MCP Secure -- The HTTPS of the Agent Era

$ npm install mcp-secure Copied!

$ pip install mcp-secure Copied!

6/6

EU AI Act Articles Covered

8/10

OWASP MCP Risks Mitigated

CVE-2025-6514 -- CVSS 9.6

No Identity

Any agent can connect to any MCP server. No way to verify who is calling. No passports, no certificates, no trust.

OWASP MCP Top 10

No Message Signing

JSON-RPC messages travel unsigned. Man-in-the-middle attacks can modify tool calls, inject parameters, or replay requests.

82% Vulnerable

No Tool Integrity

Tool definitions can be tampered with after registration. Tool poisoning and rug pulls are trivial. 82% of MCP servers have path traversal vulnerabilities.

Enterprise Blocker

No Revocation

Compromised agents cannot be revoked. No mechanism to blacklist bad actors. No audit trail. Enterprise calls MCP a "non-starter."

Agent Passports

ECDSA P-256 signed identity credentials. Every agent gets a cryptographic passport that proves who they are.

Message Signing

Every JSON-RPC message wrapped in a signed envelope. Nonce + timestamp prevents replay attacks.

Tool Integrity

Signed tool definitions prevent poisoning and rug pulls. Detect tampering before execution.

Real-Time Revocation

Revoke compromised agents instantly via Trust Authority. Blacklist bad actors across the network.

Trust Levels (L0-L4)

From unsigned (L0) to audited (L4). Enforce minimum trust levels per server. Progressive trust.

On-Premise

Run your own Trust Authority. All verification stays local. Nothing phones home. Full enterprise control.

const mcps = require('mcp-secure');


const keys = mcps.generateKeyPair();
const passport = mcps.createPassport({
  name: 'my-agent',
  version: '1.0.0',
  publicKey: keys.publicKey,
});


const signed = mcps.signPassport(passport, taPrivateKey);


const envelope = mcps.signMessage(mcpMessage, passport.passport_id, keys.privateKey);


const result = mcps.verifyMessage(envelope, keys.publicKey);

from mcp_secure import generate_key_pair, create_passport, sign_passport
from mcp_secure import sign_message, verify_message


keys = generate_key_pair()
passport = create_passport(
    name="my-agent",
    version="1.0.0",
    public_key=keys["public_key"],
)


signed = sign_passport(passport, ta_private_key)


envelope = sign_message(mcp_message, passport["passport_id"], keys["private_key"])


result = verify_message(envelope, keys["public_key"])

✓

✓

✓

✓

✓

✓

✓

✓

No other protocol-level solution covers Articles 12, 13, 14, 15, 16, and 50 in a single install.
OAuth handles auth. TLS handles transport. MCPS handles everything in between.

Scan Your Server Read the IETF Spec

FAIL 13 agents

WARN 17 agents

PASS 9 agents

 docker run -p 8080:8080 agentsign/server