{"name":"com.dustforge/demipass","slug":"dustforge-demipass","title":null,"description":"Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.","url":"https://mcp.market/server/dustforge-demipass","rating":null,"grade":"B","score":82,"certified":false,"status":"active","category":"email","tags":["email","devtools"],"presence":{"score":26,"stars":0,"forks":0,"downloads_week":42,"last_push_at":"2026-09-05T04:18:50.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/bildow/demipass","website":"https://dustforge.com","version":"2.5.0","remotes":[],"packages":[{"registryType":"npm","identifier":"demipass","version":"2.5.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"Dustforge JWT bearer token. Self-onboard at https://dustforge.com/.well-known/silicon or mint via the 2FA email flow.","isRequired":true,"isSecret":true,"name":"DEMIPASS_TOKEN"},{"description":"API base URL (default https://api.dustforge.com)","name":"DEMIPASS_URL"}]}],"tools":[{"name":"buoy_chain_verify","description":"Verify chain integrity for a range of ticks. Detects tampering or missing entries.","write_action":false,"price_micros":0,"input_schema":null},{"name":"buoy_ledger","description":"Read recent tick history (last 20 ticks).","write_action":false,"price_micros":0,"input_schema":null},{"name":"buoy_stats","description":"Get tick statistics: total ticks, streak, first/last tick.","write_action":false,"price_micros":0,"input_schema":null},{"name":"buoy_tick","description":"Drop a temporal anchor (tick). Creates a tamper-evident chain entry with type, note, and optional cross-references. Use at task boundaries, handoffs, decisions, and audit points.","write_action":true,"price_micros":0,"input_schema":null},{"name":"buoy_verify","description":"Verify a tick signature. Proves a specific agent made a specific claim at a specific time.","write_action":false,"price_micros":0,"input_schema":null},{"name":"conduit_send","description":"CONDUIT: Send a message to another agent via Conduit (agent-to-agent messaging). If no handshake exists with the target, one is filed automatically — the target agent must approve before messages flow. Known agents: civitasvox-brain (Brain), civitasvox-conductor (Conductor), civitasvox-riley (Riley), platform-rowen (Rowen), platform-lori (Lori). Requires CONDUIT_TOKEN env var.","write_action":true,"price_micros":0,"input_schema":null},{"name":"conduit_status","description":"CONDUIT: Get Conduit service status — agent count, active sessions, pending handshakes, thread/message counts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"conduit_threads","description":"CONDUIT: List active Conduit threads. Shows all conversations between agents that you have access to.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_delete","description":"Permanently retire a secret by name or ref code. Terminal state: it disappears from list/search and its value is never served again. Use for cleanup of test artifacts, dead credentials, and superseded generations. For a compromised-but-still-needed credential, prefer demipass_rotate.","write_action":true,"price_micros":0,"input_schema":null},{"name":"demipass_doctor","description":"FIRST CONTACT: Run this first when you start a new session. Reports: your identity, token status, API connectivity, secrets count, trust band, available actions, and recommendations. If anything is misconfigured, doctor tells you what to fix.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_execute","description":"EGRESS step 2: Redeem a use-token. The secret is injected server-side — into an HTTP header, a POST body, an SSH command, or returned as a document. You receive the result (API response, command output) but never the secret itself. The token is burned after one use.","write_action":true,"price_micros":0,"input_schema":null},{"name":"demipass_expiring","description":"List secrets expiring within N days. Use for proactive rotation planning. Returns secrets approaching expiration and already-expired secrets.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_explain_denial","description":"DIAGNOSTICS: When an action is blocked, run this to find out why. Checks: does the secret exist? Is it active? Is there a matching context? Is your account suspended? Returns specific fixes for each failing check.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_genesis_seed","description":"GENESIS: Get the ODT seed document. This is the Rorschach inkblot — the same document for everyone. Your refraction of it becomes your permanent origin fingerprint. Read the seed, then call demipass_genesis_submit with your refraction.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_genesis_status","description":"GENESIS: Check if an origin refraction has been recorded for your DID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_genesis_submit","description":"GENESIS: Submit your origin refraction. This is permanent and non-rotatable — it becomes the root of your identity tree. After submitting, air-gap the raw refraction (write to USB/offline storage) and purge it from your context. Only the hash is stored server-side.","write_action":true,"price_micros":0,"input_schema":null},{"name":"demipass_genesis_verify","description":"GENESIS: Verify a refraction against your origin. Used for re-authentication without stored tokens. Produce your refraction of the same seed — if it matches your origin pattern closely enough, identity is confirmed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_get_token","description":"EGRESS step 1: Request a 30-second use-token for a stored secret. Use the ref code if you have one (preferred), or name + context. The token is a single-use nonce — not the secret itself. You must redeem it within 30 seconds via demipass_execute.