Skip to main content

Products

Evidence products for MCP servers, above a free identity.

The MCP Passport is free and stays free. The products below turn the evidence around an MCP server into something a customer, a reviewer or a regulator can use — and each one says plainly what it does not do.

Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.

Which product is for me

Start from the job you need done

Each row names the product for one MCP job, with its availability as TrustOps lists it today. Every row starts from the same free MCP Passport.

  • Give an MCP server a public identity anyone can re-check

    Availability today
    • Free · Open
  • Answer a customer's MCP security and procurement review

    Availability today
    • Paid · Open
  • Review an agent and the MCP servers it calls together

    Availability today
    • Paid · Open
  • Track your MCP servers' binding state, tool-list fingerprint and drift

    Availability today
    • Paid · Open
  • Check a server's public resolver posture before a high-risk tool call

    Availability today
    • Free · Open
  • See what the MCP servers in your workspace declare, and what changed

    Availability today
    • Free · Open
    • Paid · Open
  • State what an MCP server is authorised to do

    Availability today
    • Paid · Open
  • Evaluate a proposed tool call before it happens

    Availability today
    • Paid · Open
  • State the boundary and evaluate calls against it, in one plan

    Availability today
    • Paid · Open
  • Keep the receipts your ECZ-ID activity produces

    Availability today
    • Paid · Open
  • Find out what changed on a server you rely on

    Availability today
    • Free · Open
    • Paid · Open
    • By arrangement · Enquiry
  • See which of your servers need attention now

    Product
    PulseGuard
    Availability today
    • Paid · Open
    • By arrangement · Enquiry
  • Keep a history of identity and lifecycle events

    Product
    LedgerCore
    Availability today
    • Paid · Open
    • By arrangement · Enquiry
  • Trace who operates what, and how it connects

    Availability today
    • Paid · Open
    • By arrangement · Enquiry
  • Actively manage more entities than the free baseline

    Availability today
    • Paid · Open
    • By arrangement · Enquiry
  • Evidence an ICT service for DORA-regulated customers

    Availability today
    • Paid · Open
  • Evidence what is in the software you ship

    Availability today
    • Paid · Open
  • Make a digital counterparty easier to identify

    Availability today
    • Paid · Open
  • Have the implementation work done for you

    Availability today
    • Paid · Open
    • By arrangement · Enquiry

Flagship

The MCP Security & Customer Assurance Kit

The direct MCP product: server, tool, operator and security evidence, assembled once into a customer-ready assurance record.

Flagship · MCP specialist kit

ECZ-ID MCP Security & Customer Assurance Kit

  • Paid · Open

A practical MCP evidence product for vendors and internal platform teams that have to answer the same security, identity and procurement questions for every customer — who operates the server, which tools it exposes, how authorisation is configured, what has been observed and what is actually enforced — without rebuilding the pack for each review.

  • MCP identity and operator evidence: the server's MCP Passport, its Parent record and the bindings a reviewer can re-check on the Resolver.
  • A tool-surface review structure: tool inventory, schemas, input validation, destructive-action safeguards and the provenance of tool descriptions.
  • Authorisation and deployment evidence prompts: how OAuth-based MCP authorization, transport and session state are configured — documented, not replaced.
  • An OBSERVED-versus-ENFORCED register, so every control is stated as either a published observation or an enforcement your own runtime performs.
  • Customer-facing assurance artefacts: a review pack, questionnaire-to-evidence mapping and a Resolver proof page to point reviewers at.

The kit is an evidence product, not a certification of MCP security.

Workflow bundles

When the customer's problem spans more than one entity

An agent calls an MCP server that fronts an API. Bundles assure the connected stack while keeping every identity distinct.

MCP assurance plans

Track the MCP servers you operate, and set posture rules over them

MCP Assurance, Assurance Plus and MCP Policy are operated by TrustOps. Their availability and prices below are TrustOps' own.

Free tools and developer tooling

Check a server before you rely on it, and see what your workspace declares

The MCP Verifier is free. MCP Trust Community is free; MCP Trust Pro and the Developer Trust Pro Bundle are optional software subscriptions. None is a Passport, and none proves anything on its own.

Solutions

DCI, DORA and SBOM — the business problem above the identity

Each sits on the same free MCP Passport and shared ECZ-ID infrastructure. None is required to hold a Passport, and each states its evidence boundary.

