io.github.canoydario847-cloudPublished by GitHub account canoydario847-cloudv0.12.1Updated Oct 30, 2026
Quantum-sealed audit logs for AI agents (ML-DSA-87, SHA3-512), plus Privi Guard and trust passports.
Privi Quantum Ledger gives AI agents a tamper-evident, hash-chained audit log, plus compliance reports, trust passports, KYA wallet checks and content…
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.canoydario847-cloud%2Fprivi-ledger/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"privi-quantum-ledger": {
"type": "http",
"url": "https://privi-ledger.onrender.com/mcp"
}
}
}(formerly Privi Ledger)
Quantum-sealed, tamper-evident audit logs for AI agents. Every company running agents needs to prove what those agents did: what data they touched, what they paid for, what they changed, and that nobody rewrote the record afterwards. Privi Ledger gives any MCP-capable agent a place to log each action, and gives auditors a way to verify the log, paid per check in USDC on Base via x402.
Works with Claude, ChatGPT, Cursor, VS Code and custom agents. Built by Privi World Co on the same record technology as Privi Verify.
Live (testnet): https://privi-ledger.onrender.com/mcp
Real-time tools (live_*, approval_*, trust_events, gateway_*, room_*) are described under Privi Live below.
Action types: tool_call, data_access, data_change, payment, message, decision, approval, error, other. Outcomes: success, failure, pending, blocked.
Each entry's SHA-256 fingerprint covers its contents and the previous entry's fingerprint in the same stream. Editing, deleting or reordering any entry breaks the chain from that point, and audits report the exact entry where it broke. Organizations only ever see their own streams; API keys are stored as hashes.
Stream heads are anchored on the Privi blockchain every few minutes (see On-chain checkpoints), so integrity can be proven without trusting Privi.
Any company, or an AI agent acting for one, can sign up, start logging, and upgrade without talking to anyone. Payments go straight to LEDGER_PAY_TO, and each purchase is recorded in the organization's own privi-billing stream. ledger_plan shows usage and renewal. Set LEDGER_FREE_MONTHLY and LEDGER_PRICE_PRO_MONTH to change the limits.
Create an organization with the admin key (set LEDGER_ADMIN_KEY):
The customer adds the server to their agent with header Authorization: Bearer plk_..., and tells it to call ledger_record_action after each meaningful action. They share their org_id and stream names with auditors, who call ledger_audit_stream.
ledger_compliance_report turns an organization's agent logs into evidence for SOC 2 reviews, customer security questionnaires and AI-regulation record keeping. For any period it reports actions by type, actors, failures, blocked actions, human approvals, log integrity and on-chain status. It also lists findings an auditor would raise, such as broken integrity, logs not yet anchored, failed actions, or payments and data changes with no human approval recorded. The result comes as JSON plus a ready-to-share Markdown version.
Each report is sealed. Its SHA-256 hash, taken over canonical JSON, is anchored on the Privi blockchain through Privi Anchor. Anyone holding the report can run ledger_verify_report, which recomputes the hash, confirms Privi Ledger issued exactly that content, and checks the anchor on chain. Editing even one number, such as hiding a failure, makes verification fail.
Federal agencies must keep an inventory of their AI use cases, publish the releasable ones as a machine-readable file, and show minimum risk practices for high-impact AI. That requirement comes from OMB Memorandum M-25-21 and OMB's guidance on 2025 agency AI reporting. Privi Ledger covers the whole loop:
The inventory links to agents' Privi Ledger activity logs (monitoring_streams), so "ongoing monitoring" is backed by real, tamper-evident records.
Field names follow OMB's published reporting fields. Confirm them against OMB's current template before submitting. This tool supports compliance work; it is not legal advice or an OMB-approved system.
Executive Order 14409 (June 2026) requires federal key establishment to move to post-quantum cryptography by Dec 31, 2030, and digital signatures by Dec 31, 2031. OMB M-26-15 asks every agency for a migration plan built on a cryptographic inventory (CBOM), prioritizing High Value Assets, high-impact systems and data that must stay sensitive past 2030, plus TLS 1.3 support by Jan 2, 2030.
The rules follow public summaries of EO 14409 and OMB M-26-15. Confirm them against the official texts and NIST IR 8547 before relying on them. This tool supports compliance work; it is not legal advice.
The feature no one else can copy: a signed, on-chain-anchored credential that says how much an AI agent can be trusted, scored 0-1000 from evidence only Privi Ledger holds.
Grades: A >= 850, B >= 700, C >= 550, D >= 400, E below. Valid 30 days.
passport_issue (org key; free on Pro/enterprise, $LEDGER_PRICE_PASSPORT via x402 on the free plan) - Ed25519-signed by the server, hash anchored on the Privi chain, every component itemised.passport_verify (free) - signature, content, expiry, revocation, chain anchor, and a live re-score: if the agent's history is tampered with after issue, the passport fails.passport_gate (free) - one-call allow/deny with your minimums (min_score, min_grade, require_anchored); send your own key and the decision is written to your log as due-diligence evidence.passport_list, passport_revoke (org key).GET /passports/<id> (JSON + live verification), GET /passports/<id>/badge.svg (embeddable badge), GET /.well-known/privi-passport.json (issuer public key).Why it compounds: agents that gate on passports push their counterparties onto Privi Ledger; every logged action, report and handshake raises the score; a better score wins more deals. Set LEDGER_PASSPORT_SIGNING_KEY (32-byte hex Ed25519 seed) to pin the issuer key across redeploys; otherwise one is generated and stored in the database.
