Aeroz vs Tracepass MCP Server
A side-by-side look at the Aeroz and Tracepass MCP Server MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
A
AerozIndustrial & IoT · Remote HTTP/SSEProve a physical item is genuine (NFC chip); read its EU Digital Product Passport, recalls, custody.51GoodAuth: not declaredVerdict: choose Aeroz for industrial & iot work over a hosted endpoint; choose Tracepass MCP Server for industrial & iot as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
AChoose Aeroz when
- You need dedicated capabilities in the Industrial & IoT domain.
- You prefer a remote HTTP/SSE transport.
- You have the keys it needs:
PSA_API_TOKEN. - You want tools like
verify_chip, check_recall, dpp_readiness.
Choose Tracepass MCP Server when
- You need dedicated capabilities in the Industrial & IoT domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: API key required.
- You have the keys it needs:
TRACEPASS_API_KEY, TRACEPASS_BASE_URL. - You want tools like
tracepass_products, tracepass_passports, tracepass_passport_fields.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | A Aeroz | |
|---|---|---|
| Category | Industrial & IoT | Industrial & IoT |
| Quality signal | 51/100 · Good | 64/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Remote HTTP/SSE | Local subprocess (stdio) |
| Auth | Not declared | API key required |
| Pricing | Not declared | Not declared |
| Required env vars | PSA_API_TOKEN | TRACEPASS_API_KEYTRACEPASS_BASE_URL |
| Verified owner | Community listing | Community listing |
| GitHub stars | — | 1 |
| Directory activity | 0 views 0 installs 0 upvotes | 3 views 0 installs 0 upvotes |
| Tools | 30 | 6 |
| Full listing | View Aeroz | View Tracepass MCP Server |
Tools & capabilities
Aeroz tools 30
verify_chipVerify a physical item by its Aeroz chip: the UID plus whatever signature the tap carried. Same answer as GET /v1/verify. Use this before trusting any claim about a physical unit — a database record proves a record exists, not that the object in front of you is the one it describes. Read `proof` and `proves`: proof "presence" means the chip answered a fresh one-time SUN challenge (picc_data + cmac) and was physically there at this tap; proof "identity" means the static `t` signature is the one Aeroz issued for this UID, which a copied tag also carries. verified:false with reason "no_signature" (recognised:true) proves NOTHING about the item — only that the number is on the register. "signature_unchecked" means the signature was not compared (not a mismatch). A failed signature returns NO product data. Each call records the tap and spends the chip's one-time answer, so pass each SUN tap once. A sandbox key answers its seeded sandbox chips as fixtures (mode "sandbox" with a _warning) and any other UID from the register (mode "sandbox", register:true), so a sandbox company can check the test tags it minted.check_recallCheck whether a specific unit is subject to an active recall, from the register: reads only, verifies no signature and spends no chip answer. Returns known (on the register), recalled, and the recall reason, severity, date and id when one applies. recalled:null means the status is UNKNOWN (the UID is not on the register, or the register could not be read) — never report that as "not recalled". This says nothing about whether the item is genuine; use verify_chip for that. Use whenever a unit is about to be shipped, sold, dispensed, or installed. A sandbox key answers its seeded sandbox chips first and any other UID from the register (register:true).dpp_readinessAssess how ready a product category is for an EU Digital Product Passport, against the delegated act that applies to it. Returns the required data fields, which are present, and which are missing. IMPORTANT: this is a readiness signal, not a legal compliance determination — never report its output as confirmation that a product is compliant.list_findingsList findings raised by the Aeroz compliance agents watching this organisation — recall hits, DPP data gaps, regulatory changes, dwell anomalies, and clone detections. Use this to answer "what needs my attention".list_agentsList the Aeroz compliance agents available to this organisation and which are currently enabled. Use this to explain monitoring coverage or to find an agent worth enabling.get_usageReturn this organisation's Aeroz verification volume and outcome breakdown over a recent period. Use for reporting on scan volume, authentication failure rates, and trend. The buckets — authentic, recalled (any tap whose answer carried a recall, verified or not), mismatched (failed static or SUN signature), not_found, unverified (no or unchecked signature, test tag, held or disabled unit) and other — always sum to total.list_sandbox_chipsList the seeded sandbox chips for this organisation, with the UID and signature to pass to verify_chip, one per scenario: authentic, recalled, signature_mismatch (listed with a deliberately WRONG signature) and not_found (a UID that is not on the register). Sandbox only — use when building or testing an integration before physical chips ship.onboarding_statusReport where this organisation stands in Aeroz onboarding: current stage, percentage complete, health, the single next action, and every open step with which side owns it. Use this to answer "what do we still need to do", "why are we not live yet", or "what is Aeroz waiting on". Steps marked side="aeroz" are Aeroz's obligation, not the customer's — say so