# io.github.jarod-vyent/xrpl-identity-mcp (npm · xrpl-identity-mcp)

MCP server for XRPL identity: DIDs, credentials, signer lists, and safe transaction workflows.

- Trust score: 66/100 (medium)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `xrpl-identity-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/jarod-vyent-xrpl-identity-mcp/xrpl-identity-mcp.md), [page](https://verifymcp.io/servers/jarod-vyent-xrpl-identity-mcp/xrpl-identity-mcp)

## Channel facts

- Registry: `npm`
- Package: `xrpl-identity-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 26 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1123 tokens (~93/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add jarod-vyent-xrpl-identity-mcp -- npx -y xrpl-identity-mcp
```

### Codex

```bash
codex mcp add jarod-vyent-xrpl-identity-mcp -- npx -y xrpl-identity-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jarod-vyent-xrpl-identity-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "xrpl-identity-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jarod-vyent-xrpl-identity-mcp --command npx --arg -y --arg xrpl-identity-mcp
```

### Hermes

```yaml
mcp_servers:
  jarod-vyent-xrpl-identity-mcp:
    command: "npx"
    args: ["-y", "xrpl-identity-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "jarod-vyent-xrpl-identity-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "xrpl-identity-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +23)

- [security regression] Install scripts: pass → unverified
- [security regression] Provenance: fail → unverified
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Maintenance: pass → unverified
- [functional regression] License: pass → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 43, −11)

- [security regression] Known CVEs: partial → unverified
- [functional regression] Dependency health: partial → unverified

### 2026-07-31 (score 54, +45)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 9, −17)

- [security regression] Malware scan: pass → unverified
- [functional regression] Security disclosure: unverified → fail

### 2026-07-29 (score 26, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-07-28 (score 26, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (12)

### `did_resolve` (~114 tokens)

Resolve XRPL DID

Resolve an XLS-40 DID object for an XRPL account or did:xrpl identifier. Returns raw ledger data, UTF-8 decoded DID fields where valid, and fetched DID document content for ipfs:// or https:// URIs. Only text/JSON documents are inlined; binary content is reported as metadata (source, content type, byte length) with the body omitted.

Input parameters:

- `address` (string, required): Classic XRPL address, did:xrpl:<address>, or did:xrpl:1:<address>.

### `did_prepare_set` (~119 tokens)

Prepare DIDSet

Prepare an unsigned XLS-40 DIDSet transaction. This server does not sign or custody keys; sign externally and verify the signed blob before submission.

Input parameters:

- `account` (string, required): Classic XRPL account address setting the DID.
- `data` (string): Optional DID data. UTF-8 encoded to XRPL hex Data.
- `didDocument` (string): Optional DID document JSON/string payload. UTF-8 encoded to XRPL hex DIDDocument.
- `uri` (string): Optional DID document URI. UTF-8 encoded to XRPL hex URI.

### `did_prepare_delete` (~52 tokens)

Prepare DIDDelete

Prepare an unsigned XLS-40 DIDDelete transaction for an account DID. This server never signs; sign externally and verify the blob before submitting.

Input parameters:

- `account` (string, required): Classic XRPL account address deleting its DID.

### `credential_prepare_create` (~125 tokens)

Prepare CredentialCreate

Prepare an unsigned XLS-70 CredentialCreate transaction. The issuer signs externally; this server only prepares JSON and never custodies keys.

Input parameters:

- `credentialType` (string, required): Credential type as UTF-8 text. Encoded to XRPL hex and capped at 64 bytes.
- `expiration` (string): Optional ISO-8601 expiration time converted to Ripple epoch seconds.
- `issuerAccount` (string, required): Classic XRPL issuer account address.
- `subject` (string, required): Classic XRPL subject account address.
- `uri` (string): Optional credential URI encoded as XRPL hex URI.

### `credential_prepare_accept` (~89 tokens)

Prepare CredentialAccept

Prepare an unsigned XLS-70 CredentialAccept transaction for a subject to accept an issued credential. Signing happens outside this server.