As AI agents become the main senders of on-chain transactions, every chain, DeFi protocol, exchange, stablecoin issuer and x402 facilitator needs one answer before accepting a transaction: is this wallet operated by an audited agent, and how trustworthy is it right now? Privi KYA answers it, and only Privi can, because the answer is the Passport.
kya_challenge + kya_bind_wallet (org key) - bind a wallet to your Passport by signing a Privi challenge with the wallet (EIP-191 personal_sign, recovered in pure Python; no web3 dependency). A binding without a signature is only declared.kya_check <address> (free) - resolves the wallet to its organization and live Passport; returns allow/deny with reasons, the current score and grade, and a Privi-signed KYA attestation valid 60 minutes that a facilitator can cache and verify offline. Send your key and the decision is logged as evidence.kya_wallets, kya_unbind_wallet (org key) - rotated or compromised keys are denied immediately.GET /kya/connect — paste the org key, connect MetaMask, sign once; done. No code needed.GET /kya/<address> (JSON verdict + attestation; ?min_score=&min_grade=&require_signed=), GET /kya/<address>/badge.svg.Integration pattern for a chain or protocol: before accepting an agent transaction, GET /kya/<from>; require allow: true (and optionally proof: "signature"); keep the attestation + signature as your compliance record.
The whole log is sealed into a chain of quantum blocks every few minutes (LEDGER_QBLOCK_INTERVAL, default 300 s):
PRIVI_FOUNDATION_COSMOS_CHAIN_ID, PRIVI_FOUNDATION_EVM_CHAIN_ID) and, when PRIVI_FOUNDATION_RPC_URL points at a Foundation node, carries a witness of its latest block (height + hash). Until the Foundation mainnet launches, each block settles on Base through Privi Anchor.Tools (all free except sealing): qledger_status, qledger_block, qledger_verify_chain (anyone can re-verify the entire chain), qledger_entry_proof (prove a receipt is sealed in a block, without revealing contents), qledger_seal (organization key; seal now). Privi Quantum Scan (/quantum-scan) is the public block explorer: every block, entry-receipt, tree-head, log-root and Base settlement hash, with search by block height or any hash. Only hashes and counts are shown, never an organization, stream or entry contents. JSON behind it: GET /quantum-ledger (status), /quantum-ledger/stats, /quantum-ledger/blocks?limit&before, /quantum-ledger/blocks/<height>, /quantum-ledger/entries?limit&offset&block, /quantum-ledger/search?q=.
Engineering controls, not a certification (FIPS 140-3, FedRAMP, DoD IL).
Engineering controls aligned with CNSA 2.0 and NIST SP 800-53 (AU-9 protection of audit information, AU-10 non-repudiation, AC-5 separation of duties, SC-13 cryptographic protection). They are not a certification (no FIPS 140-3 validation, FedRAMP or DoD Impact Level authorization is claimed).
fortress_keys, /.well-known/privi-passport.json. Pin the seed with LEDGER_PQ_SIGNING_KEY (32-byte hex) or one is generated and stored.ledger_tree_head returns a dual-signed tree head, anchored on the Privi chain every LEDGER_STH_INTERVAL seconds (default 900); ledger_inclusion_proof proves an entry is in the log and ledger_consistency_proof proves the log only grew between two heads. HTTP: /log/sth, /log/inclusion?hash=, /log/consistency?first=&second=. All free.fortress_tpi_policy names the officers' wallets and how many must approve (at least 2). fortress_tpi_request returns an approval page (/tpi/<id>); each officer signs with their own wallet, the same officer cannot approve twice, outsiders are refused, and any officer can veto. fortress_tpi_execute consumes the authorization once. Every step is logged.ledger_evidence_bundle exports entries, the hash chain, an inclusion proof, the signed tree head, the on-chain checkpoint and Privi's keys, dual-signed. python verify_bundle.py bundle.json (download at /tools/verify_bundle.py) checks all of it with no network access.Signed proof that a person authorized an AI agent to spend, which any merchant or payment facilitator can check before taking the agent's money.
mandate_create (org key) drafts the terms: budget, per-payment cap, allowed payees (0x addresses or domains), expiry, purpose. It returns a sign_url./mandates/<id>/sign, reads the plain-English terms, and signs once with their wallet (EIP-191; free, no transaction). The terms hash is countersigned by Privi and anchored on the Privi chain, and the approval is logged.mandate_spend, which enforces the caps, payee list, expiry and remaining budget atomically and writes the payment (or the blocked attempt) to the agent's tamper-evident log.mandate_check or GET /mandates/<id>/check?amount=&payee= (free) and get allow/deny with reasons plus a Privi-signed attestation.mandate_revoke.Public: GET /mandates/<id> (terms, signatures, budget, recent spends).
One call checks content before an agent acts on it or sends it:
Each check returns an Ed25519-signed receipt holding the content's SHA-256 (never the content). Receipts are Merkle-batched into the transparency log every five minutes and anchored on-chain.
Privi Scan syncs the official MCP Registry. It reads every public streamable-HTTP server's tool list with initialize and tools/list only, and never calls a tool. It grades each server A-F for tool poisoning:
.env files or seed phrasesEvery tool definition is hashed. The first observation and every change go into the Privi Ledger transparency log (Merkle tree, anchored on-chain). That gives anyone a permanent record of what a server's tools said and when they changed.
Config: SCAN_ENABLED (default 1), SCAN_INTERVAL (300 s), SCAN_BATCH (40), SCAN_REPROBE_S (6 h), SCAN_REGISTRY_URL.
Everything here runs over WebSocket and server-sent events, backed by one durable event log (7 days of replay).
