vorim_check_permission
Check if an agent has a specific permission scope. Returns allowed (boolean), reason if denied, and remaining quota. Sub-5ms via Redis cache.
LABSCO SUMMARY
Answers the question that gets asked after an agent does something: who acted, what were they allowed to do, and can you prove it.
Identity, scoped permission and audit are handled as three separate things here, which is what makes the record usable — a permission check reports the reason and the remaining quota rather than a bare no, and the audit export ships with a hash manifest so a third party can verify it. Trust verification is a public endpoint, so another party can check your agent without holding any credential of yours.
What it is
Vorim's server for agent identity and trust: agents get an Ed25519 keypair, permission scopes with quotas and expiry, hash-linked audit events, and a trust score anyone can check.
What you get
- Agent registration returning an identity — keypair, agent id and trust score — with the private key shown once, plus ephemeral agents on a did:key identity that expire on their own
- The agent roster: list with paging and status filters, read one agent's capabilities, permissions and metadata, update its details, or revoke it permanently, which zeroes its trust score
- Permissions as scopes: grant one with an expiry and a rate limit, list what is active, revoke it, and check whether an agent holds it — the check returns the reason for a denial and the remaining quota
- Audit events logged per action, and a signed export for a date range with a SHA-256 manifest so the bundle can be verified later
- Public trust verification that needs no authentication at all — score out of 100, status, active scopes and key details
- Credential delegation to an agent with its own rate limits and expiry, delegations listed per agent, and short-lived scoped access tokens issued for a named provider
- A device-authorization onboarding pair for users who have no key yet: start the flow, hand over the code and activation URL, then poll until the human approves
- A health check on the API and its services
Requirements
A Vorim account, free to create, and an API key from Settings → API Keys carrying the agents, audit and trust scopes, passed as VORIM_API_KEY. Published on npm as @vorim/mcp-server and run over stdio; VORIM_BASE_URL points it at a different API host. The underlying protocol, VAIP, is MIT-licensed and has been submitted to the IETF.
Setup effort
One command plus a key — npm install -g @vorim/mcp-server, then supply credentials
USE CASES
01
Giving a new agent an identity you can point to later
Register it, store the private key it returns once, then grant only the scopes it needs with an expiry.
02
Deciding whether an action is allowed
Check the scope before acting and read back the reason and remaining quota when it is refused.
03
Proving what happened during an incident
Export the signed audit bundle for the window with its hash manifest, and verify it afterwards.
04
Shutting an agent down for good
Revoke the specific scope, or revoke the agent itself — permanent, and its trust score goes to zero.
05
Checking an agent you do not own
Verify its trust score, status and active scopes through the public endpoint, no credential needed.
06
Handing a task to a short-lived worker
Register an ephemeral agent, delegate the credential with a rate limit, and issue a scoped token for the provider it calls.
19 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
vorim_delegate_credential
Delegate a credential to an agent. Creates a scoped delegation with optional rate limits and expiry.
vorim_emit_event
Log an audit event for an agent action. Every agent action should be logged for compliance and traceability. NOTE: events emitted via the MCP server are sent unsigned because the MCP server does not hold the agent's private key. For tamper-evident audit trails sign client-side via @vorim/sdk before emit.
vorim_export_audit
Export a signed audit bundle for a date range. Returns events with a SHA-256 manifest for tamper-proof verification. Window must be <= 90 days; the server returns 400 if from > to or the range exceeds the cap. The returned bundle has up to 1,000,000 events; if truncated, the response carries truncated: true and the caller should re-export a narrower window.
vorim_get_agent
Get details of a specific agent by agent_id. Returns name, status, trust score, capabilities, permissions, and metadata.
vorim_grant_permission
Grant a permission scope to an agent. Optionally set expiry and rate limits.
vorim_list_agents
List all agents in the organisation. Supports pagination and filtering by status.
vorim_list_delegations
List credential delegations. Optionally filter by agent_id to see delegations for a specific agent.
vorim_list_permissions
List all active permissions for an agent.
vorim_onboard_check
Check whether the human has approved the onboarding request from vorim_onboard_start. Pass the device_code you received. Returns the new API key once approved; otherwise returns a status (authorization_pending — wait ~5s and call again; slow_down — wait longer; access_denied; expired_token).
vorim_onboard_start
Start onboarding a user who does NOT yet have a Vorim API key (device-authorization flow). Returns a user_code and an activation URL. You MUST show the human the user_code and verification_uri VERBATIM and ask them to approve in their browser. Then call vorim_onboard_check with the returned device_code to obtain the API key. No VORIM_API_KEY is required for this tool.
vorim_ping
Check Vorim AI API health and connectivity. Returns status, version, and service health.
vorim_register_agent
Register a new AI agent with Vorim. Returns the agent identity (Ed25519 keypair, agent_id, trust score). The private key is shown once — store it securely.
vorim_register_ephemeral
Register an ephemeral agent with a did:key identity. Short-lived agents that auto-expire. Returns agent_id, did:key, and keypair.
vorim_request_token
Request a short-lived access token for an agent. Returns a scoped token for the specified provider.
vorim_revoke_agent
Permanently revoke an agent. This cannot be undone. The agent's identity will be deactivated and its trust score set to 0.
vorim_revoke_permission
Revoke a specific permission scope from an agent.
vorim_update_agent
Update an agent's metadata (name, description, status).
vorim_verify_trust
Verify an agent's identity and trust score. Public endpoint — no authentication required. Returns trust score (0-100), status, active scopes, and key fingerprint.
BEFORE YOU INSTALL
What to know first
Tools you get
19 tools when we connected. vorim_verify_trust needs no authentication, and vorim_onboard_start and vorim_onboard_check issue a key if you lack one. The rest need VORIM_API_KEY, whose scopes (agents:*, audit:*, trust:*) decide which tools respond.
Requires
- npx on PATH
- VORIM_API_KEY in your environment
CONTEXT COST
Light Standing cost
Rated by the size of the 19 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npm install -g @vorim/mcp-serverMCP Clients
Claude Desktop, Cursor, Antigravity
JSON
{
"mcpServers": {
"vorim": {
"command": "npx",
"args": [
"@vorim/mcp-server"
],
"env": {
"VORIM_API_KEY": "<YOUR_VORIM_API_KEY>"
}
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"vorim": {
"command": "npx",
"args": [
"@vorim/mcp-server"
],
"env": {
"VORIM_API_KEY": "<YOUR_VORIM_API_KEY>"
}
}
}
}Any MCP client — npx
ANY MCP CLIENT — NPX · TERMINAL
VORIM_API_KEY=<YOUR_VORIM_API_KEY> npx @vorim/mcp-server
