deus-witness
Demo MCP tool server exposing five simulated tools; most actions are only recorded, and file reads return fixed text rather than accessing real files.
send_email: Simulate sending an email withto,subject, andbody.purchase: Simulate a purchase withvendorandamount_cents.delete_resource: Simulate deleting a namedresource.publish: Simulate publishingtextto achannel.read_file: Simulate reading a file atpath, returning fixed text and reading nothing.
Each tool returns a simple result string; no real email, purchase, deletion, publishing, or filesystem access is performed.
Provides curl-based integration examples for calling the Witness HTTP API directly, allowing agents or scripts to request tool-call decisions and work with signed receipts.
Provides Vercel AI SDK integration examples so AI SDK-based agents can route tool calls through the witness for mandate checks and signed, independently verifiable receipts.
Deus Witness
A witness service for AI-agent tool calls. Your agent asks before it acts; a witness outside the agent
checks the call against a mandate you signed, and answers allow, deny or defer (wait for you). A decision made against your mandate is a signed,
append-only receipt you can verify offline (a few automatic refusals, e.g. a call before any mandate or over a rate limit, are kept only in the server database) - so "what did the agent do, and who allowed it" has an answer you do not have to take on trust.
Install and try (one command): uvx --from deus-witness deus-witness try - or in Claude Code /plugin marketplace add sipkigroup/witness, then /plugin install deus-witness@sipkigroup.
As an MCP proxy (stdio; after -- put the MCP server you want witnessed; the bundled demo server records calls to a file and does nothing real): uvx deus-witness -- deus-witness-demo-tools, with DEUS_WITNESS_KEY (dwk_..., from your account at the hosted service) set.
Hosted service: https://witness.sipkigroup.com - live demo: https://witness.sipkigroup.com/demo
This repository: the open parts - the receipt specification, two separate verifiers, the TypeScript client, the Python client and the HTTP API contract (OpenAPI, data only).
Status: early (0.x). The specification is an individual draft in
spec/(not an IETF standard, not submitted to the IETF). The evidence so far is our own simulations and separate implementations written from the spec by one author; there are no external audits or deployments yet. Treat it as something to test and attack, not as a certified security boundary. Reports of bypasses are the most valuable thing you can send us.
Try it in Claude Code
Needs Claude Code 2.1.295+ and uv (curl -LsSf https://astral.sh/uv/install.sh | sh); macOS, Linux, WSL.
/plugin marketplace add sipkigroup/witness
/plugin install deus-witness@sipkigroup
/deus-witness:trytry makes a trial account and opens a page in your browser. The first tool call that needs you waits; the page asks for two passkey touches (one makes your passkey, one signs the recommended rules), then that call is decided - allowed, refused, or shown to you for one more touch. Until your first touch a call waits up to 90 s, then it is refused (TRIAL_NOT_CLAIMED): ask again after the touches. A trial account has no phone notifications: the call waits for you on that page. A trial account you do not keep is erased after 7 days.
/plugin install opens the plugin panel: pick a scope and install; if it says so, run /reload-plugins.
Without the plugin: uvx --from deus-witness deus-witness try (pip install deus-witness only with Python 3.10+ in a venv).
Related MCP server: Proofpane
What is here
Path | What | License |
| Draft specification of the action receipt ( | Apache-2.0 |
| Verifier in JavaScript, written from the spec | Apache-2.0 |
| Verifier in Swift, written from the spec (source; build with | Apache-2.0 |
|
| Apache-2.0 |
|
| Apache-2.0 |
| HTTP API contract (OpenAPI), WebAuthn signing profile, contract stub | Apache-2.0 |
| Claude Code plugin: the hook in one install command | Apache-2.0 |
| Examples: Vercel AI SDK, curl | Apache-2.0 |
| Teams, recovery, anchors, verifying receipts | Apache-2.0 |
In this repo, all Apache-2.0 and run locally: the complete MCP server (deus-witness-mcp, a stdio proxy you put in front of any MCP server), the Claude Code hook and plugin, the offline verifiers and the specs.
Not in this repo: the hosted Witness API that the MCP server calls, like any API-backed MCP server calls its API (passkey approvals, the signed journal). It is run by the author and is not covered by this license; packs it issues are checked offline with the verifiers here, so you don't have to trust it.
