Bernstein Mcp

io.github.sipyourdrink-ltdPublished by GitHub account sipyourdrink-ltdv0.2.0Updated Oct 24, 2026

Verifies Bernstein run receipts and hash chains; lists the shipped presets and adapters. Read-only.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Stateless, read-only remote MCP endpoint that verifies Bernstein run receipts, hash chains, TRACE Trust Records and agent manifests, and lists shipped presets…

What you can do
  • Verify and explain run receipts: recompute embedded hash chains, rebuild the signed subject and check the Ed25519 signature, with a plain-language narration of the result
  • Verify chains on their own: walk journal rows, lineage entries or audit events and report the first divergent link
  • Check TRACE v0.2 Trust Records and delegation chains: schema, profile, embedded signatures, and leaf-to-root classification
  • Check signed agent manifests (v0.2 COSE envelope) and optionally cross-check them against trust records
  • Explain how a run maps onto a TRACE Trust Record, claim by claim
  • List the compliance presets and bundled agent adapters of the release, and report server version and limits
When to use it
Useful when you need to check that a Bernstein run receipt or hash chain was not edited after signing, or to run TRACE and agent-manifest conformance checks, without installing anything or holding keys. Suited to audit and provenance review of agent sessions.
Requirements
Remote streamable HTTP endpoint; no account, key or environment variables. Receipts must be passed as the file's text, not a parsed object. Limits: 1 MiB request body, 2 000 rows per chain, 60 requests per minute per address.
Before you install
Verification is trust-on-first-use: it does not prove the embedded key belongs to the operator, so pin the published key yourself. Audit-range HMAC values are not proven. Signed verdicts attest only that this verifier reached this verdict for these bytes at this time. Requests are logged as JSON lines without address, headers, body or receipt content.

Installation

In SourceWeft

  1. Open Bernstein Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.sipyourdrink-ltd%2Fbernstein-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "bernstein": {
      "type": "http",
      "url": "https://mcp.bernstein.run/mcp"
    }
  }
}

README

[bernstein-mcp]

bernstein-mcp

Stateless, read-only MCP endpoint at https://mcp.bernstein.run that verifies bernstein run receipts and hash chains. No account, no key, nothing stored, nothing fetched.

claude mcp add --transport http bernstein https://mcp.bernstein.run/mcp

What it does

ToolResult
verify_receiptrecomputes every chain a run receipt embeds, rebuilds the signed subject, checks the Ed25519 signature; verdict + one line per check, plus the verdict as a signed statement (below)
explain_receiptthe same verification, narrated: what the run recorded, where it diverges, what the result does and does not prove
verify_chainwalks journal rows, lineage entries or audit events on their own (pass the file text for byte-exact rows); names the first broken link
verify_trace_recordTRACE v0.2 conformance checks on one Trust Record, stateless, no account: vendored schema, profile rules, the embedded signature with the key in cnf.jwk (EdDSA, ES256, ES384); record_sha256 is the RFC 8785 digest a child hop links to
verify_delegation_chainwalks a set of Trust Records from the leaf to the root and classifies the chain (verified, provenance-invalid, authorization-invalid, unverifiable) with the same codes as the delegation-link corpus
verify_agent_manifeststateless check of a signed agent manifest (v0.2 COSE envelope): vendored schema, profile, canonicalization, embedded signature (Ed25519, P-256, P-384); optional trust record cross-check via references[]; verdicts valid / invalid / unverifiable
explain_trace_mappinghow a bernstein run maps onto a TRACE v0.2 Trust Record, claim by claim; pass a receipt to fill in what its journal answers
list_presets / get_presetthe compliance presets this release ships
list_adaptersthe agent adapters bundled with this release
server_infoversion and limits

Same walk as bernstein verify-receipt, reachable from any MCP client or the paste form at /verify. A verdict's page address is the receipt's own digest.

Trust model

ProvesDoes not prove
the embedded rows are exactly the rows that were signedthat the embedded key belongs to who you think (trust-on-first-use; pin the operator's published key yourself)
nothing was edited, reordered, dropped or appended after signingaudit-range HMAC values (keyed by the producing install; their linkage and content hash are still checked)

Pass the receipt file's contents as a string: an already parsed object cannot tell 1 from 1.0, and the reference hashes the original spelling.

Signed verdicts

Every verdict comes back as a DSSE envelope (signed_verdict) signed with this deployment's Ed25519 key: the payload is a JCS-canonical statement naming the receipt by digest, the verdict, every check, and an appraisal block in the EAR status vocabulary (affirming / contraindicated / none). Keep it next to the receipt; anyone can re-check it offline against the public key at /.well-known/bernstein-mcp/keys.json (kid = RFC 7638 thumbprint). The signature covers the DSSE PAE of application/vnd.bernstein.verdict+json, the same construction the receipt itself uses. It attests that this verifier reached this verdict for these bytes at this time — nothing about the receipt's producer.

Session receipts

bernstein-attest turns a Claude Code or Codex CLI session into a signed run receipt that this server verifies.

bash
npx bernstein-attest init          # registers hooks for both agents (user scope); --claude-code / --codex / --project to narrowbernstein-attest link              # verify link + one Markdown line for a PR descriptionbernstein-attest verify .bernstein/receipts/<session>.json

Codex runs project hooks only after they are trusted once with /hooks in an interactive session; codex exec skips untrusted hooks without printing anything. With --project, Claude Code hooks go to .claude/settings.local.json and Codex hooks to .codex/hooks.json; both name the bundle under your home directory, so keep .codex/hooks.json out of version control.

