
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@provenonce/mcp
Advanced tools
Provenonce Skill — MCP server giving any AI agent cryptographic identity, SIGIL, heartbeat, passport, and beats proofs.
Provenonce Skill — Give any AI agent cryptographic identity in under 60 seconds.
Add this skill to your agent and it gets:
Add to ~/.claude/claude_desktop_config.json:
{
"mcpServers": {
"provenonce": {
"command": "npx",
"args": ["-y", "@provenonce/mcp"]
}
}
}
That's it. On first use, your agent calls provenonce_register and gets a permanent identity.
{
"mcpServers": {
"provenonce": {
"command": "npx",
"args": ["-y", "@provenonce/mcp"],
"env": {
"PROVENONCE_API_KEY": "pvn_...",
"PROVENONCE_AGENT_HASH": "0x..."
}
}
}
}
If you're a developer embedding this skill in your framework, include your partner ref token:
{
"env": {
"PROVENONCE_SKILL_REF": "your16hextoken"
}
}
You earn 30% of every SIGIL purchased by agents you deploy. Register at POST /api/v1/skill/register.
| Tool | What it does | Auth needed |
|---|---|---|
provenonce_register | Auto-register agent, get hash + API key | None |
provenonce_status | Full current state (SIGIL, balance, hints) | Yes |
provenonce_purchase_sigil | Buy SIGIL, unlock heartbeat + passport | Yes + SOL tx |
provenonce_heartbeat | Submit liveness proof | Yes + SOL tx |
provenonce_get_passport | Get signed identity document | Yes |
provenonce_beats_proof | Compute work proof, get receipt (for spawn/resync) | None |
provenonce_submit_beats | Compute VDF beats and credit lifetime beat count | Yes |
provenonce_verify_agent | Check another agent's identity | None |
provenonce_spawn | Spawn a child agent | Yes |
provenonce_get_lineage | Get full ancestry chain | None |
Day 1: provenonce_register → hash minted, credentials saved
provenonce_beats_proof → works immediately, no SIGIL needed
provenonce_status → { sigil: null, _hint: "Call provenonce_purchase_sigil..." }
Day 7: provenonce_purchase_sigil → pay SOL, SIGIL issued
provenonce_heartbeat → now unlocked
provenonce_get_passport → signed identity doc, share with anyone
provenonce_verify_agent → verify a counterparty before trusting them
| Variable | Description | Default |
|---|---|---|
PROVENONCE_API_KEY | Agent API key (pvn_...) | Read from ~/.provenonce/config.json |
PROVENONCE_AGENT_HASH | Agent hash (0x...) | Read from ~/.provenonce/config.json |
PROVENONCE_SKILL_REF | Your partner ref token (for rev share) | None |
PROVENONCE_REGISTRY_URL | Registry URL override | https://provenonce.io |
import { PROVENONCE_TOOLS } from '@provenonce/mcp/tools';
// OpenAI
const tools = PROVENONCE_TOOLS.map(t => ({ type: 'function', function: t }));
// LangChain / custom — use PROVENONCE_TOOLS for schema, implement handlers yourself
Credentials are stored in ~/.provenonce/config.json with chmod 600 permissions (Unix).
On Windows, use environment variables (PROVENONCE_API_KEY + PROVENONCE_AGENT_HASH) — file permissions are not enforced.
provenonce_kyc — KYC / identity class upgradeprovenonce-py)FAQs
Provenonce Skill — MCP server giving any AI agent cryptographic identity, SIGIL, heartbeat, passport, and beats proofs.
The npm package @provenonce/mcp receives a total of 58 weekly downloads. As such, @provenonce/mcp popularity was classified as not popular.
We found that @provenonce/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.