plainly rather than presenting them as homework.onboarding_next_stepReturn only the single most important next action and how to complete it. Use when the user asks what to do next and does not want the whole checklist.complete_onboarding_stepMark a manual onboarding step complete on behalf of this organisation. Only steps the customer owns and that Aeroz cannot verify automatically can be set this way; an automatically verified step will refuse, because a self-report that contradicts the platform data is worse than no report. Pass the step key from onboarding_status.business_briefThe full picture of this business as Aeroz holds it: declared product categories with their mandate dates and whether each date is fixed or provisional, onboarding state, open findings, and — importantly — which recall sources are NOT being monitored. Use this to orient before answering anything about the account. Never present an empty findings list as evidence of safety without also reporting coverage_gaps.ask_agentAsk this organisation's dedicated Aeroz agent a question in plain language and get a grounded answer. Use it for anything a human at the business would ask their account manager: "what do we still need to do", "when is our deadline", "what is Aeroz waiting on", "what is not being monitored", "how do we go live". The answer carries `grounded`: `computed` means it was read directly from the account's own data; `model` means a model composed it from that data and every date and figure was checked against it; `declined` means the agent does not hold what the question needs and said so — relay that honestly rather than filling the gap yourself. Asking refreshes the account's onboarding state and records the question and answer in the conversation (see agent_conversation). It sends nothing outside Aeroz and changes no product, shipment or passport data.- +18 more on the listing page
Tracepass MCP Server tools 6
tracepass_productsManage the TracePass product catalogue. A product is the catalogue layer — one product can have many passports (one per serialised unit). Products are not billable on their own. Actions (pass via `action`, with `args`): - list — args: { page?, limit? (≤100), category?, status?, search? }. Read-only. - get — args: { id }. Read-only. - create — args: { name, model, category, description? }. `category` is one of: battery, textile, electronics, construction, steel, detergents, paints-coatings, packaging, furniture, tyres, jewelry, toys, fmcg. - update — args: { id, name?, model?, description? }; pass at least one field to change. - create_batch — args: { products: [ { name, model, category, description? }, … ] }, up to 100. Partial-success: the response carries a per-item status, so some items can be created while others error. The whole batch consumes N writes upfront; if that would exceed the daily cap NOTHING is created (429). - archive — args: { id }. Soft-archive a product. Blocked with 409 while any non-archived passport still references it — archive those passports first. This is reversible and is NOT deletion.tracepass_passportsManage Digital Product Passports — create, read, and run lifecycle actions. IMPORTANT: `create` consumes a DPP slot on the account's plan and IS BILLABLE. Creating a passport beyond the included quota incurs a per-passport overage charge; if over quota the tool returns a 402-style message — only re-run with args.confirmOverage=true after the user explicitly agrees to the charge. `archive` is IRREVERSIBLE (the public QR permanently 404s); prefer `suspend` when a change might be undone. Actions (pass via `action`, with `args`): - list — args: { page?, limit? (≤100), productId?, status?, search? }. status ∈ draft|in_review|approved|published|suspended|expired|archived. Read-only. - get — args: { id, format? (summary|full), lang? }. Read-only. - get_by_serial — args: { serial, format?, lang?, gtin? }. Read-only. Addresses the passport by your own serial. A serial is unique only WITHIN a GTIN — if the same serial exists under two GTINs in your account the call returns 409 ambiguous_serial; pass `gtin` (or use the by-id action) to resolve exactly. - compliance — args: { id }. Read-only. Returns a three-tier compliance verdict (compliant | compliant_with_warnings | incomplete) with regulation-cited findings — use to gap-check a passport against the rules for its category, fix the cited fields/parties, then re-check. - registry_readiness — args: { id }. Read-only. Returns { ready, findings[] } — whether the passport would pass the EU DPP Registry's FORMAL submission gate (mandatory fields present, correct formatting, a resolvable public link, item-level granularity via a serial number, and a well-formed commodity code where the category carries one). This is the registry's mechanical pre-submission check, NOT the substantive compliance verdict; a passport can be registry-ready yet not substantively compliant. Battery passports only. - create — args: { productId, gtin, serialNumber, confirmOverage? }. BILLABLE. - suspend — args: { id }. Reversible — public QR shows 'suspended'. - suspend_by_serial — args: { serial, gtin? }. Same as suspend, addressed by your serial. 409 ambiguous_serial if the serial isn't unique in your account — pass `gtin`. - archive — args: { id }. IRREVERSIBLE — confirm with the user first. - archive_by_serial — args: { serial, gtin? }. IRREVERSIBLE, addressed by your serial — confirm first. 