Recorded per tool call: tool name, hashes of its input and output, success flag, repo-relative path for files the call wrote (hash only for paths outside the project), the program name of a shell command (first token, path stripped, at most 32 characters). Not recorded: prompts, model output, command text, file contents, absolute paths. The receipt is sealed at the end of every turn that recorded something new, and every 2 000 rows; the file lives in .bernstein/receipts/ and can be committed with the change it describes. Because later turns reseal the same file, run npx bernstein-attest link right before committing it so the link you paste names the current bytes.

Limits

Request body1 MiB
Rows per chain2 000 (larger receipts: verify locally)
Rate60 requests/min per address on POST /mcp and POST /verify
Loggingone JSON line per request: route, method, status, JSON-RPC method, tool, verdict, producer family, MCP client name/version, country, colo. Never the address, a header, the body or the receipt

Correctness

vectors/ holds eight golden vectors generated by the Python reference (scripts/gen_vectors.py against the pinned bernstein source). The TypeScript verifier must reproduce each vector's verdict, every check, the binding bytes and the receipt digest byte for byte (test/vectors.test.ts). vectors/session/ holds three frozen session receipts written by bernstein-attest (scripts/gen-session-vectors.mjs).

Development

bash
npm installnpm test          # no-fetch guard + vitestnpm run typechecknpm run dev       # wrangler dev

src/ may not call fetch, eval or new Function; CI fails otherwise. Deploying: see DEPLOY.md. Licence: Apache-2.0.

Source: README.md at commit cd2c7e2

Tools

11

server_info

Server info

Identity, version, and request limits for this MCP server.

Takes no parameters.

verify_receipt

Verify a run receipt

Recompute every hash chain a bernstein run receipt embeds (journal, lineage spine, optional audit range), rebuild the signed subject from the recomputed heads, and check the Ed25519 signature with the key the receipt carries. Needs no secret and reads nothing but the receipt. Returns the verdict, the first failing check, one line per check, and the same verdict as a DSSE envelope signed by this verifier's Ed25519 key (public key at keys_url) so the outcome can be kept and re-checked offline.

Parametersreceiptrequired

explain_receipt

Explain a run receipt

Verify a run receipt and narrate the result in plain language: what the run recorded, which chains recomputed, where the first divergence is, and what an auditor can and cannot conclude without the producing install's keys.

Parametersreceiptrequired

verify_chain

Verify a hash chain

Walk bernstein chain rows and recompute every link: journal rows (event_hash), lineage spine entries (entry_hash) or audit events (prev_hmac linkage). The row kind is detected from the fields, or pass `kind` explicitly. Reports the first divergent index. Pass `entries` as the file text (a JSON array or one row per line, as journal.jsonl is written) for byte-exact hashing; a parsed array also works, but then a float spelled 1.0 or -0.0 in the file cannot be told apart from an integer.

Parameterskindentriesrequired

verify_trace_record

Verify a TRACE Trust Record

TRACE v0.2 conformance checks on one Trust Record, stateless, no account: schema (vendored trace-claim.json), profile, subject URI, software-only runtime rule, policy digest, public-only confirmation key, the embedded signature (EdDSA, ES256 or ES384 with the key in cnf.jwk), appraisal, delegation link shape and references. Nothing is fetched: resolvers are checked as URIs only. `record_sha256` is the RFC 8785 digest of the complete record, signature included — the value a child hop puts in delegation.parent_record_hash.

Parametersrecordrequired

verify_agent_manifest

Verify an Agent Manifest

Agent Manifest v0.2 conformance checks on one manifest, stateless, no account: schema (vendored agent-manifest.schema.json), profile context, version, canonicalization, COSE envelope signature (Ed25519, key identified by kid in the protected header; ML-DSA-65 is reported unverifiable). Optionally checks that a TRACE Trust Record cites this manifest by digest. Nothing is fetched; resolvers are checked as URIs only. The manifest hash is sha256 over the COSE payload bytes (or RFC 8785 canonical JSON for object input).

ParametersmanifestrequiredtrustRecord

verify_delegation_chain

Verify a TRACE delegation chain

TRACE v0.2 delegation-chain conformance, stateless, no account: index every Trust Record by the RFC 8785 digest of its complete form, start at the leaf, follow delegation.parent_record_hash to the root, and check each hop's signature, the root key against `trusted_root_keys`, the depth bound, the link's digest algorithm, the credential (registered, issuer = parent subject, holder = record subject, window at the hop's own iat) and data_class narrowing under `data_class_lattice`. Classification: provenance-invalid outranks authorization-invalid; an unread link is unverifiable, not broken. Pass `records` as a JSON array or as file text (one record per line or a JSON array).

Parameterscontextrecordsrequired

explain_trace_mapping

Explain the bernstein → TRACE mapping

How a bernstein run maps onto a TRACE v0.2 Trust Record: one row per claim with the journal field it is sourced from and the rule that derives it. Pass a run receipt to fill in the rows its embedded journal can answer (subject, iat, model, data_class, policy digest, tool transcript) alongside the receipt's own verdict.

Parametersreceipt

list_presets

List compliance presets

The compliance presets bernstein v3.19.2 ships, with the switches each one turns on.

Takes no parameters.

get_preset

Get a compliance preset

Every field of one compliance preset as bernstein v3.19.2 resolves it.

Parametersnamerequired

list_adapters

List agent adapters

The agent adapters bundled with bernstein v3.19.2: adapter name, the binary it drives, the module that implements it.

Takes no parameters.

Version history

2
  1. v0.2.0LatestSep 19, 2026
  2. v0.1.0Sep 18, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts