# KeyID (npm · @keyid/agent-kit)

Signup sessions, browser continuity, email, SMS, and OTP/TOTP infrastructure for AI agents.

- Trust score: 58/100 (low)
- Change this week: +16
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `keyid.ai`: 33/100, [markdown](https://verifymcp.io/servers/keyid-ai-keyid/keyid.md), [page](https://verifymcp.io/servers/keyid-ai-keyid/keyid)
- npm · `@keyid/agent-kit`: 58/100 (this document), [markdown](https://verifymcp.io/servers/keyid-ai-keyid/keyid-agent-kit.md), [page](https://verifymcp.io/servers/keyid-ai-keyid/keyid-agent-kit)

## Channel facts

- Registry: `npm`
- Package: `@keyid/agent-kit`
- Version: `0.2.10`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 130 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 64/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (poor).
  - Tool/resource definitions use about 2048 tokens (~37/item across 54 items; 47 tools + 7 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 68/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 5% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add keyid-ai-keyid -- npx -y @keyid/agent-kit
```

### Codex

```bash
codex mcp add keyid-ai-keyid -- npx -y @keyid/agent-kit
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "keyid-ai-keyid": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@keyid/agent-kit"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add keyid-ai-keyid --command npx --arg -y --arg @keyid/agent-kit
```

### Hermes

```yaml
mcp_servers:
  keyid-ai-keyid:
    command: "npx"
    args: ["-y", "@keyid/agent-kit"]
```

### Other

```json
{
  "mcpServers": {
    "keyid-ai-keyid": {
      "command": "npx",
      "args": [
        "-y",
        "@keyid/agent-kit"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 58, +50)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-08-01 (score 8, −35)

- [security regression] Known CVEs: partial → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 43, +17)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, −40)

- [security regression] Known CVEs: partial → unverified
- [security regression] Install scripts: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT

### 2026-07-29 (score 66, +47)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Schema quality: unverified → poor
- [functional] Licence: MIT

### 2026-07-28 (score 19, −23)

- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 42)

First indexed and scored.

## MCP tools (47)

### `provision_identity` (~36 tokens)

Provision Identity

Create or reveal the email identity for this MCP session.

Input parameters:

- `storageType` (string): How the local MCP session stores its private key

### `get_identity` (~22 tokens)

Get Identity

Fetch the current KeyID identity, address, phone, and reputation.

### `request_phone_number` (~20 tokens)

Request Phone Number

Assign a phone number to the current KeyID identity.

### `list_messages` (~100 tokens)

List Messages

List email or SMS messages with search and inbox filters.

Input parameters:

- `channel` (string)
- `direction` (string)
- `labels` (string): Comma-separated label filter
- `limit` (integer)
- `page` (integer)
- `search` (string)
- `senderContains` (string)
- `since` (string): ISO timestamp filter
- `subjectContains` (string)
- `unreadOnly` (boolean)

### `wait_for_message` (~89 tokens)

Wait For Message

Poll until a matching inbound message arrives.

Input parameters:

- `channel` (string)
- `includeExisting` (boolean)
- `pollIntervalSeconds` (integer)
- `receivedAfter` (string): Only match messages at or after this ISO timestamp
- `search` (string)
- `senderContains` (string)
- `subjectContains` (string)
- `timeoutSeconds` (integer)

### `get_message` (~27 tokens)

Get Message

Fetch the full details for a single message.

Input parameters:

- `messageId` (string, required): Message ID

### `send_email` (~83 tokens)

Send Email

Send an email from the current identity.

Input parameters:

- `bcc` (array)
- `body` (string)
- `cc` (array)
- `displayName` (string)
- `html` (string)
- `scheduledAt` (string)
- `subject` (string, required)
- `threadId` (string)
- `to` (string, required)

### `reply_to_message` (~49 tokens)

Reply To Message

Reply to a message, optionally as reply-all.

Input parameters:

- `body` (string)
- `html` (string)
- `messageId` (string, required)
- `replyAll` (boolean)

### `update_message` (~57 tokens)

Update Message

Update message flags such as read or starred state.