Universal operating infrastructure

Operate the estate: the same products for every Passport family

The same products and entitlements serve all seven Passport families. There is no MCP edition — only MCP examples.

Scale

AEC — Active Entity Capacity

  • Paid · Open
  • By arrangement · Enquiry

Scale the estate you actively operate without turning capacity into identity.

For an MCP server: An MCP server you actively manage in production, with live bindings and current state, counts as one active entity — in the same pool as your agents, APIs and other identities.

AEC is capacity, not verification, certification or trust status.

Current state

PulseGuard

  • Paid · Open
  • By arrangement · Enquiry

Know the current state of the ECZ-ID entities you operate.

For an MCP server: For an MCP server: its record's lifecycle and binding state evaluated on demand, with the basis shown, so an operator sees which servers need attention before a customer's re-check does.

PulseGuard reports observed state; it is not a safety verdict or certification.

Evidence

LedgerCore

  • Paid · Open
  • By arrangement · Enquiry

Keep decisive identity and lifecycle evidence without pretending evidence proves the claim inside it.

For an MCP server: For an MCP server: when its binding or operator changes, the lifecycle event is kept with its time, so a customer's reviewer can see what was recorded and when.

A record shows what was recorded and when; it does not make the statement true.

Relationships

ECZ-ID Graph Intelligence

  • Paid · Open
  • By arrangement · Enquiry

See the relationships that make a machine-economy identity meaningful.

For an MCP server: For an MCP server: the path from the server to its operator, the agents that call it, the API behind it and the package that ships it — each a distinct identity.

A Graph relationship is a published relationship, not an endorsement.

Change awareness

ECZ-ID Watch

  • Free · Open
  • Paid · Open
  • By arrangement · Enquiry

Know when public ECZ-ID information you rely on has changed.

For an MCP server: For a team whose agents rely on third-party MCP servers: follow each server's ECZ-ID, see what changed, and re-check the Resolver when its operator, binding or state has changed.

A Watch notification is a change signal, not certification, approval or a safety assessment.

Retained receipts

ECZ-ID Receipts

  • Paid · Open

Keep the receipts your ECZ-ID activity produces, retained in your Receipts Vault and searchable.

For an MCP server: For an MCP server: keep the receipts its ECZ-ID activity produced, so a customer's reviewer can see what was recorded about the server, and when.

Paying for Receipts buys retention: an allowance for your organisation's Receipts Vault. It never makes a receipt valid, verified, anchored or signed.

Authorised objective

ECZ-ID Intent

  • Paid · Open

Define the authorised objective, constraints and validity of what a Passport may do.

For an MCP server: For an MCP server: record the objective and the constraints its tools may act within, authorised by your organisation's owner or administrator.

Payment is not authorisation: an Intent is authorised only by an owner or administrator.

Action evaluation

ECZ-ID Intent Control

  • Paid · Open

Evaluate a proposed action against authority, the Intent, policy and optional counterparty context.

For an MCP server: For an MCP server: evaluate a proposed tool call against the server's Intent and your policy before the call is made, and keep the EVALUATED decision.

A decision is EVALUATED, never ENFORCED, unless an inline enforcement point reports mediating the action.

Boundary and evaluation, one plan

ECZ-ID Intent + Intent Control

  • Paid · Open

Both services in one plan: the authorised boundary and its runtime control.

For an MCP server: For an MCP server: state what its tools may act on, then evaluate each proposed tool call against that boundary and your policy before the call is made.

Payment authorises nothing: an Intent is authorised only by an owner or administrator, and a Passport is not an Intent authorisation.

Professional services

Need a human-reviewed engagement instead of, or alongside, a product?

Fixed-scope MCP professional services with published prices: the Readiness Audit, the Stateless Migration Sprint, EMA/ID-JAG Design & Pilot and the Enterprise MCP Pilot. TrustOps also sells further MCP engagements directly, listed on the services page.

  • MCP Readiness Audit

    £395

    • Paid in full at checkout

    A fixed-scope, human-reviewed assessment of one MCP implementation — what will hold in production, what will not, and what to change first.

