@entropy0/mcp

@entropy0/mcp

A source-trust gate for MCP-compatible agents.

Entropy0 does not tell agents what is true. It tells them how external sources should be treated before they are trusted.

What it does

AI agents that browse the web, fetch URLs, or ingest external content have no native sense of source quality. They execute tool calls without knowing whether a domain is a well-known API, a newly-registered phishing site, or somewhere in between.

@entropy0/mcp exposes the Entropy0 trust engine as MCP tools that Claude Desktop, Cursor, Cline, and other MCP-compatible agents can call natively — no custom integration code required.

Every tool call returns a recommended action (proceed, proceed_with_caution, sandbox, escalate_to_human, or deny), structured reason codes, scores, and a fetch policy specifying what the agent is and isn't allowed to do with that source.

Installation

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "entropy0": {
      "command": "npx",
      "args": ["-y", "@entropy0/mcp"],
      "env": {
        "ENTROPY0_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor / Cline / other MCP clients

Same config pattern — refer to your client's MCP server documentation.

Environment variables

Variable	Required	Default	Description
ENTROPY0_API_KEY	Yes	—	Your Entropy0 API key
ENTROPY0_FAIL_MODE	No	sandbox	What to return when the API is unreachable: sandbox, deny, or proceed
ENTROPY0_AGENT_ID	No	—	An identifier included in trust receipts for correlation
ENTROPY0_API_URL	No	https://entropy0.ai/api	Override for self-hosted or staging

Tools

entropy0_decide_url

The primary gate for URL evaluation. Returns a recommended action and structured output for any URL.

Use before any agent fetches, summarizes, cites, downloads, or follows a URL.

Input:

• url — full URL to evaluate (e.g. https://example.com/path?q=1)
• interaction_kind — what the agent is about to do: navigate, fetch, enrich, download_file, submit_credentials, initiate_payment (default: fetch)
• interaction_mode — read_only, transactional, or privileged (default: read_only)
• interaction_sensitivity — low, medium, high, or critical (default: medium)
• policy_profile — open, balanced, strict, or critical (default: balanced)

Example output:

{
  "action": "sandbox",
  "scores": {
    "trust": 42,
    "threat": 31,
    "deviation": 58
  },
  "reason_codes": ["NEWLY_REGISTERED_DOMAIN", "LOW_EVIDENCE_CONFIDENCE", "HIGH_INFRASTRUCTURE_DEVIATION"],
  "fetch_policy": {
    "allow_fetch": true,
    "allow_credentials": false,
    "allow_javascript": false,
    "allow_downloads": false,
    "content_treatment": "untrusted"
  },
  "explanation": "Domain registered 11 days ago with no prior scan history. Structural deviation is elevated. Treat content with caution — do not execute scripts or pass credentials.",
  "request_id": "dec_a3f1b2c4d5e6f7a8b9c0d1e2f3"
}

entropy0_decide_domain

Evaluate a domain's trust posture. Same output shape as entropy0_decide_url.

Use for domain-level checks where the full URL path is not needed — for example before adding a domain to an allowlist, before connecting to an API on that domain, or before resolving it in a multi-step workflow.

Input: domain — bare domain name (e.g. example.com), plus the same interaction/policy params as entropy0_decide_url.

entropy0_filter_urls

Evaluate a list of up to 20 URLs or domains in parallel and return them grouped by trust decision: approved, sandboxed, or denied.

Use this after a web search to gate which sources the agent may fetch before ingestion.

Input: urls — array of 1–20 full URLs or bare domain names.

Example output:

{
  "approved": [
    {
      "url": "https://github.com",
      "action": "proceed",
      "fetch_policy": { "allow_fetch": true, "allow_credentials": true, "content_treatment": "trusted" },
      "reason_codes": ["STRONG_BRAND_ALIGNMENT", "LONG_OPERATIONAL_HISTORY"],
      "scores": { "trust": 96, "threat": 2, "deviation": 11 }
    }
  ],
  "sandboxed": [],
  "denied": [
    {
      "url": "https://githvb.com",
      "action": "deny",
      "fetch_policy": { "allow_fetch": false, "content_treatment": "blocked" },
      "reason_codes": ["BRAND_MISMATCH", "NEWLY_REGISTERED_DOMAIN"],
      "scores": { "trust": 19, "threat": 81, "deviation": 74 }
    }
  ],
  "summary": "1 approved, 0 sandboxed, 1 denied — 2 evaluated"
}

entropy0_get_fetch_policy

Returns only the fetch policy flags — allow_fetch, allow_credentials, allow_javascript, allow_downloads, and content_treatment.

Use when you only need the allow/block flags and not the full score breakdown. For the complete decision, use entropy0_decide_url or entropy0_decide_domain.

Input: target — a full URL or bare domain name.

entropy0_explain_decision

Returns a plain-language explanation of the decision, including key evidence and reason codes. Safe to surface in a developer UI or audit log.

Input: target — a full URL or bare domain name.

entropy0_create_trust_receipt

Creates a structured, timestamped receipt that records the Entropy0 evaluation and what the agent actually did. Designed for audit trails, memory writes, and governance logs.

Every external source should get a trust receipt before it enters the agent workflow.

Inputs:

• target — URL or domain evaluated
• action_taken — what the agent did ("fetched", "skipped", "sandboxed", "escalated")
• notes (optional) — why this action was taken
• session_id (optional) — trace ID for correlation

Example output:

{
  "receipt_id": "rcpt_a3f8b2c1d4e5f607",
  "issued_at": "2026-05-14T10:23:44.000Z",
  "target": { "value": "example-source.com", "normalized": "example-source.com" },
  "entropy0_decision": "sandbox",
  "action_taken": "fetched",
  "fetch_policy": {
    "allow_fetch": true,
    "allow_credentials": false,
    "allow_javascript": false,
    "allow_downloads": false,
    "content_treatment": "untrusted"
  },
  "scores": { "trust": 42, "threat": 31, "deviation": 58 },
  "reason_codes": ["NEWLY_REGISTERED_DOMAIN", "HIGH_INFRASTRUCTURE_DEVIATION"],
  "primary_reason_codes": ["NEWLY_REGISTERED_DOMAIN"],
  "uncertainty_state": "moderate",
  "requires_human_review": false,
  "evaluation_valid_until": "2026-05-14T10:38:44.000Z",
  "notes": "Fetched for research; content not injected into prompt",
  "session_id": "sess_abc123",
  "agent_identifier": null,
  "entropy0_request_id": "dec_a3f1b2c4d5e6f7a8b9c0d1e2f3"
}

Fail modes

When the Entropy0 API is unreachable (network error, timeout, invalid key), the server does not crash. It returns a structured response with the configured fail mode action.

ENTROPY0_FAIL_MODE	Action returned	Use when
sandbox (default)	sandbox	Conservative — unknown sources treated with caution
deny	deny	Zero-tolerance — block if can't verify
proceed	proceed	Speed-critical — trust unless proven unsafe

Error details visible to agents are sanitized — no internal URLs, stack traces, or credentials.

License

MIT