409 ambiguous_serial if the serial isn't unique — pass `gtin`. - get_qr — args: { id, format? (svg|png) }. Read-only. - get_qr_by_serial — args: { serial, format? (svg|png), gtin? }. Read-only. Same as get_qr, addressed by your own serial. A serial is unique only WITHIN a GTIN — if the same serial exists under two GTINs in your account the call returns 409 ambiguous_serial; pass `gtin` (or use get_qr by id) to resolve exactly.tracepass_passport_fieldsUpdate field values on a Digital Product Passport. Every change is recorded in the passport's audit trail, tagged as an API-key update. Actions (pass via `action`, with `args`): - update — args: { id, fieldKey, value }. `value` type matches the field's dataType (string, number, boolean, array, object). - update_by_serial — args: { serial, fieldKey, value, gtin? }. Same as update, addressed by your own serial. A serial is unique only WITHIN a GTIN — if it isn't unique in your account the call returns 409 ambiguous_serial; pass `gtin` (or use update by id) to resolve exactly.tracepass_passport_partiesManage the economic-operator parties on a passport — manufacturer, importer, authorisedRepresentative, distributor, recycler, producerResponsibilityOrg. Each party carries a legal name and ideally a validated 13-digit GS1 GLN. Actions (pass via `action`, with `args`): - set — args: { id, role, legalName, gln?, country?, legacyOperatorId? }. Sets or updates one role. - remove — args: { id, role }. Clears one role.tracepass_epcisGS1 EPCIS 2.0 supply-chain events. `export` is included on Starter plans and up; `capture`, `capture_job`, and `query` require the paid EPCIS add-on (those actions return a 403-style message without it). Actions (pass via `action`, with `args`): - export — args: { id }. Export a passport's events as an EPCIS 2.0 JSON-LD document. Read-only. - export_by_serial — args: { serial, gtin? }. Same as export, addressed by your own serial. A serial is unique only WITHIN a GTIN — if it isn't unique in your account the call returns 409 ambiguous_serial; pass `gtin` (or use export by id). Read-only. - capture — args: { events }. `events` is an EPCISDocument, a single event, or an array of events (JSON-LD). Returns a 202 with a captureJobId. - capture_job — args: { jobId }. Poll an async capture job. Read-only. - query — args: { params? }. `params` is a key/value map of standard EPCIS query parameters (EQ_bizStep, GE_eventTime, MATCH_epc, …). Read-only.tracepass_templatesDiscover the regulatory field schema for each DPP category — what a COMPLIANT passport must contain, per the governing EU regulation. Read-only reference data. Use this to advise on requirements before creating products/passports, and to gap-check a draft against the rules. Actions (pass via `action`, with `args`): - list — args: {}. Lists all 13 categories with their field count, required-field count, and governing regulation (name + number + effective/mandatory dates). - get — args: { category }. Full field schema for one category: every field's key, label, dataType, whether it is REQUIRED, its access level (public/restricted/authority), enum options, validation bounds, and — where known — the regulation article/annex that mandates it. `category` is one of: battery, textile, electronics, construction, steel, detergents, paints-coatings, packaging, furniture, tyres, jewelry, toys, fmcg. BATTERY — required-ness is per-category, so `required` alone is the wrong answer. Resolve it in this order: 1. SCOPE FIRST. Only EV, LMT and industrial_gt_2kwh batteries owe a passport at all (Art. 77(1), Reg (EU) 2023/1542). For portable, SLI or industrial_lte_2kwh, NO field is required — do not list mandatory fields for them; say the battery is out of scope. 2. Then `requiredBy[batteryCategory]` where the field carries that map (required | conditional | notApplicable). 3. Then fall back to `required`. The map is keyed ONLY by the three in-scope categories, so skipping step 1 falls through to `required` and invents an obligation the Regulation does not impose. Note also that EV and LMT report state-of-health through MUTUALLY EXCLUSIVE field sets — an EV battery must leave the remaining-capacity cluster empty and an LMT battery must leave stateOfCertifiedEnergy empty, so no single battery ever fills every field.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Aeroz
{
"mcpServers": {
"aeroz": {
"command": "npx",
"args": [
"-y",
"aeroz"
],
"env": {
"PSA_API_TOKEN": "YOUR_PSA_API_TOKEN_HERE"
}
}
}
}
Tracepass MCP Server
{
"mcpServers": {
"malinoto-tracepass-mcp-server": {
"command": "npx",
"args": [
"-y",
"tracepass-mcp-server"
],
"env": {
"TRACEPASS_API_KEY": "YOUR_TRACEPASS_API_KEY_HERE",
"TRACEPASS_BASE_URL": "YOUR_TRACEPASS_BASE_URL_HERE"
}
}
}
}
Frequently asked questions
Aeroz is categorized under Industrial & IoT and uses a remote HTTP/SSE transport. Tracepass MCP Server belongs to Industrial & IoT and uses a local stdio subprocess. Pick Aeroz for industrial & iot work and Tracepass MCP Server for industrial & iot.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Aeroz has no declared pricing — check the project's own site. Tracepass MCP Server has no declared pricing — check the project's own site. Auth: api key required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add aeroz and malinoto-tracepass-mcp-server as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Aeroz has a quality signal of 51/100 (Good) with 0 views, 0 installs and 0 GitHub stars. Tracepass MCP Server has 64/100 (Good) with 3 views, 0 installs and 1 GitHub stars.