
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@veridocs/mcp
Advanced tools
VeriDOCS MCP server — drop cryptographic AI governance into Claude Desktop, Cursor, Cline, or any MCP-aware host.
Cryptographic AI governance for any MCP-aware host. Drop signed, hash-chained, independently verifiable receipts into Claude Desktop, Cursor, Cline, or any other Model Context Protocol client with a single config entry.
npx -y @veridocs/mcp@1.0.1
@veridocs/mcp is the official MCP server for Proof Layer — the cryptographic governance layer for AI agents. Once installed, it gives any MCP-aware AI assistant the ability to:
EXECUTE / BLOCK / REVIEW / SHADOW verdictsEvery receipt is Ed25519-signed, hash-chained, and independently verifiable offline using only the published public key at /v1/public-key.
Add this block to ~/.claude/claude_desktop_config.json (macOS/Linux) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"veridocs": {
"command": "npx",
"args": ["-y", "@veridocs/mcp@1.0.1"],
"env": {
"VERIDOCS_API_KEY": "vdk_...",
"VERIDOCS_API_URL": "https://veridocs.dev"
}
}
}
}
Restart Claude Desktop. Ask: "List my recent VeriDOCS receipts." — Claude will call vd_list_receipts and return your audit chain.
Get an API key at veridocs.dev.
The same command / args / env block works in any MCP-aware host. Place it in the host's MCP server configuration file under whatever key the host uses (e.g. mcpServers in Cursor).
| Variable | Required | Description |
|---|---|---|
VERIDOCS_API_KEY | yes | Your vdk_... key. Get one at veridocs.dev. |
VERIDOCS_API_URL | no | Defaults to https://veridocs.dev. Override for self-hosted or staging environments. |
The server registers eight tools:
| Tool | What it does |
|---|---|
vd_evaluate | Submit an action proposal — returns a signed receipt with verdict EXECUTE / BLOCK / REVIEW / SHADOW. |
vd_get_receipt | Fetch a single receipt by its UUID. |
vd_verify_receipt | Cryptographically verify a receipt's Ed25519 signature and key status. |
vd_list_receipts | List recent receipts; filter by agent_id and verdict. |
vd_usage | Current quota usage, credit balance, billing cycle, and plan tier. |
vd_list_policy_packs | List all governance policy packs with the active one flagged. |
vd_create_plan | Human approves a scoped, time-bounded plan covering future agent actions. |
vd_delegate | Agent requests authorization to perform a specific action under a plan. |
Full schema for each tool is exposed via ListToolsRequestSchema — your MCP host will discover them automatically.
Your AI assistant (Claude Desktop / Cursor / Cline)
↓ MCP (stdio)
@veridocs/mcp ← this package
↓ HTTPS
Proof Layer kernel
↓
Signed receipt → hash chain → verifiable offline
Before any consequential action — sending email, modifying data, executing payment, deleting records — the assistant calls vd_evaluate. Proof Layer evaluates against your active policy pack and returns a verdict plus a signed receipt. The assistant proceeds only when the verdict is EXECUTE.
Receipts are independently verifiable using only Ed25519 standard library calls and the public key at https://veridocs.dev/v1/public-key. No SDK or account required. See the main Proof Layer repo for the full verification protocol and offline tooling.
MIT — © WORLD999_LABS
Built by Proof Layer.
FAQs
Proof Layer (VeriDOCS) — official MCP server. Cryptographic AI governance receipts for Claude, Cursor, Cline, and any MCP-aware host.
The npm package @veridocs/mcp receives a total of 4 weekly downloads. As such, @veridocs/mcp popularity was classified as not popular.
We found that @veridocs/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.