Skip to content

Commit f1b362a

Browse files
ZeroXLaurenZeroXLauren
committed
Initial release — verify-mcp v0.1.0
MCP server for offline verification of signed artifacts. MIT licensed. 4 tools: self_test, verify_receipt, verify_bundle, explain_artifact. No accounts, no API calls, no ScopeBlind dependency.
0 parents  commit f1b362a

11 files changed

Lines changed: 569 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
node_modules/

‎Dockerfile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
FROM node:22-alpine
2+
3+
WORKDIR /app
4+
5+
COPY package.json server.js server.json ./
6+
COPY samples/ ./samples/
7+
8+
RUN npm install --omit=dev
9+
10+
ENTRYPOINT ["node", "server.js"]

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 ScopeBlind (Tom Farley)
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# @scopeblind/verify-mcp
2+
3+
MCP server for offline verification of ScopeBlind and Veritas Acta artifacts.
4+
5+
It is deliberately narrow:
6+
- verify a single signed receipt or artifact
7+
- verify an audit bundle offline
8+
- explain a signed artifact in normalized form
9+
- run a packaged self-test so clients can prove the verifier works
10+
11+
This is the registry-worthy MCP surface for the verification lane. It is not a gateway, not a builder, and not a hosted verification service.
12+
13+
## Install
14+
15+
```bash
16+
npm install -g @scopeblind/verify-mcp
17+
```
18+
19+
## Claude Desktop / MCP config
20+
21+
```json
22+
{
23+
"mcpServers": {
24+
"scopeblind-verify": {
25+
"command": "npx",
26+
"args": ["-y", "@scopeblind/verify-mcp"]
27+
}
28+
}
29+
}
30+
```
31+
32+
## Tools
33+
34+
### `self_test`
35+
Runs packaged sample verification.
36+
37+
Returns:
38+
- sample receipt valid / invalid
39+
- sample bundle valid / invalid
40+
- total receipts in the sample bundle
41+
42+
### `verify_receipt`
43+
Inputs:
44+
- `artifact_json` or `path`
45+
- optional `public_key_hex`
46+
47+
Returns:
48+
- valid / invalid
49+
- type
50+
- format
51+
- issuer
52+
- kid
53+
- canonical hash
54+
55+
### `verify_bundle`
56+
Inputs:
57+
- `bundle_json` or `path`
58+
59+
Returns:
60+
- valid / invalid
61+
- total receipts
62+
- passed
63+
- failed
64+
65+
### `explain_artifact`
66+
Inputs:
67+
- `artifact_json` or `path`
68+
69+
Returns a normalized summary of:
70+
- type
71+
- format
72+
- issuer
73+
- kid
74+
- issued_at / timestamp
75+
- payload keys
76+
77+
## Notes
78+
79+
- No ScopeBlind servers are contacted.
80+
- This server verifies local JSON artifacts only.
81+
- `protect-mcp` remains the local policy gateway.
82+
- `@scopeblind/passport` remains the local pack builder.
83+
- `@scopeblind/red-team` remains the local benchmark runner.
84+
85+
## License
86+
87+
MIT

‎glama.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"$schema":"https://glama.ai/mcp/schemas/server.json","maintainers":["tomjwxf"]}

‎package.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"name": "@scopeblind/verify-mcp",
3+
"version": "0.1.0",
4+
"description": "MCP server for offline verification of ScopeBlind and Veritas Acta artifacts.",
5+
"license": "MIT",
6+
"type": "module",
7+
"bin": {
8+
"scopeblind-verify-mcp": "server.js"
9+
},
10+
"files": [
11+
"server.js",
12+
"README.md",
13+
"server.json",
14+
"samples/"
15+
],
16+
"dependencies": {
17+
"@modelcontextprotocol/sdk": "^1.27.1",
18+
"@veritasacta/artifacts": "^0.2.0",
19+
"zod": "^3.24.0"
20+
},
21+
"engines": {
22+
"node": ">=18.0.0"
23+
},
24+
"keywords": [
25+
"mcp",
26+
"model-context-protocol",
27+
"scopeblind",
28+
"veritasacta",
29+
"artifact-verification",
30+
"receipts",
31+
"offline-verification"
32+
],
33+
"repository": {
34+
"type": "git",
35+
"url": "git+https://github.com/tomjwxf/scopeblind-gateway.git"
36+
},
37+
"homepage": "https://scopeblind.com/verify",
38+
"bugs": {
39+
"url": "https://github.com/tomjwxf/scopeblind-gateway/issues"
40+
},
41+
"mcpName": "io.github.tomjwxf/verify-mcp",
42+
"scripts": {
43+
"check": "node --check server.js",
44+
"smoke": "node test/smoke.mjs",
45+
"prepublishOnly": "npm run check && npm run smoke"
46+
}
47+
}

