MCP server

@vitrified/mcp is the official Model Context Protocol (MCP) server for Vitrified. It exposes Vitrified's API and offline verifier to MCP-compatible clients (Claude Desktop, the Anthropic Agent SDK, third-party AI agents) as a set of tools. The server runs in your environment; nothing about the MCP path requires Vitrified-hosted infrastructure beyond the same API any SDK consumer calls.

The server is a thin TypeScript wrapper over the JS SDK plus the verifier libraries; no cryptographic logic of its own.

Install

npm install -g @vitrified/mcp

Or pin in your MCP-host configuration so the server is launched on demand:

npx @vitrified/mcp

Configure (Claude Desktop)

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your platform:

{
  "mcpServers": {
    "vitrified": {
      "command": "npx",
      "args": ["@vitrified/mcp"],
      "env": {
        "VITRIFIED_API_KEY": "vit_live_..." <!-- pragma: allowlist secret -->
      }
    }
  }
}

Restart Claude Desktop; the Vitrified tools appear in the tool picker.

Configure (Anthropic Agent SDK)

import Anthropic from "@anthropic-ai/sdk";
import { vitrifiedMcpServer } from "@vitrified/mcp";

const client = new Anthropic();

const response = await client.messages.create({
  model: "claude-sonnet-4-6",
  max_tokens: 1024,
  mcp_servers: [vitrifiedMcpServer({ apiKey: process.env.VITRIFIED_API_KEY })],
  messages: [{ role: "user", content: "Attest ./build/release.tar.gz with SLSA provenance." }],
});

Tool catalog

The server groups tools by purpose. The full set is enumerated in services/mcp/src/.

Attestation

• attest — hash a local artifact and submit it.
• attest_hash — submit a precomputed hash + metadata.
• get_attestation — fetch a submission by ID.
• get_bundle — fetch the proof bundle for a submission.
• list_attestations — list submissions with filters.

Verification

• verify — verify a proof bundle offline. Same Verdict shape as the CLI / SDK.
• verify_webhook — validate a webhook signature.

Webhooks

• list_webhooks, create_webhook, delete_webhook — webhook subscription management.

Export

• export — trigger an export to a customer-controlled destination.

Security

The MCP server runs in your environment with your API key. It never proxies through Vitrified-hosted infrastructure. The same rate limits and authentication that apply to direct API use apply to MCP-tool-mediated calls.

Source

services/mcp/ — server source, tool definitions, and tests.