cedulon
Cedulon
Capa de auditoría para gastos de agente a agente: manifiesto de intercambio firmado, política de cierre ante fallos, recibo de gasto firmado (anclable a SCITT).
Cedulon no es un raíl de pago. Se sitúa por encima de x402 y AP2.
Los paquetes están en npm y el servidor MCP está en el MCP Registry, pero nada de esto toca dinero: no hay carteras reales ni raíles de red, solo fixtures simulados. cedulon_spend liquida en un raíl simulado y así lo dice en su propia descripción.
Los paquetes principales tienen cero dependencias en tiempo de ejecución; el paquete del servidor MCP depende únicamente del SDK MCP oficial.
Requisitos
Node.js 22 o superior (20+ para las bibliotecas; los scripts usan la eliminación de tipos de Node)
npm 10 o superior
Related MCP server: wwall
Instalación y ejecución (clon limpio)
npm install
npx tsc --noEmit
npm run test:all
npm run demoSe espera que npm run tamper termine con código distinto de cero (los bytes manipulados no pasan la verificación).
npm run demo:unguarded muestra el hueco sin proteger: 100/100 permitidos.
npm run audit debe terminar con código 0 (audit: balanced).
npm run demo:bypass debe terminar con código distinto de cero:
audit: 1 settlement without receipt → FAIL.
npm run demo:bypasses imprime cuatro líneas FAIL (recibo faltante, cantidad incorrecta, referencia nula, cabecera de cadena corrupta) y termina con 0 solo cuando se detecta cada bypass; un bypass no detectado hace que termine con código distinto de cero.
npm run demo:live concilia una ventana real de USDC en Base Sepolia en lugar de un fixture. Es de solo lectura: necesita una URL RPC en CEDULON_RPC_URL y no requiere cartera, clave ni transacción. Frente a una cuenta de la que no tienes los recibos, cada liquidación que la cadena reporta aparece como una laguna.
Un tercero puede reproducir esto sin confiar en nosotros:
docs/RUN_AS_VERIFIER.md.
Guía de cinco minutos, incluida la configuración del host MCP: docs/QUICKSTART.md.
Servidor MCP
Cedulon puede ejecutarse como un servidor MCP local por stdio. El host se comunica mediante JSON-RPC por stdin/stdout. Las cinco herramientas son envoltorios ligeros sobre los paquetes existentes; no reimplementan la política, los recibos ni la auditoría.
Herramienta | Argumentos | Resultado |
|
| Permitido → recibo firmado en JSON. Denegado → |
|
|
|
| objeto |
|
| ninguno | Recibos + checkpoint + extracto en la forma JSON de |
| ninguno |
|
Claude Desktop / Claude Code / Cursor. Nada que clonar ni que construir:
{
"mcpServers": {
"cedulon": {
"command": "npx",
"args": ["-y", "@cedulon/mcp-server"]
}
}
}En Claude Code, esa configuración es un solo comando:
claude mcp add cedulon -- npx -y @cedulon/mcp-serverLos límites de la política provienen del entorno: CEDULON_MAX_AMOUNT, CEDULON_MAX_CUMULATIVE, CEDULON_MAX_PAYMENTS, CEDULON_WINDOW_MS, CEDULON_ALLOWED_PAYEES, CEDULON_ALLOWED_CURRENCIES, CEDULON_ALLOWED_TOOLS, CEDULON_PAYER. Establece CEDULON_STATE_PATH para conservar la cadena de recibos entre reinicios; sin ella, el libro mayor vive en memoria.
Si en su lugar trabajas dentro de este repositorio, sobre las fuentes:
npm run mcpEl servidor está listado en el MCP Registry como io.github.dogrucanemek-alt/cedulon; server.json es la entrada desde la que se publica.
npm run mcpb crea un paquete .mcpb — un zip que contiene el servidor y sus dependencias, que un host de escritorio instala con un clic, con los topes de política expuestos como ajustes. Instala el paquete npm publicado en lugar de empaquetar el árbol de trabajo, por lo que el paquete contiene lo que npm te habría dado, y la versión ya debe estar publicada. El resultado se genera en build/ y es un artefacto de publicación, no código fuente.
smithery.yaml es el formato más antiguo del ecosistema y no se envía; las instrucciones actuales de Smithery aceptan un endpoint HTTPS o un paquete .mcpb.
