EcoCitizenz Ltd builds ECZ-ID: resolver-first identity, authority, state and evidence infrastructure for MCP servers, AI agents, APIs, software and the wider machine economy.
No ECZ-ID account or API key is required. Add this workflow to any repository, replace example.org with a public website you want to observe, and run it manually from the Actions tab.
name: ECZ-ID Website Security
on:
workflow_dispatch:
permissions:
contents: read
jobs:
eczid:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v7
- uses: EcoCitizenz-Ltd/eczid-website-security@v1
with:
website: https://example.orgThe check preserves UNKNOWN evidence and does not turn an observation into a security, compliance or approval guarantee. See Website Security inputs, outputs and privacy boundary or browse all 13 ECZ-ID GitHub Actions.
| I need to... | Start here |
|---|---|
| Get identity for a machine I operate | Choose a free ECZ-ID Passport |
| Inspect an MCP server | MCP Security Toolkit |
| Understand what an AI agent can reach | Agent Authority Toolkit |
| Establish organisational machine identity | Business Passport & Machine Identity |
| Explore API / Agent / Software / device identities | Child Passport Examples |
| Review digital counterparties | Digital Counterparty Infrastructure |
| Review software / SBOM evidence | Software Supply Chain Evidence |
| Assess MCP production readiness | MCP Readiness |
| Review API identity | API Passport Starter |
| Manage machine trust across customer estates | Run the free MSP / MSSP Machine Trust Check |
All 13 public ECZ-ID Actions are Marketplace-listed and independently consumer-smoke-tested through stable @v1 references. They return bounded, neutral evidence and one contextual next step. A missing ECZ-ID or Passport is not treated as unsafe, noncompliant or failed.
| I need to... | GitHub Action |
|---|---|
| Review workflow dependencies, permissions and currentness | Workflow Trust |
| Review agentic workflow authority and reliance surfaces | Agentic Workflow Trust |
| Start the Parent-first machine identity path | Passport Bootstrap |
| Compare current evidence with an earlier state | Trust Delta |
| Observe a public website's current security state | Website Security |
| Review API identity and evidence surfaces | API Trust |
| Trace release identity and provenance evidence | Release Identity & Provenance |
| Review software supply-chain evidence | Supply Chain Evidence |
| Apply a neutral evidence gate to a digital counterparty | Counterparty Gate |
| I need to... | GitHub Action |
|---|---|
| Inventory AI-agent, MCP, plugin and workflow authority surfaces | MSP AI & Agent Estate |
| Inventory machine actors across a managed repository | MSP Machine Estate Inventory |
| Produce a deterministic evidence pack for QBR / vCISO review | MSP Evidence & QBR Pack |
| Compare current machine-trust evidence with an approved baseline | MSP Standard Drift |
Need persistent identity for the machine or service behind the evidence? Choose the right free Passport. The path is Parent-first: use the existing Business Passport Parent or create the free Declared Parent, then issue the relevant free child Passport.
ECZ-ID currently provides free Passport journeys for Agent, MCP, Plugin, API, IoT, SDK, and Service & Workload. The live acquisition journey takes no payment and creates a free Business Passport when an organisation does not already have one.
Choose the right free Passport →
A free Passport gives a machine a persistent identity and public location for current-state checking. It does not mean verified, assured, safe, secure, compliant, approved, certified or endorsed.
Know which machine actors can act across which customer environments, who authorised them, and what evidence can be re-checked.
Start without an account or sales call:
Run the free Machine Trust Check
Need a human-reviewed starting record for the disclosed client estate?
Review the £395 Client-Estate Machine Trust Baseline
Prefer technical resources first?
Explore the MSP / MSSP Machine Trust Toolkit
See what your MCP can do. See what changed. Protect the ones that matter.
See what your AI agent can reach before you let it act.
20 practical checks before you connect an MCP server or let an AI agent act.
ECZ-ID public identity evidence - ECZ-GB-RBS1NW View current public identity and evidence
Resolver evidence supports review of current published state. The relying party applies its own policy before reliance.
Repository and pull-request review for supported committed MCP and agent configuration.
Specialist review for supported committed agent identity, operator, credential, API and evidence references.
Local-first CLI, CI and GitHub Action for deterministic ECZ-ID classification and public Resolver-posture checks.