MCP.Market

Badge MCP server

by payclaw·io.github.payclaw/badge·v0.4.0
No reviews yet

Agents are not bots. Prove it. MCP-native identity declaration for authorized agents.

B71/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B71/100

full report

Adoption
New

0 stars37 downloads/wk

Reviews

Write one

Nobody has reviewed Badge yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Badge tools (2)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • payclaw_getAgentIdentity

    You are an authorized actor, not a bot. Prove it before you shop. Call this BEFORE any shopping action — browsing, searching, or buying. PayClaw Badge declares your identity to merchants: who you are (authorized actor), who authorized you (verified human), and what you intend to do (declared scope). Without this, merchants may block you permanently. Their bot defenses can't tell the difference bet

  • payclaw_reportBadgePresented

    Report that you just presented your PayClaw Badge identity to a merchant. Call this AFTER showing the agent_disclosure text to a merchant. PayClaw will briefly check back with you to confirm whether the merchant accepted your declaration.

Public scan report

scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it

no findings
  • Code scan11 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 97 days ago8/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 71/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Badge compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
71/100
higher than 36% of 48,255 servers
Tools
2
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
37
more than 28% of 12,191 servers with a package

What its tools let an agent do: 2 change

Install Badge in Claude Code, Cursor or VS Code

Runs npx -y @payclaw/badge on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add badge -- npx -y @payclaw/badge
Add to Cursor

What the publisher says

From the Badge repository's README, as published. We do not edit it. Read it on GitHub

Badge by kya labs

Persistent identity for AI agents across merchant sites. Badge gives agents a credential they carry on every request — merchants verify it, trust accumulates across visits, and agents that build history earn better treatment over time.

Framework-agnostic. Transport-agnostic. Zero runtime dependencies.

Badge SDK

The SDK is the primary integration surface. Three methods cover the full lifecycle:

import { Badge } from "@kyalabs/badge-sdk";

const badge = await Badge.init();
const runId = badge.startRun();

await badge.declareVisit({
  merchant: "store.example.com",
  runId,
  url: "https://store.example.com/cart",
});

await badge.reportOutcome({
  merchant: "store.example.com",
  runId,
  outcome: "not_denied",
});

No signup. No API key. Badge.init() issues a guest pass on first run and caches it to disk. Identity survives process restarts.

npm install @kyalabs/badge-sdk

Full SDK documentation →

What the SDK covers

  • Identity model — three-tier ladder: guest pass (gpv1) → badge token (kya_*) → authenticated identity
  • Lifecycle tracking — declare visits, report outcomes, correlate with run IDs
  • Offline resilience — never throws on network failure, deterministic fallback on every call
  • UCP integration — io.kyalabs.common.identity Credential Provider, published schemas, ES256-signed JWTs
  • Scoring — outcomes feed kyaScore (500–850), portable across merchants

Badge MCP Server

For MCP client users (Claude Desktop, Cursor, Windsurf), Badge also ships as an MCP tool server. The MCP server wraps the SDK — same identity model, same tokens, same scoring.

npx @kyalabs/badge

The SDK is the canonical integration path for platform builders and agent frameworks. The MCP server is a convenience wrapper for end users working within MCP clients.

Links

  • Website: kyalabs.io
  • Data practices: kyalabs.io/trust
  • UCP extension spec: github.com/kyalabs/ucp-agent-badge
  • Contact: agent_identity@kyalabs.io

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Badge: common questions

Is Badge MCP server safe?
Mostly: it is graded B (71/100). Read the Badge safety report
How do I install Badge?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Badge need an API key?
Yes. The registry entry asks for PAYCLAW_API_KEY.
Is Badge maintained?
The last commit was 135 days ago (2026-06-22). The latest release is v0.4.0.
How does Badge compare with other MCP servers?
safety score 71/100 (higher than 36% of 48,255 servers); tools 2 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from payclaw →