# io.github.ProvenonceAI/provenonce (npm · @provenonce/mcp)

Cryptographic identity, SIGIL naming, heartbeat, and passports for AI agents.

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@provenonce/mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/provenonceai-provenonce/provenonce-mcp.md), [page](https://verifymcp.io/servers/provenonceai-provenonce/provenonce-mcp)

## Channel facts

- Registry: `npm`
- Package: `@provenonce/mcp`
- Version: `1.1.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 144 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1004 tokens (~91/item across 11 items; 11 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add provenonceai-provenonce -- npx -y @provenonce/mcp
```

### Codex

```bash
codex mcp add provenonceai-provenonce -- npx -y @provenonce/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "provenonceai-provenonce": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@provenonce/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add provenonceai-provenonce --command npx --arg -y --arg @provenonce/mcp
```

### Hermes

```yaml
mcp_servers:
  provenonceai-provenonce:
    command: "npx"
    args: ["-y", "@provenonce/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "provenonceai-provenonce": {
      "command": "npx",
      "args": [
        "-y",
        "@provenonce/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 68, +47)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 21, +16)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (11)

### `provenonce_register` (~93 tokens)

Register Agent Identity

Register this agent with Provenonce to get a cryptographic identity (hash + API key). Safe to call multiple times — returns existing identity if already registered. No wallet required. Free.

Input parameters:

- `name` (string): Human-readable name for this agent (optional, max 64 chars)
- `skill_ref` (string): 16-character hex ref token of the skill that deployed you — for rev-share attribution (optional)

### `provenonce_status` (~37 tokens)

Get Agent Status

Get this agent's current Provenonce status: identity, SIGIL, beats balance, and next steps. Requires prior provenonce_register call.

### `provenonce_purchase_sigil` (~210 tokens)

Purchase SIGIL Identity

Purchase a Provenonce SIGIL to unlock full provenance: heartbeat access, signed passport, and a permanent identity record. If payment_tx is omitted, returns payment instructions (fee amount + address). SIGIL format: name*principal*tier (e.g. my-agent*acme*ind).

Input parameters:

- `identity_class` (string, required): Agent identity class (pricing axis): narrow_task=single-purpose, autonomous=independent decision-maker, orchestrator=coordinates other agents
- `name` (string, required): SIGIL name segment — identifies this specific agent (e.g. "my-agent")
- `payment_tx` (string): Solana transaction signature for the SIGIL fee payment. If omitted, returns payment instructions instead.
- `principal` (string, required): Principal segment — identifies the operator or organisation (e.g. "acme")
- `tier` (string, required): Trust governance tier: sov=sovereign/root, org=organisation, ind=individual, eph=ephemeral, sbx=sandbox

### `provenonce_heartbeat` (~88 tokens)

Submit Heartbeat

Submit a heartbeat to prove this agent is alive. Root agents (depth 0) require a SIGIL first; child agents (depth > 0) can heartbeat without a SIGIL. If payment_tx is omitted, returns payment instructions (fee amount + address).

Input parameters:

- `payment_tx` (string): Solana transaction signature for the heartbeat fee payment. If omitted, returns payment instructions instead.

### `provenonce_get_passport` (~88 tokens)

Get Signed Passport

Get this agent's cryptographically signed Passport — a verifiable identity document any third party can verify offline using the Provenonce authority public key. Root agents (depth 0) require an active SIGIL; child agents (depth > 0) only need at least one heartbeat.

Input parameters:

- `payment_tx` (string): Solana transaction signature for the passport reissue fee (if applicable)

### `provenonce_beats_proof` (~113 tokens)

Compute Beats Work-Proof

Compute a Beats work-proof — cryptographic evidence of computational effort by this agent. Computes sequential hash chains at the current network difficulty, submits to the Beats service for a signed receipt. The receipt can be used for spawn authorization and other operations.

Input parameters:

- `count` (integer, required): Number of beats to compute (min 10, max 10000)
- `difficulty` (integer): Hash iterations per beat (default 1000, min 100, max 5000). Usually auto-detected from network.

### `provenonce_submit_beats` (~94 tokens)

Submit Beats to Registry

Compute VDF beats and submit to the Registry to credit this agent's lifetime beat count. Unlike provenonce_beats_proof (which gets a receipt for spawn/resync), this extends the agent's persistent beat chain and increases the "Lifetime Beats" metric visible in the Registry.

Input parameters:

- `count` (integer): Number of beats to compute and submit (default 100, min 10, max 2000)

### `provenonce_verify_agent` (~56 tokens)

Verify Agent Identity

Verify another agent's Provenonce identity. Returns their SIGIL, identity class, and registration status. Public — no authentication required.

Input parameters:

- `hash` (string, required): The agent hash to verify (0x + 64 hex chars)

### `provenonce_spawn` (~63 tokens)

Spawn Child Agent

Spawn a child agent under this agent's identity. The child inherits lineage from the parent. Returns the child's hash and API key. Requires sufficient beats balance or a work-proof receipt.

Input parameters:

- `child_name` (string, required): Name for the child agent (max 64 chars)

### `provenonce_get_lineage` (~74 tokens)

Get Agent Lineage

Get the full lineage chain for an agent — all events in its provenance history (registration, SIGIL issuance, heartbeats, spawns). Public — no authentication required.

Input parameters:

- `hash` (string): The agent hash to get lineage for (0x + 64 hex chars). Defaults to this agent if omitted.

### `provenonce_batch_heartbeat` (~88 tokens)

Batch Heartbeat Children

Submit heartbeats for multiple child agents in a single call. One payment covers all children. Requires active sponsorships for each child. Max 20 children per batch.

Input parameters:

- `children` (array, required): Array of child agent hashes to heartbeat (max 20)
- `payment_tx` (string): Solana transaction signature covering the total fee for all children. If omitted, returns payment instructions.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/provenonceai-provenonce/provenonce-mcp#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 21
- 2026-07-31: 5
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@provenonce/mcp
- Socket report: https://socket.dev/npm/package/@provenonce/mcp
- Repository: https://github.com/ProvenonceAI/provenonce-mcp
- Website: https://provenonce.dev/mcp-skill
- Changelog RSS feed: https://verifymcp.io/servers/provenonceai-provenonce/provenonce-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/provenonceai-provenonce/provenonce-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/provenonceai-provenonce/provenonce-mcp