‎samples/sample-bundle.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"format": "scopeblind:audit-bundle:v1",
3+
"generated_at": "2026-03-22T00:00:00Z",
4+
"issuer": "protect-mcp",
5+
"description": "Sample audit bundle with 3 receipts from a protect-mcp session.",
6+
"verification": {
7+
"signing_keys": [
8+
{
9+
"kty": "OKP",
10+
"crv": "Ed25519",
11+
"kid": "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k",
12+
"x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
13+
"use": "sig"
14+
}
15+
]
16+
},
17+
"receipts": [
18+
{
19+
"v": 2,
20+
"type": "decision_receipt",
21+
"algorithm": "ed25519",
22+
"kid": "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k",
23+
"issuer": "sb:test",
24+
"issued_at": "2026-01-01T00:00:00Z",
25+
"payload": {
26+
"decision": "allow",
27+
"policy_digest": "sha256:abcdef0123456789",
28+
"scope": "my-service",
29+
"tool": "read_database",
30+
"tier": "signed-known",
31+
"mode": "shadow",
32+
"reason_code": "policy_match",
33+
"request_id": "req_test_001"
34+
},
35+
"signature": "324a966f8d4e6652e2270311c9682157d5adc01f1f019d84b24a1125220869a5c5a0fc0096ed3afffaa66ac36cfbbd97e60d9c5f7ad632a2cf11c45c2c50fd0d"
36+
},
37+
{
38+
"v": 2,
39+
"type": "gateway_restraint",
40+
"algorithm": "ed25519",
41+
"kid": "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k",
42+
"issuer": "sb:protect",
43+
"issued_at": "2026-01-01T00:01:00Z",
44+
"payload": {
45+
"tool": "delete_user",
46+
"decision": "deny",
47+
"reason_code": "tier_insufficient",
48+
"policy_digest": "sha256:abcdef0123456789",
49+
"agent_id": "sb:agent:test-bot",
50+
"tier": "unknown",
51+
"mode": "enforce"
52+
},
53+
"signature": "e0acddfd57dac1d1cd1a7b48d4554c81cede6bf44aa40f97ed5cbf8825e4157ec1fb44527b0b2cc17b24e5853b2190e02e5c7a826c3919592e693f09c04fac0e"
54+
},
55+
{
56+
"v": 2,
57+
"type": "trust_ticket",
58+
"algorithm": "ed25519",
59+
"kid": "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k",
60+
"issuer": "sb:trust-authority",
61+
"issued_at": "2026-01-15T12:00:00Z",
62+
"payload": {
63+
"tier": "evidenced",
64+
"scope": "production",
65+
"expires_at": "2026-02-01T00:00:00Z",
66+
"agent_id": "sb:agent:verified-bot",
67+
"manifest_hash": "sha256:manifest_hash_example",
68+
"evidence_summary": {
69+
"receipt_count": 150,
70+
"epoch_span": 30,
71+
"issuer_count": 5
72+
}
73+
},
74+
"signature": "c4e5b0048449d0f6757877410d3066f285dc07d1f73ec1e4f6222ec2f3a95a3953db3f3c9a3079c7a7cef837e36d522791a095884633f52d42876b1b25ae6600"
75+
}
76+
],
77+
"_note": "Verify with: npx @veritasacta/verify sample-bundle.json --bundle"
78+
}

‎samples/sample-receipt.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"v": 2,
3+
"type": "decision_receipt",
4+
"algorithm": "ed25519",
5+
"kid": "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k",
6+
"issuer": "sb:test",
7+
"issued_at": "2026-01-01T00:00:00Z",
8+
"payload": {
9+
"decision": "allow",
10+
"policy_digest": "sha256:abcdef0123456789",
11+
"scope": "my-service",
12+
"tool": "read_database",
13+
"tier": "signed-known",
14+
"mode": "shadow",
15+
"reason_code": "policy_match",
16+
"request_id": "req_test_001"
17+
},
18+
"signature": "324a966f8d4e6652e2270311c9682157d5adc01f1f019d84b24a1125220869a5c5a0fc0096ed3afffaa66ac36cfbbd97e60d9c5f7ad632a2cf11c45c2c50fd0d"
19+
}

0 commit comments

Comments
 (0)