Estructura
packages/core policy engine + Decision Token (workspace dep on @cedulon/cose)
packages/cose deterministic CBOR + COSE_Sign1 (Ed25519)
packages/manifest signed trade manifest
packages/receipts spend receipt (COSE default, JSON legacy)
packages/checkpoint epoch checkpoints + in-process transparency log
packages/audit rail-extract completeness checker
packages/mcp-guard MCP tools/call wrapper (mock)
packages/mcp-server stdio MCP server (official SDK)
packages/x402-adapter HTTP 402 adapter + mock rail extract
packages/base-extract read-only Base Sepolia USDC → RailExtract
examples/demo runaway, dispute, bypass, audit CLI
spec/ draft-dogru-cedulon-01 (current), -00, plus the
reattestation and streaming drafts
THREAT_MODEL.md
docs/RUN_AS_VERIFIER.mdLos nombres de marca provienen únicamente de packages/core/src/brand.ts.
Cómo citar
Los metadatos de citación están en CITATION.cff. La versión -00 archivada se publica como https://doi.org/10.5281/zenodo.22099792
Licencia
Apache-2.0
Available Tools
5 toolscedulon_auditARead-only
Reconcile the in-process receipt chain and checkpoint against the rail extract: this server's own ledger, or a signed extract you present. Returns audit: balanced or findings, names the account, rail and window it was computed over (scope) when an extract declared one, and counts the class every receipt and row landed in (counts).
| Name | Required | Description | Default |
|---|---|---|---|
| trust | No | Rail key you hold out of band: { publicKeyPem: string | string[], accountId?, railId?, windowStartMs?, windowEndMs? } | |
| extract | No | A signed rail extract you were presented with: { body: { accountId, railId, windowStartMs, windowEndMs, settlements: [{ ref, amount, currency, timestampMs }], clockSkewMs? }, signature, publicKeyPem }. Present, it is the settlement side of the audit: this server's in-process settlement rows are not consulted, rows added through extraSettlements are refused beside it (an empty list adds nothing and is accepted), and the result carries scope. The receipt side is still this server's own receipt chain and checkpoints, so an extract for an account or rail this server did not settle on reports this server's receipts as unmatched; that is the correct reading of that pairing, not a defect. A body the library would refuse to sign (malformed window, amount outside the grammar, negative clock skew), an empty account, rail or signature, or a key that is not a PEM is refused as extract: ... before anything is reconciled. Absent, the audit runs over this server's own ledger and declares no scope. | |
| manifest | No | A Trade Manifest you were presented with. Omit for a no-manifest deployment. Present without manifestTrust is unauthenticated-manifest. | |
| payeeTrust | No | Payee keys you hold out of band, keyed by payee: { "payee-1": publicKeyPem } | |
| issuerTrust | No | Issuer key(s) you hold out of band: { publicKeyPem: string | string[] }. Without it the audit checks this server's records against this server's own key. | |
| witnessTrust | No | Transparency log key you hold out of band: { publicKeyPem: string | string[] } | |
| manifestTrust | No | Manifest publisher key(s) you hold out of band: { publicKeyPem: string | string[] } | |
| extraSettlements | No | Optional extra extract rows, used to inject a bypass settlement in tests |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint and openWorldHint; the description adds substantial non-obvious behavior: extract presence suppresses in-process settlement rows and makes extraSettlements refused, scope is populated only when an extract declared one, an empty list is still accepted, and mismatched account/rail pairings are the correct reading rather than a defect. It also enumerates the validation failures that surface as 'extract: ...' before reconciliation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the action, then the return shape (audit/scope/counts). The extract clause runs long and nests several conditions, but each carries decision-relevant information rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 optional nested parameters and no output schema, the description carries the return contract itself (balanced vs findings, scope, counts) and the key cross-parameter interactions, which is most of what an agent needs. Minor gap: it does not characterize cost, determinism, or how findings are enumerated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning the schema does not: extraSettlements is refused beside an extract (except an empty list), issuerTrust absence falls back to the server's own key, and manifest without manifestTrust yields unauthenticated-manifest. That is genuine semantic lift above the field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: reconcile the in-process receipt chain and checkpoint against a rail extract or this server's own ledger. It is clearly distinguishable from cedulon_verify_receipt and cedulon_export_ledger by scope (whole-ledger reconciliation vs. single receipt / export), though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives conditional context for the two modes (extract present = settlement side taken from the extract; absent = this server's own ledger), plus the refusal conditions. But it never says when an agent should choose this tool over cedulon_verify_receipt or cedulon_status, so routing must be inferred from the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cedulon_export_ledgerARead-only
