Skip to content
ECZ-ID MSPs & MSSPs
Free Trust Check

ECZ-ID for MSPs · Products

Free machine Passports for the agents, MCP servers and APIs in a client estate

A free, persistent ECZ-ID for one machine actor — an AI agent, an MCP server, a plugin, an API, an IoT device, an SDK or a service or workload — with a public Resolver page. Seven families, each started from its own TrustOps door.

FREE Agent PassportFree · OpenGet a FREE Agent Passport
Run the free Machine Trust Check

In an MSP client estate

Why Seven free machine Passport families matters for a managed estate

Who it is for

MSPs that want each client's machine actors to have a checkable identity before authority and evidence are recorded around them.

The MSP problem it addresses

Machine actors in a client estate are known by tool-specific identifiers that nobody outside that tool can check, so every authority conversation starts by establishing what the machine even is.

The client problem it addresses

The client cannot point anyone — an auditor, an insurer, its own customer — at a stable, independent record of which machine is which.

When to attach it to a client

Identity comes first: Customer Authority, delegation and evidence attach to a machine that can be named and re-checked. Starting free removes the cost question from the first step.

What the MSP receives

  • A persistent ECZ-ID per machine actor you start, under your own Business Passport.
  • A public Resolver page per Passport once publication is consented.

What the client receives

  • Passports for its own machine actors, started under its own Business Passport — the client owns them.
  • A Resolver page anyone can re-check without access to your console.

How it fits the recurring Machine Trust service

Passports are the identities the recurring Machine Trust record refers to: authority, lifecycle state and evidence are kept against them.

Options, prices and state

Each option, as TrustOps lists it

Each family has its own free TrustOps door: one sign-in creates or reuses the organisation's Business Passport, then issues the Passport. Nothing to pay. Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.

Seven free machine Passport families

States and prices from the TrustOps catalogue snapshot of 2026-10-14; TrustOps shows the current state. Buying a capability changes what you can operate. It never changes what the public record proves, and no paid tier is a verification outcome.

What you get

In TrustOps' own words

  • FREE Agent Passport

    A persistent, canonical ECZ-ID for your agent — public, resolver-verifiable, free. One sign-in. Nothing to pay.

  • FREE MCP Passport

    A persistent, canonical ECZ-ID for your mcp — public, resolver-verifiable, free. One sign-in. Nothing to pay.

  • FREE Plugin Passport

    A persistent, canonical ECZ-ID for your plugin — public, resolver-verifiable, free. One sign-in. Nothing to pay.

  • FREE API Passport

    A persistent, canonical ECZ-ID for your api — public, resolver-verifiable, free. One sign-in. Nothing to pay.

  • FREE IoT/Device Passport

    A persistent, canonical ECZ-ID for your iot/device — public, resolver-verifiable, free. One sign-in. Nothing to pay.

  • FREE SDK Passport

    A persistent, canonical ECZ-ID for your sdk — public, resolver-verifiable, free. One sign-in. Nothing to pay.

  • FREE Service & Workload Passport

    A persistent, canonical ECZ-ID for your service & workload — public, resolver-verifiable, free. One sign-in. Nothing to pay.

How it works

In plain English

  1. 1Choose the family that matches the machine actor.
  2. 2Sign in once in TrustOps; the organisation's Business Passport is created or reused.
  3. 3The Passport is issued and stays the same ECZ-ID for the life of the machine.
  4. 4Publish its Resolver page when the owner consents.

Inputs

  • One sign-in by the organisation that will own the Passport.
  • The machine actor to identify, and explicit consent before anything is published.

Outputs and evidence

  • A persistent ECZ-ID for the machine actor.
  • A public Resolver page, once publication is consented.

With your existing stack

A Passport sits beside the machine's native identity (an Entra app, an OAuth client, a service account); it does not replace or authenticate it.

Boundaries

What it does not do

  • It does not verify the machine or its operator: a free Passport is self-declared context.
  • It does not authorise anything: holding a Passport is never an authorisation.
  • It does not authenticate the machine or replace its native identity.

TrustOps terms for FREE Agent Passport

  • Self-declared: not independently verified.
  • Holding it is not proof of anything on its own.
  • Re-check the live record at the Resolver before relying on it.
  • One subject, one ECZ-ID: it is never re-minted.
  • Nothing is published without explicit consent.
  • There is nothing to pay.

What buying it never changes

  • the Parent organisation tier (a free Passport is DECLARED context)
  • any verification, assurance, safety or approval claim
  • any other Passport

Proof and integration

Resolver and Developer Gateway

Resolver relationship

Each Passport's public state is read at the Resolver. Re-check it there before relying on it; this site never restates it.

Developer Gateway route

In the MSP journey

What comes before and after

Usually comes before

Questions

Seven free machine Passport families: questions MSPs ask

Who should start a client's Passports?
The client. A Passport belongs to the organisation that starts it, under its own Business Passport. A Partner of Record acts on a client's estate only within that client's consent.
Are the seven Passports the whole ECZ-ID catalogue?
No. They are the free machine families most client estates start with. The wider catalogue — capacity, state, evidence, authority and practice products — is on the products page.
What does it cost?
Nothing. Each family is free from its own door, and the snapshot this page was built from lists every family's state beside it.

Next step

Start with Seven free machine Passport families, or see everything you can attach

Free · OpenGet a FREE Agent PassportAll MSP products