Streams (live_info lists them): wss://…/live/ws, GET /live/events (SSE), GET /live/trust/recent, dashboard at /live.
trust (public: passports issued / revoked / re-scored, wallets bound, mandates activated or revoked, transparency-log heads anchored), mandate:<id>, and org (private: a live tail of your audit log, approvals, kill switch, rooms).{"type":"auth","key":"…"}, {"type":"subscribe","channels":["trust","org"],"replay":20,"filter":{"address":"0x…","types":["passport."]}}, {"type":"kill","stream_id":"agent|*"}, {"type":"ping"}. Server frames: {"type":"event","event":"passport.score_changed","id":N,"channel":"trust","at":"…","data":{…}}, heartbeat.Authorization: Bearer (SSE/HTTP) or the first WebSocket frame.LIVE_FREE_DELAY_S (default 300 s); Pro and enterprise get them in real time. A background watcher re-scores every live passport every LIVE_TRUST_INTERVAL seconds (default 120) and announces score or state changes (valid → broken / expired).Human approvals. approval_policy_set makes mandate_spend pause on payments over a threshold: it returns approval_required with an approve_url; the mandate's principal signs an approve/deny message with their wallet (EIP-191), then the agent calls mandate_spend again with approval_id. An approval is for exactly one payment (mandate, amount and payee must match), valid 10 minutes after it is granted, usable once. approval_request / approval_wait do the same for any action. The organization's API key can only cancel, so an agent cannot approve itself.
Kill switch. live_kill (or privi kill, the /live dashboard, or a WebSocket frame) stops mandate_spend, the organization's gateways and room messages for one agent or all of them on the very next call, and pushes agent.killed to the live channel. Audit logging is never blocked. live_resume lifts it.
Gateway. gateway_create puts any public HTTPS MCP server behind /gw/<id>/mcp (and wss://…/gw/<id>/ws, the same JSON-RPC over one persistent connection). Privi rate-limits each caller, can require a Passport (min_score: the caller proves a KYA wallet with a fresh personal_sign over Privi Gateway <id>\nTimestamp: <ts>), meters every tools/call, writes each call to your log, and forwards the request unchanged, including x402 payment headers, so the upstream's own paywall keeps working. The kill switch stops it instantly. Upstreams that resolve to private, loopback or link-local addresses are refused. Free plan: 1,000 metered calls and 2 gateways; Pro: unlimited calls, 50 gateways. Per-tool stats: gateway_stats.
Rooms. room_open creates a live, hash-chained conversation between two organizations' agents (wss://…/rooms/<id>/ws; invite by org id or one-time join code). Optionally charge the guest per message, paid under their human-signed Mandate (budget, cap, payee list, approval policy and kill switch all apply). Closing a room seals the transcript: signed with Ed25519 and ML-DSA-87, anchored on the Privi chain, and written into both organizations' logs. room_verify (free) checks a transcript against the seal. Privi enforces and records the per-message charge; moving the money is between the two parties.
Every company that builds or uses AI in the EU needs to know each system's tier and prove its obligations.
ai_act_system_save registers a system, screens it against the Article 5 bans, classifies it (prohibited /
high-risk / transparency / general-purpose / minimal) and lists the obligations for its role with dates
(Annex III high-risk from 2 Dec 2027, Annex I from 2 Aug 2028, per the Digital Omnibus, Regulation (EU)
2026/1744). ai_act_check flags gaps; ai_act_export returns a register sealed on chain that anyone checks
free with ai_act_verify_export. Workflow aid, not legal advice.
A buyer publishes what suppliers must prove (supplier_requirement_create, shareable invite page at
/supplier/requirements/<id>). Suppliers answer from their own Privi org with document fingerprints only
(supplier_proof_submit). On approval (supplier_proof_decide) Privi issues a certificate naming both companies
and the evidence hashes, sealed on chain, with a public page /certs/<id> and badge /certs/<id>/badge.svg.
supplier_cert_verify is free and can confirm a specific document is covered.
seal_content seals the SHA-256 of a file or text with who made it and whether AI was involved (human,
ai_assisted, ai_edited, ai_generated + tool); a batch of up to 50 is one on-chain anchor. Anyone checks free with
seal_verify, GET /seal/<sha256>, a badge, or the drag-and-drop page /seal/check (the file is hashed in the
browser and never uploaded).
A dealing between two companies, such as a payment, a data transfer, a delivery or an agreement, gets recorded by both of them, with neither able to deny or rewrite it alone.
ledger_handshake_offer with the other company's org_id and the terms. A's log records the offer.ledger_handshake_inbox and calls ledger_handshake_accept, or ledger_handshake_reject with a reason.ledger_handshake_verify to see both parties, the status, whether both entries still exist, and the on-chain seal, without seeing the terms.Handshakes only work between organizations on Privi Ledger.
Every 5 minutes the server anchors the latest fingerprint of each stream that changed on the Privi blockchain through Privi Anchor. Audit results include onchain_checkpoint: the anchored position, transaction, and Merkle proof, plus an anchor_verify call anyone can run. If stored history no longer matches what was anchored, the audit fails even when every local hash was recomputed consistently. Set LEDGER_ANCHOR_KEY (an Anchor API key) to turn it on; LEDGER_ANCHOR_INTERVAL changes the period (seconds, default 300).
Same x402 v2 MCP flow as Privi Verify: an unpaid call returns PaymentRequired; the agent retries with a signed USDC authorization in _meta["x402/payment"]; the server verifies, runs the audit, settles, and returns the receipt in _meta["x402/payment-response"]. Funds go straight to LEDGER_PAY_TO.
The Dockerfile runs on Railway with a volume at /data. Start on base-sepolia; switch to base only with a production facilitator.
