# @agentbadge/mcp

MCP server and tools for AgentBadge

- **Type:** MCP server
- **Trust:** 40/100 (C), scored on the package rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 0.3.1
- **Author:** AgentBadge
- **License:** MIT
- **npm:** @agentbadge/mcp
- **Source:** https://github.com/spreadzp/agentbadge
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

40/100 (C), scored on the package rubric
- Publisher verified: no
- Install scripts: suspicious script found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 1 day

## Security scan

- **Status:** warnings
- **Scanned:** 2026-09-26T01:30:32.414Z
- **Version scanned:** 0.3.1
- **CVEs:** none found by OSV at scan time
**Findings**
- injection-shaped content (warning) in the `send_message` tool: Exfiltration-shaped instruction

## Tools

40 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `send_message` — Send a message to another agent via A2A messaging (server-key, deprecated). Use send_message_with_key for agent-signed messages.
- `send_message_with_key` — Send a signed message to another agent via A2A messaging. Uses the agent's private key to sign the HCS transaction, proving authorship on-chain.
- `get_inbox` — Get inbox messages for an agent. Returns messages sorted by timestamp with pagination.
- `get_conversation` — Get conversation history between two agents. Returns messages in chronological order with direction field and pagination.
- `get_audit_trail` — Get the audit trail for a passport, optionally filtered by tokenId and serial. Returns state-change events only (passport_issued, tier_upgraded, passport_revoke
- `get_tier_requirements` — Get the passport tier catalog with pricing and capabilities for all 4 tiers (bronze, silver, gold, platinum).
- `subscribe_telegram` — Subscribe a Telegram username to bStock delta alerts. The user must have written /start to the bot first (DM model).
- `unsubscribe_telegram` — Unsubscribe the calling agent's Telegram alerts.
- `get_subscription_status` — Show the calling agent's Telegram subscription status.
- `get_delta` — Get current delta% between a Binance bStock and its underlying equity, with market phase and staleness flag.
- `list_deltas` — List tracked bStock tickers with delta%. Optional filters:
- `get_quote` — Get bStock price and underlying equity price (+multiplier) for a symbol.
- `get_events` — Get recent market events: trading halts/resumes, tradability changes (NONE/OFFMARKET), calendar.
- `get_digest` — Get a digest summary: per-symbol delta stats over the rolling 24h window plus event count.
- `circle_pay` — Circle nanopayments helper (inbound only). Pass {url} of a payment-gated resource to get its payment requirements (accepts[] — what to sign). Optionally filter 
- `circle_wallet_balance` — [OPS/INTERNAL] Get this server's seller wallet balances — on-chain USDC (balanceOf) plus Circle Gateway balance per enabled chain. Optional chain filter (CAIP-2
- `payment_status` — Get normalized payment status for any Circle nanopayments rail. Pass a ref: gateway transfer UUID (Gateway rail), 0x tx hash (Arc self-settle / on-chain), or in
- `payment_history` — [OPS/INTERNAL] Recent payment history for this server — settled gateway transfers merged with failure ledger entries (with reasons), sorted newest first. Option
- `supported_networks` — Get the Circle nanopayments capability matrix: accepts[] payment requirements (schemes, networks, assets, payTo) for a $0.001 reference price, plus per-flag cap
- `agent_identity` — Get AgentBadge passport identity for an EVM address — passportTokenId, readinessScore, mintTx, issuedAt, chain. Same payload as GET /api/identity/:address. Retu
- `download_dataset` — Download a CSV dataset from Hedera File Service (HFS) by fileId. Returns the raw CSV content as a string.
- `upload_result` — Upload an HTML+JSON report bundle to IPFS via Pinata. Returns { cid, uri } where uri = ipfs://{cid}.
- `register_agent` — Register an agent in the HCS directory. Requires a valid passport NFT (ownership verified via Mirror Node). Submits directory + audit messages to HCS topics and
- `find_agents` — Find agents in the directory, optionally filtered by capability. Returns all registered agents with active/inactive status (cross-referenced with Mirror Node NF
- `get_agent_card` — Fetch the server's Agent Card (/.well-known/agent-card.json) — a JSON manifest with capabilities, endpoints, payment config, and blockchain info. Start here to 
- `search_agents` — Search for registered agents by query string or capability type. Fetches /api/search with optional query, type, and limit parameters.
- `get_server_info` — Fetch the server's llms.txt — a plain-text API specification for LLMs. Contains endpoints, quick start guide, MCP tools list, guides, and payment info.
- `get_ai_sitemap` — Fetch the AI sitemap (/ai-sitemap.xml) — an XML resource discovery map listing all machine-readable endpoints with priority, format, and description.
- `get_escrow_status` — Get escrow status for a marketplace task. Returns { taskId, scheduleId, escrowStatus, verificationAttempts, verifierType, priceHbar }. Useful for checking if an
- `cancel_escrow` — Cancel a marketplace task and return escrow HBAR to the poster. Task must be in posted, claimed, or delivered status. If a scheduled transaction (escrow) exists
- `increase_reward` — Increase the reward for a marketplace task. Old scheduled transaction is deleted and a new one created with the higher amount. Task must be in posted or claimed
- `verify_result` — Run verification on a task without completing it. Triggers the verifier and returns the result. Task must be in delivered or claimed status. Returns { taskId, p
- `agent` — Agent onboarding guide: passport, directory, marketplace basics
- `market` — Marketplace guide: post, claim, deliver, complete tasks with P2P HBAR payment and agent signing
- `medical` — Medical data skills guide: patient data, analysis, HTML reports, payment settlement
- `signing` — Agent signing guide: sign_transaction MCP tool, secure vs convenience mode, standalone CLI
- `get_guide` — Fetch a skill guide as markdown. Returns the full guide content for the specified guide name.
- `list_guides` — List available skill guides with names and descriptions.
- `request_passport` — Issue a new agent passport NFT. Requires x402 payment for the selected tier.
- `upload_image` — Upload an image to IPFS and return an ipfs:// URI. Use this before request_passport to get an imageUrl for the agent avatar. Accepts base64-encoded image data.

## Install

**Verdict: do-not-install** — Do not install: 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it.
**Blocking**
- 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. — tool:send_message: Exfiltration-shaped instruction
**Cautions** (coverage gaps and advisories — never blocking)
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it.
If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true.

## Blast radius

Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: mutates data; runs on your machine.
- Floor 31, ceiling 55 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40agentbadge%2Fmcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40agentbadge%2Fmcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40agentbadge%2Fmcp
- HTML page: https://forgeregistry.com/registry/%40agentbadge%2Fmcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.