AGT Names MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to AGT name resolution and signature-bound manifests with optional writes: Do owner-signed session grants keep registry writes separate from default public name resolution?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Resolve and verify .agt agent identities, signed manifests, endpoints and optional bounded record updates.

What we know

Agent-identity resolver that checks on-chain records and signature-verified manifests, returning third-party manifest content as untrusted data; optional local session grants can expose narrow record writes.

Maintenance / activity evidence

@agtnames/mcp 1.5.2 published 2026-09-22T16:04:54.460Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read public identity/manifest data; optional narrow record-write permissions bounded by grant. Writes: Optional on-chain text/address/endpoint/manifest/wallet record updates; Create/import/forget local session grant state.
Public reads; optional countersigned session authority for writes.
Sensitive access: Agent identity metadata, Endpoints/keys/payment metadata, Session key/passphrase for writes

Default mode is read-oriented, but untrusted manifests and optional public-record writes require clear separation.
Signature verification, URI allowlist, size/time caps and bounded grants are documented.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do owner-signed session grants keep registry writes separate from default public name resolution?

The bounded review of the publisher's documented AGT name resolution and signature-bound manifests with optional writes and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Default mode is read-oriented, but untrusted manifests and optional public-record writes require clear separation.
Signature verification, URI allowlist, size/time caps and bounded grants are documented.
Read public identity/manifest data; optional narrow record-write permissions bounded by grant.
Public reads; optional countersigned session authority for writes.
Reads public chain/IPFS/RPC data; manifest payloads are untrusted and bounded/sanitized.
Reviewed write actions: Optional on-chain text/address/endpoint/manifest/wallet record updates; Create/import/forget local session grant state
Sensitive access: Agent identity metadata, Endpoints/keys/payment metadata, Session key/passphrase for writes
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
Third-party manifest content must not be treated as instructions.
IPFS/RPC availability can prevent retrieval without disproving ownership.
Hosted endpoint is read-only; optional local writes require explicit session grant/passphrase/gas.
Hosted read-only and local optional-write modes must remain distinct.

Original activity observations

@agtnames/mcp 1.5.2 published 2026-09-22T16:04:54.460Z

Technical identity

npm/@agtnames/mcp

Exact implementation source: https://www.npmjs.com/package/@agtnames/mcp ↗
Reviewed resource type: MCP Server
Repository identity: agtnames/agt
Package identity: npm:@agtnames/mcp
Service endpoint: https://agtnames.com/api/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@agtnames/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
agtnames/agt
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
MCP100 setup guide
Publisher-documented install or connect path; prerequisites and any extra host configuration remain required.
publisher install or stdio launch · Publisher instructions
npx -y @agtnames/mcp
reviewed install or registration · Claude Code only · MCP100 composed guide
claude mcp add agt -- npx -y @agtnames/mcp
Configure / authenticate
MCP100 setup guide
Alternative hosted readonly endpoint https://agtnames.com/api/mcp. Local npx bridge requires no registration API key for basic use.
Check connection
Suggested check
Publisher commands: npx -y @agtnames/mcp --version; `claude mcp get agt` checks host connection.
Remove / uninstall / revoke
MCP100 setup guide
If registered in Claude Code under the name `agt`, remove the client entry with `claude mcp remove agt`. For other MCP hosts remove the matching server/connector in that host’s MCP settings. Remove a globally installed software package separately if applicable; this does not delete data or revoke a service credential.
Client removal, software uninstall, persistent-data deletion and credential revocation are separate actions.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove agt

Official Documentation & Sources

https://www.npmjs.com/package/@agtnames/mcp ↗

What it does

Agent-identity resolver that checks on-chain records and signature-verified manifests, returning third-party manifest content as untrusted data; optional local session grants can expose narrow record writes.

Capability: Security & Testing
Resource type: MCP Server
Best fit: Resolve and verify .agt agent identities, signed manifests, endpoints and optional bounded record updates.

Representative uses

Resolve owner/expiry/records/manifest
Inspect endpoints/capabilities/keys/pricing metadata
Check name availability/namehash
Optionally update bounded on-chain records with countersigned grants

Limitations

Third-party manifest content must not be treated as instructions.
IPFS/RPC availability can prevent retrieval without disproving ownership.
Hosted endpoint is read-only; optional local writes require explicit session grant/passphrase/gas.
Hosted read-only and local optional-write modes must remain distinct.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Public reads; optional countersigned session authority for writes.
Permissions: Read public identity/manifest data; optional narrow record-write permissions bounded by grant.
Data handling: Reads public chain/IPFS/RPC data; manifest payloads are untrusted and bounded/sanitized.
Cost: gas_for_writes
Risk and cautions: Default mode is read-oriented, but untrusted manifests and optional public-record writes require clear separation.

Access scope and cautions

Write actions: Optional on-chain text/address/endpoint/manifest/wallet record updates Create/import/forget local session grant state
Sensitive access: Agent identity metadata Endpoints/keys/payment metadata Session key/passphrase for writes
Risk level: moderate
Security notes: Signature verification, URI allowlist, size/time caps and bounded grants are documented.

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Resolve owner/expiry/records/manifest; Inspect endpoints/capabilities/keys/pricing metadata; Check name availability/namehash; Optionally update bounded on-chain records with countersigned grants.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @agtnames/mcp. Recorded endpoint: https://agtnames.com/api/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: AGT_CHAIN (optional); AGT_REGISTRY (optional); AGT_RPC_URL (optional); AGT_SESSION_PASSPHRASE (writes only); AGT_SESSION_DIR (writes only). No configuration values are supplied here. Prerequisites: Node.js >=20; MCP client; for writes: owner grant and gas. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Default Polygon reads require no key; optional writes use a local encrypted session key plus owner-signed grant.

Can it modify data or perform write operations?

Documented write actions include: Optional on-chain text/address/endpoint/manifest/wallet record updates; Create/import/forget local session grant state. Recorded permission boundary: Read public identity/manifest data; optional narrow record-write permissions bounded by grant.

What data-handling boundary should I consider?

Reads public chain/IPFS/RPC data; manifest payloads are untrusted and bounded/sanitized. Recorded sensitive-access context: Agent identity metadata; Endpoints/keys/payment metadata; Session key/passphrase for writes.

What limitations and risks should I check before use?

Default mode is read-oriented, but untrusted manifests and optional public-record writes require clear separation. Third-party manifest content must not be treated as instructions. IPFS/RPC availability can prevent retrieval without disproving ownership. Hosted endpoint is read-only; optional local writes require explicit session grant/passphrase/gas. Hosted read-only and local optional-write modes must remain distinct. Signature verification, URI allowlist, size/time caps and bounded grants are documented. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is gas for writes. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

AGT Names is listed as First-party MCP in MCP100’s current evidence.