Trust Layer

io.github.ErnesmarPublished by GitHub account Ernesmarv0.1.0Updated Oct 24, 2026

Notario verificable de agentes de IA: registra identidad y acciones en un log inmutable y firmado.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that acts as a verifiable notary for AI agents, recording agent identity and actions in an immutable, signed log.

What you can do
Verify an AI agent's identity before it acts, using the verificar_identidad_agente tool. Record relevant agent actions in an auditable, cryptographically verifiable log with registrar_accion_auditable. Check the integrity of the recorded history with verificar_historial. Integrity relies on a hash chain plus signature; storage currently uses in-memory adapters, with a Postgres schema prepared for later.
When to use it
Useful when you want an auditable trail of which AI agent did what, and want to check that the record has not been altered. Suited to early experiments and local testing rather than production compliance, since it is a first-phase version with in-memory storage.
Requirements
Runs as a local process on the user's machine (desktop only). The README installs it from source with pip in editable mode and starts it with python -m src.mcp_server.servidor, so a Python environment is needed. No packages, environment variables, headers or authentication are declared in the manifest.
Before you install
The server explicitly does not certify or judge whether actions comply with any regulation, and involves no payments. Storage is in-memory in this phase, so records are not durable and the Postgres integration is still pending. Treat the audit log as a technical integrity record, not as legal proof.

Installation

In SourceWeft

  1. Open Trust Layer in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Registro de Confianza para Agentes

Servidor MCP que actúa como notario verificable de agentes de IA: registra su identidad y cada acción relevante en un log inmutable y criptográficamente verificable — sin certificar ni juzgar si esas acciones cumplen ninguna normativa.

Ver la especificación completa (arquitectura, modelo de datos, plan de validación) en el documento de diseño del proyecto.

Estructura

src/  domain/            # lógica de negocio pura, sin dependencias externas    models.py        # AgenteIA, RegistroAuditable    hash_chain.py     # integridad criptográfica: hash-chain + firma    ports.py          # interfaces que la infraestructura implementa    servicios.py       # casos de uso: VerificarIdentidadAgente, RegistrarAccionAuditable  infrastructure/    adaptadores_memoria.py   # implementación en memoria (tests, Fase 1)    postgres_schema.sql      # esquema para cuando se conecte Postgres real  mcp_server/    servidor.py        # expone los casos de uso como herramientas MCPtests/  unit/          # dominio puro, sin DB  integration/   # (pendiente: contra Postgres real)  contract/      # garantiza el schema que ve cualquier cliente MCPdocs/adr/        # decisiones de arquitectura, con su razonamiento

Uso

bash
pip install -e ".[dev]"pytest                          # corre toda la suitepython -m src.mcp_server.servidor   # levanta el servidor MCP

Estado

Fase 1, primera versión: verificar_identidad_agente + registrar_accion_auditable + verificar_historial, con adaptadores en memoria. Sin pagos, sin certificación normativa — ver ADR 0001 y el documento de diseño para el porqué de cada decisión.

Listado en el MCP Registry oficial como io.github.Ernesmar/trust-layer.

Source: README.md at commit 7ce1f9a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 23, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.