@entropy0/mcp

@entropy0/mcp

A source-trust gate for MCP-compatible agents.

Entropy0 does not tell agents what is true. It tells them how external sources should be treated before they are trusted.

What it does

AI agents that browse the web, fetch URLs, or ingest external content have no native sense of source quality. They execute tool calls without knowing whether a domain is a well-known API, a newly-registered phishing site, or somewhere in between.

@entropy0/mcp exposes the Entropy0 trust engine as MCP tools that Claude Desktop, Cursor, Cline, and other MCP-compatible agents can call natively — no custom integration code required.

Every tool call returns a recommended action (proceed, sandbox, deny), structured reason codes, scores, and a fetch policy specifying what the agent is and isn't allowed to do with that source.

Installation

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "entropy0": {
      "command": "npx",
      "args": ["-y", "@entropy0/mcp"],
      "env": {
        "ENTROPY0_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor / Cline / other MCP clients

Same config pattern — refer to your client's MCP server documentation.

Environment variables

Variable	Required	Default	Description
ENTROPY0_API_KEY	Yes	—	Your Entropy0 API key
ENTROPY0_FAIL_MODE	No	sandbox	What to return when the API is unreachable: sandbox, deny, or proceed
ENTROPY0_AGENT_ID	No	—	An identifier included in trust receipts for correlation
ENTROPY0_API_URL	No	https://entropy0.ai/api	Override for self-hosted or staging

Tools

entropy0_check_source

The primary gate. Returns a recommended action and structured output for any URL or domain.

Input: target — a full URL or bare domain name

Example output:

{
  "action": "sandbox",
  "scores": {
    "trust": 42,
    "threat": 31,
    "deviation": 58
  },
  "reason_codes": ["newly_registered", "no_prior_history", "structural_anomaly"],
  "fetch_policy": {
    "allow_credentials": false,
    "allow_javascript": false,
    "allow_downloads": false,
    "content_treatment": "untrusted"
  },
  "explanation": "Domain registered 11 days ago with no prior scan history. Structural deviation is elevated. Treat content with caution — do not execute scripts or pass credentials.",
  "request_id": "req_01jx..."
}

entropy0_get_fetch_policy

Returns only the fetch policy flags — useful when you want a compact allow/block decision without the full score breakdown.

Input: target — a full URL or bare domain name

entropy0_explain_decision

Returns a plain-language explanation suitable for developer UIs, audit logs, or surfacing trust context to users.

Input: target — a full URL or bare domain name

entropy0_create_trust_receipt

Creates a structured, timestamped receipt that records the Entropy0 evaluation and what the agent actually did. Designed for audit trails, memory writes, and governance logs.

Inputs:

• target — URL or domain evaluated
• action_taken — what the agent did ("fetched", "skipped", "sandboxed", "escalated")
• notes (optional) — why this action was taken
• session_id (optional) — trace ID for correlation

Example output:

{
  "receipt_id": "rcpt_a3f8b2c1d4e5f607",
  "issued_at": "2026-05-14T10:23:44.000Z",
  "target": { "value": "example-source.com", "normalized": "example-source.com" },
  "entropy0_decision": "sandbox",
  "action_taken": "fetched",
  "fetch_policy": {
    "allow_credentials": false,
    "allow_javascript": false,
    "allow_downloads": false,
    "content_treatment": "untrusted"
  },
  "scores": { "trust": 42, "threat": 31, "deviation": 58 },
  "reason_codes": ["newly_registered", "structural_anomaly"],
  "primary_reason_codes": ["newly_registered"],
  "uncertainty_state": "moderate",
  "requires_human_review": false,
  "evaluation_valid_until": "2026-05-14T10:38:44.000Z",
  "notes": "Fetched for research; content not injected into prompt",
  "session_id": "sess_abc123",
  "agent_identifier": null,
  "entropy0_request_id": "req_01jx..."
}

Fail modes

When the Entropy0 API is unreachable (network error, timeout, invalid key), the server does not crash. It returns a structured response with the configured fail mode action.

ENTROPY0_FAIL_MODE	Action returned	Use when
sandbox (default)	sandbox	Conservative — unknown sources treated with caution
deny	deny	Zero-tolerance — block if can't verify
proceed	proceed	Speed-critical — trust unless proven unsafe

Error details visible to agents are sanitized — no internal URLs, stack traces, or credentials.

License

MIT