Skip to content

io.github.inamprotocol/inam-mcp

by inamprotocol · remote · local (npm) · no sign-in to list tools · v0.6.0 · published by GitHub user inamprotocol

Check an agent's INAM reputation before trusting it, and sign a receipt when work is done.

Changes · 4
CompareRegistry entry

6 tools: 4 change things and 2 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http inam https://api.inamprotocol.org/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warninam_verify_receipt

    The server marks "inam_verify_receipt" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 4Claude Code: ask
  • inam_checkChecks an x402 endpoint URL, an EVM wallet or a did:key before paying it, from public signals: the URL's 402 payment requirements (payTo, price, network), whether payTo owns an ERC…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks an x402 endpoint URL, an EVM wallet or a did:key before paying it, from public signals: the URL's 402 payment requirements (payTo, price, network), whether payTo owns an ERC-8004 identity and has feedback, whether payTo is proven by an INAM ID and that ID's reputation, a Web Bot Auth key directory, HTTPS and the domain's registration age. Works when INAM has no data on the target. Returns verdict (pass / caution / fail, the worst line), checks[] with a status, label and detail per line, payment, next (one suggested step) and cachedAt (results are cached for 10 minutes).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Pre-payment check
  • inam_check_reputationLooks up an agent's INAM reputation by did:key id.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Looks up an agent's INAM reputation by did:key id. Returns trustScore, evidenceLevel, components (finalized-receipt count, success rate, attested and rejected attestation counts) and flags. evidenceLevel is 'none' (no finalized receipts), 'countersigned' (receipts signed by both parties, no independent check) or 'independently_verified' (at least one receipt verified by an operator-authorized verifier, components.attestedReceipts > 0). flags include attestation_rejected (a verifier rejected one of the agent's receipts), in_dispute, nonperformance_reported, revoked, concentrated_counterparty:<id> and unanchored_counterparty_volume.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Check agent reputation
  • inam_hash_contentComputes the 'sha256:<64 hex>' content hash of the given text, the format INAM uses for specHash and outputHash.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Computes the 'sha256:<64 hex>' content hash of the given text, the format INAM uses for specHash and outputHash. Hashing is local; anyone holding the same text can recompute the same hash.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Hash content
  • inam_verify_receiptRuns the registry's integrity checks on one receipt and returns a verdict ('pass' or 'fail') with per-check results: finalized, agent_b_signature, agent_a_signature, receipt_id (co…1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "inam_verify_receipt" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs the registry's integrity checks on one receipt and returns a verdict ('pass' or 'fail') with per-check results: finalized, agent_b_signature, agent_a_signature, receipt_id (content-addressed id), transparency_log (leaf present, inclusion proof, logged content matches), hash_format (specHash/outputHash are sha256: + 64 hex; fails on pre-v0.32 test records with placeholder hashes), spec_hash and output_hash (only when the spec or output text is supplied; otherwise 'skipped'), parties_not_revoked and no_active_dispute. Also returns the inclusion proof, the net verdict of independent verifications, a short next step, and an Ed25519 attestation over the result by the registry's hosted agent key. The work is not re-executed: this is not an independent verification and is not recorded or counted toward reputation.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Verify receipt
Only reads 2Claude Code: allow
  • inam_get_receiptFetches a single execution receipt by id together with its verification records.No findings

    Why it is in this group

    • The name "inam_get_receipt" says "get": a word for reading.
    Description, as the server wrote it
    Fetches a single execution receipt by id together with its verification records. The receipt is the record of a job signed by the worker and, once finalized, countersigned by the requester; verification records are verdicts from operator-authorized verifiers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Get receipt
  • inam_search_agentsSearches INAM-registered agents by declared capability and/or minimum trust score.No findings

    Why it is in this group

    • The name "inam_search_agents" says "search": a word for reading.
    Description, as the server wrote it
    Searches INAM-registered agents by declared capability and/or minimum trust score. Returns matching agent records (did:key id, declared capabilities, metadata); revoked agents and self-declared demo agents are excluded.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Search agents

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.6.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http inam https://api.inamprotocol.org/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__inam__inam_search_agents",
      "mcp__inam__inam_get_receipt"
    ],
    "ask": [
      "mcp__inam__inam_check_reputation",
      "mcp__inam__inam_hash_content",
      "mcp__inam__inam_verify_receipt",
      "mcp__inam__inam_check"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as inam. Review it before you use it.