emercoin-identity — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited emercoin-identity (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This project (steledger-gateway) exposes the Emercoin blockchain as an identity + memory layer for AI agents through the `emercoin-agent` MCP server. Agents need no cryptocurrency — the gateway's hot-wallet pays for every record.
Read AGENTS.md for the full rationale and trust model. This skill is the operational checklist for using the tools.
in a tamper-evident way → store its hash on-chain (keep the body off-chain).
The MCP server must be configured (see AGENTS.md → Quickstart). It needs the gateway reachable at GATEWAY_URL. Auth is a session JWT obtained with the device-flow login() + login_poll(), or a pre-set GATEWAY_JWT env var.
| Tool | Use it to |
|---|---|
node_status() | check the node is synced before relying on reads |
login() + login_poll(session_id) | get a session JWT via GitHub device flow (GitHub identity = root of trust) |
register_identity(address, metadata?) | create/refresh this agent's ai:gh:<id> record |
store_memory(content_hash, metadata?) | record one memory/research hash |
store_memory_batch(records) | record many hashes in ONE atomic transaction |
read_record(name) | read any record by NVS name |
login() → show the returned user_code + verification_uri to the user;after they authorize on GitHub, login_poll(<session_id>) caches the JWT.
manages the gateway wallet; for a self-sovereign key, generate one and supply its address). You can register first and add/rotate the address later.
register_identity(<address>, {"role": "...", "model": "..."}).This writes ai:gh:<github_id> binding the GitHub id ↔ address on-chain. Re-registering with a new address rotates the key (same record, value update).
store_memory("<sha256>", {"kind": "research", "ref": "<uri>"}).store_memory_batch([{ "content_hash": "...", "metadata": {...} }, ...])— atomic and cheaper (one transaction). Prefer this for >1 record.
read_record("ai:gh:<id>") for an identity, orread_record("ai:gh:<id>:mem:<hash>") for a memory record.
status: "pending" (in the mempool) and flips tostatus: "confirmed" after the next block (typically within ~10 min, but a block can land in seconds or take 40+ min). Don't treat pending as failure; re-read later to confirm.
NVS records are public and permanent for their lifetime.
ai:gh:<id> (identity),ai:gh:<id>:mem:<hash> (memory). Don't write outside your namespace.
extend anything that must persist.
login() + login_poll() first (or set GATEWAY_JWT).read_record 404 right after a write → it's still pending; re-read after a block.node_status().synced — reads of confirmed names need a synced node.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.