MIT © 2026 Dario Canoy, Privi World Co
The existing USDC via x402 payment tools are unchanged. The additive MCP tool
privi_payment_options reports two clearly distinct paths:
LEDGER_NETWORK
and LEDGER_PAYMENTS_ENABLED. All settlement still passes the existing facilitator.The simulator is disabled by default. To enable it in a disposable development
or isolated staging service, set PRVI_TEST_PAYMENT_MODE=1 and
LEDGER_NETWORK=base-sepolia. When LEDGER_NETWORK=base, simulation is always
forced off even if the flag is set. Keep the flag at 0 in production.
A verified existing Ledger organization with its API key can run:
privi_payment_options (no key required; lists methods and launch status).privi_test_payment_quote with sku=ledger_upgrade_pro (API key required).privi_test_payment_simulate with the returned quote ID and
acknowledgement="VALUELESS TEST ONLY" (same organization key).A simulated receipt says SIMULATED_NOT_PAID, paid: false, settled: false,
service_unlocked: false and real_transaction_hash: null. Quotes expire after
10 minutes, are bound to one organization, are one-use only, and are held
in ephemeral process memory. Real USDC billing continues exclusively through
existing tools such as ledger_upgrade_pro and the original x402 facilitator.
Native PRVI real settlement is not enabled. The PRVI mainnet release, fee and token economics, security audit, independent validators, legal review, chain ID, oracle/quote policy, custody and payment replay protections must pass separately reviewed launch gates before any real-value PRVI path is designed.
Run the isolated developer safety suite:
Source: ledger-server/README.md at commit ba19d8b
PRIVI token market
PRIVI on Base: price, how much PRIVI and USDC the Privi swap desk holds (so whether a swap can fill), any Uniswap v3 / Aerodrome pools, and optionally a swap quote. Every paid Privi tool also accepts PRIVI. Free.
sideamountLedger pricing
List Privi Ledger tools, what each costs, and how to get an organization key.
Takes no parameters.
Check a receipt
Confirm that an action receipt exists in the ledger and when it was recorded. Reveals no action contents. Free.
entry_hashrequiredAudit a stream
Check whether an agent's action log is intact: entry count, time span, action and failure counts, head hash, and where tampering broke the chain if it did. Does not reveal the actions themselves. Paid per call via x402.
org_idrequiredstream_idrequiredRecord an agent action
Append an action to the organization's tamper-evident log. Returns the entry with its entry_hash receipt. Requires the organization API key.
actorrequireddetailsoutcomesummaryrequiredresourcestream_idrequiredaction_typerequiredRead a stream
Read your organization's entries in a stream, oldest first, with an integrity check of the whole stream. Requires the organization API key.
limitafter_seqstream_idrequiredList streams
List your organization's streams with entry counts. Requires the organization API key.
Takes no parameters.
Compliance report
Audit-ready report of your AI agents' activity for a period (SOC 2 evidence, security questionnaires, AI-regulation record keeping): actions by type, failures, human approvals, log integrity, on-chain status, and findings. The report's hash is anchored on the Privi blockchain so it cannot be edited later without detection. Requires the organization API key.
sinceuntilstreamsCompliance report PDF
A finished PDF of a sealed compliance report, for auditors and customers. Returned as base64 (pdf_base64) and as an embedded PDF resource; also downloadable at /reports/<report_id>.pdf with the organization key. Requires the organization API key.
report_idrequiredVerify a report
Check that a compliance report is unaltered: recomputes its hash, confirms Privi Ledger issued it, and checks the anchor on chain (Base, until the Privi chain mainnet). Free; no key needed.
reportrequiredSign up
Create a Privi Ledger organization on the free plan and get its API key (shown once; store it). Free plan: up to the monthly entry limit, all tools included. Upgrade any time with ledger_upgrade_pro. No key needed to sign up.
organization_namerequiredPlan and usage
Your plan, entries used this month, the limit, and when a Pro plan renews. Requires your organization API key.
Takes no parameters.
Upgrade to Pro
Buy 30 days of Privi Ledger Pro (unlimited entries) for your organization, paid in USDC on Base via x402. Each call adds 30 days. Requires your organization API key.
Takes no parameters.
Save an AI use case
Add or update an entry in your agency's AI use case inventory (OMB M-25-21). Every change creates a new version and is written to your tamper-evident 'ai-inventory' log. Requires the organization API key.
actorrequiredmergeuse_caserequiredAI use case inventory
Your agency's AI use case inventory: the current version of each record. Requires the organization API key.
use_case_idCheck inventory readiness
Flags what an OMB M-25-21 review would flag before you submit: missing required fields, PII without a Privacy Impact Assessment, and high-impact AI in pilot or deployment missing any minimum risk practice (testing, impact assessment, independent review, monitoring, operator training, fail-safe, appeals, public feedback) or without a recently active activity log as monitoring evidence. Requires the organization API key.
Takes no parameters.
Export public inventory
Machine-readable CSV of your publicly releasable AI use cases (for publishing at agency.gov/ai), with its SHA-256 sealed on chain (Base, until the Privi chain mainnet) so the published file can be proven unaltered. Requires the organization API key.
include_withheldVerify a published inventory
Check that a published AI inventory file is exactly what the agency exported from Privi Ledger, and return its on-chain seal. Free; no key needed.
csv_textrequiredClassify an algorithm
Classify cryptographic algorithms as quantum-vulnerable (RSA, ECDH, ECDSA, EdDSA, DH, DSA, MQV), post-quantum (ML-KEM, ML-DSA, SLH-DSA), hybrid, symmetric/hash, or unknown. Free.
algorithmsrequiredSave a system's crypto inventory
Record the cryptographic inventory (CBOM) of one system for post-quantum migration. Every change creates a new version and is written to the agency's tamper-evident 'pqc-inventory' log. Scanners and agents can submit results directly. Requires the organization API key.
actorrequiredsystemrequiredCrypto inventory
Current cryptographic inventory of your systems. Requires the organization API key.
system_idPost-quantum migration plan
Prioritized post-quantum migration plan: every quantum-vulnerable asset ranked (High Value Assets, high-impact systems and long-lived sensitive data first; key establishment before signatures), with its deadline (key establishment Dec 31 2030, signatures Dec 31 2031), recommended NIST replacement, progress metrics, and findings (missed deadlines, TLS below 1.3, no target dates, unrecognized algorithms). Requires the organization API key.