Input parameters:

- `isRead` (boolean)
- `isStarred` (boolean)
- `labels` (array)
- `messageId` (string, required)
- `status` (string)

### `list_threads` (~37 tokens)

List Threads

List conversation threads for the current identity.

Input parameters:

- `labels` (string)
- `limit` (integer)
- `page` (integer)

### `get_thread` (~25 tokens)

Get Thread

Fetch a thread and all of its messages.

Input parameters:

- `threadId` (string, required)

### `get_verification_codes` (~72 tokens)

Get Verification Codes

Read OTP or verification codes from a message, or from the latest matching message.

Input parameters:

- `channel` (string)
- `messageId` (string)
- `search` (string)
- `senderContains` (string)
- `subjectContains` (string)
- `timeoutSeconds` (integer)

### `follow_verification_link` (~46 tokens)

Follow Verification Link

Follow a verification link directly or from an extracted message link list.

Input parameters:

- `linkIndex` (integer)
- `messageId` (string)
- `url` (string)

### `start_registration_session` (~134 tokens)

Start Registration Session

Start a signup session that correlates email, SMS, or TOTP artifacts for one service.

Input parameters:

- `bodyPattern` (string)
- `browserStateKey` (string)
- `expectedArtifactTypes` (array)
- `expectedChannels` (array)
- `expectedSenders` (array)
- `expiresAt` (string): ISO timestamp when the session should expire
- `metadata` (object)
- `senderPattern` (string)
- `serviceDomain` (string)
- `serviceName` (string, required)
- `subjectPattern` (string)
- `useSmsLease` (boolean)

### `list_registration_sessions` (~47 tokens)

List Registration Sessions

List current and historical signup sessions for this identity.

Input parameters:

- `limit` (integer)
- `page` (integer)
- `service` (string)
- `status` (string)

### `get_registration_session` (~31 tokens)

Get Registration Session

Fetch one signup session, including its latest artifact summary and lease state.

Input parameters:

- `sessionId` (string, required)

### `wait_for_registration_artifact` (~55 tokens)

Wait For Registration Artifact

Poll a signup session until an artifact arrives or the session expires, blocks, or times out.

Input parameters:

- `pollIntervalSeconds` (integer)
- `sessionId` (string, required)
- `timeoutSeconds` (integer)

### `get_registration_artifacts` (~31 tokens)

Get Registration Artifacts

Fetch the normalized artifacts attached to a signup session in priority order.

Input parameters:

- `sessionId` (string, required)

### `save_browser_state` (~58 tokens)

Save Browser State

Store cookies and browser session state for a signup session in the KeyID vault.

Input parameters:

- `expiresAt` (string)
- `sessionId` (string, required)
- `state` (required): Browser state object, typically cookies plus localStorage or sessionStorage

### `load_browser_state` (~27 tokens)

Load Browser State

Load the saved browser state for a signup session.

Input parameters:

- `sessionId` (string, required)

### `complete_registration_session` (~35 tokens)

Complete Registration Session

Mark a signup session complete after the browser flow succeeds.

Input parameters:

- `metadata` (object)
- `sessionId` (string, required)

### `block_registration_session` (~52 tokens)

Block Registration Session

Mark a signup session blocked and record why the flow could not continue.

Input parameters:

- `code` (string)
- `metadata` (object)
- `reason` (string, required)
- `sessionId` (string, required)

### `list_totp_entries` (~21 tokens)

List TOTP Entries

List registered authenticator/TOTP entries for the identity.

### `get_totp_code` (~32 tokens)

Get TOTP Code

Generate the current TOTP code for a stored authenticator entry.

Input parameters:

- `totpId` (string, required)

### `get_persona` (~17 tokens)

Get Persona

Fetch the synthetic persona used for registrations.

### `create_or_update_persona` (~124 tokens)

Create Or Update Persona

Create a persona or update the existing one with explicit overrides.

Input parameters:

- `addressLine1` (string)
- `city` (string)
- `companyName` (string)
- `country` (string)
- `customFields` (object)
- `dateOfBirth` (string)
- `firstName` (string)
- `fullName` (string)
- `gender` (string)
- `jobTitle` (string)
- `lastName` (string)
- `state` (string)
- `zip` (string)

### `save_registration` (~87 tokens)

Save Registration

Create or update a registration record for an external service.

