KryptosAI/mcp-observatory

MCP Receipts: portable trust evidence for agent dependencies

This release makes MCP Receipts a canonical public trust artifact for MCP Observatory.

A scan finds facts. A report explains facts. A receipt makes those facts portable, reproducible, citable, and actionable for CI gates, Safety Index entries, maintainers, agents, and buyers.

Highlights

• New receipt CLI command for standalone JSON or Markdown MCP Receipts.
• New audit --receipt <file> output path to emit receipts alongside JSON, Markdown, or SARIF reports.
• Receipt verdicts with explicit action states: allow, gate, rerun, quarantine, and escalate.
• Buyer-ready and maintainer-ready CTAs inside receipt artifacts.
• Government and enterprise pilot artifacts: procurement one-pager, security due diligence, public guidance crosswalk, and commercial boundary docs.
• Private telemetry command center improvements for growth direction, stale-version adoption, and paid-intent tracking.
• Stronger test coverage around receipt generation, artifact hashing, action receipts, and release behavior.

Try it

npx @kryptosai/mcp-observatory@latest audit npx -y <server-package> --receipt receipt.md --format markdown --output report.md
npx @kryptosai/mcp-observatory@latest receipt npx -y <server-package> --output receipt.json

Next step after a clean receipt

npx @kryptosai/mcp-observatory@latest setup-ci --all --sarif --schedule weekly

Notes

This is safe-mode evidence generation only. MCP Observatory does not execute destructive payloads, exfiltrate secrets, or contact attacker-controlled callbacks.