@qed-proof/mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@qed-proof/mcpCheck if my claim that I pushed commit abc123 to GitHub is verified."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@qed-proof/mcp
QED Proof as an MCP server. An AI agent says it did something; QED Proof reads the destination itself — never the agent's own report — decides a verdict, and issues a signed receipt anyone can check.
This server lets any MCP client (Claude, Claude Code, Cursor, and others) submit claims, read verdicts, fetch receipts and verify them offline, with no code.
Tools
Tool | What it does |
| Records a claim (an action on a target) for QED Proof to verify. Returns a |
| A claim's state, verdict ( |
| The full signed receipt, with a shareable link. Receipts are public. |
| Checks a receipt offline: schema, integer-only encoding, key validity, Ed25519 signature, claim digest, and Merkle inclusion. It doesn't read the chain, so the anchor is reported as not checked and the achieved trust level is at most 1. |
| Recent claims in your workspace, with filters. |
| Destinations your workspace has connected read-only, and whether a verifier is live for each. |
There are no tools to connect accounts, disconnect them or manage keys: those stay in the console.
Actions verified today are the ones with a published verifier profile in the QED Proof spec: github.commit.push,
github.pr.open, github.checks.pass, x.post.publish and slack.message.post. Any other action is accepted and
decided as unverifiable — QED Proof never guesses.
Related MCP server: vantic-mcp
Use it
You need a workspace API key from the console (Developers → API keys).
Local (stdio):
claude mcp add qed-proof --env QED_API_KEY=<your key> -- npx -y @qed-proof/mcpEnvironment: QED_API_KEY (required for everything but offline verification), QED_AGENT_ID (the default agent_id
for claims; otherwise the MCP client's name), QED_API_URL (defaults to https://api.qedproof.site, e.g. for a
self-hosted node).
Hosted (Streamable HTTP): https://mcp.qedproof.site/mcp with Authorization: Bearer <your key>.
claude mcp add --transport http qed-proof https://mcp.qedproof.site/mcp --header "Authorization: Bearer <your key>"The hosted server keeps no state and stores nothing. It forwards your key to the QED Proof API for each request, so the API's own workspace scoping and rate limits apply, and it logs only the method, tool name, status and latency.
Data
target and params of a claim are copied into its receipt, which is public and permanent. Receipts record
fingerprints and the facts a verifier read (a commit SHA, an HTTP status), never content.
Develop
npm install
npm test # includes every spec test vector
npm run buildApache-2.0. QED Proof has no token.
Available Tools
6 toolsget_receiptGet a signed receiptARead-onlyIdempotent
Returns the full signed receipt for a receipt_id: the claim, what the verifier read at the destination (facts and fingerprints, never content), the verdict, the Ed25519 signature, and the log inclusion and anchor proof. Receipts are public, and the response includes a shareable link.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt_id | Yes | The receipt_id from get_verdict or submit_claim. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnly, openWorld, idempotent, and non-destructive hints. The description adds valuable behavioral context by stating what is included and what is explicitly excluded ('never content'), that receipts are public, and that a shareable link is returned – details not captured in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences with no fluff; the primary return content is listed first, followed by the public-access and link feature. Every phrase contributes meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only tool with no output schema, the description thoroughly enumerates the expected return payload and the sharing behavior. No essential detail needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the parameter receipt_id is clearly explained in the schema as coming from get_verdict or submit_claim. The description does not add additional parameter semantics beyond what the schema provides, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Returns the full signed receipt for a receipt_id' with a specific resource and verb, enumerating the exact contents (claim, facts/fingerprints, verdict, signature, proof). It clearly differentiates from sibling verify_receipt by describing a complete receipt with log inclusion/anchor proof rather than just verification semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context (receipt_id comes from get_verdict or submit_claim) and notes receipts are public, implying when it can be called. However, it does not explicitly contrast with verify_receipt or state conditions when another tool should be used instead, leaving selection partially to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_verdictGet a claim's verdictARead-onlyIdempotent
Returns a claim's state ("queued" or "decided"), its verdict when decided, and the receipt_id. Verdicts: verified, late, mismatch, failed, unverifiable; the response includes what the verdict means. Only claims in the API key's own workspace are visible.
