jpyc-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited jpyc-agent (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
JPYC Agent MCP can be used both as a public MCP endpoint and as a Codex plugin bundle. This repository now uses the repository root as the plugin root so Codex can discover it directly.
Codex should discover the plugin from the repository root via the files below:
.codex-plugin/plugin.json.mcp.jsonskills/jpyc-agent-mcp/SKILL.mdskills/jpyc-agent-mcp/agents/openai.yamlconfig/default.jsonhttps://jpyc-info.com/api/jpyc-agent-mcphttps://jpyc-info.com/api/jpyc-agent-oauthhttps://jpyc-info.com/.well-known/oauth-protected-resourcehttps://jpyc-info.com/.well-known/oauth-authorization-serverhttps://jpyc-info.com/.well-known/openid-configurationhttps://jpyc-info.com/mcp/connecthttps://jpyc-info.com/.well-known/mcp-registry-authThe endpoint is OAuth-protected. Users must log in and grant consent before private wallet operations can run. If you open the MCP endpoint directly in a browser, it redirects to https://jpyc-info.com/mcp/connect. If an MCP client receives 401 unauthorized, it should follow WWW-Authenticate and the resource metadata above to discover the OAuth flow. If ChatGPT/Codex does not surface a full authorization URL automatically, open https://jpyc-info.com/mcp/connect in the browser as the canonical human fallback. Low-level manual auth with /api/jpyc-agent-oauth/start remains available for debugging, but it is not the primary documented path. Clients using the low-level flow must keep the returned auth_session_secret private and present it when polling /api/jpyc-agent-oauth/auth-session.
For the complete OAuth contract and exact URLs, see docs/auth.md and config/oauth.json.
Claude Code does not natively support streamable-http MCP servers. Use mcp-remote to bridge streamable-http + OAuth to stdio.
Add the following to your project .mcp.json or ~/.claude/settings.json:
{
"mcpServers": {
"jpyc-agent-mcp": {
"command": "npx",
"args": [
"mcp-remote",
"https://jpyc-info.com/api/jpyc-agent-mcp"
]
}
}
}On first connection, mcp-remote opens a browser for OAuth consent. After authentication, all tools are available immediately.
This repository defines the OAuth-protected MCP endpoint and the plugin metadata needed for Codex discovery. It does not implement client-side credential storage on behalf of Codex, ChatGPT, or any other MCP client.
Expected client behavior:
https://jpyc-info.com/api/jpyc-agent-mcpauth_statusIf a client can complete browser login but cannot persist and reuse the issued credential locally, the MCP integration is incomplete from the user's point of view. In that case, the fix belongs in the MCP client implementation rather than this repository's server-side OAuth protocol.
For local operator workflows, this repository includes helpers that persist the issued refresh token with DPAPI and reuse it across future sessions:
docs/local-token-cache.mdscripts/jpyc_oauth_cache.py (Python, Windows)scripts/jpyc_oauth_cache.ps1 (PowerShell, Windows)This repository includes server.json for publishing the remote server to the public MCP Registry using the domain-based namespace com.jpyc-info/jpyc-agent-mcp.
For HTTP-based domain verification, host the exact text value v=MCPv1; k=...; p=... at https://jpyc-info.com/.well-known/mcp-registry-auth. In the jpyc-info deployment, that endpoint is served from the MCP_REGISTRY_AUTH environment variable.
auth_statuslist_agent_walletsget_agent_walletcreate_agent_walletget_agent_wallet_balancequote_transfertransfer_jpyclist_transactionsget_transfer_statusread_contractquote_contract_writeexecute_contract_writelist_contract_call_historyget_contract_call_statusDetailed request and response examples are in docs/tools.md.
auth_statuslist_agent_walletscreate_agent_walletTransfer flow:
quote_transfertransfer_jpycContract write flow:
quote_contract_writeexecute_contract_writedocs/auth.md, config/oauth.json, and docs/openai-and-mcp.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.