Takes no parameters.
Export sealed CBOM and plan
Export the full cryptographic inventory (CBOM) and migration plan as one JSON document for OMB, the CIO or auditors, with its SHA-256 sealed on chain (Base, until the Privi chain mainnet). Requires the organization API key.
Takes no parameters.
Verify a CBOM export
Check that a CBOM and migration-plan document is exactly what was exported from Privi Ledger and return its on-chain seal. Free; no key needed.
documentrequiredOffer a handshake
Start a Privi Handshake: a two-sided record of a dealing with another company's agent (payment, data transfer, delivery, agreement). Recorded in your log now; when the other company accepts, both logs hold matching entries and the pair is sealed on chain (Base). Requires your organization API key; the other company must also use Privi Ledger.
actorrequireddetailssummaryrequiredresourcestream_idrequiredaction_typerequiredexpires_hourscounterparty_org_idrequiredHandshake inbox
Handshakes sent to and from your organization, newest first, with their terms and status. Requires your organization API key.
Takes no parameters.
Accept a handshake
Accept a handshake addressed to your organization: records the same terms in your log, confirms it in the other company's log, and seals the matched pair on chain (Base). Requires your organization API key. Read the terms first with ledger_handshake_inbox.
actorrequiredstream_idrequiredhandshake_idrequiredReject a handshake
Reject a handshake addressed to your organization; the other company's log records the rejection. Requires your organization API key.
reasonhandshake_idrequiredVerify a handshake
Public check of a handshake: both companies, status, whether both matching log entries still exist, and the on-chain seal. Never reveals the terms. Free; useful for disputes and audits.
handshake_idrequiredIssue a Privi Passport
Issue a Privi Passport: a signed, on-chain-anchored trust credential for your agent or organization, scored 0-1000 (grade A-E) from verified history, integrity, anchoring, reliability, human oversight, compliance reports and confirmed handshakes. Show it to counterparties; they verify it free with passport_verify / passport_gate. Valid 30 days. Free on Pro/enterprise; free-plan organizations pay per passport via x402. Requires the organization API key.
stream_idVerify a Privi Passport
Check an AI agent's Privi Passport before trusting it: Privi signature, content unaltered, not expired or revoked, anchor on chain (Base), and a live re-score of the agent right now (so tampering after issue is caught). Free; no key needed.
passportpassport_idGate on a Privi Passport
One-call allow/deny decision before transacting with another AI agent: verifies its Privi Passport and applies your minimums, returning the reasons. If you send your organization API key the decision is recorded in your own tamper-evident log as due-diligence evidence. Free.
purposemin_grademin_scorepassport_idrequiredrequire_anchoredList your passports
Your organization's issued passports with score, grade, expiry and revocation. Requires the organization API key.
Takes no parameters.
Revoke a passport
Revoke one of your passports (e.g. an agent was retired or compromised). Verifiers see it immediately. Requires the organization API key.
reasonpassport_idrequiredKYA: check a wallet
Know-Your-Agent for blockchains: is this wallet operated by an audited AI agent, and how trustworthy is it right now? Resolves the address to its organization and live Privi Passport and returns allow/deny with reasons, plus a Privi-signed attestation (valid 60 min) you can cache. For chains, DeFi protocols, exchanges, stablecoin issuers and x402 facilitators. Free; send your organization key to log the check as evidence.
addressrequiredpurposemin_grademin_scorerequire_signedKYA: challenge for a wallet
Step 1 of binding a wallet to your Privi Passport: get a message to sign with that wallet (EIP-191 personal_sign). Valid 30 minutes. Requires the organization API key.
addressrequiredKYA: bind a wallet
Step 2: bind the wallet to your organization's Privi Passport so its transactions pass KYA checks. With a wallet signature the binding is *proven*; without one it is only *declared* (most checkers require proven). Requires the organization API key.
labeladdressrequiredsignaturestream_idchallenge_idKYA: your wallets
Wallets bound to your organization and how each was proven. Requires the organization API key.
Takes no parameters.
KYA: unbind a wallet
Remove a wallet from your Passport (rotated or compromised key). KYA checks deny it immediately. Requires the organization API key.
addressrequiredCreate a spending mandate
Draft a Privi Mandate: the human's signed permission for your agent to spend, with a budget, per-payment cap, allowed payees and expiry. Returns sign_url: send it to the human, who reads the plain-English terms and signs once with their wallet (free, no transaction). Nothing can be spent until they sign. Requires the organization API key.
dayspayeespurposerequiredstream_idrequiredagent_walletmax_total_usdcrequiredprincipal_walletrequiredmax_per_payment_usdcCheck a payment against a mandate
For merchants, payment facilitators and counterparties: did a human authorize this AI agent to pay you this amount? Verifies the human's wallet signature, status, expiry, per-payment cap, remaining budget and payee list, and returns allow/deny with reasons plus a Privi-signed attestation. Free; no key needed.
payeerequiredmandate_idrequiredamount_usdcrequiredSpend under a mandate
Call before each payment: checks the mandate and, if allowed, deducts the amount from the budget and records the payment in the agent's tamper-evident log. Refused payments are logged as blocked. Refused at once if the kill switch is on. Over the organization's live-approval threshold it returns approval_required with an approve_url for the human; call again with approval_id once they approve. Requires the organization API key.
payeerequiredreferencemandate_idrequiredamount_usdcrequiredapproval_idGet a mandate
Public view of a mandate: terms, status, the human's signature, spent and remaining budget, and recent spends. Free.
mandate_idrequiredList your mandates
Your organization's mandates with status and remaining budget. Requires the organization API key.
