{"id":"03db0c7b-2e11-4b15-a4ca-235e6fe1190a","slug":"install-attest-agent","kind":"mcp","name":"Install-attest-agent","summary":"","owner":"attestagents","repoUrl":"https://github.com/attestagents/Install-attest-agent","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-06-07T03:39:55.000Z","addedAt":"2026-10-14T05:27:19.364Z","logoUrl":"https://avatars.githubusercontent.com/u/291425206?u=a5bc353b24a832e7304f0537070bbebbcf5f00f3&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["utilities"],"tags":[],"runtime":"node","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-17T14:52:54.713Z","sample":false,"url":"https://conduits.dev/tools/install-attest-agent","language":"JavaScript","transports":["stdio"],"install":{"npm":"attest-mcp"},"requirements":{"env":[{"name":"ATTEST_BASE_URL","secret":false,"required":false,"description":"Override the Attest API base URL. Defaults to https://attestagent.org. Only needed for self-hosting or testing."}],"upstreamMayCharge":false},"tools":null,"readme":"# Attest MCP Server\n\n[![npm version](https://img.shields.io/npm/v/attest-mcp.svg)](https://www.npmjs.com/package/attest-mcp)\n[![npm downloads](https://img.shields.io/npm/dm/attest-mcp.svg)](https://www.npmjs.com/package/attest-mcp)\n[![License: MIT](https://img.shields.io/npm/l/attest-mcp.svg)](./LICENSE)\n[![Node.js](https://img.shields.io/node/v/attest-mcp.svg)](https://nodejs.org)\n\n**Trust scanning for agent payments — right inside your AI agent.**\n\n`attest-mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server that lets any MCP-compatible agent (Claude, Cursor, Windsurf, VS Code, and more) scan an agent payment endpoint and get back a letter grade **A–F** with a clear safety verdict **before authorizing a single cent**.\n\nIt covers the agentic payment protocols in use today: **x402, MPP, AP2, L402, and HTTP 402**.\n\n> Powered by [Attest](https://attestagent.org). The scoring engine runs entirely on Attest's servers — this package is a thin client that relays requests, so installing it never exposes any proprietary grading logic.\n\n---\n\n## Why\n\nAutonomous agents are starting to pay for things on their own. A single malicious or misconfigured endpoint can drain funds through impersonation, a blocklisted payout wallet, bait-and-switch pricing, or a broken payment handshake. `attest-mcp` gives your agent a fast, deterministic safety check it can run as a step in its payment loop.\n\n## Tools\n\n| Tool | What it does |\n|------|--------------|\n| `attest_scan` | Runs a full scan on a payment endpoint URL and returns a grade (A–F), a composite score (0–100), a verdict, danger flags, price, and a link to the full report. Call this before paying an unfamiliar endpoint. |\n| `attest_grade` | Fast lookup of the most recent grade for a host that has already been scanned. Good for a quick pre-check. |\n\n## Requirements\n\n- Node.js **18 or newer**\n- Any MCP-compatible client\n\nNo API key required.\n\n## Quick start\n\nRun it directly with `npx` (no install needed):\n\n```bash\nnpx attest-mcp\n```\n\nThe server speaks MCP over stdio, so you normally don't run it by hand — you point your MCP client at it using one of the configs below.\n\n## Client setup\n\n### Claude Desktop\n\nEdit `claude_desktop_config.json` (Settings → Developer → Edit Config):\n\n```json\n{\n  \"mcpServers\": {\n    \"attest\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"attest-mcp\"]\n    }\n  }\n}\n```\n\n### Cursor\n\nAdd to `~/.cursor/mcp.json` (or **Settings → MCP → Add new server**):\n\n```json\n{\n  \"mcpServers\": {\n    \"attest\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"attest-mcp\"]\n    }\n  }\n}\n```\n\n### Windsurf\n\nAdd to `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"attest\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"attest-mcp\"]\n    }\n  }\n}\n```\n\n### VS Code\n\nAdd to `.vscode/mcp.json` in your workspace:\n\n```json\n{\n  \"servers\": {\n    \"attest\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"attest-mcp\"]\n    }\n  }\n}\n```\n\n### Any other MCP client\n\nUse the command `npx -y attest-mcp` with the **stdio** transport.\n\n## Remote server (no install)\n\nPrefer not to install anything? Attest also runs a hosted MCP server you can connect to over Streamable HTTP:\n\n```\nhttps://attestagent.org/api/mcp\n```\n\nPoint any remote-MCP-capable client at that URL.\n\n## Usage example\n\nOnce connected, just ask your agent in natural language:\n\n> \"Before you pay, scan `https://api.example.com/paid-resource` with Attest.\"\n\nThe agent calls `attest_scan` and gets back something like:\n\n```json\n{\n  \"host\": \"api.example.com\",\n  \"grade\": \"A\",\n  \"composite\": 95,\n  \"danger\": false,\n  \"verdict\": \"Valid endpoint, established host.\",\n  \"priceHuman\": \"0.01 USDC\",\n  \"reportUrl\": \"https://attestagent.org/r/abc-123\"\n}\n```\n\n## Configuration\n\n| Environment variable | Default | Description |\n|----------------------|---------|-------------|\n| `ATTEST_BASE_URL` | `https://attestagent.org` | Override the Attest API base URL. Only needed for self-hosting or testing. |\n\n## Security & privacy\n\n- **No secrets, no accounts, no API keys.** The server holds no credentials.\n- **No proprietary logic ships here.** Grading happens server-side; this package only relays requests and formats responses.\n- **Inputs are validated** before any request is made.\n- **Outbound only.** The server makes HTTPS requests to the Attest API and speaks MCP over stdio — it opens no inbound ports.\n- Scanned URLs and results are logged to Attest's public directory. Do not scan endpoints whose URL or response contains private or sensitive information. See [attestagent.org/legal](https://attestagent.org/legal).\n\n## Links\n\n- Website: [attestagent.org](https://attestagent.org)\n- Developer docs: [attestagent.org/developers](https://attestagent.org/developers)\n- Methodology: [attestagent.org/methodology](https://attestagent.org/methodology)\n- X / Twitter: [@Attestagent](https://x.com/Attestagent)\n\n## Contributing\n\nIssues and pull requests are welcome — see [CONTRIBUTING.md](./CONTRIBUTING.md).\n\n## License\n\n[MIT](./LICENSE) © Attest\n"}