You can implement your own witness from spec/ and contract/.
Use it
Claude Code: the three commands above (the one-step form /plugin install deus-witness --marketplace sipkigroup/witness also exists in Claude Code 2.1.275 or later); see plugins/deus-witness/README.md.
The hosted service is at https://witness.sipkigroup.com. From TypeScript: npm install @deus-witness/sdk (see sdk-ts/README.md). From Python, or to put any MCP server behind the witness: pip install deus-witness (Python 3.10+ in a venv) or, with no install, uvx deus-witness -- <your MCP server command> (MCP Registry: io.github.sipkigroup/witness; see python/README.md; setup: https://witness.sipkigroup.com/dl/docs/quickstart.html).
Any other language: speak HTTP, see contract/openapi.yaml and integrations/.
Honest limits
A witness cannot know what an action really does beyond what the tool map and the operator's description say; it checks the call against your mandate. Routes that do not go through the witness are not covered.
The TypeScript client does not verify receipt signatures yet (the verifiers here do). Do not treat an
allowseen through it as cryptographically checked.If the witness is unreachable, calls should be blocked (fail closed). That is a safety choice that costs availability.
Verify the receipts yourself
python3 spec/vectors/check_vectors.py # the abstract spec vectors through the reference model of the spec (no dependencies)
(cd verifier_js && npm ci && npm test) # the same vectors through the JavaScript verifier
(cd verifier_swift && ./build.sh && ./aarc --quiet --extra extra-vectors)If two implementations disagree on a vector, one of them (or the spec) is wrong - please open an issue with the vector.
Security, contributing, license
Vulnerabilities:
SECURITY.md(support@sipkigroup.com). Contributions:CONTRIBUTING.md.Apache License 2.0 (
LICENSE,NOTICE). Copyright 2026 Sipki LLC.
Available Tools
5 toolsdelete_resourceB
Delete a resource (demo: only recorded).
| Name | Required | Description | Default |
|---|---|---|---|
| resource | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden; it does disclose a crucial trait -- that this is a demo where deletion is only recorded, not actually performed. It omits what 'recorded' means in practice, whether real deletion is ever possible, and what permissions or side effects apply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with the important operation front-loaded and the demo caveat attached immediately. Nothing is wasted, though the terseness borders on under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the demo caveat is a useful addition for a destructive-sounding tool. However, ambiguity about what 'resource' identifies and the absence of any safety/permission context leave real gaps for a mutation tool with zero annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% for the single required 'resource' parameter, and the description says nothing about identifier format, accepted values, or examples. With one undocumented parameter, the description should compensate and does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the specific verb+resource ('Delete a resource'), which cleanly distinguishes it from siblings like read_file, publish, send_email and purchase. The only weakness is that 'resource' stays abstract and the description never says what kind of resource is meant.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus alternatives, no prerequisites, and no confirmation/irreversibility note. The only usage-adjacent text is the '(demo: only recorded)' caveat, which explains behavior rather than selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publishB
Publish text to a channel (demo: only recorded).
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| channel | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that this is a demo and only records the publish action, which is important context, but it does not explain permissions, side effects, or where the recording occurs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. The demo caveat is placed immediately after the core action, so the agent sees the important behavior early.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. However, for a two-parameter publish tool with no annotations, the description is too thin: it lacks usage criteria, parameter semantics, and sufficient behavioral detail beyond the demo caveat.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only implies that text is the content and channel is the destination. It adds almost no constraints, formats, allowed values, or distinctions beyond the parameter names themselves.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: "Publish text to a channel." This clearly identifies the action and target, though it does not explicitly differentiate the tool from sibling tools like send_email or describe how a channel differs from other destinations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does but gives no guidance on when to use it versus alternatives such as send_email. It also does not mention prerequisites, exclusions, or the required channel context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
purchaseC
Buy something (demo: only recorded).
