Skip to content
MCPSTAMP
MCP server report

ECZ-ID Trust MCP server

com.ecocitizenz/trust-mcp

We checked this server on 2 November 2026 with McpStamp Check engine 1.2.0. It scored 78 of 100 (grade C), higher than 23.7% of the 33,003 registry servers that responded over HTTPS that day. Ready for MCP Registry. Not ready for Claude, ChatGPT and Gemini.

Measured facts

Score
78C
Sign-in
OAuth
Tools listed
7
Protocol version
2025-11-25
Stores

Store readiness

StoreStatusReason
Claude Connectors Directory Not ready Blocked by PKCE S256 advertised and readOnlyHint or destructiveHint on every tool.
ChatGPT app directory Not ready Blocked by issuer equals the authorization_servers entry; token_endpoint_auth_methods_supported (ChatGPT), PKCE S256 advertised, readOnlyHint or destructiveHint on every tool and Explicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT).
Gemini Connected Apps Not ready Blocked by First metadata URL Gemini tries answers 200 with the required fields and PKCE S256 advertised.
Official MCP Registry Ready No blocking check failed.

MCP Registry ready means a valid public remote for the registry, not that the server is listed in a store.

Fixes

7 checks to fix

  1. Fails

    readOnlyHint or destructiveHint on every tool

    tool_annotations

    Blocks Claude and ChatGPT.

    Measured 7/7 tools set neither readOnlyHint nor destructiveHint: resolve_identity, get_current_state, get_resolver_link, explain_status, find_product and 2 more

    Set annotations.readOnlyHint: true on read-only tools and destructiveHint: true on tools that modify or delete data (Claude needs one of them on every tool; ChatGPT needs all three hints, see tool_open_world).

  2. Fails

    PKCE S256 advertised

    auth_pkce

    Blocks Claude, ChatGPT and Gemini.

    Measured code_challenge_methods_supported missing

    Support PKCE and advertise "code_challenge_methods_supported": ["S256"] (MCP clients refuse to proceed without it).

  3. Fails

    Explicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT)

    tool_open_world

    Blocks ChatGPT.

    Measured 7/7 tools miss an explicit hint: resolve_identity, get_current_state, get_resolver_link, explain_status, find_product and 2 more

    Set readOnlyHint, destructiveHint and openWorldHint to explicit true/false on every tool (OpenAI app review requires all three).

  4. Fails

    First metadata URL Gemini tries answers 200 with the required fields

    auth_gemini_discovery

    Blocks Gemini.

    Measured Gemini tries https://login.microsoftonline.com/organizations/v2.0/.well-known/oauth-authorization-server first and gets HTTP 404; it uses that answer and does n

    Make https://login.microsoftonline.com/organizations/v2.0/.well-known/oauth-authorization-server answer HTTP 200 with the authorization server metadata (authorization_endpoint, token_endpoint, response_types_supported ["code"], registration

  5. Fails

    issuer equals the authorization_servers entry; token_endpoint_auth_methods_supported (ChatGPT)

    auth_chatgpt_metadata

    Blocks ChatGPT.

    Measured issuer "https://login.microsoftonline.com/{tenantid}/v2.0" is not exactly the authorization_servers entry "https://login.microsoftonline.com/organizations/v2.0"

    Use the exact metadata "issuer" string in the protected resource metadata authorization_servers list (no trailing-slash or case differences), and list token_endpoint_auth_methods_supported (for example ["none"] for public clients) in the au

  6. Warning

    Client registration (DCR or Client ID Metadata Documents)

    auth_registration

    Measured No registration_endpoint and no client_id_metadata_document_supported

    Add a Dynamic Client Registration endpoint (RFC 7591) or set client_id_metadata_document_supported: true; otherwise every store needs a manually issued client id.

  7. Warning

    refresh_token grant advertised

    auth_refresh

    Measured grant_types_supported missing

    Issue refresh tokens and list "refresh_token" in grant_types_supported so users are not logged out hourly.

19 checks passed, 1 did not run

Passed. Served over HTTPS, initialize over Streamable HTTP, Supported protocol version negotiated, JSON or SSE response Content-Type, JSON-RPC error for unknown method, GET answers SSE or 405, initialize latency, serverInfo name and version, Server instructions, tools capability declared, Sign-in method the store supports (OAuth or none), Protected resource metadata (RFC 9728), Resource metadata "resource" equals the server URL, Authorization server metadata (RFC 8414 / OIDC), tools/list returns tools, inputSchema is an object schema, Tool names are valid and portable, Human-readable title on every tool, Tool descriptions.

Not run. 401 carries WWW-Authenticate resource_metadata. These need an OAuth sign-in flow the check could not reach.

Run a fresh check

This page is the 2 November 2026 snapshot. If you maintain this server and have shipped fixes since then, re-check it. The live check and the badge show the current result, and the next snapshot will pick up the change.

Re-check now

Badge

README badge

The badge shows the latest score for this URL and links to this report.

McpStamp score for ECZ-ID Trust

Markdown

[![McpStamp score](https://www.mcpstamp.com/badge?url=https%3A%2F%2Ftrust-mcp.ecocitizenz.com%2Fmcp)](https://www.mcpstamp.com/r/com-ecocitizenz-trust-mcp/)

HTML

<a href="https://www.mcpstamp.com/r/com-ecocitizenz-trust-mcp/"><img src="https://www.mcpstamp.com/badge?url=https%3A%2F%2Ftrust-mcp.ecocitizenz.com%2Fmcp" alt="McpStamp score" height="20"></a>
Registry entry

About this server

Read-only ECZ-ID Business Passport state lookup via the public ECZ-ID Resolver. Reports state only.
Registry name
com.ecocitizenz/trust-mcp
Remote URL
https://trust-mcp.ecocitizenz.com/mcp
Version
0.2.0
Website
developers.ecocitizenz.com
Checked
2 November 2026, engine 1.2.0, no credentials

The description above is the server's own text from the official MCP Registry. If a result looks wrong, run a fresh check and email support@zovo.one with the report link.

More grade C servers

All grade C servers · All server reports · State of MCP readiness, November 2026