoke an active handshake. Only parties to the handshake may revoke it. Revocation is terminal — the handshake cannot be reopened.

Input parameters:

- `handshake_id` (string, required): Handshake ID to revoke
- `reason` (string, required): Reason for revocation

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/emiliaprotocol-mcp-server/emilia-protocol-mcp-server#diagnostics

## Score history

- 2026-08-03: 71
- 2026-08-02: 20
- 2026-08-01: 20
- 2026-07-31: 35
- 2026-07-30: 53
- 2026-07-28: 53
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/@emilia-protocol/mcp-server
- Socket report: https://socket.dev/npm/package/@emilia-protocol/mcp-server
- Repository: https://github.com/emiliaprotocol/emilia-protocol
- Website: https://www.emiliaprotocol.ai/mcp
- Changelog RSS feed: https://verifymcp.io/servers/emiliaprotocol-mcp-server/emilia-protocol-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/emiliaprotocol-mcp-server/emilia-protocol-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/emiliaprotocol-mcp-server/emilia-protocol-mcp-server