| Name | Required | Description | Default |
|---|---|---|---|
| claim_id | Yes | The claim_id returned by submit_claim. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, and non-destructive behavior. The description adds useful behavioral context beyond that: the queued/decided state distinction, inclusion of receipt_id, verdict meanings, and the workspace scoping restriction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences convey the return fields, possible states, verdict meanings, and scope restriction without wasted words. Key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only lookup with one parameter and no output schema, the description sufficiently covers what is returned, what the verdicts mean, and the workspace restriction. Nothing critical is missing for an agent to call and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single claim_id parameter is already described as the ID returned by submit_claim. The description adds no meaningful parameter details beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the operation as retrieving a claim's state, verdict, and receipt_id, and enumerates the possible verdict values. It is specific about the resource and scope, though it does not explicitly contrast itself with sibling tools like get_receipt or verify_receipt.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for checking a claim's status or verdict but gives no explicit guidance on when to prefer it over alternatives such as get_receipt or list_claims. The workspace visibility constraint is a limitation, not usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_claimsList recent claimsARead-onlyIdempotent
Lists claims in the API key's workspace, newest first, with each claim's state, verdict and receipt_id. Filters: agent_id, action, verdict, state (queued or decided). Paginate with the returned next_cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max claims to return. | |
| state | No | ||
| action | No | ||
| cursor | No | next_cursor from a previous call. | |
| verdict | No | ||
| agent_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, idempotentHint, destructiveHint, openWorldHint). The description adds genuinely useful behavioral context beyond that: result ordering, per-claim fields returned, workspace scoping, and the next_cursor pagination contract. No contradiction with annotations; 'Lists' matches readOnlyHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with zero waste: purpose and scope first, then filters, then pagination. Every sentence earns its place and the most decision-relevant information (what the tool lists and returns) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter, 0-required tool with no output schema, the description covers the essential surface: scope, ordering, returned per-claim fields, filter options, and pagination mechanics. The remaining gaps — the undefined semantics of action and agent_id — are the main reason it isn't a 5, but the rich annotations and clear filter/fetch narrative make it adequate for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% (just limit and cursor have descriptions), so the description must compensate. It does helpfully enumerate the filter set and clarifies state's allowed values (queued or decided) and cursor's role ('Paginate with the returned next_cursor'). However, action and agent_id remain semantically opaque — what actions exist and what agent_id refers to is left undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Lists claims'), scopes it to the API key's workspace, and adds ordering ('newest first') plus the returned fields (state, verdict, receipt_id). This makes it clearly distinguishable from siblings like get_verdict, get_receipt, and verify_receipt, which operate on single entities, and submit_claim, which creates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The filter list and pagination instruction imply the usage context, but the description never explicitly says when to prefer this tool over alternatives or when not to use it. With siblings like get_verdict and get_receipt available, no routing guidance is provided — the agent must infer the boundary between listing and fetching a single entity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_connectionsList connected destinationsARead-onlyIdempotent
Lists the destinations the workspace has connected read-only (for example GitHub, Slack, X) and whether a verifier is live for each. Read-only: connecting or disconnecting happens in the QED Proof console, not here.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds useful context beyond those hints by clarifying that mutations happen externally in the QED Proof console and that the list includes live verifier status. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the core purpose and output front-loaded in the first sentence and the read-only constraint in the second. Every word earns its place, and there is no redundant restating of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only listing tool, the description is complete: it states what is listed, the per-item status, and where mutations happen. The annotations cover safety, and no output schema is present, so the description's summary of return content is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4 per the rubric. There is nothing for the description to add about individual parameters, and it appropriately focuses on the tool's purpose and output instead.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Lists'), the resource ('destinations the workspace has connected'), and the key output detail ('whether a verifier is live for each'). It also gives concrete examples (GitHub, Slack, X) and clearly marks the operation as read-only, making it easy to distinguish from the mutation-oriented siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: this tool is for viewing connections and their verifier status, not for changing them. It explicitly says connecting or disconnecting happens in the QED Proof console, not here. It does not name a sibling tool as an alternative, but the when-not-to-use guidance is explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_claimSubmit a claim for verificationA
Records that an agent says it performed an action, so QED Proof can check the destination and issue a signed receipt. Returns a claim_id and, when the check finishes inline, the verdict and receipt_id; otherwise state is "queued" and get_verdict returns the outcome later.