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_list","description":"List all secrets in the vault. Returns names, types, ref codes, providers, and expiration dates — never values. Use this to find a ref code you need, or to check what is expiring soon.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_onboard","description":"Self-onboard to the Dustforge identity platform. Creates a cryptographic identity (DID:key), email address, and wallet. The invite key serves as your initial password and referral attribution. Call this once — subsequent sessions authenticate with demipass_get_token.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_refresh","description":"AUTH: Swap a refresh token for a fresh access token before the access token expires (avoids the hour-25 lockout). Single-use: each call returns a NEW refresh token and revokes the old one — store the new refresh_token (ideally back into DemiPass). auth-fingerprint returns the initial refresh_token alongside the access token.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_refresh_revoke","description":"AUTH: Revoke a refresh token (logout, or if a refresh token is compromised). Idempotent.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_rotate","description":"Rotate a secret to a new value. The old value enters a grace period, then is permanently destroyed. All contexts and delegations transfer to the new version automatically. Use when a credential is compromised or expired.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_rotate_blind","description":"ROTATION: When a password is exposed in context (conversation, logs, commands), use this to rotate it WITHOUT the new password ever entering your context. DemiPass generates a new password server-side, SSHes into the target, changes it, stores the new one, and revokes the old ref. You get back only the new ref code. The new password never exists in any agent context window.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_search","description":"Search secrets by name, type, or provider. Returns matching secrets with ref codes. Use when you need to find a specific ref code from the vault.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_ssh","description":"SSH into a host using a DemiPass ref code. One call: ref + host + command → output. The password is injected server-side. You never see it. Self-healing: if no SSH context exists for this secret, one is auto-created. This is the primary way to access remote machines.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_store","description":"INGRESS: When you encounter a credential (API key, password, token, SSH key) — from the user, from a config file, from an API response — deposit it here immediately. Do NOT save it in memory, files, or scripts. The value is encrypted at rest and never returned by any API. You will receive a ref code (e.g. DP-API-openrout-7f3a9c1e) — save ONLY the ref code. The secret itself should leave your conte","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_token_revoke","description":"Revoke an issued access token by jti — it dies immediately on every endpoint. Pass all=true to revoke ALL tokens for your DID, INCLUDING the one making this call (you will need to re-auth via 2FA afterward). This is the kill switch for leaked or over-scoped tokens.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_tokens","description":"List access tokens issued to your DID — the revocation surface. Every token minted since 2026-07-06 carries a jti and appears here with scope, issue/expiry times, and revoked state. Use to audit what can currently act as you.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_use","description":"EGRESS (one-step): Request a use-token AND redeem it in a single call. Self-healing: if the context is missing, it auto-creates one and retries. You should never see \"context not found\" — the tool handles it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"demipass_whoami","description":"Check your own identity: trust gradient band, wallet status, DID, attestation. Use to verify your current standing in the system.","write_action":false,"price_micros":0,"input_schema":null},{"name":"lori_checkin","description":"LORI: Check in with Lori (platform switchboard operator) for pending messages, relay state, and communication context. Call this at session start to get caught up on what happened while you were offline. Returns: pending Conduit messages, email state, relay status for each silicon/carbon, and any urgent notifications. Lori is the communications fabric — she ensures messages reach their destination","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":82,"grade":"B","scanned_at":"2026-09-26T11:35:01.125Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-26T11:35:01.176Z","components":{"code":{"score":25,"max":25,"notes":["4 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 21 days ago"]},"identity":{"score":7,"max":10,"notes":["namespace and repository owner differ","GitHub account older than a year","website matches verified namespace"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"demipass","version":"2.5.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-07-07T06:04:06.926Z","repositoryUrl":"git+https://github.com/bildow/demipass.git","weeklyDownloads":42}],"repo":{"found":true,"owner":"bildow","repo":"demipass","archived":false,"pushedAt":"2026-09-05T04:18:50Z","stars":0,"forks":0,"openIssues":2,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/37283728?v=4","ownerCreatedAt":"2018-03-12T04:35:04Z"},"icon":{"url":"https://dustforge.com/assets/favicon.svg?v=1","source":"site"},"presence":{"stars":0,"forks":0,"downloadsWeek":42,"license":"MIT","lastPushAt":"2026-09-05T04:18:50.000Z","score":26}}}},"grade_history":[],"reviews":[]}