Agent Q MCP server

by stelis-dev·io.github.stelis-dev/agent-q·v0.2.2

No reviews yet

Local MCP server for requesting signatures from Agent-Q Firmware.

A86/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A86/100

full report

Adoption

New

0 stars38 downloads/wk

Reviews

Write one

Nobody has reviewed Agent Q yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Agent Q tools (15, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

connect_device
Open a communication session with a known Agent-Q Firmware device. Resolves the target device by deviceId, by purpose, or by the default active device. Sends a connect request that requires Firmware-owned device-local approval. Writes a status handshake to candidate USB serial ports while locating the device. Connect is not signing approval and does not authorize signing. Session is held in Agent-
disconnect_device
End a previously approved Agent-Q Firmware session. Resolves the target device by deviceId, by purpose, or by the default active device. Returns 'not_connected' without contacting Firmware when there is no Agent-Q runtime session. Writes a status handshake to candidate USB serial ports when locating the device. Disconnect does not require physical approval.
get_accounts
List the public accounts (chain, address, public key) held by a provisioned Agent-Q Firmware device over an approved session. Resolves the target device by deviceId, by purpose, or by the default active device. Requires a prior connect_device approval; returns 'not_connected' without contacting Firmware when there is no Agent-Q runtime session. Read-only: no signing, no private material, and no se
get_approval_history
Read a bounded page of Firmware-owned approval history over an approved session. This is not on-chain history and is read-only: no raw requests, session ids, private material, PINs, client names, or full policy documents are returned.
get_capabilities
Read Firmware-authored supported chains, public account schemes, and supported signing methods over an approved session. Resolves the target device by deviceId, by purpose, or by the default active device. Requires a prior connect_device approval; returns 'not_connected' without contacting Firmware when there is no Agent-Q runtime session. signing.authorization is Firmware-authored read-only state
get_device_status
Read live or cached status for a known Agent-Q Firmware device by writing a status handshake to candidate USB serial ports. Resolves the device by deviceId, by purpose, or by the default active device.
identify_devices
Ask discovered Agent-Q Firmware devices to display short identification codes. Writes a status handshake to candidate USB serial ports before sending the identify request.
list_devices
List Agent-Q Firmware devices known to Agent-Q, including local label, purpose routing assignments, and any in-memory connection session metadata. Reads from local Agent-Q process state only; does not contact Firmware.
policy_get
Read the Firmware-owned active policy document over an approved session. Resolves the target device by deviceId, by purpose, or by the default active device. Requires a prior connect_device approval; returns 'not_connected' without contacting Firmware when there is no Agent-Q runtime session. Read-only: no policy update, no signing, no private material, and no session id is ever returned.
policy_proposewrite action
Submit a bounded current-schema active-policy proposal to Agent-Q Firmware. Firmware validates the proposal, shows a device-local policy summary review, starts local PIN approval only after device-local Continue, and returns the terminal policy proposal outcome. This is a request path only: Agent-Q and MCP do not store, apply, or decide policy.
scan_devices
Find USB-connected Agent-Q Firmware devices by writing a status handshake to candidate USB serial ports, and report sanitized candidate failure reasons.
select_device
Set a previously discovered Agent-Q Firmware device as the default active device, or as the active device for a named routing purpose. 'purpose' is local Agent-Q process routing metadata, not security policy. Updates local Agent-Q process state only; does not contact Firmware.
set_device_metadata
Set local metadata for a known Agent-Q Firmware device. 'label' is human-readable local metadata, not a security boundary and not device authority. Pass null to clear the label. Updates local Agent-Q process state only; does not contact Firmware.
sign_personal_message
Request a Firmware-owned Sui personal-message signature over an approved session. Agent-Q and MCP do not store keys, choose authorization, or make signing decisions. The current Firmware implementation signs this method only in user-confirmed authorization mode; policy authorization mode fails closed.
sign_transaction
Request a Firmware-owned transaction signature over an approved session. Agent-Q and MCP do not store keys, choose authorization, or make signing decisions; Firmware uses its local signing authorization mode to select policy authorization or user confirmation and returns signing outcome.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings

Code scan17 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 54 days ago12/15
Maintainer identityregistry namespace matches repository owner7/10

Overall 86/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Agent Q compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 86/100; higher than 75% of 4,460 AI and agents servers
Tools: 15; the typical AI and agents server has 6
Tools that change things: 7%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 38; more than 30% of 1,538 AI and agents servers with a package

What its tools let an agent do: 13 read · 2 change

Install Agent Q in Claude Code, Cursor or VS Code

Runs npx -y @stelis/agent-q on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add agent-q -- npx -y @stelis/agent-q

Add to Cursor

What the publisher says

From the Agent Q repository's README, as published. We do not edit it. Read it on GitHub

Agent-Q

Development status: Agent-Q is an active development project with

hardware-tested Sui signing paths for CLI, MCP, and supported provider flows.

The current StackChan CoreS3 Firmware path uses DEV_PROFILE material intended

for development and demos, not real-asset custody. See Current Status for

storage and profile limitations.

Concept

Agent-Q separates execution surfaces from signing authority.

Execution capability is not signing authority. Agent-Q keeps that boundary explicit for agent-driven and local Sui signing flows.

This README describes the Agent-Q authority-boundary architecture for local Sui signing flows. Current implementation status and profile limitations are tracked in docs/IMPLEMENTATION_STATUS.md.

MCP clients, Sui CLI, and supported Sui app adapters submit bounded requests through the local agent-q host process. AI agent runtimes usually reach Agent-Q through MCP clients. The host relays requests; it does not store signing material, decide policy, or approve signing.

Agent-Q Firmware runs on a separate signing device. It holds signing material and policy for the implemented material profile, checks device state and request contents, applies the implemented policy or device-local approval gate, and returns signed results or explicit failures.

Signing request transport stays local. Signing authority stays on the device. Requesters can ask for signatures, but they cannot hold signing material, choose the authorization mode, or approve their own requests.

Structure

Agent-Q has three roles:

submission, or status requests. MCP clients, Sui CLI, Sui app adapters, and the Admin Page are request surfaces, not signing authorities.

requesters create signing, account, policy read, policy proposal

tools, the local HTTP API, the Admin Page, and adapter-facing request surfaces, then relays bounded requests to Firmware.

the host process is the local agent-q process. It exposes MCP stdio

owns policy checks, device-local approval gates, signing, persistence, and cleanup, and holds signing material for the implemented material profile.

Agent-Q Firmware is the software running on the signing device. Firmware

Agent-Q uses a simple authority model:

state.

requesters create requests;
the host process relays requests;
Firmware handles each implemented request type according to device-local

For signing requests, Firmware decides whether the implemented policy or device-local approval gate permits signing.

Unsupported chains and methods fail explicitly.

Use Agent-Q

See packages/agent-q/README.md.

Sui users can register agent-q-sui-signer as a Sui CLI external signer.

packages/agent-q/README.md.

MCP clients can run the local server and call Agent-Q MCP tools. See

Standard adapter flows. See packages/provider-sui/README.md and packages/sample-sui-dapp-kit/README.md.

Sui app developers can use the Sui provider package for supported Wallet

non-production test web sample. See packages/sample-zklogin-test-web/README.md.

Sui zkLogin browser setup and sign-only transaction checks live in the

local approval, and bounded signing flows should start with firmware/README.md.

Firmware and hardware developers working on device-owned signing policy,

Packages

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Agent Q: common questions

Is Agent Q MCP server safe?: Yes, by our scan: it is graded A (86/100). Read the Agent Q safety report
How do I install Agent Q?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Agent Q need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Agent Q maintained?: The last commit was 92 days ago (2026-08-04). The latest release is v0.2.2.
How does Agent Q compare with other AI and agents MCP servers?: safety score 86/100 (higher than 75% of 4,460 AI and agents servers); tools 15 (the typical AI and agents server has 6); tools that change things 7% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.