Input parameters:

- `account` (string, required): Classic XRPL subject account accepting the credential.
- `credentialType` (string, required): Credential type as UTF-8 text. Encoded to XRPL hex and capped at 64 bytes.
- `issuer` (string, required): Classic XRPL issuer account address.

### `credential_prepare_delete` (~120 tokens)

Prepare CredentialDelete

Prepare an unsigned XLS-70 CredentialDelete transaction. The submitter signs externally; this server never signs or stores keys.

Input parameters:

- `account` (string, required): Classic XRPL account submitting the delete transaction.
- `credentialType` (string, required): Credential type as UTF-8 text. Encoded to XRPL hex and capped at 64 bytes.
- `issuer` (string): Optional issuer account; if omitted, Account may be treated as issuer by XRPL.
- `subject`: Optional subject account; if omitted, Account may be treated as subject by XRPL.

### `credential_verify` (~91 tokens)

Verify Credential

Read an XLS-70 Credential ledger object and report whether it exists, has been accepted, and is expired relative to the validated ledger close time.

Input parameters:

- `credentialType` (string, required): Credential type as UTF-8 text. Encoded to XRPL hex and capped at 64 bytes.
- `issuer` (string, required): Classic XRPL issuer account address.
- `subject` (string, required): Classic XRPL subject account address.

### `credential_list` (~67 tokens)

List Account Credentials

List up to 400 XLS-70 Credential objects visible in an account owner directory, optionally filtered by whether the account is issuer or subject.

Input parameters:

- `address` (string, required): Classic XRPL account address.
- `role` (string): Optional role filter comparing the account to Issuer or Subject fields.

### `account_identity_summary` (~79 tokens)

Account Identity Summary

Summarize an XRPL account identity posture: AccountRoot auth flags, RegularKey and Domain state, signer list, DID presence, and visible credential counts as issuer and subject (each with a *Truncated boolean flagging when the count hit the 400-object scan cap).

Input parameters:

- `address` (string, required): Classic XRPL account address to summarize.

### `signer_list_prepare_set` (~107 tokens)

Prepare SignerListSet

Prepare an unsigned SignerListSet transaction to create, replace, or delete an XRPL multisign signer list. This server never signs or stores keys.

Input parameters:

- `account` (string, required): Classic XRPL account whose signer list is being changed.
- `quorum` (integer, required): Required signer weight sum. Use 0 with no signers to delete the list.
- `signers` (array, required): Signer entries. Use an empty array only when quorum is 0 to delete the list.

### `tx_decode_verify` (~82 tokens)

Decode and Verify Signed Transaction

Decode a signed XRPL transaction blob, compute its hash, and optionally compare it against an expected partial intent before submission. This is the WYSIWYS safety gate.

Input parameters:

- `expectedIntent` (object): Optional partial transaction JSON. Every provided field is compared against the decoded transaction.
- `signedBlob` (string, required): Signed XRPL transaction blob as a hexadecimal string.

### `tx_submit_signed` (~78 tokens)

Submit Signed Transaction

Submit a pre-signed XRPL transaction blob and poll for validation. On mainnet this is blocked unless ALLOW_MAINNET_SUBMIT=true is set.

Input parameters:

- `failHard` (boolean): Forward fail_hard behavior to rippled submit; defaults to false.
- `signedBlob` (string, required): Signed XRPL transaction blob as a hexadecimal string.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/jarod-vyent-xrpl-identity-mcp/xrpl-identity-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 43
- 2026-07-31: 54
- 2026-07-30: 9
- 2026-07-29: 26
- 2026-07-28: 26
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/xrpl-identity-mcp
- Socket report: https://socket.dev/npm/package/xrpl-identity-mcp
- Repository: https://github.com/jarod-vyent/xrpl-identity-mcp
- Changelog RSS feed: https://verifymcp.io/servers/jarod-vyent-xrpl-identity-mcp/xrpl-identity-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jarod-vyent-xrpl-identity-mcp/xrpl-identity-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jarod-vyent-xrpl-identity-mcp/xrpl-identity-mcp