zkshare_prove
Produce a yes/no answer and signed proof envelope for a stored server-sealed fact.
LABSCO SUMMARY
Prove a property of a private fact to another agent without handing over the fact.
The pattern is store once and prove repeatedly: zkshare_prove turns a question into a yes/no answer inside a signed envelope, and the recipient checks it with zkshare_verify_proof without ever seeing the value. Know where the trust sits in the default mode — server-sealed facts are decrypted in memory by the server that holds the encryption key, so the operator is inside the boundary; use the client-sealed path when they should not be.
What it is
A privacy layer for agent context. Facts go in encrypted; what comes back out is a yes/no answer wrapped in a signed proof envelope, plus semantic search and an allow-listed sandbox for computing over values you would rather not expose.
What you get
- A fact stored encrypted with AES-256-GCM, with a commitment and an embedding kept beside it
- A yes/no answer to a question about a stored fact, returned in an HMAC-signed envelope carrying the commitment, the query and a nonce — never the value
- The same answer plus a single-use, time-bound share token issued to a named recipient agent
- Semantic search across the facts stored under your API key
- Verification of any proof envelope, done without reading the fact behind it
- Allow-listed computations over sensitive values, such as calculate_travel_budget and analyze_spending
- A client-sealed path, where the server holds only opaque ciphertext and never derives plaintext
Requirements
ZKSHARE_API_KEY, which identifies the caller and scopes which stored facts are visible. ZKSHARE_API_URL points at the deployment — the hosted service, or your own, since the implementation is a Next.js app backed by PostgreSQL with pgvector.
Setup effort
One command plus a key — npx -y zkshare-mcp, then supply credentials
USE CASES
01
Letting another agent confirm a preference without learning it
Store the fact once, then answer the question about it with a signed envelope that carries the answer and not the value.
02
Handing a downstream service a claim that expires
Issue the answer together with a time-bound share token bound to one recipient agent id, rather than a standing grant.
03
Checking a claim someone else sent you
Verify the envelope's signature and commitment locally, without access to the fact it was derived from.
04
Finding a fact you stored months ago without remembering its wording
Search semantically across the facts under your key, then prove against the one that comes back.
05
Running a budget calculation over figures you would rather not expose
Call one of the allow-listed sandbox actions so the computation happens next to the data instead of in the transcript.
6 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
zkshare_sandbox
Run an allow-listed sandbox action (e.g. calculate_travel_budget, calculate_budget, analyze_spending).
zkshare_search
Semantic search over stored server-sealed facts for this API key.
zkshare_share
Like prove, plus issue a time-bound share token for a recipient agent id.
zkshare_store
Encrypt and store a fact (server-sealed). Same as REST operation store with value.
zkshare_verify_proof
Verify a zkshare proof envelope (from prove/share) without reading fact plaintext.
BEFORE YOU INSTALL
What to know first
Tools you get
6 tools when we connected. Client-sealed, end-to-end encrypted facts are not reachable through these tools: prove and share return 422 CLIENT_ENCRYPTED, and search returns server-sealed rows only.
Requires
- npx on PATH
- ZKSHARE_API_KEY in your environment
Where it runs
The documented client runs the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 6 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y zkshare-mcpMCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"zkshare": {
"command": "npx",
"args": [
"-y",
"zkshare-mcp"
],
"env": {
"ZKSHARE_API_KEY": "zk_live_…",
"ZKSHARE_API_URL": "https://zkshare.io"
}
}
}
}~/.cursor/mcp.json
