Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.webaesbyamin/agent-receipts

NPM · @AGENT-RECEIPTS/MCP-SERVER

Ed25519-signed receipts for every AI agent action. Local-first, verifiable, no server required.

+38 this week 66 Trust /100

Last scanned (5 hours ago)

Scores higher than 34% of npm servers

Category Security

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 98 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 3 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 4217 tokens (~175/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
  • Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 98% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cleanup" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Nov 26 +30
    • Injection markers: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Tool safety: Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Tool coverage: unverified → 100 ▲ functional
    • Stability: unverified → 0.00 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Schema quality: unverified → 100 ▲ functional
    • First check of Schema quality: fail functional
    • First check of Schema quality: fail functional
    • First check of Destructive annotations: 0 functional
    • First check of Tool coverage: 98 functional
    • First check of Schema quality: good functional
    • Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet. functional
    • Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
    • Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
    • Package version: 0.5.2 → 0.6.0 functional
  • 1 Nov 26 +1
    • Security disclosure: fail → pass ▲ functional
  • 30 Oct 26 +5
    • Known CVEs: unverified → fail ▼ security
    • Dependency health: unverified → 0.83 ▲ functional
    • Package version: 0.5.1 → 0.5.2 functional
  • 29 Oct 26 −5
    • Known CVEs: fail → unverified ▼ security
    • Dependency health: 0.83 → unverified ▼ functional
    • Package version: 0.2.11 → 0.5.1 functional
    • Package version: 0.2.11 → 0.5.0 functional
  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 13 Oct 26 0
    • Security disclosure: unverified → fail ▼ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/@agent-receipts/mcp-server@0.6.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 98 packages
Packages resolved 98
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 24 exposed · ~4,217 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
cleanup ~133

Delete receipts that have passed their expiration time based on the expires_at field in metadata. Expired receipts are receipts where metadata.expires_at is set and is earlier than the current time. Supports dry_run mode to preview deletions without committing. Returns count of deleted receipts and remaining total. Use periodically to manage storage and enforce TTL policies set during receipt creation. Set cleanup_memory to also soft-delete expired memory observations.

NameTypeReqDescription
cleanup_memoryboolean–Also clean up expired memory observations (soft-delete). Defaults to false.
dry_runboolean–If true, returns what would be deleted without actually deleting. Defaults to false.

No output schema declared.

No examples provided.

complete_judgment ~240

Submit evaluation results to finalize a pending judgment receipt created by judge_receipt. Records the verdict, overall score, per-criterion scores and reasoning, and confidence. The judgment receipt is re-signed with Ed25519 and linked to the original receipt via parent_receipt_id. Returns the judgment receipt ID, verdict, score, and chain ID. Use immediately after evaluating the prompt returned by judge_receipt.

NameTypeReqDescription
confidencenumberyesYour confidence in this evaluation, 0.0 to 1.0
criteria_resultsarrayyesArray of per-criterion results. Each item needs: criterion (name string), score (0.0-1.0), reasoning (explanation string)
judgment_receipt_idstringyesThe pending judgment receipt ID returned by judge_receipt
overall_reasoningstringyesOverall explanation of the evaluation verdict
scorenumberyesOverall quality score from 0.0 to 1.0
verdictstringyesOverall evaluation result: "pass" (meets threshold), "fail" (below threshold), or "partial" (mixed results)

No output schema declared.

No examples provided.

complete_receipt ~306

Finalize a pending receipt by recording execution results, costs, and output data. Updates the receipt status to completed, failed, or timeout and re-signs with Ed25519. Use after create_receipt when you need to record results separately from creation (two-phase tracking). Cannot complete an already-completed receipt. Returns the updated signed receipt.