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | Yes | ||
| amount_cents | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load, but it does disclose the key behavioral trait that this is a demo and nothing is actually purchased ("only recorded"), which prevents an agent from assuming real side effects. It omits permissions, idempotency, and whether repeated calls append records.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with the demo caveat front-loaded and zero wasted words. However, the terseness crosses into under-specification rather than effective conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, but for a mutation-style tool with no annotations and 0% parameter coverage, the description leaves too much unsaid about side effects, constraints, and argument meaning to be complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so both required parameters (vendor, amount_cents) are documented only by bare titles. The description adds no meaning about expected formats, currency, or units, so it does not compensate for the coverage gap, though the parameter names are largely self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Buy something" states a verb but the object is unspecified ("something"), so the resource is vague. The parenthetical "(demo: only recorded)" does clarify the demo nature and differentiates it from real transaction tools, which adds some value beyond the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the available siblings (send_email, publish, delete_resource, etc.), and no preconditions or exclusions. The only cue is the demo caveat, which does not help an agent decide between tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileA
Read a file (demo: returns fixed text, reads nothing).
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it discloses the most consequential trait: nothing is actually read, fixed text is returned. It lacks detail on error handling or whether the path is validated or ignored, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence, front-loaded with the verb and resource, with the critical caveat in the same breath. Nothing wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the description tells the agent the output is fixed text. The remaining gap is the undocumented required 'path' parameter, minor for a stub that ignores it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the only parameter, 'path', is never mentioned in the description. 'Reads nothing' weakly implies the path is ignored, but the required 'path' argument's role, format, or whether it must exist is left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read a file') and immediately qualifies it with the decisive fact that this is a demo returning fixed text. An agent knows exactly what the tool produces, which matters more than differentiating it from the unrelated siblings (send_email, purchase, etc.).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus other tools, and no preconditions stated. The 'demo' note hints at context, but the description never says an agent should not rely on it for real file access or when to prefer an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailB
Send an email (demo: only recorded).
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| body | Yes | ||
| subject | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the key behavioral trait: this is a demo that only records and does not actually send mail. That is genuinely useful. However, it omits whether sends are logged, whether recipients are validated, whether calls are rate-limited, or what the recorded result contains — for a side-effecting tool with zero annotation coverage this is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence that front-loads the operation and appends the crucial demo caveat. Nothing is wasted, though the terseness is partly under-specification rather than pure efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the demo caveat covers the most surprising behavior. Still, with three wholly undocumented required parameters and no annotations, the agent lacks enough information to construct a correct call in edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across three required parameters, so the description needs to compensate and does not. It says nothing about expected format for 'to' (single address? comma-separated?), whether 'subject' may be empty, or whether 'body' supports HTML — all decisions an agent must make.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Send an email'), which unambiguously identifies the operation. None of the sibling tools (purchase, publish, read_file, delete_resource) are email-related, so differentiation is implicit rather than needing explicit mention.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no prerequisites, and no mention of what happens with invalid addresses or unreachable recipients. The only usage-relevant note is that it is a demo that records rather than delivers, which speaks to behavior more than to selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.2.27- First observed
delete_resource - First observed
publish - First observed
purchase - First observed
read_file - First observed
send_email
TDQS
Scored across 5 tools
Each tool targets a clearly distinct action and resource type: email, purchase, deletion, publishing, and file reading. There is little risk of an agent confusing one tool with another.
Most names use verb_noun form (send_email, delete_resource, read_file), but purchase and publish are standalone verbs. The conventions are mixed but still readable and predictable enough.
Five tools is a reasonable, compact set. Each tool represents a distinct operation, so the count is well-scoped rather than bloated.
The surface is disjointed: delete_resource exists with no create/update/read resource tools, read_file has no write counterpart, and purchase/send_email/publish have no lifecycle operations. This leaves significant gaps for most plausible domains.
Maintenance
Related MCP Connectors
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Human approval for irreversible AI agent actions, bound to the exact tool call by a passkey tap
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceSecurity gateway for MCP tool calls. Sits between your LLM client and MCP servers, enforcing per-tool policies (allow/block/approve/read-only), logging every call, and pausing dangerous operations for human approval in terminal or Slack.4 npm2MIT
- AlicenseBqualityAmaintenanceA governance proxy for AI tools — every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.13MIT
- FlicenseNot gradedqualityCmaintenanceProvides a secure MCP boundary for AI agents, intercepting and validating tool calls, redacting secrets, and requiring human approval for sensitive actions with a tamper-evident audit trail.-
- AlicenseNot gradedqualityCmaintenanceSits in front of any MCP server to enforce allow/ask/block policies on tool calls, paths, shell commands, and network domains, with local approval prompts and an audit log.MIT