MCP

Introduction

— Servers prove their identity.
— Authorization enforced per-tool.
— Proof of every agentic action.

1. How It Works

When an AI agent wants to use a tool, both sides prove who they are—like showing ID before entering a building.

2. The Handshake

Before any tool is called, the server cryptographically proves its identity. No more trusting random endpoints.

{
  "capabilities": {
    "identity": {
      "challenge": "prove-yourself-123"
    }
  }
}

{
  "identity": {
    "did": "did:key:z6Mk...",
    "credential": "eyJ...",
    "proof": {
      "signature": "z58DAdFfa9..."
    }
  }
}

3. Tool Authorization

Tools declare what permissions they need.
The agent checks if the human granted those permissions before calling.

4. Origin Proof

A detached proof binds the tool request and response to identity, session, authorization context, and exact content. It proves origin; it does not assign a position in an audit ledger.

{
  "name": "read_calendar",
  "arguments": { "date": "2025-01-29" },
  "authorization": {
    "delegation": "eyJ...",
    "proof": {
      "timestamp": 1735689600,
      "signature": "z58DAdFfa9..."
    }
  }
}

5. Audit Lifecycle

The MCP adapter projects protocol lifecycle transitions into strict, privacy-minimal audit events. A single authoritative recorder then orders accepted events and returns a signed append receipt.

session / authorization / tool lifecycle
                  ↓
        frozen producer event
                  ↓
     authoritative recorder append
                  ↓
 signed entry + receipt reference in _meta
                  ↓
 checkpoint, observation, and replay bundle

Delivery is explicitly best-effort, buffered, or required. A buffered event is pending until receipt reconciliation; only a required append has an authoritative receipt at the response boundary. Raw arguments, responses, prompts, tokens, and exception text are excluded from the integrity ledger by default.

Managed deployments use Checkpoint as the recorder. Self-hosted deployments retain recorder authority and can send exact signed envelopes to Checkpoint as a verified mirror. There is never more than one sequencing authority for a ledger epoch.

6. Capability Discovery

The _kyaos identity action exposes audit capability data independently from identity and delegation conformance. It declares the AAP profile, authoritative-recorder topology and epoch, delivery and durability mode, event-coverage scope, integrity suite, checkpoint/observer policy, retention policy, and latest healthy checkpoint.

AAP-0  audit disabled
AAP-1  typed capture
AAP-2  durable, atomically chained receipts
AAP-3  source-gap evidence + Merkle transparency
AAP-4  independently observed checkpoints

7. Error Codes

-32001  UNAUTHORIZED          Missing/invalid credential
-32002  FORBIDDEN             Valid credential, insufficient scope
-32003  DELEGATION_EXPIRED    Delegation has expired
-32004  DELEGATION_REVOKED    Delegation was revoked

8. Implementation

Reference implementations:

npm install @kya-os/mcp   # identity, delegation, proof, and audit protocol

import { createAuditTrail } from '@kya-os/mcp/audit';
import { withKyaOs } from '@kya-os/mcp';

See the auditability protocol for recorder contracts, delivery semantics, privacy boundaries, assurance profiles, and offline replay verification.