NameTypeReqDescription
callback_verifiedboolean|null–Whether an external callback verified the result
confidence––Confidence score for output quality, 0.0 to 1.0
cost_usd––Total cost in USD
error––Error details if status is "failed" (e.g., {"code": "TIMEOUT", "message": "..."})
latency_ms––Total execution time in milliseconds
modelstring|null–AI model used during execution
output_hashstring|null–Pre-computed SHA-256 hash of the output in format "sha256:hexstring"
output_summarystring|null–Human-readable summary of the execution result
receipt_idstringyesThe receipt ID to complete — must be a pending receipt (status: "pending")
statusstringyesFinal status: "completed" (success), "failed" (error occurred), or "timeout" (timed out)
tokens_in––Input tokens consumed
tokens_out––Output tokens generated
tool_calls––Names of tools called during execution

No output schema declared.

No examples provided.

create_receipt ~412

Create an Ed25519-signed receipt with pre-computed SHA-256 hashes. Use when you have already hashed the input/output data externally or need full control over receipt fields. For automatic hashing, use track_action instead. Returns the signed receipt object with receipt_id. The receipt is stored locally in SQLite and can be completed later with complete_receipt.

NameTypeReqDescription
actionstringyesAction name being recorded (e.g., "generate_code", "analyze_data")
chain_idstring–Chain ID (auto-generated if not provided)
confidence––Confidence score 0-1
constraintsarray–Array of constraint definitions to evaluate (types: max_latency_ms, max_cost_usd, min_confidence, required_fields, status_must_be, output_schema)
cost_usd––Cost in USD
expires_atstring–ISO datetime when this receipt expires
input_hashstringyesPre-computed SHA-256 hash of the input data in format "sha256:hexstring"
latency_ms––Latency in milliseconds
metadataobject–Arbitrary metadata
modelstring|null–AI model used
output_hashstring|null–Pre-computed SHA-256 hash of the output data in format "sha256:hexstring"
output_summarystring|null–Human-readable summary of the output
parent_receipt_idstring|null–Parent receipt ID for chains
receipt_typestring–Receipt type: "action" (default), "verification", "judgment", or "arbitration"
statusstring–Initial status: "pending" (default, complete later) or "completed"
tags––Tags for categorization
tokens_in––Input tokens
tokens_out––Output tokens
tool_calls––Tools called during the action
ttl_msnumber–Time-to-live in milliseconds from now

No output schema declared.

No examples provided.

generate_invoice ~407

Generate a client invoice from cryptographically signed receipts within a date range. Aggregates receipt data by agent, action, or day and calculates total costs, token usage, and receipt counts. Supports JSON, CSV, and Markdown output formats. Each line item references a signed receipt for verifiable billing. Use to bill clients for AI agent work with cryptographic proof of every billed action.

NameTypeReqDescription
actionsarray–Filter to specific action names only
agent_idsarray–Filter to specific agent IDs only
client_emailstring–Client email address
client_namestring–Client or bill-to name for the invoice header
constraints_passed_onlyboolean–If true, only include receipts where all constraints passed
formatstring–Output format: "json" (structured data), "csv" (spreadsheet), or "md" (markdown table)
fromstringyesInvoice period start date in ISO 8601 format (e.g., "2026-01-01" or "2026-01-01T00:00:00Z")
group_bystring–How to group line items: "action" (by action name), "agent" (by agent ID), "day" (by date), or "none" (single total)
include_receiptsboolean–If true, includes full receipt objects in JSON output for full auditability
notesstring–Additional notes to include in the invoice
payment_termsstring–Payment terms text (e.g., "Net 30", "Due on receipt")
provider_emailstring–Your email address
provider_namestring–Your company or provider name
tostringyesInvoice period end date in ISO 8601 format (e.g., "2026-01-31" or "2026-01-31T23:59:59Z")

No output schema declared.

No examples provided.

get_chain ~97

Retrieve all receipts belonging to a chain, ordered by timestamp ascending to show the sequence of operations. A chain groups related receipts from a multi-step agent workflow. Returns the complete receipt objects for every step. Use to audit a complete workflow, calculate total chain cost and duration, or identify which step in a pipeline failed.

NameTypeReqDescription
chain_idstringyesThe chain ID to retrieve (format: "chain_" followed by 8 alphanumeric characters)

No output schema declared.

No examples provided.

get_judgments ~103

Retrieve all judgment receipts associated with a given receipt ID. Judgment receipts are linked via parent_receipt_id. Returns an array of judgment receipt objects ordered by timestamp, including verdict, score, criteria results, and confidence. Use to review the evaluation history of a receipt, compare multiple judgments, or audit AI quality assessments. Returns empty array if no judgments exist.

NameTypeReqDescription
receipt_idstringyesThe original receipt ID to get judgments for (not the judgment receipt ID)

No output schema declared.

No examples provided.

get_public_key ~74

Export the Ed25519 public key used to sign all receipts on this instance. Returns the key as a 64-character hex string. Share this key with clients or third parties so they can independently verify receipt signatures without accessing your private key. The private key never leaves your machine — only the public key is needed for verification.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_receipt ~102

Retrieve a single receipt by its ID from local SQLite storage. Returns the full receipt object including all 27 fields: identity, timestamps, action data, performance metrics, constraints, cryptographic proof, and metadata. Returns an error message if the receipt ID does not exist. Use to inspect a specific receipt or retrieve it before verification.

NameTypeReqDescription
receipt_idstringyesThe receipt ID to retrieve (format: "rcpt_" followed by 12 alphanumeric characters)

No output schema declared.

No examples provided.

get_started ~71

Display a getting-started guide with usage examples for all Agent Receipts tools. Shows how to record agent actions, verify receipts, use receipt chains, evaluate with constraints, and generate invoices. Call this tool first when setting up Agent Receipts or when you need a reference for available tools and their typical usage patterns.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

judge_receipt ~216

Start an AI judgment evaluation for a receipt by creating a pending judgment receipt and returning a structured evaluation prompt. The host model (you) evaluates the receipt's output against the provided rubric criteria and then calls complete_judgment with the results. Use to assess output quality beyond simple pass/fail constraints — supports weighted criteria, partial verdicts, and confidence scores. Judgment receipts are themselves Ed25519-signed for auditability.

NameTypeReqDescription
output_summary_for_reviewstring–The actual output content to evaluate — provide if output_summary on the receipt is insufficient for evaluation
receipt_idstringyesThe receipt ID to evaluate — the original action receipt
rubricobjectyesEvaluation rubric with criteria array. Each criterion needs: name (string), description (string), weight (0.0-1.0), and optional passing_threshold (0.0-1.0, default 0.7). Also set: passing_threshold…

No output schema declared.

No examples provided.

list_receipts ~302

Query and paginate receipts from local SQLite storage with optional filtering by agent, action, status, environment, type, chain, or tag. Supports sorting by timestamp, cost, or latency. Returns paginated results with total count, page info, and has_next/has_prev flags. Default: 50 receipts per page, sorted by timestamp descending. Use to audit agent activity, generate reports, or find specific receipts.

NameTypeReqDescription
actionstring–Filter by action name (exact match)
agent_idstring–Filter by agent ID (exact match)
chain_idstring–Filter to receipts in a specific chain
environmentstring–Filter by environment: "development", "production", "staging", or "test"
limitinteger–Results per page, 1 to 100 (default: 50)
pageinteger–Page number, starting at 1 (default: 1)
receipt_typestring–Filter by type: "action", "verification", "judgment", or "arbitration"
sortstring–Sort field and direction in format "field:asc" or "field:desc" (e.g., "timestamp:desc", "cost_usd:asc")
statusstring–Filter by status: "pending", "completed", "failed", or "timeout"
tagstring–Filter to receipts containing this tag

No output schema declared.

No examples provided.

memory_audit ~85

Generate an audit report of memory operations. Shows what was remembered, forgotten, merged, and by which agents over a time period.

NameTypeReqDescription
agent_idstring–Filter by agent
entity_idstring–Filter by entity
fromstring–Start date (ISO 8601)
tostring–End date (ISO 8601)

No output schema declared.

No examples provided.

memory_context ~153

Get a complete context dump of all stored memories — top entities, recent observations, active relationships, and preferences. Call this at the start of a conversation to understand what is already known about the user, their projects, and their preferences. Every context pull is logged as a signed receipt.

