Moss Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Moss Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Protocol-level governance for Model Context Protocol (MCP) using ML-DSA-44 post-quantum cryptography.
MOSS MCP integration signs ALL MCP tool calls with NIST FIPS 204 post-quantum cryptography. By intercepting at the MCP transport layer, MOSS governs every tool invocation regardless of the agent framework.
| Approach | Coverage | Bypassable? |
|---|---|---|
| Framework SDKs | Per-framework | Yes |
| MCP Integration | All tools | No |
pip install moss-mcpfrom mcp import Client
from moss_mcp import wrap_mcp_client
# Wrap MCP client - all tool calls are now signed
moss_client = wrap_mcp_client(client, agent_id="my-agent")
# Use normally - signing happens automatically
result = await moss_client.call_tool("send_email", {
"to": "[email protected]",
"body": "Hello"
})from moss_mcp import wrap_mcp_client
moss_client = wrap_mcp_client(client, agent_id="my-agent")from moss_mcp import MOSSMCPServer
server = MOSSMCPServer(agent_id="email-service")
@server.tool()
async def send_email(to: str, body: str) -> str:
return f"Sent to {to}"from moss_mcp import MOSSMCPMiddleware
middleware = MOSSMCPMiddleware(
agent_id="my-service",
block_on_policy_violation=True,
)| Variable | Description | Default |
|---|---|---|
MOSS_API_KEY | Enterprise API key | None (local mode) |
MOSS_API_URL | API endpoint | https://api.mosscomputing.com |
from moss_mcp.server import PolicyViolationError
try:
await moss_client.call_tool("execute_trade", {"amount": 1000000})
except PolicyViolationError as e:
print(f"Blocked: {e.reason}")result1 = await sign_tool_request_async("analyze_data", {...}, agent_id="agent-1")
result2 = await sign_tool_request_async(
"make_decision",
{...},
agent_id="agent-2",
parent_sig=result1.signature_id
)MIT License - see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.