Takes no parameters.
Revoke a mandate
Stop an agent from spending under a mandate (the human can also revoke from the sign_url page). Requires the organization API key.
reasonmandate_idrequiredFortress keys
Privi's public signing keys: Ed25519 and ML-DSA-87 (NIST FIPS 204, CNSA 2.0 post-quantum). Pin these to verify Privi signatures offline. Free.
Takes no parameters.
Signed tree head
The latest signed tree head of Privi's transparency log: an RFC 9162 Merkle root over every entry ever recorded, signed with Ed25519 and ML-DSA-87, and periodically anchored on chain (Base). Free.
Takes no parameters.
Inclusion proof
Merkle audit path proving an entry is in Privi's append-only transparency log (RFC 9162). Verifiable offline against the signed tree head. Reveals no entry contents. Free.
tree_sizeentry_hashrequiredConsistency proof
Proof that Privi's log only grew between two signed tree heads: nothing recorded earlier was edited, removed or reordered (RFC 9162). Free.
firstrequiredsecondSet a two-person policy
Define a Two-Person Integrity policy: which officers can approve, and how many distinct approvals an action needs. Requires the organization API key.
namerequiredrequiredrequiredofficer_walletsrequiredRequest two-person approval
Ask officers to authorize a sensitive action under a two-person policy. Returns approve_url for the officers; each signs with their wallet. Do not act until fortress_tpi_status shows 'authorized', then call fortress_tpi_execute. Requires the organization API key.
hourspolicyrequireddetailssummaryrequiredstream_idrequiredTwo-person status
Status of a two-person request (pending, authorized, vetoed, expired, executed) and who approved. Free.
request_idrequiredExecute an authorized action
Consume a two-person authorization right before performing the action. Single use; refused unless authorized. Requires the organization API key.
request_idrequiredQuantum Ledger status
Privi Quantum Ledger: latest quantum-sealed block (SHA3-512, ML-DSA-87 + Ed25519), entries waiting for the next block, the Privi Foundation chain it is fused with, and signing keys. Free.
Takes no parameters.
Quantum Ledger block
One quantum-sealed block with its signatures, settlement on chain and a validity check. Free.
heightrequiredVerify the Quantum Ledger
Verify the whole Quantum Ledger: SHA3-512 block hashes, hash links, both signatures on every block, and for recent blocks the log roots, entry roots and RFC 9162 consistency proofs. Free; anyone can run it.
deep_lastQuantum proof for an entry
Prove an entry (by its receipt hash) is sealed in a quantum block: the block, its post-quantum signatures, its on-chain settlement and the Merkle inclusion proof. Reveals no entry contents. Free.
entry_hashrequiredSeal a quantum block now
Seal your newest entries into a quantum block now instead of waiting for the next scheduled block (every few minutes). Does nothing if no entries are waiting. Requires the organization API key.
Takes no parameters.
List two-person requests
Your organization's two-person requests. Requires the organization API key.
Takes no parameters.
Evidence bundle
Export a self-contained evidence package for auditors, courts or air-gapped systems: every entry, the hash chain, an RFC 9162 inclusion proof, the signed tree head, on-chain checkpoint and Privi's keys, signed with Ed25519 and ML-DSA-87. Verify offline with verify_bundle.py (GET /tools/verify_bundle.py). Requires the organization API key.
stream_idrequiredPrivi Live: how to connect
Real-time Privi: WebSocket and server-sent-event streams (trust changes, your own audit tail, approvals), a kill switch, human approvals, a metered MCP gateway and paid agent-to-agent rooms. Returns the endpoints, channels, frames and what each plan gets. Free; no key needed.
Takes no parameters.
Kill switch: stop an agent
Stop an agent at once: mandate_spend, your gateways and your room messages are refused until live_resume. Takes effect on the next call, and is pushed to your live channel immediately. Audit logging keeps working. Requires the organization API key.
reasonstream_idKill switch: resume an agent
Lift a kill switch set with live_kill. Requires the organization API key.
stream_idLive status
Your kill switches, live-approval thresholds, pending approvals, gateways, rooms and usage this month. Requires the organization API key.
Takes no parameters.
Approvals: set a live-approval threshold
Make mandate_spend pause for a human on large payments: any payment over the threshold creates an approval request that the mandate's principal must sign with their wallet before the agent can spend. Requires the organization API key.
stream_idrequiredapprove_over_usdcApprovals: ask a human
Ask a human to approve (or deny) an action. Returns approve_url for them: they read the request and sign with their wallet (free, no transaction). Your agent then calls approval_wait, or watches your live channel for approval.approved. Only the named wallet can decide; your API key can only cancel. Requires the organization API key.
payeettl_sactionrequiredreasonreferencestream_idrequiredmandate_idamount_usdcapprover_walletApprovals: check one
Status of an approval request: pending, approved, denied, expired or cancelled, with the human's wallet signature once they decide. Free.
approval_idrequiredApprovals: wait for the human
Block until the human decides (or timeout_s passes). Returns the current status; if still pending, call again. Free.
timeout_sapproval_idrequiredApprovals: cancel
Withdraw an approval request (or revoke an approval not yet used). Your key cannot approve, only cancel. Requires the organization API key.
