What can you do with this server?

Cedulon is an audit layer for agent-to-agent spend on a mock rail — it enforces spend policy, issues signed receipts, and reconciles ledgers against rail extracts. It does not touch real money or networks. * cedulon_spend — Policy-gated mock-rail spend; allows return a signed COSE receipt, denials return a fail-closed reason (e.g. limit-amount). * cedulon_audit — Reconcile the server's receipt chain and checkpoints against its own ledger or a signed rail extract you present; accepts out-of-band trust roots, manifests, payee/issuer/witness keys, and test-only extraSettlements; returns balanced/findings, scope, and per-class counts. * cedulon_verify_receipt — Verify a COSE_Sign1 spend receipt and optional payee countersignature; use expectIssuerKeyPem to avoid a self-referential check. * cedulon_export_ledger — Export receipts, checkpoint, and rail extract with the audit's findings, guarantee, and counts. * cedulon_status — Report server version, policy summary, receipt count, and chain head. * Operational notes — Runs as a local stdio MCP server with no network requests, no wallets, and no credentials; policy caps and persistent state are configured via CEDULON_* environment variables.

de en es ja ko ru zh

cedulon

by dogrucanemek-alt

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

Cedulon

Maintained by VERAX Teknoloji. Start with the VERAX body: verax-ai/verax. Related projects: Conarium · Tugra.

Listed on: npm · Glama · MCP Registry · MCP Market · LobeHub · Zenodo

Audit layer for agent-to-agent spend: signed trade manifest, fail-closed policy, signed spend receipt (SCITT-anchorable).

Cedulon is not a payment rail. It sits above x402 and AP2.

The packages are on npm and the MCP server is in the MCP Registry, but nothing here touches money: no real wallets and no network rails, only mock fixtures. cedulon_spend settles on a mock rail and says so in its own description.

Core packages carry zero runtime dependencies; the MCP server package depends only on the official MCP SDK.

Requirements

Node.js 22 or newer (20+ for the libraries; scripts use Node type stripping)
npm 10 or newer

Related MCP server: wwall

Install and run (clean clone)

npm install
npx tsc --noEmit
npm run test:all
npm run demo

npm run tamper is expected to exit non-zero (tampered bytes fail verify).

npm run demo:unguarded shows the unprotected hole: 100/100 allows.

npm run audit must exit 0 (result balanced findings=0 on a tagged report).

npm run demo:bypass must exit non-zero: audit: 1 settlement without receipt → FAIL.

npm run demo:bypasses prints four FAIL lines (missing receipt, wrong amount, null-ref, garbage chain head) and exits 0 only when every bypass is caught; a missed bypass makes it exit non-zero.

npm run demo:live reconciles a real Base Sepolia USDC window instead of a fixture. Read-only: it needs an RPC URL in CEDULON_RPC_URL and no wallet, key, or transaction. Against an account whose receipts you do not hold, every settlement the chain reports comes back as a gap.

A third party can reproduce this without trusting us: docs/RUN_AS_VERIFIER.md.

Five-minute path, including the MCP host config: docs/QUICKSTART.md.

MCP server

Cedulon can run as a local stdio MCP server. The host talks JSON-RPC on stdin/stdout. The five tools are thin wrappers over the existing packages; they do not reimplement policy, receipts, or audit.

Tool	Arguments	Result
`cedulon_spend`	`amount` (string), `currency`, `payee`, `nonce`, optional `tool`	Allow → signed receipt JSON. Deny → `{ ok: false, reason }` (for example `limit-amount`).
`cedulon_audit`	optional `extract` (a signed rail extract you were presented with: `body`, `signature`, `publicKeyPem`), the trust roots (`trust`, `issuerTrust`, `witnessTrust`, `payeeTrust`, `manifest`, `manifestTrust`), optional `extraSettlements[]` (`ref`, `amount`, `currency`, `timestampMs`; refused beside `extract`)	`{ ok, summary, findings, warnings, guarantee, counts }`, plus `scope` when the audit ran over a presented extract; `counts` is the class every receipt and row landed in. Balanced books print `audit: balanced`.
`cedulon_verify_receipt`	`receipt` object, or `coseHex` + `publicKeyPem`, optional countersignature fields	`{ ok, receipt, countersignature }`
`cedulon_export_ledger`	none	Receipts + checkpoint + extract in the `demo:export` JSON shape
`cedulon_status`	none	`{ version, policy, receiptCount, chainHead }`

Claude Desktop / Claude Code / Cursor. Nothing to clone and nothing to build:

{
  "mcpServers": {
    "cedulon": {
      "command": "npx",
      "args": ["-y", "@cedulon/mcp-server"]
    }
  }
}

In Claude Code that config is one command:

claude mcp add cedulon -- npx -y @cedulon/mcp-server

Policy limits come from the environment: CEDULON_MAX_AMOUNT, CEDULON_MAX_CUMULATIVE, CEDULON_MAX_PAYMENTS, CEDULON_WINDOW_MS, CEDULON_ALLOWED_PAYEES, CEDULON_ALLOWED_CURRENCIES, CEDULON_ALLOWED_TOOLS, CEDULON_PAYER. Set CEDULON_STATE_PATH to keep the receipt chain across restarts; without it the ledger lives in memory.

Working inside this repository instead, against the sources:

npm run mcp

The server is listed in the MCP Registry as io.github.dogrucanemek-alt/cedulon; server.json is the entry it is published from.

npm run mcpb builds an .mcpb bundle — a zip holding the server and its dependencies, which a desktop host installs in one click, with the policy caps exposed as settings. It installs the released npm package rather than packing the working tree, so the bundle holds what npm would have given you, and the version must already be released. The result lands in build/ and is a release artifact, not source. Released bundles are attached to the matching GitHub release, with the bundle's SHA-256 in the release notes; v0.13.0 carries cedulon-0.13.0.mcpb, and v0.12.0 the one before it.

smithery.yaml is the older ecosystem format and is not submitted; Smithery's current instructions take an HTTPS endpoint or an .mcpb bundle.

There is also a Dockerfile, for hosts and directories that build the repository rather than install the package:

docker build -t cedulon .
docker run -i --rm cedulon

The protocol is the container's stdin/stdout, so it needs -i. It needs no credentials: the server settles on a mock rail and holds no wallet.

Layout

packages/core           policy engine + Decision Token (workspace dep on @cedulon/cose)
packages/cose           deterministic CBOR + COSE_Sign1 (Ed25519)
packages/manifest       signed trade manifest
packages/receipts       spend receipt (COSE default, JSON legacy)
packages/checkpoint     epoch checkpoints + in-process transparency log
packages/audit          rail-extract completeness checker
packages/mcp-guard      MCP tools/call wrapper (mock)
packages/mcp-server     stdio MCP server (official SDK)
packages/x402-adapter   HTTP 402 adapter + mock rail extract
packages/base-extract   read-only Base Sepolia USDC → RailExtract
examples/demo           runaway, dispute, bypass, audit CLI
spec/                   draft-dogru-cedulon-10 (latest here; in preparation,
                        not posted), -09 (posted 6 September 2026), -08,
                        -07, -06, -05, -04, -03, -02, -01, -00;
                        draft-dogru-cedulon-decision-profile-04 (posted
                        5 October 2026), -03, -02, -01, -00: decisions against effects
                        on the same reconciler; and the direction seeds
                        draft-dogru-cedulon-reattestation-00 and
                        draft-dogru-cedulon-streaming-00
THREAT_MODEL.md
docs/RUN_AS_VERIFIER.md

Brand names come from packages/core/src/brand.ts only.

How to cite

Citation metadata is in CITATION.cff. Cite the concept record https://doi.org/10.5281/zenodo.22099791, which resolves to the latest archived version. The decision profile, posted at draft-dogru-cedulon-decision-profile-04, is deposited on its own as https://doi.org/10.5281/zenodo.22337734 (all versions; the posted -04 text is https://doi.org/10.5281/zenodo.23155667)

Privacy Policy

https://cedulon.com/privacy.html

The MCP server runs on your machine and makes no network requests. It collects nothing, because there is no endpoint of ours to collect it. packages/mcp-server/README.md states what it holds while it runs and what it writes if you ask it to.

License

Apache-2.0

Available Tools

5 tools

cedulon_auditA

Read-only

Reconcile the in-process receipt chain and checkpoint against the rail extract: this server's own ledger, or a signed extract you present. Returns audit: balanced or findings, names the account, rail and window it was computed over (scope) when an extract declared one, and counts the class every receipt and row landed in (counts).

Inputs: trust, extract, manifest, payeeTrust, +4 more.

cedulon_export_ledgerA

Read-only

Export receipts, checkpoint, and rail extract in the same JSON shape as npm run demo:export, with the findings, guarantee and counts of the audit over this server's own ledger. A stored checkpoint whose encoding is not strict hex reports hash: null.

