Attest Mcp

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";import { withAttest } from "@attest-dev/sdk/mcp";
const server = new McpServer({ name: "my-tools", version: "1.0.0" });const protectedServer = withAttest(server, {  issuerUri: "https://api.attest.dev",});
// Register tools exactly as before — every call is now credential-gated.protectedServer.tool("send_email", schema, handler);

import { withAttest } from "@attest-dev/sdk/mcp";import type { AttestToolOptions } from "@attest-dev/sdk/mcp";
protectedServer.tool("gh_create_issue", schema, handler, {  requiredScope: "github:write",} satisfies AttestToolOptions);
protectedServer.tool("stripe_charge", schema, handler, {  requiredScope: "stripe:write",} satisfies AttestToolOptions);
// Auto-mapping still applies when requiredScope is omitted.protectedServer.tool("send_email", schema, handler);// → "email:send"

const protectedServer = withAttest(server, {  issuerUri: "https://api.attest.dev",  toolScopeMap: {    "send_message": "slack:send",    "query_db":     "postgres:read",  },});

import { withAttest, getAttestScopes } from "@attest-dev/sdk/mcp";
const protectedServer = withAttest(server, { issuerUri: "https://api.attest.dev" });
protectedServer.tool("send_email", schema, handler);protectedServer.tool("gh_create_issue", schema, handler, { requiredScope: "github:write" });
// Express / Hono / any HTTP framework:app.get("/.well-known/attest-scopes", (_req, res) => {  res.json({ tools: getAttestScopes(protectedServer) });});

// Before starting a task, discover what the MCP server needs:const { tools } = await fetch("https://my-mcp-server/.well-known/attest-scopes")  .then(r => r.json());
// Issue a credential with exactly those scopes:const { token } = await attestClient.issue({  agent_id: "my-agent",  user_id:  "usr_alice",  scope:    Object.values(tools),   // ["email:send", "github:write"]  instruction: "...",});

withAttest(server, {  // Required: URI of your Attest server  issuerUri: "https://api.attest.dev",
  // How long to cache JWKS before re-fetching (seconds). Default: 3600  jwksCacheTTL: 3600,
  // How long to cache revocation status per JTI (seconds).  // Set 0 to disable caching (every call hits the server). Default: 10  revocationCacheTTL: 10,
  // false = log violations via onViolation but don't block the call.  // Useful for gradual rollout. Default: true  requireCredential: true,
  // Per-tool scope overrides. Keys are exact tool names.  toolScopeMap: {    "send_message": "slack:send",  },
  // Called on every scope violation (synchronous).  // Use for metrics, alerting, structured logging.  onViolation: (event) => {    console.warn("Attest violation", {      tool:     event.toolName,      reason:   event.reason,      required: event.requiredScope,      granted:  event.grantedScope,      jti:      event.jti,    });  },});

import { withAttest, getAttestContext } from "@attest-dev/sdk/mcp";
protectedServer.tool("send_email", schema, async (args, extra) => {  const ctx = getAttestContext(extra);  // ctx.att_uid   — the human who initiated the task  // ctx.att_tid   — task tree ID (use for audit correlation)  // ctx.att_scope — granted scopes  // ctx.att_depth — delegation depth (0 = root)  // ctx.jti       — this credential's unique ID
  await sendEmail(args.to, args.body, { actingAs: ctx?.att_uid });  return { content: [{ type: "text", text: "sent" }] };});

const protectedServer = withAttest(server, {  issuerUri: "https://api.attest.dev",  requireCredential: false,   // observe, don't block  onViolation: (event) => metrics.increment("attest.violation", {    tool:   event.toolName,    reason: event.reason,  }),});

const protectedServer = withAttest(server, {  issuerUri: "https://api.attest.dev",
  // Tier 1: implement a retry queue for guaranteed delivery  onAuditError: (err, event) => {    retryQueue.push({ event, attempts: 0, nextRetry: Date.now() + 5000 });    logger.error("attest audit delivery failed", {      jti:      event.jti,      agent_id: event.agent_id,      error:    err.message,    });  },
  // Tier 2: violations (including audit_failure) go to your monitoring  onViolation: (e) => metrics.increment("attest.event", { reason: e.reason }),});

import { AttestClient } from "@attest-dev/sdk";
const client = new AttestClient({ baseUrl: "https://api.attest.dev", apiKey: "..." });const chain = await client.audit(taskId);chain.events.forEach(e => console.log(e.event_type, e.jti, e.created_at));

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";import { withAttest } from "@attest-dev/sdk/mcp";import { z } from "zod";
const server = new McpServer({ name: "email-server", version: "1.0.0" });
server.tool(  "send_email",  { to: z.string().email(), subject: z.string(), body: z.string() },  async ({ to, subject, body }) => {    await sendEmail(to, subject, body);    return { content: [{ type: "text", text: `Sent to ${to}` }] };  },);
// Wrap — every tool now requires a valid credential with "email:send" scope.const protectedServer = withAttest(server, {  issuerUri: process.env.ATTEST_URI ?? "http://localhost:8080",  onViolation: (e) => console.warn("blocked:", e.reason, e.toolName),});
const transport = new StdioServerTransport();await protectedServer.connect(transport);