{"name":"io.github.Sequesign/sequesign","slug":"sequesign-sequesign","title":"Sequesign","description":"Cryptographically verifiable receipts of an agent's delegated work, verified offline.","url":"https://mcp.market/server/sequesign-sequesign","rating":null,"grade":"C","score":68,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":23,"stars":0,"forks":0,"downloads_week":96,"last_push_at":"2026-08-21T03:03:37.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/Sequesign/mcp","website":"https://sequesign.com","version":"0.4.1","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"@sequesign/mcp","version":"0.4.1","runtimeHint":"npx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Transport: 'direct' (default; sign locally, an independent witness co-signs) or 'managed' (route through the Sequesign broker for a registered identity).","name":"SEQUESIGN_MODE"},{"description":"Sequesign write-class API key (from the dashboard). Required for managed mode; in direct mode it authenticates the hosted witness.","isSecret":true,"name":"SEQUESIGN_API_KEY"},{"description":"Ed25519 PKCS#8 private-key PEM for the agent. In managed mode, the key registered to your API key. In direct mode, omit to mint an ephemeral key per session.","isSecret":true,"name":"SEQUESIGN_AGENT_PRIVATE_KEY"},{"description":"Directory where sealed receipt packages are written. Defaults to a temporary directory.","name":"SEQUESIGN_PACKAGE_DIR"},{"description":"Base URL of a read-only dynamic template registry (e.g. https://dashboard-api.sequesign.com/v1/registry). When set, direct-mode sessions and the discovery tools resolve templates published there in addition to the bundled ones, falling back to bundled offline. Omit to use only the bundled templates.","name":"SEQUESIGN_TEMPLATE_REGISTRY_URL"},{"description":"Read-only bearer token for an account-scoped template registry (discovery only; never used in verification). Omit for a public registry.","isSecret":true,"name":"SEQUESIGN_TEMPLATE_REGISTRY_TOKEN"}]}],"tools":[{"name":"sequesign_approve_receipt","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_check_action","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_countersign_receipt","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_finalize","description":"Seal the session into a verifiable receipt package and run the SDK's own verification. After finalize the sessionId is closed (removed from memory). Returns the package directory (and the stored receipt URL in managed mode) plus a verification summary.","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_get_template","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_list_templates","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_record_action","description":"Append a signed action to the session's chain. evidence is the structured record of what the agent did or observed; it is hashed and signed. Returns the actionId (use it as attestedActionId for a counterparty attestation).","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_record_approval","description":"Attach a signed approval for an action already recorded in this session (e.g. a human or independent agent reviewer signing off). The action being approved must already be recorded. If no approverPrivateKeyPem is given, an ephemeral key is minted and the approval leg stays present_unverified; supply an enrolled key plus identityProofRef to make it a vouched (present_verified) approval.","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_record_counterparty_attestation","description":"Attach a counterparty's signed confirmation of an action already recorded in this session (e.g. a vendor confirming a corrected invoice total). The SDK derives the content binding from the attested action, so the confirmation cannot be pointed at content the counterparty never saw. If no counterpartyPrivateKeyPem is given, an ephemeral key is minted (present_unverified); supply an enrolled key plu","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_start_session","description":"Open a new receipt-recording session (one signed action chain). Returns a sessionId (the receiptId) used by the other tools. Provide a policyContext object to bind the receipt to a policy (reaches verification level L3_POLICY_BOUND).","write_action":false,"price_micros":0,"input_schema":null},{"name":"sequesign_verify","description":"","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":68,"grade":"C","scanned_at":"2026-11-02T06:13:58.362Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-11-02T06:13:58.320Z","components":{"code":{"score":20,"max":25,"notes":["4 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 73 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"fs.traversal","severity":"medium","component":"code","title":"Path built from user input without normalization","evidence":"dist/index.js: … const receipt = JSON.parse(await readFile(path.join(args.packageDirectory, \"receipt.json\"), \"utf…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@sequesign/mcp","version":"0.4.1","found":true,"license":"Apache-2.0","hasInstallScripts":false,"dependencyCount":3,"publishedAt":"2026-08-21T03:04:07.749Z","repositoryUrl":"git+https://github.com/Sequesign/mcp.git","weeklyDownloads":96}],"repo":{"found":true,"owner":"Sequesign","repo":"mcp","archived":false,"pushedAt":"2026-08-21T03:03:37Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/284468165?v=4","ownerCreatedAt":"2026-05-13T23:45:58Z","license":"Apache-2.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/284468165?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":96,"license":"Apache-2.0","lastPushAt":"2026-08-21T03:03:37.000Z","score":23}}}},"grade_history":[],"reviews":[]}