# AffixIO MCP

Open-source Model Context Protocol connector for AffixIO zero-knowledge prove and verify.

Install works like Claude for every MCP client: point at the hosted URL, complete browser authorisation at [affix-io.com/mcp](https://www.affix-io.com/mcp). Without that step, tools will not run.

## Install (Claude, Cursor, VS Code, others)

```json
{
  "mcpServers": {
    "affixio": {
      "url": "https://www.affix-io.com/mcp"
    }
  }
}
```

1. Paste the block into your MCP client config (examples in `config/`).
2. Open the client. When prompted, finish authorisation in the browser.
3. Call prove and verify from the agent tool list.

Or run `npx -y github:AffixIO/MCP` to print the same install block.

Connect guide: [https://www.affix-io.com/docs/mcp-connect](https://www.affix-io.com/docs/mcp-connect)

## Why authorise at affix-io.com/mcp?

The hosted connector is the public gate for every client. OAuth 2.0 PKCE binds your MCP session. The open-source server talks to AffixIO upstream on the host side. You never paste platform credentials into frontend config.

## Tools

| Tool | Purpose |
|------|---------|
| `zk_verify_user` | Confirm the MCP session is connected |
| `zk_prove` | Generate a ZK proof |
| `zk_verify` | Verify a proof / detect double-spend |
| `zk_gate_verify` | Allow/deny gate before privileged agent actions |
| `zk_list_circuits` | List compiled circuits |
| `zk_merkle_proof` | Merkle inclusion path |
| `zk_merkle_verify` | Verify Merkle path |
| `zk_governance_stats` | Audit tree stats |
| `zk_health` | Engine status |
| `zk_identity_verify` | KYC-style identity prove |

Core circuits: `yesno`, `health_age`, `kyc`. Any id from `zk_list_circuits` works with `zk_prove`.

## Agent pattern

1. Authorise at `https://www.affix-io.com/mcp`.
2. Call `zk_verify_user` once to confirm the session.
3. Call `zk_prove` (or `zk_identity_verify`).
4. Before a privileged tool runs, call `zk_gate_verify` (`check` or `consume`).
5. On deny, stop. On allow, continue.

## Repository layout

| Path | Role |
|------|------|
| `config/` | Client install snippets (URL only) |
| `src/` | Open-source MCP server implementation |
| `README.md` | This guide |

Affix operators running a hosted process set `AFFIX_HOSTED=1` (see `.env.example`). Public users only need the URL config above.

## Licence

Apache-2.0. See [LICENSE](LICENSE).