@scytalex-llc/pcrzero-mcp

PCRZERO — MCP server

Issue and verify signed receipts for agent actions from any MCP-speaking agent. PCRZERO adjudicates an attestation document against a policy and hands back a cryptographically signed receipt pair — durable, independently checkable proof that this decision was made, by these keys, over this document. Anyone can verify a receipt, offline, without an account and without trusting us.

• Website: pcrzero.com
• Sign up / API keys: pcrzero.com/signup
• API: api.pcrzero.com
• Hosted MCP: https://mcp.pcrzero.com/mcp (streamable-http, Mode A)
• Package: @scytalex-llc/pcrzero-mcp · registry name com.pcrzero/mcp

Install

Stdio (default)

Your agent host launches the process; nothing listens on a port.

Claude Code

claude mcp add pcrzero -e PCRZERO_API_KEY=<your-key> -- npx -y @scytalex-llc/pcrzero-mcp

Claude Desktop / any JSON-configured MCP client

{
  "mcpServers": {
    "PCRZERO": {
      "command": "npx",
      "args": ["-y", "@scytalex-llc/pcrzero-mcp"],
      "env": { "PCRZERO_API_KEY": "<your-key>" }
    }
  }
}

No key yet? Leave env out. verify_receipt and get_keyset work with no API key and no account — only the metered tool needs one.

Requires Node 22 or later.

Hosted (public)

The public streamable-http endpoint is:

https://mcp.pcrzero.com/mcp

Mode A only: send Authorization: Bearer ak_live_… (or X-PCRZERO-API-KEY) for issue_receipt. Free tools work without a key and are rate-limited.

Streamable-http (self-host / Bazaar agents)

stdio cannot be indexed by marketplaces that require a network MCP endpoint. v0.2.0 adds streamable-http alongside stdio. Prefer the hosted URL above unless you are running your own listener.

# Default: loopback, Mode A (per-client API key header — process env key disabled)
npx -y @scytalex-llc/pcrzero-mcp --http
# equivalent:
PCRZERO_MCP_TRANSPORT=http npx -y @scytalex-llc/pcrzero-mcp

Variable / flag	Default	Meaning
--http / PCRZERO_MCP_TRANSPORT=http	off (stdio)	Enable streamable-http
--host / PCRZERO_MCP_HTTP_HOST	127.0.0.1	Bind address
--port / PCRZERO_MCP_HTTP_PORT	3333	Listen port
--path / PCRZERO_MCP_HTTP_PATH	/mcp	MCP endpoint path
--auth / PCRZERO_MCP_AUTH_MODE	client_key	client_key (Mode A) or env_key (Mode B)
PCRZERO_MCP_CORS_ORIGINS	(empty)	Comma allowlist; empty = no CORS
PCRZERO_MCP_ALLOWED_HOSTS	localhost,127.0.0.1	Host header allowlist
PCRZERO_MCP_MAX_BODY_BYTES	1048576	Request body cap
PCRZERO_MCP_FREE_TOOL_RPM	60	Free-tool rate limit per client
PCRZERO_MCP_AUTH_FAIL_RPM	20	Auth-failure throttle per source IP
PCRZERO_MCP_REQUIRE_TLS	off	Log HTTPS reminder when non-loopback

Mode A — client_key (default, required for remote/Bazaar): each client supplies its own PCRZERO API key on the HTTP request via:

• Authorization: Bearer ak_live_… or
• X-PCRZERO-API-KEY: ak_live_…

Configure that header in your MCP client’s secure settings. Never paste API keys into chat. The process env key is not used for issue_receipt in this mode (prevents a shared metered key on a multi-client listener).

Mode B — env_key (local sidecar only): uses PCRZERO_API_KEY from the environment. Bind must be loopback (127.0.0.1 / localhost). Binding 0.0.0.0 with env_key refuses to start.

TLS: for any non-loopback deploy, terminate HTTPS at a reverse proxy (Caddy, nginx, cloud load balancer). The binary may speak cleartext HTTP on loopback for local agents.

Example reverse-proxy sketch (TLS terminator in front of loopback MCP):

# TLS terminates here; proxy to 127.0.0.1:3333
location /mcp {
  proxy_pass http://127.0.0.1:3333/mcp;
  proxy_http_version 1.1;
  proxy_set_header Host $host;
  proxy_set_header Authorization $http_authorization;
  proxy_buffering off;
}

The three tools

Tool	Cost	What it does
issue_receipt	Metered — bills one receipt_verifications unit per call	Adjudicates an attestation document against a policy on the live API and returns the verdict with a signed receipt pair. A fail verdict bills exactly like a pass: you are paying for the adjudication, not for the answer you wanted. The only tool here that spends. Always requires an API key (stdio env or HTTP header).
verify_receipt	Free, and it stays free	Checks a PCRZERO receipt pair against the signing keyset: whether the signature holds, and whether the receipt says what it appears to say. Offline by default — supply keyset and this call touches the network not at all; omit it and the server fetches the public keyset once. keyset_source in the result tells you which happened, every time.
get_keyset	Free	Returns the current PCRZERO signing keyset — key ids, public halves, each key’s status. Public and unauthenticated. The same document an outside party fetches to check a receipt without trusting us.

On streamable-http, free tools are public with per-client rate limits; auth failures are throttled per source IP (session id is not in that bucket — rotating Mcp-Session-Id cannot reset the spray limit).

Current pricing is published at pcrzero.com — it is deliberately not baked into this README or into any tool description.

Auth, exactly

Stdio: PCRZERO_API_KEY in the server’s environment, via your MCP client configuration.

Streamable-http Mode A: per-request/session key header (see above). Mode B: env key on loopback only.

The key is sent as Authorization: Bearer on outbound issue_receipt calls to api.pcrzero.com and used nowhere else: the key never appears in tool results, error text, SSE/HTTP bodies, or logs — not even redacted. With no key, issue_receipt refuses cleanly (auth_missing) and the two free tools keep working.

API errors pass through verbatim (code, message, request_id). This server never rewrites, retries, or softens a billing refusal.

Verify without trusting us

A PCRZERO receipt is checkable by anyone holding the public keyset — including people who are not our customers and never will be. Call get_keyset once (or fetch https://api.pcrzero.com/v1/keys yourself), pin it, and verify_receipt runs entirely offline from then on. If we disappeared tomorrow, every receipt ever issued would still verify.

Transport & scope

• stdio — local host, process env key, no listen socket.
• streamable-http — optional network listener for remote agents / registry indexers that require it. Default bind is loopback; remote multi-client use requires Mode A per-client keys.

No receipt storage, no key-management tools — key management is a human path at pcrzero.com by design. No /env, /debug, or open /metrics surfaces.

Proprietary — © Scytalex LLC. The receipt verification path is free to use for anyone, forever.