NameTypeReqDescription
auditedboolean–Create a signed receipt for this read operation (default: false)
max_entitiesnumber–Maximum entities to return, ordered by activity (default: 10, max: 50)
max_observationsnumber–Maximum recent observations to return (default: 20, max: 100)
scopestring–Filter memories by scope (default: returns all accessible scopes)

No output schema declared.

No examples provided.

memory_entities ~89

List known entities (people, projects, organizations, etc.) with optional filtering. Returns entities with their observation counts.

NameTypeReqDescription
entity_typestring––
include_forgottenboolean–Include forgotten entities (default: false)
limitnumber–Max results (default: 20)
querystring–Search entity names and aliases
scopestring––

No output schema declared.

No examples provided.

memory_export_bundle ~116

Export memories as a portable, verifiable bundle. Includes entities, observations, relationships, source receipts, and the public key needed to verify them. Share with other agents or import into another Agent Receipts instance.

NameTypeReqDescription
descriptionstring–Description of what this bundle contains
entity_idsarray–Export specific entities (default: all)
include_forgottenboolean–Include forgotten/deleted memories (default: false)
include_receiptsboolean–Include source receipts for verification (default: true)

No output schema declared.

No examples provided.

memory_forget ~88

Forget a specific observation or an entire entity. This is a soft delete — the memory is marked as forgotten but retained for audit purposes. The forget operation itself is recorded as a signed receipt.

NameTypeReqDescription
entity_idstring–Entity to forget entirely (all its observations)
observation_idstring–Specific observation to forget
reasonstring–Why this memory is being forgotten

No output schema declared.

No examples provided.

memory_import_bundle ~80

Import a memory bundle from another Agent Receipts instance. Verifies checksums before importing. Skips memories that already exist locally. The import operation itself is recorded as a signed receipt.

NameTypeReqDescription
bundleobjectyesThe memory bundle JSON object to import
skip_existingboolean–Skip entities/observations that already exist (default: true)

No output schema declared.

No examples provided.

memory_observe ~179

Store a memory observation about a person, project, preference, or any entity. Automatically creates the entity if it doesn't exist. Every observation is cryptographically signed and linked to a receipt.

NameTypeReqDescription
confidencestring–How confident you are in this observation (default: medium)
contentstringyesThe observation/fact to remember
contextstring–What conversation or task produced this observation
entity_namestringyesName of the entity (person, project, tool, etc.)
entity_typestringyesType of entity
scopestring–Who can see this memory (default: agent)
tagsarray–Tags for categorization
ttl_secondsnumber–Time-to-live in seconds. After this duration, the observation expires and is excluded from recall but retained for audit.

No output schema declared.

No examples provided.

memory_provenance ~54

Get the full provenance chain for a memory observation. Shows when it was created, which conversation produced it, which agent made the observation, and every subsequent modification.

NameTypeReqDescription
observation_idstringyesThe observation to trace

No output schema declared.

No examples provided.

memory_recall ~156

Search and retrieve stored memories. Use text search to find relevant observations across all entities, or filter by entity type, specific entity, or scope. Every recall is logged as a receipt.

NameTypeReqDescription
auditedboolean–Create a signed receipt for this read operation (default: false)
entity_idstring–Get memories for a specific entity
entity_typestring–Filter by entity type
include_forgottenboolean–Include soft-deleted memories (default: false)
limitnumber–Max results to return (default: 20, max: 100)
querystring–Text to search for across all observations
scopestring–Filter by memory scope

No output schema declared.

No examples provided.

memory_relate ~111

Create a relationship between two entities (e.g., "Amin" builds "ModQuote"). Relationships are bidirectional for querying but stored with a direction.

NameTypeReqDescription
contextstring–What established this relationship
from_entity_idstringyesSource entity ID
relationship_typestringyesType of relationship (e.g., "builds", "uses", "works_at", "prefers")
strengthstring––
to_entity_idstringyesTarget entity ID

No output schema declared.

