Server data from the Official MCP Registry
Hash-chained HMAC-signed audit log MCP for A2A (agent-to-agent) calls. Every tool-call, agent-ha...
Hash-chained HMAC-signed audit log MCP for A2A (agent-to-agent) calls. Every tool-call, agent-ha...
The Agent Audit Logger MCP implements reasonable authentication and cryptographic signing for audit logging, but has several security and code quality issues that reduce confidence. Key concerns include: a development fallback signing key that should never reach production, an insecure attestation API call that sends sensitive data over HTTPS without certificate pinning or replay protection, environment variable handling that could leak credentials in error messages, and reliance on in-memory storage without persistence guarantees. While the server's stated purpose (A2A audit logging) justifies its permissions, the implementation has gaps that create operational risk. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).
6 files analyzed · 15 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Unverified package source
We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-csoai-org-agent-audit-logger-mcp": {
"args": [
"agent-audit-logger-mcp"
],
"command": "uvx"
}
}
}From the project's GitHub README.
Hash-chained, HMAC-signed audit log for A2A agent calls. Tamper-evident by construction. EU AI Act Art 12 / DORA Art 17 / ISO 42001 clause 9 auditor-ready.
By MEOK AI Labs.
When agent A delegates to agent B who invokes tool C, the causal chain disappears the moment anything fails. Auditors need a record that proves:
Point every agent at this MCP's log tool. Each entry is HMAC-SHA256 signed and hash-chained to the previous entry.
log — append a new (from_agent, to_agent, action, outcome) entry, signed + chainedverify_chain — re-verify the entire chain for a tenant; flags the first breaksearch — query by agent, operation, outcomedaily_stats — per-day log volumesign_day_attestation — Pro: signed end-of-day evidence packet with tip hashpip install agent-audit-logger-mcp
{
"mcpServers": {
"audit": { "command": "agent-audit-logger-mcp" }
}
}
# In your orchestrator MCP, immediately after an A2A delegation:
log(
tenant_id="acme-corp",
from_agent="orchestrator",
to_agent="compliance-scorer",
action="score_dora_article_9",
payload_hash=sha256(payload),
outcome="success",
context_csv="high-risk,financial"
)
# End of day: emit signed attestation for auditor
sign_day_attestation(
tenant_id="acme-corp",
date_utc="2026-04-23",
api_key="meok_pro_..."
)
agent-rate-limiter-mcp — fleet-wide shared rate limiteragent-policy-enforcement-mcp — per-agent-pair IAMa2a-governance-bridge-mcp — map A2A to compliance frameworksmeok-attestation-verify — verify signed certs anywhereMIT — MEOK AI Labs, 2026.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.