MCP SERVER · OFFICIAL PROJECTSign a tool call before it runs, so afterwards you can prove what was requested — and detect if the record was altered.
LABSCO SUMMARY
The difference matters when the question is asked later by an auditor rather than by you: a signed receipt covers the exact parameters, and a changed field makes verification fail rather than quietly passing. Two design choices are worth noting — the secret key is taken from the environment and never returned or accepted as an argument, and hashing is canonicalised, so the same object serialised two ways still verifies. For continuous coverage the transport wrapper is the real integration; these four tools are for signing and checking on demand.
Cryptographic receipts for agent actions. A call's tool name, parameters and target are signed with an Ed25519 key into a receipt that anyone holding the public key can verify offline, without the provider that ran it.
No account and no service — it is local cryptography, verifiable anywhere. Signing needs an Ed25519 secret key in SIGNET_SECRET_KEY; generate one with signet_generate_keypair, or a persistent named identity through the CLI. The signing tools run as npx @signet-auth/mcp-tools. Verification needs only the public key and the receipt, on any machine. Apache-2.0 or MIT.
One command — npx @signet-auth/mcp-tools
USE CASES
Sign the call before it executes, keep the receipt, and verify it against the public key whenever it is questioned.
Verify it against the expected public key — no access to their machine or their provider required.
Generate a keypair for it, keep the secret in the environment, and hand out only the public key for verification.
Hash both through canonical JSON, so different key ordering or whitespace does not read as a difference.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
signet_content_hashCompute a deterministic SHA-256 hash over canonical JSON using RFC 8785 JCS. Use this when you need a stable digest for receipt params, audit records, or comparing semantically identical JSON with different formatting or key order. Returns JSON {hash: string}.
signet_generate_keypairCreate a fresh Ed25519 identity for demos, tests, or agent bootstrapping. Returns JSON with {public_key, note}. The secret key is intentionally not returned by this MCP tool, so use Signet CLI or your own secure key storage for long-lived identities.
signet_signCreate a Signet receipt for a tool call before execution. The secret key is read from the SIGNET_SECRET_KEY environment variable (never passed as an argument). Returns the full signed receipt JSON.
signet_verifyVerify that a receipt was signed by the expected public key. Use this to validate receipts from agents, logs, tests, or exchanged MCP metadata. Returns JSON {valid: boolean}. This checks signature validity against the supplied key; it does not enforce freshness, authorization, or policy decisions.
BEFORE YOU INSTALL
4 tools when we connected. inspect_current_request, verify_receipt and verify_request_payload belong to the separate @signet-auth/mcp-server package, not this one.
npx on PATH
CONTEXT COST
Rated by the size of the 4 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
npx @signet-auth/mcp-toolscodex mcp add signet -- npx @signet-auth/mcp-toolsMCP servers
ExposureGuard
emiliaprotocol
aeoess
attestedintelligence