Export receipts, checkpoint, and rail extract in the same JSON shape as npm run demo:export, with the findings, guarantee and counts of the audit over this server's own ledger.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and openWorldHint=false, so the read-only nature is covered. The description adds useful behavioral context beyond annotations by specifying the output shape ('same JSON shape as npm run demo:export') and the included audit content (findings, guarantee, counts). It does not mention auth or rate limits, but the read-only annotation lowers the burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently packs the core resource, the output shape, and the scope. Every phrase contributes meaningful information, and there is no filler. It is slightly dense, but it remains appropriately sized for a zero-parameter export tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no inputs and annotations covering the safety profile, the description provides a solid output contract and scope. The main gap is that 'npm run demo:export' is an external reference and the relationship to cedulon_audit is not explicitly clarified, but for a read-only zero-parameter export this is substantially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema coverage is 100%, so there are no parameter details that need explanation. The zero-parameter baseline is 4, and the description correctly adds no parameter guidance since none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Export') and names the exact resources: receipts, checkpoint, rail extract, and the audit's findings, guarantee, and counts. It also defines the output shape by referencing 'npm run demo:export', which makes the tool's function concrete and distinct from siblings like cedulon_status or cedulon_audit. The only slight assumption is familiarity with the demo:export script, but the core purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: call this when you need the server's own ledger audit data in the demo:export JSON shape. However, it does not explicitly mention sibling tools or state when not to use this one, so an agent must infer routing from the tool name and context rather than from explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cedulon_spendA
Policy-gated spend on the mock rail. Allow returns a signed COSE receipt JSON. Deny returns the fail-closed reason.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Calling tool name recorded on the request | |
| nonce | Yes | ||
| payee | Yes | ||
| amount | Yes | Integer amount as a decimal string | |
| currency | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses both possible outcomes—an allow path returning a signed COSE receipt JSON and a deny path returning the fail-closed reason. This goes beyond the annotations, which only indicate hints like readOnly false and idempotent false. It doesn't explain the policy itself, but it clearly communicates the behavioral contract.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short sentences, front-loaded with the primary action, and each sentence adds distinct value. There is no filler, redundancy, or unnecessary background.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description explains return variants, it does not cover policy prerequisites, parameter formats, or the meaning of nonce, payee, and currency. With no output scheme and only 40% schema description coverage, these omissions make it difficult for an agent to invoke the tool correctly the first time.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 40%, yet the description adds no parameter-level meaning for nonce, payee, or currency, and does not even mention 'amount' or 'tool'. With most parameters undocumented in both schema and description, the agent has little guidance on how to set valid inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('spend'), the resource ('mock rail'), and the policy-gating nature of the operation. It also distinguishes the tool from siblings like cedulon_verify_receipt and cedulon_audit by describing the spend-specific outcome.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is used when a policy-gated spend should be attempted, and sibling names suggest the other tools serve different purposes. However, it does not explicitly state when to use this tool over alternatives, nor does it provide exclusions or condition-based routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cedulon_statusARead-only
Server version, policy summary, receipt count, and chain head hash.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful context about the specific data fields exposed, but does not disclose any further behavioral details such as response format, freshness, or failure modes. This is comparable to a straightforward status read where the annotations carry the main burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the most important information: it enumerates exactly what the status tool exposes. Every word earns its place and there is no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless status endpoint with read-only annotations, the description is largely sufficient: it names the key result fields. There is no output schema to supplement the return values, but the listed fields are concrete enough for an agent to understand what this tool offers in the context of its siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the schema is empty, so there are no parameter semantics to document. With 0 params, the baseline of 4 applies, and the description does not need to compensate for any parameter coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title 'Server status' plus the description's list of returned data ('Server version, policy summary, receipt count, and chain head hash') clearly identifies this as a read-only status tool. It is distinct from the sibling tools (spend, audit, verify_receipt, export_ledger), though it lacks an explicit verb such as 'returns' or 'gets'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to choose this tool versus its siblings such as cedulon_audit or cedulon_export_ledger. There is no stated condition, exclusion, or mention of alternatives; usage is only weakly implied by the word 'status' in the title.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cedulon_verify_receiptARead-only
Verify a spend receipt COSE_Sign1 (and payee countersignature when present). Supply expectIssuerKeyPem to check it against a key you already hold; without one the receipt is only checked against the key it carries, which any key satisfies.
