Sovereign Identity Wallet

io.github.TamTunnelPublished by GitHub account TamTunnelv0.1.3Updated Oct 24, 2026

Self-hosted signing wallet: DIDs, agency grants, and task mandates for AI agents.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Self-hosted sovereign-identity wallet MCP server that gives an AI agent a DID, owner-to-agent grants and task mandates for website authentication.

What you can do
Create and read wallet identities: onboard the owner/agent identity and get the DID for a role, plus fresh pairwise DIDs per audience to avoid cross-site correlation. Issue grants: the owner delegates scopes and a USD limit to an agent DID. Mint mandates: an agent mints a task mandate for a website audience, optionally delegating a narrowed scope or amount to a downstream agent. Verify mandates and delegation chains: check signatures, expiry, audience, replay, grant binding, scope and amount confinement, and per-hop attenuation.
When to use it
Use it when you want an agent to hold its own decentralized identity and present signed, scoped, time-limited mandates to websites, or when you need to prove and verify multi-hop owner-to-agent delegation chains locally. It suits self-hosters who control their own keys and hardware.
Requirements
Runs as a local stdio process from the npm package, or in HTTP mode with a port. Needs Node.js and a passphrase supplied via SI_WALLET_PASSPHRASE for signing; HTTP mode also requires SI_MCP_TOKEN. State is stored in ~/.sov-id, overridable with SI_WALLET_DIR. Remote connectors need a public HTTPS URL and a bearer token.
Before you install
The wallet holds private keys and whoever can reach the server can ask it to sign, so treat SI_MCP_TOKEN like a password and never expose the HTTP port without TLS. Mandates over $100 require confirmOverLimit=true after explicit owner approval. Demo identities made with a test passphrase must be replaced before real use. The tooling has not had an independent cryptographic audit.

Installation

In SourceWeft

  1. Open Sovereign Identity Wallet in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

si-wallet-mcp

Sovereign-identity wallet as an MCP server. Gives any MCP-capable agent a DID, owner→agent grants, and task mandates — the identity layer underneath AWAS website authentication.

Protocol: TamTunnel/sovereign-identity — DIDs, agency grants, task mandates, and the AWAS website binding this wallet implements.

Version: 0.1.0 · License: Apache-2.0

Tools

ToolWhat it does
wallet_onboardCreate the owner/agent identity (returns existing if present)
wallet_didGet the DID for a role
issue_grantOwner delegates scopes + USD limit to an agent DID
mint_mandateAgent mints a task mandate for a website audience (returns Authorization: Mandate … value). Pass subjectDid to delegate to a downstream agent with narrowed scope/amount
verify_mandateWebsite-side verification: signatures, expiry, audience, replay, grant binding, scope/amount confinement
verify_chainWebsite-side verification of a multi-hop delegation chain (Owner → … → agent): per-hop signatures, binding, attenuation, replay
pairwise_didFresh pairwise DID per audience (no cross-site correlation)

Guardrails are enforced server-side: mandates over $100 need confirmOverLimit=true (only after the owner explicitly approved), and the verifier rejects non-canonical base64url outright.

Quick start

bash
npm install -g @tamtunnel/si-wallet-mcp   # after publish; or clone and npm installexport SI_WALLET_PASSPHRASE="your passphrase"   # required for signingsi-wallet-mcp                                # stdio mode (default)

State lives in ~/.sov-id (override with SI_WALLET_DIR). Keys are scrypt + AES-256-GCM encrypted at rest, files mode 600.

Local MCP clients (Claude Code, Hermes, OpenClaw, …)

Add to the client's MCP config:

json
{  "mcpServers": {    "si-wallet": {      "command": "node",      "args": ["/path/to/si-wallet-mcp/server.mjs"],      "env": { "SI_WALLET_PASSPHRASE": "your passphrase" }    }  }}

Muse (custom connector)

Muse custom connectors reach remote MCP servers over streamable HTTP — a server on your laptop is not reachable from Meta's cloud. Run:

bash
export SI_WALLET_PASSPHRASE="your passphrase"export SI_MCP_TOKEN="$(openssl rand -hex 32)"   # required in HTTP modesi-wallet-mcp --http --port 8787

Expose it on a public HTTPS URL (your VPS, fly.io, Tailscale, …), then add that URL as a custom connector in Muse with Authorization: Bearer <token>. The server binds 127.0.0.1 by default; only set SI_MCP_HOST=0.0.0.0 behind TLS. Full walkthrough: DEPLOY.md.

Docker

bash
docker build -t si-wallet-mcp .docker run -d --name si-wallet \  -e SI_MCP_TOKEN="$(openssl rand -hex 32)" \  -e SI_WALLET_PASSPHRASE="your passphrase" \  -v si-wallet-data:/data \  -p 127.0.0.1:8787:8787 \  si-wallet-mcp

See DEPLOY.md for fly.io, Tailscale, TLS, onboarding, backups, and connecting Meta Muse.

Delegation demo: Owner → Muse → Hermes

examples/delegation-chain/ is a runnable proof that mandates compose across agents and frameworks with no pair-specific connectors: the owner grants Muse broad authority, Muse delegates a narrowed envelope to Hermes, Hermes presents the leaf mandate to a website, and the website verifies the whole attenuated chain. Four attacks (scope escalation, amount escalation, tampering, replay) are attempted and refused.

bash
node examples/delegation-chain/run.mjs

Who hosts this?

Each user hosts their own. That is the point. A wallet holds private keys, so there is no shared hosted instance — that would be custodial and would contradict the "sovereign" in sovereign identity.

  • You, for your own use: run it on hardware you control (your Mac, a VPS you own). One command, keys never leave your machine.
  • Other users: same — they run their own instance and point their agent at it. This mirrors how Hermes/OpenClaw already work (self-hosted).
  • Stateless verification (verify_mandate without the replay ledger) is the only piece that could ever be shared, and even that is safer local.

Whoever can reach the server can ask it to sign. Treat the bearer token like a password and never expose the HTTP port without TLS.

Security notes

  • HTTP mode refuses to start without SI_MCP_TOKEN; every request needs Authorization: Bearer <token> (401 otherwise).
  • The server never logs the passphrase, keys, or tokens.
  • Demo identities created with a test passphrase must be replaced before real use — the real owner onboarding is yours to run.
  • This tooling has not had an independent cryptographic audit.

Source: README.md at commit 5934aa9

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.3LatestSep 23, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.