
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
@vouchscore/mcp-server
Advanced tools
MCP server for Vouch: ask an agent's trust score, a wallet's, or a payee's before your agent pays them.
MCP tools for checking vet402 trust scores from Claude Desktop, Cursor, or any MCP client — so an agent can ask "is this wallet safe to pay?" before it pays.
Published on npm. No clone, no build: your MCP client launches it with npx.
npm install -g @vouchscore/mcp-server # optional — the configs below use npx
| Tool | Description |
|---|---|
check_agent_trust | Score by agent ID (optional wallet verification) |
check_wallet_trust | Score by wallet (x402 payer path) |
check_payee_trust | Buyer-side: score a payment recipient before paying it (score + dataDepth + recommendation) |
explain_trust_score | Human-readable score breakdown (includes x402 + dataCoverage) |
attest_x402_payment | Write settlement attestation after payment verification |
Get a key at vet402.com/dashboard/keys,
then add this to ~/Library/Application Support/Claude/claude_desktop_config.json
(%APPDATA%\Claude\claude_desktop_config.json on Windows) and restart the app:
{
"mcpServers": {
"vouch": {
"command": "npx",
"args": ["-y", "@vouchscore/mcp-server"],
"env": {
"VOUCH_API_URL": "https://vet402.com/api/v1",
"VOUCH_API_KEY": "vouch_live_your_key_here"
}
}
}
}
Same block in ~/.cursor/mcp.json (or a project-local .cursor/mcp.json):
{
"mcpServers": {
"vouch": {
"command": "npx",
"args": ["-y", "@vouchscore/mcp-server"],
"env": {
"VOUCH_API_URL": "https://vet402.com/api/v1",
"VOUCH_API_KEY": "vouch_live_your_key_here"
}
}
}
}
Confirm it starts before wiring it into a client:
echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' \
| VOUCH_API_KEY=vouch_live_your_key_here npx -y @vouchscore/mcp-server
A serverInfo line comes back on stdout. The package also installs a
vouch-mcp binary, if you prefer npx -p @vouchscore/mcp-server vouch-mcp.
| Variable | Default | Description |
|---|---|---|
VOUCH_API_KEY | — | Required. Create one here. |
VOUCH_API_URL | https://vet402.com/api/v1 | API base URL. Override only to point at another deployment. |
0.1.0 defaults
VOUCH_API_URLtohttp://localhost:3000/api/v1— a development default that shipped by accident. The configs above set it explicitly, so they are correct on every version; 0.1.1 and later default to the hosted API.
git clone https://github.com/kzmttkc/agent-trust.git
cd agent-trust/packages/mcp-server && npm install && npm run build
# then point your client at "command": "node", "args": ["<abs>/dist/index.js"]
@vouchscore/sdk — buyer side (SpendGuard)@vouchscore/middleware — seller side (x402 request gate)MIT · vet402
FAQs
MCP server for Vouch: ask an agent's trust score, a wallet's, or a payee's before your agent pays them.
We found that @vouchscore/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.