Fidacy Mcp

io.github.lucaslubiPublished by GitHub account lucaslubiv0.19.0Updated Oct 24, 2026

AI Agent Firewall. Enforce signed authority before consequential actions. Free API key required.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that acts as a payment firewall for AI agents, checking proposed payments against a signed mandate and returning signed verdicts and audit- 可

What you can do
Assess a proposed action (payment, message, voice call, document claim) and get a signed trust verdict from the Fidacy engine, with a verifiable proof payload and signing key id. Authorize a payment against a mandate, returning either an allow with a short-lived Ed25519 grant or a deny with the violated rule. Read the mandate envelope and Fidacy public key. Retrieve a hash-chained audit proof for a decision id. Runs locally and deny-by-default, with trusted payees and caps configured in a local config file.
When to use it
Use it when an AI agent can initiate payments or other consequential actions and you want a deterministic gate in front of the executor rather than prompt-level guardrails. It suits setups where every payment decision should produce a verifiable, auditable proof.
Requirements
Runs as a local stdio process via npx or a global npm install (Node.js). The FIDACY_ENGINE_API_KEY environment variable is required to call the verdict tool; a free key is obtained from the provider's signup page. Optional FIDACY_MODE=http points the server at a hosted core. Network access to the Fidacy engine is needed for verdicts.
Before you install
The server handles payment authorization, so misconfiguration could allow or block real money movement; it is non-custodial and never holds funds. It requires the FIDACY_ENGINE_API_KEY secret, which the README says is never logged or echoed. Proposed actions and mandates are sent to the Fidacy engine for assessment. Enforcement only works if this is the agent's sole payment-capable tool and the downstream executor requires the grant.

Installation

In SourceWeft

  1. Open Fidacy Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@fidacy/mcp

[fidacy-mcp MCP server]

[Fidacy blocks a BEC lookalike-payee payment, then allows the legit one with a signed Ed25519 grant]

The action firewall for AI agents. A drop-in MCP server that gates payment actions against a cryptographically signed mandate before money can move. Non-custodial: Fidacy authorizes and proves, it never holds funds.

Install once, works in any MCP-compatible agent: Claude Code, Claude Desktop, Hermes, OpenClaw, and anything else that speaks MCP.

[npm] [license] Works with: Claude Code · Claude Desktop · OpenClaw · Hermes · Brex CrabTrap

Your agent could be paying scammers right now. Prompt-injected into the wrong payee, an inflated amount, or the same invoice twice — and your logs aren't evidence. Fidacy blocks it before money moves, and hands back a signed verdict anyone can verify against public keys. You don't trust us — you check the signature.

Quick start (free, local-first, no account)

json
{  "mcpServers": {    "fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }  }}

Runs on your machine, offline, deny-by-default. Add trusted payees + caps in ~/.fidacy/config.json. Verify any verdict yourself against the public keys at /.well-known/jwks.json.

Why

An agent can hallucinate or be prompt-injected into a payment: wrong payee, wrong amount, fabricated invoice. Prompt-level guardrails are probabilistic and bypassable. @fidacy/mcp is a deterministic gate between the agent's intent and the executor: the action is dead on arrival unless it validates against a signed mandate, and every decision lands in an immutable hash-chained audit trail.

Enforcement model

  1. Register @fidacy/mcp as the agent's only payment-capable tool. Do not give the agent a raw payment tool. Tool inventory is the runtime firewall.
  2. The agent calls request_payment. Fidacy checks it against the mandate (payee allowlist, per-tx cap, total cap, currency, time window, revocation).
  3. ALLOW returns a short-lived Ed25519 grant. DENY returns no grant and the violated rule. The downstream executor MUST require the grant, so a denied action cannot proceed.
  4. Every decision is appended to a hash-chained log. get_audit_proof returns the portable, verifiable proof.

One install, two backends

@fidacy/mcp ships two complementary capabilities in a single install:

  • Verdict layer (advisory): assess_action calls the live Fidacy engine and returns a signed trust verdict. It moves no money; it returns a judgment whose proof (riskPayloadJws + signingKeyId) is verifiable by anyone via @fidacy/verify against the engine JWKS at /.well-known/jwks.json.
  • Payment firewall (enforcement): request_payment / verify_mandate / get_audit_proof gate and prove a payment against a signed mandate through the core, returning short-lived Ed25519 grants.

Mental model: assess_action -> engine (signed verdict); request_payment and friends -> core (payment firewall).

Tools

ToolBackendPurpose
assess_actionengineSigned Fidacy trust verdict for a proposed action. Advisory.
request_paymentcoreAuthorize a payment action. ALLOW + grant, or DENY + rule.
verify_mandatecoreRead the mandate envelope + Fidacy public key.
get_audit_proofcoreHash-chained proof for a decision id.

assess_action

Returns a signed Fidacy trust verdict from the live engine for a proposed action. The signed proof is riskPayloadJws + signingKeyId, verifiable by anyone via @fidacy/verify against {engineUrl}/.well-known/jwks.json.

Inputs:

  • kind (optional, default ap2_payment): one of ap2_payment, message_send, voice_call, custom, claim_document.
  • mandate (required): the action/mandate object for that kind.
  • mandateType, spendingMandate, idempotencyKey, a2a.task_id (optional).

Environment:

VarDefaultPurpose
FIDACY_ENGINE_URLhttps://api.fidacy.comBase URL of the Fidacy engine.
FIDACY_ENGINE_API_KEY(none)An fky_live_ / fky_test_ key with scope assess:write.

The server boots without FIDACY_ENGINE_API_KEY; the tool is always registered. Only calling assess_action without the key returns a helpful error telling you to set it. The key is never logged, echoed, or attached to any error.

Install

bash
npm install -g @fidacy/mcp   # or run via npx, no install

Claude Code

bash
claude mcp add fidacy -- npx -y @fidacy/mcp

Claude Desktop (claude_desktop_config.json)

json
{  "mcpServers": {    "fidacy": { "command": "npx", "args": ["-y", "@fidacy/mcp"] }  }}

Hermes (config.yaml)

yaml
mcp_servers:  fidacy:    command: npx    args: ["-y", "@fidacy/mcp"]

OpenClaw

Add the same server via the Tools panel, or the mcpServers block in your agent config. Any MCP-compatible host uses the same command.

Wiring the real core (production)

The MCP layer talks to your core through one interface (FidacyCore). Your repository stays private. Set FIDACY_MODE=http and implement three endpoints:

  • POST /v1/mandate/get -> Mandate
  • POST /v1/decide -> Decision (runs your Ed25519/AP2 verification + audit append)
  • POST /v1/audit/proof -> AuditProof

No change to the MCP layer is needed.

Dev

bash
npm installnpm run buildnpm start      # stdio server, in-memory demo mandate

Source: README.md at commit ce42c70

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.19.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts