MCP and AI Agent Trust Inside VS Code: See What Can Act Before You Let It Act
Share
Developer environments are changing.
The question used to be mostly about what code was running.
Now it is increasingly about what an MCP server can expose, what an AI agent can reach, what authority a tool chain inherits, and what changed since the last time anyone looked.
MCP servers can expose tools, schemas and access paths to developer environments. AI agents can combine those tools with files, APIs, credentials and external actions. As those systems become more useful, they also become harder to review manually.
That creates a simple operating problem:
Before an MCP connects or an agent acts, can you see what you are actually relying on?
Today, ECZ-ID is releasing the latest production version of ECZ-ID MCP Trust and ECZ-ID Agent Trust for VS Code and compatible Open VSX environments.
Both products have a genuinely useful Community edition that is free and local-first, with optional Pro capabilities for developers and teams that need deeper analysis or local MCP mediation.
The new developer trust problem
An MCP configuration can look harmless when it is first added.
Then a server changes.
A tool schema changes.
A new environment variable appears.
A command changes.
An endpoint moves.
A server exposes new capability.
An AI agent gains another tool.
A new MCP dependency appears in the workspace.
The risk is not simply whether something looked acceptable at installation time.
The more difficult question is:
What is true now, and what changed since the last review?
Static approval is not enough for systems whose authority can evolve.
That is the problem ECZ-ID MCP Trust and Agent Trust are designed to make easier to inspect.
ECZ-ID MCP Trust
ECZ-ID MCP Trust brings a local-first MCP inspection workflow directly into VS Code.
The free Community edition can detect common MCP configuration surfaces and build a local view of the MCP servers declared in your workspace.
That includes:
MCP X-Ray
See the server name, declared transport, command shape, environment variable names, declared sandbox state, remote endpoint shape and a privacy-filtered local posture fingerprint.
Credential-shaped environment warnings
See when environment variable names look like they may carry credentials or secrets without displaying or transmitting the secret values themselves.
Change detection
Compare the current MCP posture with the previous local scan and see material changes such as added or removed servers, transport changes, command changes, environment-key changes or endpoint changes.
Resolver-reference posture
See whether an ECZ-ID resolver reference is present and open the public Resolver where a re-check is appropriate.
Community remains free, local-first and usable without a paid account.
MCP Trust Pro
For developers that need more than inspection, MCP Trust Pro adds an optional local protection layer.
Protect This MCP
Supported MCP configurations can be routed through the local ECZ Trust Gate.
For STDIO servers, this uses a local wrapper process.
For supported HTTP servers, the gate can use a localhost mediation endpoint.
This is deliberately local.
ECZ-ID does not claim that inspecting a configuration means runtime traffic has been enforced.
Coverage is labelled ENFORCED only while a live Local Trust Gate session is actually mediating that MCP server. When the gate stops, coverage falls back to the observed local posture.
Pro also adds:
- Secret Shield,
- Trust Epochs,
- Advanced Tool X-Ray,
- deterministic local policy,
- material-change indicators,
- reviewable remediation,
- retained local history.
The purpose is not to pronounce an MCP server "safe".
The purpose is to give the developer better evidence and better local controls.
ECZ-ID Agent Trust
Agent Trust addresses the other side of the relationship.
A useful AI agent often needs authority.
It may need tools.
It may need MCP servers.
It may need APIs.
It may be configured with credential-bearing environment variables.
It may be able to send data externally or trigger a destructive or production action.
The useful question is therefore not simply:
Which model is this?
It is:
What can this agent actually reach?
Agent Trust Community detects local agent surfaces, tool configurations, MCP relationships and relevant changes.
Its Agent X-Ray helps developers review the locally declared capability surface without uploading source, prompts or secrets to ECZ-ID.
Agent Trust Pro
Agent Trust Pro adds a deeper local authority view.
Authority Graph
Build a deterministic graph from discovered evidence showing agents, tools, MCP targets, APIs, declared permissions, credential key names and other capability relationships.
Authority Epochs
Compare retained local snapshots and see whether the authority surface expanded or contracted.
Dangerous action-chain indicators
Surface combinations worth human review, such as credential access followed by an external-send capability, filesystem access followed by network transmission, or package mutation followed by deployment capability.
These are indicators.
They are not a declaration that an agent is malicious or unsafe.
Reciprocal Agent-to-MCP view
See relationships between declared agent MCP dependencies and the MCP inventory in the same workspace.
This starts to answer a question that becomes increasingly important as agent systems become more connected:
What authority exists across the complete chain rather than inside only one component?
Community first
We deliberately made the Community editions useful.
You do not need a subscription to install the extensions and begin inspecting your workspace.
There is no requirement to buy ECZ-ID identity infrastructure simply to run local Community checks.
That matters because developer-security tools only become useful when they can be tried at the point of friction.
Install.
Run a scan.
See what is there.
See what changed.
Then decide whether deeper Pro controls are useful for your workflow.
One Pro bundle for both sides
Developers working with both MCP servers and agents can use Developer Trust Pro, which unlocks MCP Trust Pro and Agent Trust Pro under one Developer Trust entitlement.
Current pricing is:
MCP Trust Pro — £12.99/month or £119/year
Agent Trust Pro — £12.99/month or £119/year
Developer Trust Pro — £19.99/month or £199/year
Community remains available if a Pro entitlement is absent or expires.
A free 20-check Preflight
We have also published a practical MCP & AI Agent Trust Preflight.
It contains 20 checks covering four areas:
The MCP surface
What is configured? Which transports, commands, schemas, endpoints and environment-key names are present?
Change and drift
What changed? Can you compare the current configuration with a previous known state?
Agent authority
What tools, APIs, MCP servers, permissions and credential-shaped relationships can the agent reach?
Proof and mediation
Which observations are simply local evidence, and which controls are actually sitting in the runtime call path?
The Preflight can be used manually whether or not you install ECZ-ID.
Then the VS Code extensions help automate much of the repeatable work.
Download the free MCP & AI Agent Trust Preflight
https://developers.ecocitizenz.com/downloads/eczid-mcp-agent-trust-preflight.pdf
Install free
ECZ-ID MCP Trust
https://marketplace.visualstudio.com/items?itemName=ecocitizenz.eczid-mcp-trust
ECZ-ID Agent Trust
https://marketplace.visualstudio.com/items?itemName=ecocitizenz.eczid-ai-agents
Both are also available through Open VSX.
Want deeper local controls?
Explore:
MCP Trust
https://developers.ecocitizenz.com/mcp-trust
Agent Trust
https://developers.ecocitizenz.com/agent-trust
Developer Trust Pro
https://developers.ecocitizenz.com/developer-trust
Already purchased?
Activate Pro
https://trustops.ecocitizenz.com/developer-trust/activate
The principle behind the tools
ECZ-ID does not treat a configuration fingerprint, a Marketplace listing or a missing proof reference as a universal safety verdict.
Those are different things.
Local inspection tells you what was observed.
Runtime mediation tells you what ECZ-ID is actually mediating locally.
Resolver provides the public ECZ-ID proof surface where applicable.
And your own policy determines what is sufficient before you rely on an MCP server, agent or tool chain.
That separation matters.
The goal is not another badge saying "trust this".
The goal is to make invisible machine authority easier to see, easier to re-check and, where appropriate, easier to control.
See what your MCP can do. See what changed. See what your agent can reach before you let it act.