ScopeProof

io.github.davisvillelabsPublished by GitHub account davisvillelabsv0.1.0Updated Oct 24, 2026

Machine-verifiable authorization checks for autonomous AI agents.

The publisher's own server: Proof Holdings

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

ScopeProof is a remote MCP endpoint that provides machine-verifiable authorization checks for autonomous AI agents.

What you can do
ScopeProof is a hosted MCP server reachable at a remote endpoint. According to its registry description, it offers machine-verifiable authorization checks intended for autonomous AI agents. No tools, packages, or configuration details are listed in the available manifest, so the exact operations it exposes are not documented here.
When to use it
Consider it when an assistant or agent workflow needs authorization decisions that can be verified programmatically. Because the manifest lists no tools and no README is available, evaluate it only if you can confirm its behavior directly with the provider.
Requirements
A remote MCP client that supports streamable HTTP, plus network access to the provider's endpoint. The manifest declares no authentication, environment variables, headers, or local packages.
Before you install
The manifest declares no authentication, so anyone able to reach the endpoint may be able to use it; confirm how access is actually controlled. No tools are listed, so the scope of any write, send, or delete actions is unknown. Treat authorization results as security-relevant and verify them before relying on them.

Installation

In SourceWeft

  1. Open ScopeProof in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.davisvillelabs%2Fscopeproof/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "scopeproof": {
      "type": "http",
      "url": "https://scopeproof.davisvillelabs.com/mcp"
    }
  }
}

Tools

3

scopeproof.preflight

Preflight ScopeProof request

Free structural and secret-safety validation. Does not return an authorization verdict.

Parametersactionrequiredapprovalauthorityrequired

scopeproof.check_action

Evaluate supplied action scope

Paid $0.01 deterministic comparison of one proposed action against one supplied authority envelope. Returns within_scope, outside_scope, or review_required plus an Ed25519-signed receipt. ScopeProof does not authenticate the authority issuer, grant platform permission, replace Muse or another host approval check, or execute or fetch the target.

Parametersactionrequiredapprovalauthorityrequired

scopeproof.verify_receipt

Verify ScopeProof receipt

Free cryptographic verification of a ScopeProof authorization receipt.

Parametersreceiptrequired

Version history

1
  1. v0.1.0LatestSep 27, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Proof integrations