| Name | Required | Description | Default |
|---|---|---|---|
| coseHex | No | ||
| receipt | No | Full SignedReceipt object from cedulon_spend | |
| publicKeyPem | No | ||
| counterCoseHex | No | ||
| expectPayeeKeyPem | No | Payee key you hold out of band, for the countersignature. | |
| payeePublicKeyPem | No | ||
| expectIssuerKeyPem | No | Issuer key you hold out of band. Omit and the check is self-referential. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint, so the description carries the burden of behavioral caveats. It adds the important warning that omitting expectIssuerKeyPem makes verification self-referential and 'any key satisfies' it, which prevents an agent from over-trusting a nominally verified receipt.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences with no filler. It front-loads the primary purpose and then delivers the single most important usage caveat, making every word earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 optional parameters, no required fields, no output schema, and no guidance on which parameter combinations are valid, the description is not complete enough for reliable invocation. It explains the issuer-key pitfall but leaves the receipt/countersignature input representations and the verification result unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 43%, and the free-text description explains only expectIssuerKeyPem behaviorally. The relationship between coseHex, receipt, counterCoseHex, publicKeyPem, and payeePublicKeyPem is left unstated, so an agent cannot confidently choose among the seven optional input modes from the description alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the verb 'Verify' and names the specific resource: a spend receipt COSE_Sign1 plus the optional payee countersignature. This clearly separates it from spend/audit/export/status siblings and makes the tool's operation unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides concrete conditional guidance: supply expectIssuerKeyPem when you want to check against a key you already hold, and omit it when you accept the receipt's self-carried key. It does not name alternative tools, but the parameter-level when/how instructions are clear enough for correct invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.16.0- Changed
cedulon_audit1 field changed- changed
Input schema / properties / trust / descriptionPrevious value: -"Rail key you hold out of band: { publicKeyPem, accountId?, railId?, windowStartMs?, windowEndMs? }"New value: +"Rail key you hold out of band: { publicKeyPem: string | string[], accountId?, railId?, windowStartMs?, windowEndMs? }"
1 tool update
v0.12.0- Changed
cedulon_audit1 field changed- added
Input schema / properties / extractAdded value: +{ + "description": "A signed rail extract you were presented with: { body: { accountId, railId, windowStartMs, windowEndMs, settlements: [{ ref, amount, currency, timestampMs }], clockSkewMs? }, signature, publicKeyPem }. Present, it is the settlement side of the audit: this server's in-process settlement rows are not consulted, rows added through extraSettlements are refused beside it (an empty list adds nothing and is accepted), and the result carries scope. The receipt side is still this server's own receipt chain and checkpoints, so an extract for an account or rail this server did not settle on reports this server's receipts as unmatched; that is the correct reading of that pairing, not a defect. A body the library would refuse to sign (malformed window, amount outside the grammar, negative clock skew), an empty account, rail or signature, or a key that is not a PEM is refused as extract: ... before anything is reconciled. Absent, the audit runs over this server's own ledger and declares no scope.", + "type": "object" +}
2 tool updates
v0.5.1- Changed
cedulon_audit6 fields changed- added
Input schema / properties / issuerTrustAdded value: +{ + "description": "Issuer key(s) you hold out of band: { publicKeyPem: string | string[] }. Without it the audit checks this server's records against this server's own key.", + "type": "object" +} - added
