Fidacy

com.fidacyPublished by fidacy.comv0.2.7Updated Oct 24, 2026

Payment firewall for AI agents: a signed, verifiable verdict on every money-moving action.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that gates AI agent payment actions against a signed mandate, returning allow/deny verdicts, short-lived grants and audit proofs.

What you can do
  • Request and authorize payments against a signed mandate, returning an allow with a short-lived Ed25519 grant or a deny with the violated rule
  • Read the mandate envelope and the Fidacy public key used for verification
  • Retrieve a hash-chained audit proof for a given decision id
  • Request a signed trust verdict from the Fidacy engine for a proposed action such as a payment, message, voice call or document claim
When to use it
Use it when an agent can move money and you want a deterministic, verifiable gate in front of the executor instead of prompt-level guardrails, so wrong payees, inflated amounts or duplicate invoices are blocked before funds move.
Requirements
Runs locally over stdio via npx or a global npm install (Node.js). Works offline with a local config file listing trusted payees and caps. The optional assess_action verdict needs FIDACY_ENGINE_API_KEY with assess:write scope; production core wiring needs FIDACY_MODE=http and three HTTP endpoints.
Before you install
The server is only a firewall if it is the agent's sole payment-capable tool; a raw payment tool alongside it bypasses the gate. The downstream executor must require the grant, otherwise a denied action can still proceed. The optional engine key is a live or test API key sent to the Fidacy engine, and the hosted core is described as paid.

Installation

In SourceWeft

  1. Open Fidacy in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@fidacy/mcp

[fidacy-mcp MCP server]

[Fidacy blocks a BEC lookalike-payee payment, then allows the legit one with a signed Ed25519 grant]

The action firewall for AI agents. A drop-in MCP server that gates payment actions against a cryptographically signed mandate before money can move. Non-custodial: Fidacy authorizes and proves, it never holds funds.

Install once, works in any MCP-compatible agent: Claude Code, Claude Desktop, Hermes, OpenClaw, and anything else that speaks MCP.

[npm] [license] Works with: Claude Code · Claude Desktop · OpenClaw · Hermes · Brex CrabTrap

Your agent could be paying scammers right now. Prompt-injected into the wrong payee, an inflated amount, or the same invoice twice — and your logs aren't evidence. Fidacy blocks it before money moves, and hands back a signed verdict anyone can verify against public keys. You don't trust us — you check the signature.

Quick start (free, local-first, no account)

json
{  "mcpServers": {    "fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }  }}

Runs on your machine, offline, deny-by-default. Add trusted payees + caps in ~/.fidacy/config.json. Verify any verdict yourself against the public keys at /.well-known/jwks.json.

Why

An agent can hallucinate or be prompt-injected into a payment: wrong payee, wrong amount, fabricated invoice. Prompt-level guardrails are probabilistic and bypassable. @fidacy/mcp is a deterministic gate between the agent's intent and the executor: the action is dead on arrival unless it validates against a signed mandate, and every decision lands in an immutable hash-chained audit trail.

Enforcement model

  1. Register @fidacy/mcp as the agent's only payment-capable tool. Do not give the agent a raw payment tool. Tool inventory is the runtime firewall.
  2. The agent calls request_payment. Fidacy checks it against the mandate (payee allowlist, per-tx cap, total cap, currency, time window, revocation).
  3. ALLOW returns a short-lived Ed25519 grant. DENY returns no grant and the violated rule. The downstream executor MUST require the grant, so a denied action cannot proceed.
  4. Every decision is appended to a hash-chained log. get_audit_proof returns the portable, verifiable proof.

One install, two backends

@fidacy/mcp ships two complementary capabilities in a single install:

  • Verdict layer (advisory): assess_action calls the live Fidacy engine and returns a signed trust verdict. It moves no money; it returns a judgment whose proof (riskPayloadJws + signingKeyId) is verifiable by anyone via @fidacy/verify against the engine JWKS at /.well-known/jwks.json.
  • Payment firewall (enforcement): request_payment / verify_mandate / get_audit_proof gate and prove a payment against a signed mandate through the core, returning short-lived Ed25519 grants.

Mental model: assess_action -> engine (signed verdict); request_payment and friends -> core (payment firewall).

Tools

ToolBackendPurpose
assess_actionengineSigned Fidacy trust verdict for a proposed action. Advisory.
request_paymentcoreAuthorize a payment action. ALLOW + grant, or DENY + rule.
verify_mandatecoreRead the mandate envelope + Fidacy public key.
get_audit_proofcoreHash-chained proof for a decision id.

assess_action

Returns a signed Fidacy trust verdict from the live engine for a proposed action. The signed proof is riskPayloadJws + signingKeyId, verifiable by anyone via @fidacy/verify against {engineUrl}/.well-known/jwks.json.

Inputs:

  • kind (optional, default ap2_payment): one of ap2_payment, message_send, voice_call, custom, claim_document.
  • mandate (required): the action/mandate object for that kind.
  • mandateType, spendingMandate, idempotencyKey, a2a.task_id (optional).

Environment:

VarDefaultPurpose
FIDACY_ENGINE_URLhttps://api.fidacy.comBase URL of the Fidacy engine.
FIDACY_ENGINE_API_KEY(none)An fky_live_ / fky_test_ key with scope assess:write.

The server boots without FIDACY_ENGINE_API_KEY; the tool is always registered. Only calling assess_action without the key returns a helpful error telling you to set it. The key is never logged, echoed, or attached to any error.

Install

bash
npm install -g @fidacy/mcp   # or run via npx, no install

Claude Code

bash
claude mcp add fidacy -- npx -y @fidacy/mcp

Claude Desktop (claude_desktop_config.json)

json
{  "mcpServers": {    "fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }  }}

Hermes (config.yaml)

yaml
mcp_servers:  fidacy:    command: npx    args: ["-y", "@fidacy/mcp"]

OpenClaw

Add the same server via the Tools panel, or the mcpServers block in your agent config. Any MCP-compatible host uses the same command.

Wiring the real core (production)

The MCP layer talks to your core through one interface (FidacyCore). Your repository stays private. Set FIDACY_MODE=http and implement three endpoints:

  • POST /v1/mandate/get -> Mandate
  • POST /v1/decide -> Decision (runs your Ed25519/AP2 verification + audit append)
  • POST /v1/audit/proof -> AuditProof

No change to the MCP layer is needed.

Dev

bash
npm installnpm run buildnpm start      # stdio server, in-memory demo mandate

Source: README.md at commit ce42c70

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.7LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts