Labsco
MCP SERVER

Sign a tool call before it runs, so afterwards you can prove what was requested — and detect if the record was altered.

Agent Guardrails, Content Safety & Audit✓ Verified
Summary
A log says what happened; a receipt lets someone else check it.

The difference matters when the question is asked later by an auditor rather than by you: a signed receipt covers the exact parameters, and a changed field makes verification fail rather than quietly passing. Two design choices are worth noting — the secret key is taken from the environment and never returned or accepted as an argument, and hashing is canonicalised, so the same object serialised two ways still verifies. For continuous coverage the transport wrapper is the real integration; these four tools are for signing and checking on demand.

What it is

Cryptographic receipts for agent actions. A call's tool name, parameters and target are signed with an Ed25519 key into a receipt that anyone holding the public key can verify offline, without the provider that ran it.

What you get
  • signet_sign produces a receipt for a tool call before execution, covering the tool, its parameters and the target, with signer name and owner recorded
  • The secret key is read from SIGNET_SECRET_KEY rather than passed as an argument, so it never travels through a tool call
  • signet_verify checks a receipt against the expected public key and answers with a plain valid true or false — usable on receipts from another agent, a log, or exchanged MCP metadata
  • signet_generate_keypair creates a fresh identity for demos, tests or bootstrapping and deliberately returns only the public key
  • signet_content_hash produces a deterministic SHA-256 over canonical JSON using RFC 8785, so semantically identical JSON with different key order hashes the same
  • Beyond these tools, the project provides a transport wrapper that signs every tools/call automatically, a CLI for identities, signing, verification and audit, and a hash-chained audit trail written to ~/.signet/audit/
Requirements

No account and no service — it is local cryptography, verifiable anywhere. Signing needs an Ed25519 secret key in SIGNET_SECRET_KEY; generate one with signet_generate_keypair, or a persistent named identity through the CLI. The signing tools run as npx @signet-auth/mcp-tools. Verification needs only the public key and the receipt, on any machine. Apache-2.0 or MIT.

Setup effort

One command — npx @signet-auth/mcp-tools