No examples provided.

track_action ~504

Create a completed Ed25519-signed receipt for an AI agent action with automatic SHA-256 hashing of input and output data. Records model usage, costs, latency, and constraint evaluations. Returns the signed receipt with receipt_id for future reference. Use this as the primary tool for recording agent actions — prefer over create_receipt + complete_receipt for single-step actions.

NameTypeReqDescription
actionstringyesAction name being recorded (e.g., "generate_code", "summarize_text", "classify_intent")
chain_idstring–Chain identifier for grouping related receipts — auto-generated if not provided
confidencenumber–Confidence score for the output quality, 0.0 to 1.0
constraintsarray–Constraint definitions to evaluate against this receipt (e.g., max_latency_ms, max_cost_usd, min_confidence)
cost_usdnumber–Execution cost in USD (e.g., 0.0045)
expires_atstring–ISO 8601 datetime when this receipt expires (e.g., "2026-12-31T23:59:59Z")
input––Input data passed to the agent — automatically hashed with SHA-256, raw data is never stored
latency_msinteger–Total execution time in milliseconds
metadataobject–Arbitrary key-value metadata attached to the receipt
modelstring–AI model used (e.g., "claude-sonnet-4-20250514", "gpt-4o", "gemini-2.0-flash")
output––Output produced by the agent — automatically hashed with SHA-256, raw data is never stored
output_summarystring–Human-readable summary of the output for audit purposes (max 500 chars recommended)
parent_receipt_idstring–Parent receipt ID for chaining — links this receipt to a previous step
tagsarray–Arbitrary tags for filtering and categorization (e.g., ["production", "critical"])
tokens_ininteger–Input tokens consumed by the model
tokens_outinteger–Output tokens generated by the model
tool_callsarray–Names of tools called during this action (e.g., ["web_search", "code_exec"])
ttl_msnumber–Time-to-live in milliseconds from now — alternative to expires_at

No output schema declared.

No examples provided.

verify_receipt ~139

Cryptographically verify the Ed25519 signature on a stored receipt to confirm it has not been changed since signing. Receipt format v2 signs every field (summary, cost, model, metadata, files and the chain link); legacy v1 receipts sign 12 core fields only. Returns verified, sig_version and covers_all_fields. To check a whole chain for edited, removed or forked receipts, use the CLI: agent-receipts verify-chain <chain_id>. Use to audit receipts before using them as evidence or before completing payments based on agent work.

NameTypeReqDescription
receipt_idstringyesThe receipt ID to verify — must exist in local storage

No output schema declared.

No examples provided.

Install

How do I install the io.github.webaesbyamin/agent-receipts MCP server?

io.github.webaesbyamin/agent-receipts runs locally as an npm package, launched with npx -y @agent-receipts/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @agent-receipts/mcp-server

# add to Claude Code
claude mcp add webaesbyamin-agent-receipts -- npx -y @agent-receipts/mcp-server
Common questions

What is the io.github.webaesbyamin/agent-receipts MCP server?

io.github.webaesbyamin/agent-receipts is an MCP server listed in the public MCP registry as io.github.webaesbyamin/agent-receipts. Ed25519-signed receipts for every AI agent action. Local-first, verifiable, no server required. This page covers its npm package (@agent-receipts/mcp-server).

Is the io.github.webaesbyamin/agent-receipts MCP server safe to use?

io.github.webaesbyamin/agent-receipts scores 66 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.webaesbyamin/agent-receipts MCP server expose?

io.github.webaesbyamin/agent-receipts exposes 24 tools: create_receipt, complete_receipt, track_action, verify_receipt, get_receipt, and 19 more. Their descriptions and schemas cost roughly 4,217 tokens of context every time the server is loaded.

Is the io.github.webaesbyamin/agent-receipts MCP server still maintained?

io.github.webaesbyamin/agent-receipts is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.webaesbyamin/agent-receipts MCP server under?

io.github.webaesbyamin/agent-receipts declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.