serac-mcp

Sovereign E2E cloud storage SDK for AI agents — Python edition.

Zero runtime dependencies. Python 3.10+. Uses only stdlib hashlib, hmac, os, urllib.request, json.

Installation

pip install serac-mcp

Quick Start

from serac_mcp import SeracAgent, generate_agent_key_material

# 1. Generate key material (Ed25519 + X25519 + master key)
keys = generate_agent_key_material()

# 2. Self-register a vault
result = SeracAgent.register(
    agent_name="my-agent",
    ed25519_public_key=keys.signing.public_key_b64,
    x25519_public_key=keys.encryption.public_key_b64,
    encrypted_master_key=keys.encrypted_master_key,
    master_key_nonce=keys.master_key_nonce,
    key_commitment=keys.key_commitment,
)
agent = result["agent"]
vault_id = result["vault_id"]

# 3. Store encrypted data
from serac_mcp import derive_namespace_key, encrypt_aes256_gcm
ns_key = derive_namespace_key(keys.master_key, "memory")
encrypted = encrypt_aes256_gcm('{"role": "assistant", "content": "Hello"}', ns_key)
agent.store("memory", "greeting", encrypted.ciphertext_b64)

# 4. Retrieve
agent.retrieve("memory", "greeting")

# 5. List
agent.list("memory")

# 6. Delete
agent.delete("memory", "greeting")

# 7. Check quota
agent.quota()

Authentication

Two methods:

1. API Key (quick start): SeracAgent.from_api_key("sk_serac_...")
2. Ed25519 Challenge-Response (session renewal): Automatic JWT renewal

V2 Tools (Preview)

# Share with another agent
agent.share("memory", "prefs", target_x25519_pubkey, permission="read")

# Cryptographic attestation
agent.attest("memory", "prefs")

# Archive to Glacier
agent.archive("memory", "old-data")

Crypto Module

All E2EE primitives available standalone — no external dependencies:

MCP Configuration

Add to your agent config:

mcp_servers:
  serac:
    url: "https://serac.cloud/api/agent/mcp/v1"
    headers:
      Authorization: "Bearer sk_serac_your_api_key"

Pricing

Automatic tiering (hot → warm → cold → Glacier) for cost optimization.

Interop

The Python SDK (serac-mcp) and TypeScript SDK (serac-agent-sdk) use identical crypto primitives:

• Ed25519 for signing
• X25519 for encryption
• AES-256-GCM with HKDF-SHA256 for namespace key derivation
• Sealed box format: ephPubKey(DER) || iv(12) || tag(16) || ciphertext

Cross-SDK test vectors verified (ADR-001 §10).

License

MIT © Serac