Skip to main content

I Build MCP Servers

You develop or maintain MCP servers that AI agents connect to. This workflow audits your server configuration, creates a verifiable identity, and publishes your server to OpenA2A so users can verify its integrity.

Time to complete: approximately 15 minutes.

Step 1: Audit Your Server Configuration

See how your MCP server looks to security scanners. This identifies configuration issues, missing permissions boundaries, and unsigned manifests before users find them.

opena2a mcp audit
MCP Server Audit
=================

Scanning MCP configurations...

Server: postgres-mcp (stdio)
  Config:     ~/.claude/claude_desktop_config.json
  Tools:      4 registered (query, insert, update, schema)
  Permissions: No boundaries defined
  Signature:  Not signed
  Transport:  stdio (local only)

Findings:
  WARN  No tool-level permission boundaries
  WARN  No input validation schema for 'query' tool
  FAIL  Server manifest not signed
  PASS  Transport restricted to local stdio
  PASS  No hardcoded credentials in config

3 findings. 1 auto-fixable with 'opena2a mcp sign'.

Step 2: Create a Cryptographic Identity

Sign your MCP server configuration with an Ed25519 key. This lets users verify that the configuration has not been tampered with and that it originates from you.

opena2a mcp sign postgres-mcp
MCP Server Signing
===================

Generated Ed25519 key pair for: postgres-mcp
  Public key:   .opena2a/mcp-keys/postgres-mcp.pub
  Private key:  .opena2a/mcp-keys/postgres-mcp.key

Signed configurations:
  claude_desktop_config.json  SHA256:9f3a...c7d2
  mcp-manifest.json           SHA256:b1e4...a8f6

Signature file: .opena2a/mcp-signatures/postgres-mcp.sig

Users can verify with:
  opena2a mcp verify postgres-mcp

Step 3: Run Security Checks

HackMyAgent runs 310 static checks across 69 categories, 29 NanoMind semantic checks across 7 analyzers, and 164 adversarial payloads across 16 categories, including MCP-specific controls for input validation, permission boundaries, and tool safety.

npx hackmyagent secure
Scanning ./postgres-mcp...

  Checks      310 static declared
  Verdict     Usable with caveats. Run 'secure --fix' to auto-remediate where possible.

  Findings
  │ HIGH    No input validation on 'query' tool
  │ MEDIUM  Missing rate limiting on 'query' tool
  │ →  hackmyagent secure --fix

Step 4: Publish Trust Data

Register your MCP server with OpenA2A. This makes your server discoverable and allows users to verify its identity and security posture.

opena2a self-register
Registry Self-Registration
===========================

Registering: postgres-mcp
  Type:       MCP server
  Transport:  stdio
  Tools:      4
  Identity:   Ed25519 (SHA256:9f3a...c7d2)
  Scan:       1 high, 1 medium (hackmyagent secure)

Users can now run:
  ai-trust check postgres-mcp

Step 5: Verify Your Trust Score

Check how your server appears to users querying the trust registry.

ai-trust check postgres-mcp

The answer lists the resolved package name, the trust level, the date and scanner version of the last scan, its critical and high finding counts, and open advisories. The values come from the registry record at query time; run the command to see them for your server.

What You Now Have

  • A complete audit of your MCP server configuration
  • A cryptographic identity that users can verify
  • Security scan results with actionable remediation steps
  • A public trust profile
  • A trust score with a clear path to improvement

Next Steps