MCP SERVER · OFFICIAL PROJECTPut a human authorization step, a signed pre-action commit and a verifiable receipt in front of an agent's irreversible actions.
LABSCO SUMMARY
The guard and sign-off calls say so themselves: they evaluate policy, capture a signed human yes bound to the exact action, and leave a receipt anyone can verify, but nothing stops the action unless the code that performs it checks the action hash and consumes the receipt first. Read it as the evidence layer — commit before, receipt after, delegation and handshake for who may act for whom — and build the choke point where the action actually happens.
A trust and authorization layer for agent actions: request human sign-off before something irreversible, bind the agent to a commit beforehand, verify the receipt afterwards, and check delegations and counterparty identity. Receipts verify offline, against the anchored root rather than a service that has to be up.
npx on your PATH. The verification tools work with no account at all — a receipt checks out offline against pinned keys. EP_API_KEY is what the rest need: the trust APIs and every write, including creating a delegation, adding a presentation and revoking a commit. A handshake needs at least two parties and a governing policy. Apache-2.0.
One command — npx -y @emilia-protocol/mcp-server
USE CASES
Submit the exact payment for authorization, then poll until a human has approved or denied it.
Verify the receipt's signature and its inclusion in the anchored root, and read back who approved what.
Issue the commit with its scope and expiry, check it is still active at execution time, then bind the resulting receipt back to it.
Record the delegation with its scope and ceiling, and check it before accepting work from an agent claiming that authority.
Run the package, GitHub app or MCP server against a trust policy and get allow, review or deny with the reasons.
Open the handshake under a policy, let each side present its claims, then evaluate them together instead of taking a name at face value.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
ep_add_presentationAdd an identity presentation (proof) to an active handshake. WRITE: appends the party's identity claims to the handshake for evaluation against its policy; supports full, selective, or zero-knowledge disclosure. Requires auth. Returns the updated presentation count and handshake state. Call after ep_initiate_handshake and before ep_verify_handshake.
ep_bind_receipt_to_commitBind a post-action receipt to a commit, completing the commit-execute-receipt cycle. Links the behavioral outcome back to the signed authorization token.
ep_check_signoffPoll a pending authorization after ep_guard_action returns BLOCKED. Pass the receipt_id. Returns PENDING, APPROVED_PENDING_CONSUME, CONSUMED, or DENIED. Approval alone is not permission to execute: the executor must match action_hash and atomically consume the receipt at its own choke point.
ep_create_delegationCreate a delegation record. WRITE: persists to the EP ledger that a human or principal authorizes an agent to act on their behalf, with scope, expiry, and optional constraints. Requires auth. Returns a delegation_id that later actions reference (via ep_verify_delegation) to prove authorization. Use when a principal grants an agent standing authority for a bounded set of actions.
ep_get_commit_statusGet the current state of a pre-action commit by id. Read-only. Returns one of active, revoked, expired, or fulfilled, plus the bound action hash and expiry — poll this to learn whether a commit may still be consumed.
ep_get_handshakeGet the full state of a handshake including parties, presentations, binding, and result. Use this to check handshake progress or review completed exchanges.
ep_guard_actionRequest authorization before an irreversible action: payments, wire transfers, fund releases, deletions, record or account changes, or sending messages with real-world effect. Submits the exact action for policy evaluation and human authorization. This MCP tool does not itself sit at the executor choke point: even after approval, the executor MUST match the returned action_hash and atomically consume the receipt before effect. If BLOCKED, poll ep_check_signoff with the receipt_id.
ep_initiate_handshakeInitiate an EP Handshake — a structured identity exchange between parties. The handshake coordinates mutual presentation of identity proofs before a trust decision. Requires at least 2 parties and a governing trust policy.
ep_install_preflightBEFORE installing or enabling third-party software an agent depends on — an npm package, GitHub app, browser extension, or MCP server — check it here. Evaluates the software against a fit-for-purpose trust policy and returns allow / review / deny with reasons covering publisher, requested permissions, provenance, and trust history.
ep_issue_commitIssue a signed EP Commit before a high-stakes action. Returns a commit_id, decision (allow/deny/review), expiry, scope, and appeal path. The commit binds the agent to a specific action type, entity, and policy before execution.
ep_list_policiesList all available trust policies with their requirements and families. Use to discover which policy to evaluate against.
ep_revoke_commitRevoke an active pre-action commit before it is fulfilled or expires. SIDE EFFECT: terminally cancels the commit — it can never be consumed after this, and the change is irreversible. Requires auth. Returns the revoked status; use when a pending action should be called off.
ep_revoke_handshakeRevoke an active handshake. Only parties to the handshake may revoke it. Revocation is terminal — the handshake cannot be reopened.
ep_verify_commitVerify a pre-action commit — read-only, no side effects. Checks its signature, status, and validity and returns valid/invalid plus the current status, decision, and expiry. Use before relying on or consuming a commit to confirm it is genuine and still active.
ep_verify_delegationVerify that an agent currently holds a valid delegation from a principal for a specific action. Use this before accepting a task from an agent claiming to act on behalf of a human. Returns: valid/expired/not_found with scope details.
ep_verify_handshakeEvaluate all presentations in a handshake against its governing policy — read-only, no mutation. Returns accepted (all requirements met), rejected (policy violations), or partial (awaiting presentations), each with reason_codes explaining the outcome. Call after the parties have added their presentations to decide whether the handshake clears.
ep_verify_receiptVerify a trust receipt — its signature and Merkle inclusion against the anchored root. Read-only. Returns valid/invalid plus the verified claim (action, approver, outcome) and anchor status; use it to independently confirm a receipt was issued by EP and has not been tampered with.
BEFORE YOU INSTALL
17 tools when we connected. release_payment, delete_repo and deploy_production belong to bundled demo servers, not to this server.
npx on PATH
Both documented clients run the server on your machine.
CONTEXT COST
Rated by the size of the 17 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
npx -y @emilia-protocol/mcp-server{
"mcpServers": {
"emilia-protocol": {
"command": "npx",
"args": [
"-y",
"@emilia-protocol/mcp-server"
],
"env": {
"EP_API_KEY": "<YOUR_EP_API_KEY>",
"EP_BASE_URL": "https://emiliaprotocol.ai"
}
}
}
}MCP servers
bluetieroperations-create
Prismer-AI
CWNApps
scopeblind