    Full scope, exclusions and deliverables
  • Stateless Migration Sprint

    £1,950 total

    • One-off engagement, paid in stages
    • £1,170 due now, then 1 later milestone

    TrustOps also names this engagement MCP Protocol Migration & Modernisation Sprint — the same engagement, bought as the Stateless Migration Sprint: £1,950 total. One-off engagement, paid in stages; £1,170 due now, then 1 later milestone.

    A bounded, hands-on migration of one existing MCP implementation to a stateless, deployment-safe architecture — implemented, tested and documented.

    Full scope, exclusions and deliverables
  • EMA/ID-JAG Design & Pilot

    from £3,500 total

    • One-off engagement, paid in stages
    • £1,750 due now, then 1 later milestone

    Enterprise-managed authorization (EMA) and identity-assertion grant (ID-JAG) design for MCP — cross-app access, token exchange and identity boundaries, piloted against your identity provider.

    Full scope, exclusions and deliverables
  • Enterprise MCP Pilot

    £6,500 total

    • One-off engagement, paid in stages
    • £2,600 due now, then 2 later milestones

    A complete, evidence-backed MCP pilot for one enterprise use case — discovery to handover, with the documentation security and procurement actually ask for.

    Full scope, exclusions and deliverables
Further MCP engagements TrustOps sells directly

Product directory

Every MCP product, its page and its exact TrustOps destination

One row per product, free tool, kit, plan and service this site routes to. The page explains it; the destination is TrustOps' own door for exactly that product, where prices and Buy buttons live.

Every MCP product, its page on this site and its exact TrustOps destination
ProductKindPageDestination
Free MCP PassportFree PassportIts page: Free MCP PassportStart free in TrustOps: Free MCP Passport (continues on trustops.ecocitizenz.com)
ECZ-ID Business PassportFree Passport · paid tiersIts page: ECZ-ID Business PassportEvery tier in TrustOps: ECZ-ID Business Passport (continues on trustops.ecocitizenz.com)
ECZ-ID MCP Security & Customer Assurance KitSpecialist kitIts page: ECZ-ID MCP Security & Customer Assurance KitEvery plan in TrustOps: ECZ-ID MCP Security & Customer Assurance Kit (continues on trustops.ecocitizenz.com)
ECZ-ID Agentic Stack Assurance BundleWorkflow bundleIts page: ECZ-ID Agentic Stack Assurance BundleEvery plan in TrustOps: ECZ-ID Agentic Stack Assurance Bundle (continues on trustops.ecocitizenz.com)
ECZ-ID AI Platform Assurance BundleWorkflow bundleIts page: ECZ-ID AI Platform Assurance BundleEvery plan in TrustOps: ECZ-ID AI Platform Assurance Bundle (continues on trustops.ecocitizenz.com)
ECZ-ID Developer Distribution Assurance BundleWorkflow bundleIts page: ECZ-ID Developer Distribution Assurance BundleEvery plan in TrustOps: ECZ-ID Developer Distribution Assurance Bundle (continues on trustops.ecocitizenz.com)
ECZ-ID Digital Entity Trust SuiteWorkflow bundleIts page: ECZ-ID Digital Entity Trust SuiteEvery plan in TrustOps: ECZ-ID Digital Entity Trust Suite (continues on trustops.ecocitizenz.com)
ECZ-ID MCP Assurance plansMCP assurance planIts page: ECZ-ID MCP Assurance plansEvery plan in TrustOps: ECZ-ID MCP Assurance plans (continues on trustops.ecocitizenz.com)
ECZ-ID MCP Verifier™Developer toolIts page: ECZ-ID MCP Verifier™Its Developer Gateway page: ECZ-ID MCP Verifier™ (opens in a new tab — developers.ecocitizenz.com)
ECZ-ID MCP TrustDeveloper toolIts page: ECZ-ID MCP TrustEvery plan in TrustOps: ECZ-ID MCP Trust (continues on trustops.ecocitizenz.com)
DCI — Digital Counterparty InfrastructureSolutionIts page: DCI — Digital Counterparty InfrastructureEvery plan in TrustOps: DCI — Digital Counterparty Infrastructure (continues on trustops.ecocitizenz.com)
DORA ICT-vendor evidenceSolutionIts page: DORA ICT-vendor evidenceEvery plan in TrustOps: DORA ICT-vendor evidence (continues on trustops.ecocitizenz.com)
SBOM & software-composition evidenceSolutionIts page: SBOM & software-composition evidenceEvery plan in TrustOps: SBOM & software-composition evidence (continues on trustops.ecocitizenz.com)
AEC — Active Entity CapacityPlatform capabilityIts page: AEC — Active Entity CapacityEvery plan in TrustOps: AEC — Active Entity Capacity (continues on trustops.ecocitizenz.com)
PulseGuardPlatform capabilityIts page: PulseGuardEvery plan in TrustOps: PulseGuard (continues on trustops.ecocitizenz.com)
LedgerCorePlatform capabilityIts page: LedgerCoreEvery plan in TrustOps: LedgerCore (continues on trustops.ecocitizenz.com)
ECZ-ID Graph IntelligencePlatform capabilityIts page: ECZ-ID Graph IntelligenceEvery plan in TrustOps: ECZ-ID Graph Intelligence (continues on trustops.ecocitizenz.com)
ECZ-ID WatchPlatform capabilityIts page: ECZ-ID WatchEvery plan in TrustOps: ECZ-ID Watch (continues on trustops.ecocitizenz.com)
ECZ-ID ReceiptsPlatform capabilityIts page: ECZ-ID ReceiptsEvery plan in TrustOps: ECZ-ID Receipts (continues on trustops.ecocitizenz.com)
ECZ-ID IntentPlatform capabilityIts page: ECZ-ID IntentEvery plan in TrustOps: ECZ-ID Intent (continues on trustops.ecocitizenz.com)
ECZ-ID Intent ControlPlatform capabilityIts page: ECZ-ID Intent ControlEvery plan in TrustOps: ECZ-ID Intent Control (continues on trustops.ecocitizenz.com)
ECZ-ID Intent + Intent ControlPlatform capabilityIts page: ECZ-ID Intent + Intent ControlEvery plan in TrustOps: ECZ-ID Intent + Intent Control (continues on trustops.ecocitizenz.com)
MCP Readiness AuditProfessional serviceIts page: MCP Readiness AuditStart in TrustOps: MCP Readiness Audit (continues on trustops.ecocitizenz.com)
Stateless Migration SprintProfessional serviceIts page: Stateless Migration SprintStart in TrustOps: Stateless Migration Sprint (continues on trustops.ecocitizenz.com)
EMA/ID-JAG Design & PilotProfessional serviceIts page: EMA/ID-JAG Design & PilotStart in TrustOps: EMA/ID-JAG Design & Pilot (continues on trustops.ecocitizenz.com)
Enterprise MCP PilotProfessional serviceIts page: Enterprise MCP PilotStart in TrustOps: Enterprise MCP Pilot (continues on trustops.ecocitizenz.com)
MCP Distribution / Certification Readiness PackService sold by TrustOpsIts page: MCP Distribution / Certification Readiness PackStart in TrustOps: MCP Distribution / Certification Readiness Pack (continues on trustops.ecocitizenz.com)
Enterprise MCP Risk & Readiness AssessmentService sold by TrustOpsIts page: Enterprise MCP Risk & Readiness AssessmentStart procurement in TrustOps: Enterprise MCP Risk & Readiness Assessment (continues on trustops.ecocitizenz.com)

Beside your stack, not in its path

ECZ-ID replaces none of the controls you already run.

ECZ-ID complements OAuth, your identity provider, MCP authorization and runtime mediation such as gateways and policy enforcement. It replaces none of them and stays outside the execution path.

  • OAuth

    Its job: Issues and checks the tokens that let a client call a protected server.

    What ECZ-ID adds: Publishes which server and which operator the token is presented to. It issues no tokens.

  • Your identity provider

    Its job: Authenticates your people and workloads and federates them.

    What ECZ-ID adds: Publishes the organisation and the machine identities others can resolve. It authenticates nobody.

  • MCP authorization

    Its job: Decides, per the protocol, whether a given caller may connect and what it may call.

    What ECZ-ID adds: Adds who operates the server on the other side of that decision. It grants and denies nothing.

  • Runtime mediation

    Its job: Gateways, proxies and policy enforcement points allow, block and log calls in the path.

    What ECZ-ID adds: Gives your policy a public record to read. It sits outside the execution path and blocks nothing.