approval_idrequiredApprovals: list yours
Your organization's approval requests, newest first. Requires the organization API key.
statusTrust feed: recent events
The latest trust-change events: passports issued, revoked or re-scored, wallets bound or unbound, mandates activated or revoked, transparency-log heads anchored. Without a Pro key the feed is delayed (see live_info); use the WebSocket or SSE stream for real time. Free.
limitaddresspassport_idGateway: protect and meter an MCP server
Put your MCP server behind Privi. You get an HTTP URL and a WebSocket URL that forward to it unchanged (x402 payments keep working) while Privi rate-limits callers, optionally requires a Privi Passport, meters every tool call and writes each call to your tamper-evident log. The kill switch stops the gateway instantly. Upstream must be public HTTPS. Requires the organization API key.
namerequiredguardmin_scorerate_per_minupstream_urlrequiredGateway: Guard mode
Turn Privi Guard on for every tool result that passes through your gateway: tag adds the verdict and a receipt id in result._meta['privi/guard']; block also replaces injected results with an error before your agents see them. Each result is one Guard check (free allowance, then credits). Requires the organization API key.
moderequiredgw_idrequiredGateway: info
Public description of a gateway: where it forwards, whether callers need a Passport, its rate limit and its call counts. Free.
gw_idrequiredGateway: your gateways
Your organization's gateways. Requires the organization API key.
Takes no parameters.
Gateway: usage
Calls, errors, denials and x402 payment prompts per tool and per day for one of your gateways, plus your monthly quota. Requires the organization API key.
gw_idrequiredGateway: delete
Turn a gateway off. Its URLs stop working at once; history stays in your log. Requires the organization API key.
gw_idrequiredRooms: open a live room
Open a live, hash-chained conversation room for two organizations' agents. Both connect over WebSocket (ws_url), authenticate with their API keys and talk in real time; closing the room seals the transcript on the Privi chain. Optionally charge per message, paid under the guest's human-signed Mandate. Requires the organization API key.
hourspayeetitlerequiredmax_messagescounterparty_org_idprice_per_message_usdcRooms: info
Public facts about a room: parties, price, message count, head hash and its seal once closed. No message text. Free.
room_idrequiredRooms: list yours
Rooms your organization owns or joined. Requires the organization API key.
Takes no parameters.
Rooms: transcript
Every message in a room you are part of, with the chain check. Requires the organization API key.
room_idrequiredRooms: close and seal
Close a room and seal its transcript: the hash is signed (Ed25519 + ML-DSA-87), anchored on chain (Base) and written to both organizations' logs. Either party can close. Requires the organization API key.
room_idrequiredRooms: verify a sealed transcript
Check a closed room's seal (signature, on-chain anchor) and, if you pass the transcript, that it is complete and unaltered. Free; no key needed.
room_idrequiredmessagesCheck an MCP server before connecting
Free safety check for any remote MCP server, before an agent connects to it or after it was approved. Privi reads the server's tool list (it never calls a tool) and returns a verdict: ok, caution, danger (tool poisoning: hidden instructions, concealment from the user, requests for keys or private files, tool shadowing, invisible characters), changed (tools differ from expected_tools_hash), unverified (tools behind auth) or unreachable. Also returns the tools_hash to pin, a grade A-F and a link to the server's public history. Every first observation and change is recorded in Privi's on-chain-anchored transparency log. No key needed.
urlrequiredexpected_tools_hashSearch the MCP trust registry
Search Privi Scan, the public directory of remote MCP servers from the official MCP Registry, each with a safety grade, verdict, tool count and change history. Use it to find a trustworthy server for a job. Free.
sortgradelimitqueryoffsetPrivi Scan: one server in full
Full report for one MCP server: every tool definition with its hash, all findings with evidence, the change history (what was added, removed or modified, and when) and the transparency-log proof. Free.
server_idrequiredinclude_historyPrivi Scan: recent tool changes
The latest MCP servers whose tool definitions changed after they were first observed (possible rug pulls), newest first. Subscribe to the Live channel 'scan' for these as they happen. Free.
limitPrivi Scan: totals
How many MCP servers Privi Scan tracks, by status and grade, tools indexed, changes recorded and how to verify the evidence. Free.
Takes no parameters.
Watch an MCP server (pin its tools)
Pin the server's current tools as approved and get a real-time event on your private Live 'org' channel the moment they change, a risk appears or the server goes down. Free plan: 3 servers; Pro: 500. Needs the org key.
repinserverrequiredStop watching an MCP server
Remove a server from your watchlist. Needs the org key.
serverrequiredYour watched MCP servers
Your watched servers with their pinned tools_hash and whether each has drifted since you pinned it. Needs the org key.
Takes no parameters.
Claim your MCP server's listing
Start proving you operate an MCP server listed in Privi Scan. Returns a token to publish at https://<your host>/.well-known/privi-scan.txt. Verified owners get an owner-verified badge, unlimited rescans, change alerts and control over the listing. Needs the org key (create_org is free).
serverrequiredFinish claiming your MCP server
Check the token at /.well-known/privi-scan.txt and mark your organization as the verified owner.
serverrequiredShow or hide your server's listing
Verified owners only: hide the server from the directory (opt-out) or show it again. History already in the transparency log cannot be removed.
listedrequiredserverrequiredRescan an MCP server now
Probe the server immediately instead of waiting for the next crawl (every ~6 hours). For the verified owner or Pro organizations.
serverrequiredGuard: check text before acting on it or sending it
Check content for prompt injection (inbound) or leaked secrets and personal data (outbound) before an agent acts on it or sends it. Returns allow / warn / block, the findings, a redacted copy for outbound secrets, and an Ed25519-signed receipt anchored on-chain, which proves the check happened. Privi does not store the text. Free for 1,000 checks a month with an organization key; otherwise 1 cent per check in USDC via x402.
textrequiredsourcedirectionGuard: check many texts at once
Check up to 50 texts in one call (for example every tool result in a step). Each item is billed as its own check against your free allowance or credits and gets its own receipt. Needs an organization key.
itemsrequiredGuard: verify a receipt
Verify a Privi Guard receipt: the signed body, signature validity and its Merkle proof into the anchored transparency log. Free; anyone holding the id can verify it.
check_idrequiredGuard: balance
Your free checks left this month and your prepaid credits. Needs the organization key.
