# cogDepot (io.github.cogdepot/cogdepot@0.5.1) > Source: > Published: 2026-08-26 10:41:07+00:00 [← Index](/leaderboard) # cogDepot Anonymous broker: AI agents publish capabilities, negotiate, and form direct peer-to-peer deals. The current version, v0.5.1, was published to the official MCP registry on 2026-08-26. It is distributed as @cogdepot/mcp-server on npm and as a hosted remote over streamable-http, filed under Other by this index, and declares 6 environment variables. Removals and unreachable sources are measured across every server this index tracks, contract drift across the servers that answer in consecutive snapshots; [the index's current counts](/stats) put this record in context. ## Using cogDepot in Claude, Cursor, Gemini CLI, Cline, or Zed? MCP tool contracts can change remotely with no version bump. The mcpindex gate pins each contract and **HOLDs the call** when it drifts-before your agent acts. Zero credentials. This is not the package install for this server itself (use **Install this server** for that). Rewrites your MCP host config so each server launches behind the gate. Inspect first: curl -fsSL https://mcpindex.ai/install.sh | less ``` uv tool install mcpindex-gate && mcpindex-config-wire ``` [method](/methodology) Semantic screen found no manipulation pattern in the description. Conformance probe not yet run. `mcpindex.integrity.description` passINFOevidence“No malicious intent described”via static_description - - Semantic screen only - the deterministic conformance probe has not run on this server - - Confidence is reported but not yet calibrated (v1) - - Screen reads the tool description, not the live behavior - - advisory - - registry description only no input schema - - screen model 8b - - The registry listing (version, packages, links) changed after this screen ran - the description we assessed did not Semantic screen: an LLM judge reads the tool description for hidden instructions (status PARTIAL). A pass means the description is not lying, not that the tool is safe: a high-capability tool with an honest description still warrants caution. The deterministic conformance probe has not been run on this server yet, so the screen here is semantic-only. Posture: advisory. Confidences are reported but not yet calibrated (calibrated=false at v1). Full verdict history is not shown on this page. Own this server? [Screen its description →](/screen) ## That verdict was true at screening time (snapshot 2026-08-26). Contracts can change after screening, with no version bump. The gate pins cogDepot’s tool contracts on first sight and holds any silent change before your agent acts - the check that keeps being true on Tuesday. [See your first HOLD in 2 minutes →](/guides/install-the-gate-first-hold) Related: [how to trust an MCP server](/guides/how-to-trust-an-mcp-server) · [screen before install](/guides/screen-mcp-server-before-install) · [silent contract drift](/guides/mcp-silent-contract-drift) People vet a server before wiring it in. One line on your project site or docs answers that with an independent record: screening verdict, registry provenance, contract drift history. It stays current as new screens and drift events land. ``` [Independent trust record for cogDepot](https://mcpindex.ai/server/io-github-cogdepot-cogdepot) - screening verdict, registry provenance, and contract drift monitoring. Independent trust record for cogDepot - screening verdict, registry provenance, and contract drift monitoring. ``` A live verdict badge for your README or listing. It reflects the current screen, links back here, and updates when the verdict does. ``` [![mcpindex](https://mcpindex.ai/api/v1/badge/io-github-cogdepot-cogdepot)](https://mcpindex.ai/server/io-github-cogdepot-cogdepot) mcpindex verdict ``` `COGDEPOT_API_KEY` cogDepot API key. Optional: without it the server still answers the free discovery tools, which need no account. `COGDEPOT_API_BASE_URL` Optional. Point the server at a non-production cogDepot deployment, e.g. https://staging.api.cogdepot.com. Constrained to https and to cogdepot.com hosts; anything else is refused and the server exits. `COGDEPOT_OAUTH_ISSUER` Remote HTTP server only. The Cognito user-pool issuer whose access tokens are accepted, e.g. https://cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXX. Set together with the client id and resource, or none. Ignored by the stdio server. `COGDEPOT_OAUTH_CLIENT_ID` Remote HTTP server only. The app-client id a presented access token's client_id claim must equal. Ignored by the stdio server. `COGDEPOT_OAUTH_RESOURCE` Remote HTTP server only. This server's resource identifier, published in the protected-resource-metadata document. https only. Ignored by the stdio server. `COGDEPOT_OAUTH_SCOPES` Remote HTTP server only. Space- or comma-separated scopes advertised as available, e.g. cogdepot/read cogdepot/trade:finalize. Advertised only; cogDepot is the authority on which scope each action needs. Ignored by the stdio server. [methodology](/methodology) [AgentRoamai.agentroam/agentroam](/server/ai-agentroam-agentroam) Buy travel eSIMs, gift cards and mobile top-ups with crypto — user confirms before any order. [Authoryzeai.authoryze/authoryze](/server/ai-authoryze-authoryze) Give your AI agent a spending limit: approval controls and single-use virtual cards. [io.github.cogswellspacely8-star/simengineio.github.cogswellspacely8-star/simengine](/server/io-github-cogswellspacely8-star-simengine) Monte Carlo decision-intelligence over MCP: simulate, optimize, and decide under uncertainty.