Input parameters:

- `emailUsed` (string)
- `id` (string)
- `metadata` (object)
- `phoneUsed` (string)
- `registeredAt` (string)
- `serviceName` (string)
- `serviceUrl` (string)
- `status` (string)
- `username` (string)

### `list_registrations` (~43 tokens)

List Registrations

List saved service registrations.

Input parameters:

- `limit` (integer)
- `page` (integer)
- `service` (string)
- `status` (string)

### `get_registration` (~23 tokens)

Get Registration

Fetch one registration record by ID.

Input parameters:

- `registrationId` (string, required)

### `list_secrets` (~17 tokens)

List Secrets

List vault keys without exposing secret values.

### `get_secret` (~23 tokens)

Get Secret

Retrieve a decrypted vault entry by key.

Input parameters:

- `key` (string, required)

### `put_secret` (~45 tokens)

Put Secret

Create or update a vault entry.

Input parameters:

- `contentType` (string)
- `expiresAt` (string)
- `key` (string, required)
- `value` (string, required)

### `delete_secret` (~20 tokens)

Delete Secret

Delete a vault entry.

Input parameters:

- `key` (string, required)

### `get_auto_reply` (~17 tokens)

Get Auto Reply

Fetch the current auto-reply configuration.

### `set_auto_reply` (~58 tokens)

Set Auto Reply

Enable, disable, or edit the auto-reply responder.

Input parameters:

- `body` (string)
- `enabled` (boolean, required)
- `endDate` (string)
- `startDate` (string)
- `subject` (string)

### `get_forwarding` (~15 tokens)

Get Forwarding

Fetch the current forwarding address.

### `set_forwarding` (~22 tokens)

Set Forwarding

Set or clear the forwarding address.

Input parameters:

- `forwardingAddress` (required)

### `get_signature` (~14 tokens)

Get Signature

Fetch the current email signature.

### `set_signature` (~20 tokens)

Set Signature

Set or clear the email signature.

Input parameters:

- `signature` (required)

### `list_contacts` (~15 tokens)

List Contacts

List saved contacts for the identity.

### `upsert_contact` (~50 tokens)

Upsert Contact

Create a contact by email or update one by contact ID.

Input parameters:

- `contactId` (string)
- `email` (string)
- `name` (string)
- `notes` (string)

### `delete_contact` (~22 tokens)

Delete Contact

Delete a contact by ID.

Input parameters:

- `contactId` (string, required)

### `list_webhooks` (~16 tokens)

List Webhooks

List webhook subscriptions for the identity.

### `create_webhook` (~28 tokens)

Create Webhook

Create a webhook subscription.

Input parameters:

- `events` (array)
- `url` (string, required)

### `get_webhook_deliveries` (~32 tokens)

Get Webhook Deliveries

Inspect recent webhook delivery attempts.

Input parameters:

- `limit` (integer)
- `page` (integer)

### `get_metrics` (~44 tokens)

Get Metrics

Fetch usage metrics for the current identity.

Input parameters:

- `event` (string)
- `period` (string)
- `since` (string)
- `until` (string)

### `get_reputation` (~18 tokens)

Get Reputation

Fetch the current reputation score and factor breakdown.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/keyid-ai-keyid/keyid-agent-kit#diagnostics

## Score history

- 2026-08-03: 58
- 2026-08-02: 58
- 2026-08-01: 8
- 2026-07-31: 43
- 2026-07-30: 26
- 2026-07-29: 66
- 2026-07-28: 19
- 2026-07-27: 42

## Links

- npm package: https://www.npmjs.com/package/@keyid/agent-kit
- Socket report: https://socket.dev/npm/package/@keyid/agent-kit
- Website: https://keyid.ai/mcp
- Changelog RSS feed: https://verifymcp.io/servers/keyid-ai-keyid/keyid-agent-kit/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/keyid-ai-keyid/keyid-agent-kit/changelog.json
- HTML version of this page: https://verifymcp.io/servers/keyid-ai-keyid/keyid-agent-kit