vouch-mcp

A Model Context Protocol (MCP) server that lets AI agents issue and verify Vouch Credentials, so every action an agent takes carries cryptographic proof of who authorized it.

MCP standardized how agents call tools. It does not say who is calling, or on whose authority. vouch-mcp adds that layer: every authorized action carries a W3C Verifiable Credential with an eddsa-jcs-2022 Data Integrity proof (or the post-quantum hybrid profile), and any party can verify one over the same MCP connection.

The key stays out of the model. MCP already runs this server in its own process, so the agent's private key lives here, never in the LLM's context. A prompt-injected model cannot exfiltrate a key it never holds.

When to use this vs vouch.autosign

Vouch gives you two front doors onto one signing primitive:

• vouch.autosign (in-process, Python): wrap a tool with protect([...]) and every call is signed deterministically, before the tool runs, with no LLM cooperation. Best when your agent is Python and you want zero-effort, can't-forget signing.
• vouch-mcp (this package): the out-of-process, cross-language path. Any MCP client in any language calls sign / verify over the wire, and the key is isolated in the server process. Best for non-Python agents, key isolation, or exposing verification as a shared service.

Both call the same sign_intent core, so credentials are identical either way.

Install

pip install vouch-mcp          # or: uvx vouch-mcp

This pulls in vouch-protocol[mcp], including the official MCP SDK. For the post-quantum profile, install pip install 'vouch-protocol[mcp,pq]'.

Configure

from vouch import generate_identity
kp = generate_identity("agent.example.com")
print(kp.did)               # did:web:agent.example.com
print(kp.private_key_jwk)   # set as VOUCH_PRIVATE_KEY

Run

Local (stdio) for Claude Desktop, Cursor, and desktop agents:

VOUCH_PRIVATE_KEY='...' VOUCH_DID='did:web:agent.example.com' vouch-mcp

Remote (Streamable HTTP) for hosted / networked deployments:

VOUCH_MCP_TRANSPORT=http VOUCH_MCP_HOST=0.0.0.0 VOUCH_MCP_PORT=8080 \
  VOUCH_PRIVATE_KEY='...' VOUCH_DID='did:web:agent.example.com' vouch-mcp

// Claude Desktop / Cursor MCP config
{
  "mcpServers": {
    "vouch": {
      "command": "vouch-mcp",
      "env": {
        "VOUCH_DID": "did:web:agent.example.com",
        "VOUCH_PRIVATE_KEY": "<jwk-json-string>"
      }
    }
  }
}

Tools

Why verify matters

Signing proves you acted. Verifying is how everyone else benefits: any MCP-capable agent, in any framework, can confirm another agent's credential with a single tool call and no SDK. That is what turns Vouch Protocol from a per-app library into an interoperable trust layer.

Verifying without a key

verify checks the cryptographic signature, so a credential that only looks well-formed will not pass. When you do not pass a key, it resolves the issuer's key from the credential's DID: did:key is self-certifying and resolves offline, while did:web is fetched over HTTPS from the issuer's own domain. If the key cannot be resolved, the credential is rejected. To verify fully offline, pass the issuer's key as public_key.

Registry

This package ships a server.json manifest for the MCP registry, so it can be discovered and installed like any other MCP server.

License

Apache-2.0.

MCP registry

This server is listed in the Model Context Protocol registry.

mcp-name: io.github.vouch-protocol/vouch-mcp