@trigguard/mcp-server

@trigguard/mcp-server

Execution authorization for AI agents and automated systems.

TrigGuard authorizes execution. It does not execute actions. This package is a stdio MCP transport: tools request authority and return PERMIT · DENY · SILENCE · ESCALATE plus a signed receipt. Policy stays on the gateway.

MCP client → @trigguard/mcp-server → @trigguard/agent-sdk → POST /v1/authorize

Do not install @trigguard/mcp (abandoned scaffold).

Install

npx @trigguard/mcp-server --help
npx @trigguard/mcp-server

Or: npm install -g @trigguard/mcp-server

30-second config (Cursor)

{
  "mcpServers": {
    "trigguard": {
      "command": "npx",
      "args": ["-y", "@trigguard/mcp-server"],
      "env": {
        "TRIGGUARD_GATEWAY_URL": "https://api.trigguardai.com",
        "TRIGGUARD_API_KEY": "${env:TRIGGUARD_API_KEY}",
        "TRIGGUARD_ORG_ID": "${env:TRIGGUARD_ORG_ID}"
      }
    }
  }
}

Claude Desktop uses the same command / args / env under mcpServers in claude_desktop_config.json.

One authorization example

Ask the host:

Use TrigGuard authorize_action for surface deploy.release with repository TrigGuard-AI/TrigGuard.

Typical PERMIT payload (shape):

{
  "decision": "PERMIT",
  "execution_id": "exec_…",
  "receipt_hash": "…",
  "verify_url": "https://api.trigguardai.com/verify/exec_…"
}

Then call verify_receipt with that execution_id.

Four-state semantics

TrigGuard supports four authorization states:

PERMIT DENY SILENCE ESCALATE

PERMIT, DENY, and SILENCE are currently present in the active production policy bundle.

ESCALATE is protocol-supported and available for policy configurations that use approval workflows.

Decision	Meaning	May the caller execute?
PERMIT	Authorized	Yes, the caller executes
DENY	Refused	No
SILENCE	No authorization commitment	No (not an approval queue)
ESCALATE	Policy-required intervention	No until released

Unknown gateway values fail closed. They are never mapped to PERMIT. SILENCE is not aliased to ESCALATE. SILENCE does not mean approval and does not automatically escalate. ESCALATE is protocol-supported; it is not claimed as live in the current production policy bundle.

Receipt verification

verify_receipt looks up the execution on the gateway. Offline Ed25519 verification of a receipt body is tg verify / @trigguard/execution-sdk after you hold trusted keys.

Security model

• No local policy evaluation
• No default organisation
• TRIGGUARD_API_KEY + TRIGGUARD_ORG_ID required for authorize_action
• Credentials live in MCP server env — never in tool arguments
• This server does not actuate robots, deploys, or payments

Robotics surfaces (robot.motion.execute, robot.actuator.command, robot.zone.enter, robot.emergency.stop.override) are authorization-only in this transport.

Tools

authorize_action · verify_receipt · explain_decision · get_surface · list_surfaces · get_policy · health_check · org policy read tools (session JWT)

Monorepo development

Contributor-only:

npm run build -w @trigguard/mcp-server
npm test -w @trigguard/mcp-server