Input schema / properties / manifestAdded value: +{ + "description": "A Trade Manifest you were presented with. Omit for a no-manifest deployment. Present without manifestTrust is unauthenticated-manifest.", + "type": "object" +} - added
Input schema / properties / manifestTrustAdded value: +{ + "description": "Manifest publisher key(s) you hold out of band: { publicKeyPem: string | string[] }", + "type": "object" +} - added
Input schema / properties / payeeTrustAdded value: +{ + "description": "Payee keys you hold out of band, keyed by payee: { \"payee-1\": publicKeyPem }", + "type": "object" +} - added
Input schema / properties / trustAdded value: +{ + "description": "Rail key you hold out of band: { publicKeyPem, accountId?, railId?, windowStartMs?, windowEndMs? }", + "type": "object" +} - added
Input schema / properties / witnessTrustAdded value: +{ + "description": "Transparency log key you hold out of band: { publicKeyPem: string | string[] }", + "type": "object" +}
- Changed
cedulon_verify_receipt2 fields changed- added
Input schema / properties / expectIssuerKeyPemAdded value: +{ + "description": "Issuer key you hold out of band. Omit and the check is self-referential.", + "type": "string" +} - added
Input schema / properties / expectPayeeKeyPemAdded value: +{ + "description": "Payee key you hold out of band, for the countersignature.", + "type": "string" +}
5 tool updates
v0.2.3- First observed
cedulon_audit - First observed
cedulon_export_ledger - First observed
cedulon_spend - First observed
cedulon_status - First observed
cedulon_verify_receipt
TDQS
Scored across 5 tools
Each tool has a clearly distinct role: audit reconciles the ledger, export serializes state, spend creates a receipt, status reports server metadata, and verify checks receipt signatures. The potential overlap between audit and export is handled by descriptions, with export explicitly packaging audit findings rather than replacing audit.
All names use the consistent cedulon_ snake_case prefix, making the set easy to scan. The suffixes mix verb forms (audit, spend, status) with verb_noun forms (export_ledger, verify_receipt), but this is a minor deviation rather than a confusing convention.
Five tools is well-scoped for a focused receipt-chain and mock-rail auditing server. Each tool covers a necessary lifecycle step without obvious redundancy.
The surface covers core operations: spend, verify, audit, export, and status, with export serving as the main access path for receipts and checkpoints. Minor gaps remain, such as no explicit list-receipts or direct checkpoint lookup, but agents can work around this through export.
Maintenance
Related MCP Connectors
Governed agent execution: x402 payments, budgets, receipts, verification, and audit.
Agent-native MCP for governed commerce, x402 payments, paid capabilities, and verifiable receipts.
Scoped agent execution. Server-side credentials, policy, budgets and verifiable receipts.
Pre-execution policy gate for consequential agent actions with durable trust receipts.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceDeterministic, auditable payment policy enforcement for AI agents. It provides pre-action authorization with scopes, budgets, allowlists, and signed mandates via an MCP server.MIT
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to propose wallet payments while a local, human-authored policy decides whether each transaction is approved, requires human confirmation, or is refused, and records every decision in a signed, append-only ledger.-
- AlicenseAqualityAmaintenanceEnables MCP-speaking agents to execute tool calls through an authorization gate, producing signed decision records and reconciled effect rows for accountability.6Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to inspect, check, and audit signed offline spending authorizations, and to issue hash-chained receipts for each action taken against them. Enforces per-transaction, total, expiry, merchant, and human-approval constraints, returning allow, needs_human, or deny with the specific failing constraint.Apache 2.0