Takes no parameters.
Guard: buy check credits
Buy prepaid Privi Guard checks in USDC on Base via x402. Credits never expire and are used after the free monthly allowance. Needs the organization key.
packrequiredGuard: pricing and how it works
What Privi Guard checks, what it costs, and how receipts work. Free.
Takes no parameters.
Privi: payment methods
See existing USDC/x402 service billing and separately gated valueless PRVI_TEST development mode.
Takes no parameters.
Privi: create a valueless test-payment quote
Off-chain PRVI_TEST quote. Requires organization key and explicit test mode. Never takes money.
skurequiredPrivi: simulate a valueless test payment
Consume a test quote once. Receipt is NOT payment, on-chain proof or entitlement.
quote_idrequiredacknowledgementrequiredAI Act: register an AI system
Add or update an AI system in your company's EU AI Act register. Privi screens it against the Article 5 bans, classifies it (prohibited / high-risk / transparency / general-purpose / minimal), and lists the obligations that apply to your role with their dates. Every change is versioned and written to your tamper-evident 'ai-act' log. Requires the organization API key.
actorrequiredmergesystemrequiredAI Act: your register
Your EU AI Act register: each AI system's current record, tier and applicable obligations. Requires the organization API key.
system_idAI Act: compliance check
What a customer's due-diligence or a regulator would flag today: prohibited practices, incomplete Article 5 screens, obligations already in force without evidence (critical), obligations due within 180 days (medium), upcoming high-risk duties, and high-risk systems with no recent log. Requires the organization API key.
Takes no parameters.
AI Act: export sealed register
Export your AI Act register as JSON to hand to customers, auditors or regulators, with its SHA-256 sealed on chain so anyone can prove it was not edited afterwards (check with ai_act_verify_export). Requires the organization API key.
Takes no parameters.
AI Act: verify a register
Check that an AI Act register a supplier or partner sent you is exactly what they exported from Privi, and return its on-chain seal. Free; no key needed.
register_jsonrequiredSupplier Proof: require proof from suppliers
Publish a requirement your suppliers must meet. Share the returned invite_url with them: they answer it from their own Privi organization (free sign-up) and you approve or reject in supplier_proof_inbox. Requires the organization API key.
itemsrequiredtitlerequiredvalid_daysSupplier Proof: view a requirement
See what a buyer requires of its suppliers. Free; no key needed.
req_idrequiredSupplier Proof: submit proof to a buyer
Answer a buyer's supplier requirement with fingerprints of your evidence documents. The buyer reviews and, if approved, Privi issues a certificate sealed on chain. Requires your organization API key (sign up free with ledger_signup).
req_idrequiredevidencerequiredSupplier Proof: inbox
Supplier submissions waiting for your decision (as the buyer). Requires the organization API key.
statusSupplier Proof: approve or reject
Approve a supplier's proof (issues a certificate naming both companies and the evidence fingerprints, sealed on chain, with a public verify page and badge) or reject it with a reason. Requires the organization API key.
reasonsub_idrequiredapproverequiredSupplier Proof: verify a certificate
Check a Privi supplier certificate: untampered, not revoked, not expired, which buyer approved which supplier, and (optionally) whether a document is one it covers. Free; no key needed.
cert_idrequireddocument_sha256Supplier Proof: your certificates
Certificates you issued (as buyer) or hold (as supplier). Requires the organization API key.
Takes no parameters.
Supplier Proof: revoke a certificate
Revoke a certificate you issued (as the buyer). Verification shows it as revoked at once. Requires the organization API key.
reasonrequiredcert_idrequiredContent Seal: seal files or text
Seal content your company publishes (documents, images, video, press releases, invoices, AI output) with who made it and whether AI was involved. Each seal is anchored on chain; anyone can check a file for free at the returned verify_url or with seal_verify. Counts toward your plan's monthly entries. Requires the organization API key.
itemsrequiredContent Seal: check a file
Is this exact file or text sealed, by whom, since when, and did they declare AI involvement? Any change to the content (one pixel, one character) means no match. Free; no key needed.
textsha256Content Seal: your seals
Your most recent content seals. Requires the organization API key.
limitContent Seal: revoke a seal
Withdraw one of your seals (e.g. sealed by mistake). Checks then show it as revoked. Requires the organization API key.
reasonrequiredseal_idrequired90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a license in the repository or the registry entry.
curl -X POST https://<host>/admin/orgs \ -H "Authorization: Bearer $LEDGER_ADMIN_KEY" -H 'Content-Type: application/json' \ -d '{"name": "Acme Robotics"}'# -> {"org_id": "org_...", "api_key": "plk_...", ...} (the key is shown once)pip install -e ".[dev]"cp .env.example .envpytestprivi-ledger-mcp # HTTP :8000, MCP at /mcpprivi-ledger-mcp --stdio # local clients; set LEDGER_LOCAL_ORG_KEYcd ledger-server && python -m pytest tests/test_dual_payments.py