attest_subject
Attest subject, generate sealed Policy Artifact. Auto-loads into portal.
LABSCO SUMMARY
Every measurement leaves a receipt, and the receipts verify without calling home.
The loop is attest, measure, verify: a sealed artifact fixes what is allowed, each measurement against it is signed, and the exported bundle carries the permitted and denied calls with their proofs. Offline verification is what makes that evidence worth anything to somebody outside your organisation.
What it is
A runtime governance layer for agents. It attests a subject into a sealed policy artifact, measures the running state against it, and produces signed receipts and bundles that verify without a network.
What you get
- attest_subject — attests a subject and seals a policy artifact, loading it into the portal
- measure_integrity — measures subject state against the sealed reference, signing a receipt for every measurement
- measure_behavior — behavioural patterns such as unauthorized tools, rate violations and forbidden sequences, detective-only by default
- delegate_to_subagent — derives a constrained artifact for a sub-agent, whose scope can only narrow, never widen
- revoke_artifact — revokes an active artifact mid-session, terminating the portal on the next measurement
- init_chain, verify_chain and get_chain_events — the continuity chain started from a genesis event, verified, and read back
- generate_evidence_bundle and verify_bundle_offline — export the permitted and denied tool-call receipts with Merkle proofs, and verify a bundle with no network involved
- request_claim and list_claims — available claims with their sensitivity levels, and disclosure requests that substitute automatically when denied
- get_receipts, get_server_info and get_portal_state — the signed receipts, the server's public keys, and the current portal and enforcement state
Requirements
npx and a Node runtime; it runs as a local stdio process and needs no account key. Set AGA_GATEWAY_KEY to a signing seed you generate yourself before first use; without it the signing key changes on every restart, so evidence bundles cannot be pinned to one key. Verifying a bundle needs nothing at all — the reference verifier ships in the repository.
Setup effort
One command — npx -y @attested-intelligence/aga-mcp-server
USE CASES
01
Proving to a reviewer what an agent did and did not do
Export the signed bundle at the end of a session and hand it over with the receipts, so the account of the run is checkable rather than narrated.
02
Stopping an agent that has drifted out of scope
Measure the running state against the sealed artifact, and revoke the artifact when it no longer matches — the portal ends on the next measurement.
03
Handing a narrower remit to a sub-agent
Seal the parent's scope, then derive the child's from it, knowing the derivation can only take permissions away.
04
Keeping sensitive fields out of a transcript
Read which claims exist and at what sensitivity, then request disclosure and let the substitution happen where it is denied.
05
Checking a bundle somebody else sent you
Verify it locally with no network and no callback to the vendor, then confirm the chain behind it.
15 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
delegate_to_subagent
Derive a constrained policy artifact for a sub-agent. Scope can only diminish, never expand. (NCCoE constrained delegation)
generate_evidence_bundle
Export the canonical SEP evidence bundle: signed PERMITTED/DENIED tool-call receipts + Merkle proofs + a mandatory signed checkpoint, for offline third-party verification (verify_bundle_offline, aga-verify, or aga-receipt-spec/verify/verify-sep.mjs). Pin gateway_public_key to prove provenance.
get_chain_events
Get continuity chain events.
get_portal_state
Get current portal state, loaded artifact info, and enforcement status.
get_receipts
Get all signed receipts, optionally filtered by artifact.
get_server_info
Get AGA server info, public keys, and portal state.
init_chain
Initialize continuity chain with genesis event.
list_claims
List available claims with sensitivity levels.
measure_behavior
Measure behavioral patterns (unauthorized tools, rate violations, forbidden sequences). DETECTIVE-ONLY by default: it records and PROVES drift but does not block. Pass enforce=true to also trip the portal into phantom quarantine on drift (opt-in; off by default). (NIST-2025-0035)
measure_integrity
Measure subject state, compare to sealed reference. Generates signed receipt for every measurement.
request_claim
Request disclosure of a claim. Auto-substitutes if denied.
revoke_artifact
Revoke an active policy artifact mid-session. Portal terminates on next measurement. (NCCoE Phase 3b)
verify_bundle_offline
Verify a canonical SEP evidence bundle offline (full §6 algorithm: structural floor, receipt signatures, chain+ordering, leaf-recompute + Merkle bijection, signed checkpoint). Pass pinned_public_key to also prove provenance.
verify_chain
Verify continuity chain integrity.
BEFORE YOU INSTALL
What to know first
Tools you get
15 tools when we connected. measure_behavior only detects drift by default; blocking needs enforce=true.
Requires
npx on PATH
CONTEXT COST
Light Standing cost
Rated by the size of the 15 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @attested-intelligence/aga-mcp-serverMCP Clients
Claude Desktop
Generate a signing seed once
AGA_GATEWAY_KEY is not an account key: it is a 64-hex Ed25519 seed you create yourself. Without it the server signs with an ephemeral key that changes on every restart, so evidence bundles cannot be tied to one signer across restarts.
CLAUDE DESKTOP · TERMINAL
node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))"Add this to claude_desktop_config.json
<YOUR_AGA_GATEWAY_KEY> is the string the command printed, and keep it secret and out of version control. AGA_GATEWAY_KEY_FILE, a path to a file holding the seed, works instead.
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"aga": {
"command": "npx",
"args": [
"-y",
"@attested-intelligence/aga-mcp-server"
],
"env": {
"AGA_GATEWAY_KEY": "<YOUR_AGA_GATEWAY_KEY>"
}
}
}
}
