io.github.Agentic-Private-OfficePublished by GitHub account Agentic-Private-Officev2.0.0Updated Oct 29, 2026
Signed receipt per cleared agentic order, by decision id. Two tools: write_receipt, verify_receipt.
The publisher's own server: Family Office Knowledge Graph
Remote MCP server for the Record of Cleared Orders: writes signed, hash-chained receipts for cleared agentic orders and verifies them by decision id.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.Agentic-Private-Office%2Frco-a2a/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"rco-a2a-record-of-cleared-orders": {
"type": "http",
"url": "https://mcp.rco-a2a.ai/mcp"
}
}
}RCO is the Record of Cleared Orders. A receipt is written when a gate clears an agentic order:
Each receipt is hash-chained to the one before it and signed by the office key. Two tools, nothing else:
write_receipt — authenticated (Authorization: Bearer <writer token>, one token per writer), returns decision_id. Idempotent on decision_id.verify_receipt(decision_id) — public, returns the receipt, its chain position, its signature and the key to check it.Door: https://mcp.rco-a2a.ai/mcp (Model Context Protocol, streamable HTTP, stateless, JSON-RPC 2.0). Page and kit: https://rco-a2a.ai/. Verify URL: https://rco-a2a.ai/receipts/{decision_id}. Ledger held by the Agentic Private Office.
hash = sha256: + hex of SHA-256 over the canonical JSON of {actor_class, cleared_at, decision_id, gtin, market, prev_hash, rule_version, writer} — keys sorted, no whitespace, nulls kept.prev_hash is sha256: + 64 zeros.sig = Ed25519 (EdDSA) over the UTF-8 bytes of the hash string, base64url. kid names the key on https://rco-a2a.ai/.well-known/jwks.json (rco-office-2026-10).kid gsc-rco-2026-08, sig null, and the Azure Confidential Ledger transaction that holds their original hash. Fields the ledger never held are null.MCP client configuration (any client that speaks streamable HTTP):
Verify one receipt from a shell:
or GET https://rco-a2a.ai/receipts/dec_b73fe75bff87ef889d8ca304.
Check a signature (Python):
Typed, inside the tool result (isError: true): not_authorised · invalid_receipt · invalid_decision_id · not_found · store_unavailable · store_error · chain_contention.
worker/ — the Cloudflare Worker (index.js routes and kit, mcp.js the two tools, chain.js the record and its chain, export.js the nightly copy to the office's S3 bucket). schema.sql — the D1 table, append-only (triggers refuse UPDATE and DELETE). public/ — the office page and the five record pages. rails/ — the history loader and the D1 rail. No secret is in this repository.
MIT. © 2026 Agentic KG Holdings.
Source: README.md at commit f1d7f04
Write one receipt for an agentic order a gate has cleared. Authenticated: Authorization: Bearer <writer token>. Returns the decision_id; idempotent on decision_id.
gtinrequiredmarketcleared_atactor_classrequireddecision_idrule_versionrequiredReturn one receipt by decision_id with its chain position, its signature and the public key (JWK) that checks it. Public.
decision_idrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
{decision_id, gtin, market, actor_class, rule_version, cleared_at, writer, prev_hash, hash, sig, kid}{ "mcpServers": { "rco-a2a": { "type": "streamable-http", "url": "https://mcp.rco-a2a.ai/mcp" } } }curl -s https://mcp.rco-a2a.ai/mcp -H 'content-type: application/json' -H 'accept: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"verify_receipt","arguments":{"decision_id":"dec_b73fe75bff87ef889d8ca304"}}}'import json, base64, requestsfrom cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKeyr = requests.get("https://rco-a2a.ai/receipts/" + DECISION_ID).json()k = next(k for k in requests.get("https://rco-a2a.ai/.well-known/jwks.json").json()["keys"] if k["kid"] == r["receipt"]["kid"])pad = lambda s: s + "=" * (-len(s) % 4)Ed25519PublicKey.from_public_bytes(base64.urlsafe_b64decode(pad(k["x"]))).verify(base64.urlsafe_b64decode(pad(r["receipt"]["sig"])), r["receipt"]["hash"].encode())