Inputs: no named parameters.

cedulon_spendA

Policy-gated spend on the mock rail. Allow returns a signed COSE receipt JSON. Deny returns the fail-closed reason.

Inputs: nonce (required), payee (required), amount (required), currency (required), +1 more.

cedulon_statusA

Read-only

Server version, policy summary, receipt count, and chain head hash.

Inputs: no named parameters.

cedulon_verify_receiptA

Read-only

Verify a spend receipt COSE_Sign1 (and payee countersignature when present). Supply expectIssuerKeyPem to check it against a key you already hold; without one the receipt is only checked against the key it carries, which any key satisfies.

Inputs: coseHex, receipt, publicKeyPem, counterCoseHex, +3 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.8/5.0

Scored 2026-11-12 23:40 across 5 tools

Disambiguation4/5

Each tool targets a distinct verb-object pair: audit reconciles, export_ledger serializes, spend executes, status reports, verify_receipt validates. The only mild overlap is between cedulon_audit and cedulon_export_ledger, since export includes audit findings, but descriptions make the distinction (export is a data dump, audit is a reconciliation verdict) reasonably clear.

Naming Consistency5/5

All five tools share the cedulon_ prefix followed by a lowercase verb or verb_noun (audit, export_ledger, spend, status, verify_receipt). The single deviation is status, a noun rather than a verb, but it reads naturally as a state query and does not break the pattern.

Tool Count4/5

Five tools is on the thin side but each corresponds to a real lifecycle step of the receipt/policy/rail domain: spend, reconcile, verify, inspect state, export. Nothing appears redundant, though a server this specialized could arguably use a policy-configuration tool.

Completeness3/5

The core loop (policy-gated spend, receipt verification, chain audit, status, export) is covered, but there are notable gaps: no tool to manage or update the spend policy, no receipt lookup or paginated receipt listing, and no checkpoint reset or repair operation. An agent hitting a stale or non-strict-hex checkpoint can only observe the failure, not remediate it.

Maintenance

ActivityActive

ResponsivenessMixed handling

Resources

Related MCP Connectors

attestify-os
io.github.attestifyagent
Governed agent execution: x402 payments, budgets, receipts, verification, and audit.
Payments & Billing Finance Autonomous Agents
2
https://attestify-os.vercel.app/api/run
CrossingKey MCPB
com.crossingkeyintelligence
Agent-native MCP for governed commerce, x402 payments, paid capabilities, and verifiable receipts.
Payments & Billing Autonomous Agents
281
https://mcp.crossingkeyintelligence.com/mcp
XGuard — Agent Execution GatewayB
io.github.moelayyan90
Scoped agent execution. Server-side credentials, policy, budgets and verifiable receipts.
Finance Security
181
https://api.xguardgate.com/mcp
InterAI Risk OracleA
io.github.InterAILabs
Pre-execution policy gate for consequential agent actions with durable trust receipts.
Autonomous Agents Security
91
https://api.interailabs.dev/mcp

Related MCP Servers

MandateGuard
Autonomous Agents Payments & Billing Security
ezequiellich44-cmd
A
license
Not graded
quality
A
maintenance
Deterministic, auditable payment policy enforcement for AI agents. It provides pre-action authorization with scopes, budgets, allowlists, and signed mandates via an MCP server.
Updated 3 months ago (2026-08-21 16:30 UTC)
MIT
wwall
Blockchain
axdvdv
F
license
Not graded
quality
D
maintenance
Enables AI agents to propose wallet payments while a local, human-authored policy decides whether each transaction is approved, requires human confirmation, or is refused, and records every decision in a signed, append-only ledger.
Updated 3 months ago (2026-08-22 23:48 UTC)
-
Veraxofficial
Security Observability
verax-ai
A
license
A
quality
B
maintenance
Enables MCP-speaking agents to execute tool calls through an authorization gate, producing signed decision records and reconciled effect rows for accountability.
Updated 7 days ago (2026-11-06 15:39 UTC)
6
Apache 2.0
open-mandate
Payments & Billing Security
RayanSDDS
A
license
Not graded
quality
C
maintenance
Enables AI agents to inspect, check, and audit signed offline spending authorizations, and to issue hash-chained receipts for each action taken against them. Enforces per-transaction, total, expiry, merchant, and human-approval constraints, returning allow, needs_human, or deny with the specific failing constraint.
Updated 2 months ago (2026-09-28 19:43 UTC)
Apache 2.0

Cedulon

Requirements

Install and run (clean clone)

MCP server

Layout

How to cite

Privacy Policy

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

MandateGuard

wwall

Veraxofficial

open-mandate