Documented actions (verifier profiles published in the QED Proof spec):
github.checks.pass: Every check run on the claimed commit completed without failing. target: owner/repo; params: sha (string, 40 lowercase hex)
github.commit.push: The claimed commit exists on the remote and the claimed branch contains it. target: owner/repo; params: sha (string, 40 lowercase hex), branch (string)
github.pr.open: The claimed pull request exists, optionally against the claimed base branch and at the claimed head commit. target: owner/repo; params: number (integer ≥ 1), base? (string), head_sha? (string)
slack.message.post: A message with exactly the claimed timestamp exists in the claimed channel, and (optionally) its text matches a target: slack:///, with a team ID T… and a public (C…) or private (G…) channel ID,; params: ts (string,
^[0-9]{10}\.[0-9]{6}$), text_sha256? (string, 64 lowercase hex)x.post.publish: The claimed post exists on X, was written by the account the target handle is connected as, and (optionally) its text target: @handle (1–15 of A–Z a–z 0–9 _, with the @); params: post_id (string of 1–20 digits), text_sha256? (string, 64 lowercase hex)
Any other action string is accepted and decided as "unverifiable" (reason unsupported_action). target and params are copied into the receipt, which is public and permanent; params are limited to 4 KB. Resubmitting with the same client_claim_id returns the existing claim instead of creating a new one.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action string, e.g. github.commit.push. | |
| params | No | The fields the action's profile requires. | |
| target | Yes | Where the work was meant to land, in the action's own format (e.g. owner/repo). | |
| agent_id | No | The agent's own identifier. Defaults to the MCP client's name. | |
| claimed_at | No | When the agent says it did the work (ISO 8601 with a timezone). Defaults to now. | |
| client_claim_id | No | A stable id for this claim, so a retry doesn't create a duplicate. Generated when omitted. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations. It discloses idempotency behavior ('Resubmitting with the same client_claim_id returns the existing claim'), permanence of receipts ('target and params are copied into the receipt, which is public and permanent'), parameter size limits ('params are limited to 4 KB'), handling of unsupported actions ('decided as unverifiable (reason unsupported_action)'), and the conditional return of verdict inline versus queued. This is rich behavioral context that annotations alone (readOnlyHint=false, idempotentHint=false) do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every section earns its place. It opens with the core purpose, then explains the return flow, and devotes a structured list to documented actions. It could arguably be trimmed, but the length is justified by the need to cover multiple action profiles. Front-loading the purpose and key behaviors helps an agent quickly grasp the tool's role.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 6 parameters, nested objects, no output schema, and multiple action profiles, the description is comprehensive. It explains return values (claim_id, verdict, receipt_id, state), idempotency, permanent receipt implications, unsupported action handling, and target/param formats. Nothing an agent needs to correctly invoke the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds substantial meaning beyond the schema. It documents each supported action with exact target formats (e.g., slack://<team_id>/<channel_id>, @handle) and parameter constraints (sha as 40 lowercase hex, ts regex, text_sha256). It also explains the purpose of client_claim_id for idempotency and the 4 KB limit on params. This is far more than the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Records that an agent says it performed an action, so QED Proof can check the destination and issue a signed receipt.' It clearly distinguishes this from siblings like get_verdict (which retrieves outcomes later) and get_receipt (which presumably retrieves receipts). The purpose is unambiguous and action-oriented.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when an agent has performed an action and wants verification. It explicitly notes that if the check does not finish inline, state is 'queued' and get_verdict returns the outcome later, which guides the agent to the sibling tool. However, it does not explicitly state 'use this tool instead of X' or list exclusions; the guidance is inferred from the flow description rather than stated as a rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_receiptVerify a receipt offlineARead-onlyIdempotent
Checks a receipt independently of QED Proof's servers, as the reference checker in the QED Proof spec does: the JSON Schema, integer-only encoding, the signing key's validity window, the Ed25519 signature, the claim digest and the Merkle log inclusion proof. It does not read the blockchain, so the on-chain anchor is reported as not checked and the achieved trust level is at most 1. Pass receipt_json for a fully offline check, or receipt_id to fetch the receipt first. The public keys come from keys_json or, when omitted, from the issuer's published poaw-keys.json.
