Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Receipts Compliance MCP verify ./receipts/MANIFEST.signed.json with pubkey.pem and build an EU AI Act Annex IV report"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A local MCP server and Claude Desktop Extension. It verifies signed AI-agent receipt bundles and turns a set of receipts into auditor-ready Markdown reports. It runs offline; receipts are never uploaded.
Tool | Output |
| Checks a |
| EU AI Act Annex IV technical documentation |
| ISO/IEC 42001:2023 AI management system report |
| ISO/IEC 23894:2023 AI risk management report |
| NIST AI RMF 1.0 profile |
| SOC 2 Trust Service Criteria evidence binder |
| GDPR Article 35 DPIA and Article 30 Records of Processing |
| HIPAA Security Rule evidence binder |
| EU Cyber Resilience Act report |
| Sign an AI constitution; audit receipts against it |
Sections that need operator narrative are left as marked stubs. The reports are evidence summaries, not legal advice or a certification.
Related MCP server: agent-receipts-mcp
Download receipts-compliance.mcpb from a release and open it in Claude Desktop. To build it yourself:
npm install
npm run pack:mcpbnpm test # vitest
npm run typecheck
npm run build # bundles dist/server.jsReceipts are JSON objects with verdictId, overall (pass, warn or block) and issuedAt; see src/types.ts.
Dual-licensed under either of MIT or Apache-2.0, at your option.
Build an EU AI Act Annex IV technical-documentation report from a set of VAOS receipts. Article 11 of Regulation (EU) 2024/1689 requires this for every high-risk AI system. Returns Markdown ready to file with the EU AI Office.
Inputs: system (required), receipts (required), nextReportDue, operatorActions.
Audit a VAOS receipt set against a signed AI constitution. The constitution is a content-addressed (SHA-256) document of inviolable rules; receipts commit to its hash. This tool surfaces every receipt that violated a constitutional article, ranked by severity. Use it when you want to prove (or disprove) an autonomous agent followed its policy.
Inputs: receipts (required), constitution (required).
Build an EU Cyber Resilience Act (Regulation (EU) 2024/2847) compliance report from a VAOS receipt set. Maps every Annex I essential cybersecurity requirement + Article 13/14 obligation to receipt-derived evidence. Surfaces open findings.
Inputs: scope (required), receipts (required), residualRisks, implementationStatus.
Build a GDPR Article 35 DPIA + Article 30 RoPA report from operator-declared processing activities + a VAOS receipt set. Returns Markdown ready for the DPO + supervisory authority. High-residual-risk activities automatically flagged for Article 36 prior consultation.
Inputs: risks (required), receipts (required), activities (required), controller (required).
Build a HIPAA Security Rule (45 CFR § 164.308-318) evidence binder from a set of VAOS receipts. Maps every implementation specification to receipt-derived evidence. REQUIRED specifications without evidence are surfaced as findings; ADDRESSABLE specifications can be marked alternative-implemented with an operator note.
Inputs: scope (required), receipts (required), implementationStatus.
Build an ISO/IEC 23894:2023 AI risk-management report from operator-declared risk scenarios + a VAOS receipt set. Computes inherent + residual risk per scenario via the 5×5 likelihood × impact matrix, attenuated by receipt evidence count. Returns auditor-ready Markdown.
Inputs: scope (required), receipts (required), scenarios (required).
Build an ISO/IEC 42001:2023 AI management system (AIMS) report from a set of VAOS receipts. Covers clauses 4-10 + the 38-control Annex A matrix. Returns Markdown ready to hand to your certification body (BSI, TÜV SÜD, etc.).
Inputs: scope (required), receipts (required), retentionDays, operatorActions.
Build a NIST AI RMF 1.0 profile (GOVERN / MAP / MEASURE / MANAGE) from a set of VAOS receipts. The de-facto US federal AI risk-management standard. Returns Markdown with per-subcategory evidence counts and trustworthy-AI characteristic coverage.
Inputs: scope (required), receipts (required), maturityOverrides, functionNarratives.
Build a SOC 2 evidence binder mapped to AICPA Trust Service Criteria (2017) — security (CC1-CC9), availability (A1), processing integrity (PI1), confidentiality (C1), privacy (P-series). Each criterion gets a receipt-derived evidence count + days-of-coverage metric. Returns Markdown to walk into the audit kickoff with.
Inputs: scope (required), receipts (required), controlOwners, coverageThresholdDays.
Sign a new AI constitution. Returns a SignedConstitution whose hash field is the content-addressed identifier. Every receipt produced under this constitution should commit to this hash. The constitution itself is byte-deterministic — anyone can re-derive the hash given the same articles + name + signedBy.
Inputs: name (required), articles (required), signedBy (required), preamble.
Verify a signed receipt bundle manifest (MANIFEST.signed.json) against an Ed25519 public key. Recomputes the manifest hash and checks the signature. Use before building a report from a receipt set you did not produce yourself. Does not check the ML-DSA-65 half of a v3 signature.
Inputs: manifest (required), publicKeyPem (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 11 tools
The three non-report tools (create_constitution, build_constitution_audit, verify_manifest) are clearly distinct, and each build_* report tool names its target framework explicitly. However, eight tools share the identical shape 'build a Markdown compliance report from a receipt set,' so selection depends entirely on the agent knowing which regulatory framework applies—an easy source of misselection.
Every tool is snake_case with a leading verb (build_, create_, verify_) followed by a noun describing the target artifact or standard. The build_* family is uniform, and the two non-build tools still follow verb_noun convention.
Eleven tools sits comfortably in the well-scoped 3–15 range. The count is driven by distinct regulatory frameworks rather than redundant variants, and each report tool targets a genuinely different standard.
Framework reporting coverage is broad (EU AI Act, ISO 42001, NIST, SOC 2, GDPR, HIPAA, ISO 23894, CRA), but the receipt and constitution lifecycle is thin: no tool to list/fetch receipts, retrieve or list constitutions, or verify an individual receipt (only a whole manifest, and only the Ed25519 half of v3 signatures). Agents can work around this if receipts are supplied externally, but the surface has notable dead ends.
Issue & verify signed (ed25519), hash-chained, timestamped provenance receipts for agent actions.
Issue signed receipts for AI agent actions; verify any receipt offline - free, no account.
Post-quantum, tamper-evident receipts for agent actions. Ed25519 + ML-DSA-65, offline verify.
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