| Name | Required | Description | Default |
|---|---|---|---|
| keys_json | No | The issuer's poaw-keys.json as raw JSON text. | |
| receipt_id | No | A receipt_id to fetch, when receipt_json isn't given. | |
| receipt_json | No | The receipt as raw JSON text. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/openWorld/idempotent annotations, the description discloses meaningful behavior: it is independent of QED Proof's servers, does not read the blockchain, reports the anchor as unchecked, and caps trust level at 1. It also reveals the default key source. This gives an agent a realistic model of side effects and limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four dense sentences, each carrying distinct value: what it checks, what it does not check, input modes, and key resolution. The core purpose is front-loaded and there is no redundant restatement of the schema or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all invocation decisions, trust-level consequences, and key resolution, making it complete enough for an agent to call safely. It references the QED Proof spec for the exact checker semantics and describes the report's limitations, so the absence of an output schema is not a blocking gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema already covers all parameters at 100%, the description adds orchestration semantics: the offline-vs-fetch distinction between receipt_json and receipt_id, and the fallback behavior for keys_json from the issuer's published poaw-keys.json. This is exactly the extra meaning an agent needs to choose the right parameter combination.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Checks a receipt independently of QED Proof's servers' and enumerates the exact verification steps (JSON Schema, integer-only encoding, Ed25519 signature, Merkle proof). This clearly distinguishes it from sibling retrieval tools like get_receipt and get_verdict, so an agent knows what the tool is for without reading schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete invocation guidance: pass receipt_json for a fully offline check or receipt_id to fetch first, and explains that keys_json may be omitted in favor of the issuer's published poaw-keys.json. It also warns that the on-chain anchor is not checked, which sets expectations, but it does not explicitly route to alternative siblings such as get_verdict when a higher trust level is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
get_receipt - First observed
get_verdict - First observed
list_claims - First observed
list_connections - First observed
submit_claim - First observed
verify_receipt
TDQS
Scored across 6 tools
Each tool maps to a clearly distinct operation: submit a claim, get a single verdict, retrieve a receipt, verify a receipt, list claims, and list connections. Though get_verdict and list_claims both expose verdict information, one is a targeted lookup and the other is a filtered list, so selection should be unambiguous.
All tool names consistently follow a verb_noun snake_case pattern: get_*, list_*, submit_*, verify_*. There are no mixed casing styles, vague verbs, or unpredictable naming conventions.
Six tools is well-scoped for the claim/receipt verification domain. Each tool covers a necessary step in the workflow without unnecessary duplication or bloat.
The full claim lifecycle is covered: submit, poll/check verdict, fetch receipt, verify receipt, and list claims/connections. The only notable limitation is that verify_receipt explicitly does not check the on-chain anchor, so full trust-level-2 verification is not available within this tool set, though this is documented as an intentional scope boundary.
Maintenance
Related MCP Connectors
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
A paid remote MCP for ZeroID, built to return verdicts, receipts, usage logs, and audit-ready JSON.
Give AI agents identity, scoped access, trusted context, and verifiable actions through MCP.
Remote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceEnables verification of AI agent identity, authority, and integrity at transaction time, returning signed verdicts for allow, step-up, review, or block.MIT

vantic-mcpofficial
AlicenseNot gradedqualityBmaintenanceEnables MCP hosts to verify agent spending mandates and receipts, providing stateless tools for authorization, chain verification, credential verification, and DID resolution.Apache 2.0- AlicenseNot gradedqualityBmaintenanceEnables AI agents to cross-verify candidate claims against caller-supplied source texts, flagging hallucinations, numerical drift, entity mismatches, contradictions, and unverified assertions. It returns sentence-level verdicts with matched evidence snippets and machine-readable factual grounding confidence scores, exposed over MCP stdio, HTTP REST, and A2A discovery routes.MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to verify claims against evidence through MCP tools, returning approved, rejected, or needs_review verdicts with replayable receipts.MIT