HiveAttest

io.github.srotzinPublished by GitHub account srotzinv1.0.0Updated Oct 24, 2026

Pre-action attestation perimeter for AI agents — 8 primitives, signed C18 receipt per call.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

HiveAttest is a remote MCP server that lets an assistant issue, verify and gate signed attestations for AI agent actions using Ed25519 signatures and Merkle has

What you can do
Issue and verify pre-action passports, including signature, temporal validity and optional inputs-hash checks, and evaluate whether an agent may proceed through the gate, with a signed receipt on every allow or deny decision. Append, verify and produce Merkle inclusion proofs for custody chains, with taint that propagates once set. Register, validate and snapshot versioned cargo types in a registry with a Merkle root for version pinning. Issue, report breaches of and retrieve attestation warranties, and run probabilistic secondary inspection of record batches with signed inspection records. Build, prove and verify non-membership of events in an audit window, verify SMSH-Stamp v1 receipts, or
When to use it
Use it when you need cryptographic, signed evidence around what an AI agent is about to do or has done: pre-action authorization, chain-of-custody records, warranty commitments, audit-window absence proofs, or gate decisions with receipts. It suits evaluation and prototyping of the HiveAttest claim family rather than production enforcement.
Requirements
A remote Streamable-HTTP endpoint; no local runtime or package is needed for the hosted connection. The README also shows a local Node.js launch with a backend base URL and port set through environment variables. No authentication, API key or header is declared. Network access to the hosted server and its backend is required.
Before you install
The README describes this as a reference-grade implementation, with production-grade hardening stated as future work, so do not rely on it for real enforcement. Signing keys are generated at backend startup or loaded from a private-key environment variable on the backend. Tools issue, append, register and report breach records, which change server-side state, and requests are proxied to a third-party backend.

Installation

In SourceWeft

  1. Open HiveAttest in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.srotzin%2Fhive-mcp-attest/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "hiveattest": {
      "type": "http",
      "url": "https://hive-mcp-attest.onrender.com/mcp"
    }
  }
}

README

[Hive Civilization · HiveAttest perimeter for autonomous agents]

hive-mcp-attest

HiveAttest perimeter for autonomous agents — C8/C12/C13/C15-C20

[Glama] [Status] [Release] [License]

https://hive-mcp-attest.onrender.com/mcp

Layer C — Reference Grade

This is the reference implementation of the HiveAttest claim family. Wire format is normative. Production-grade (Layer B) is a future hardened deployment.

Reference implementation of USPTO Provisional 64/055,601 — HiveAttest claims C8/C12/C13/C15-C20.

Inventor: Stephen A. Rotzin

What this is

hive-mcp-attest is a Model Context Protocol (MCP) server that exposes the complete HiveAttest perimeter as 19 tools, proxying to the live hivemorph backend.

  • Protocol: MCP 2024-11-05 over Streamable-HTTP / JSON-RPC 2.0
  • Transport: POST /mcp
  • Discovery: GET /.well-known/mcp.json
  • Health: GET /health
  • Backend: https://hivemorph.onrender.com
  • Crypto: Ed25519, RFC 8785 JCS, SHA-256 — real signatures, no mocks
  • Brand gold: #FFB800

Tools

ToolClaimDescription
attest_passport_issueC15Issue a Pre-Action Attestation Manifest (Ed25519 signed)
attest_passport_verifyC15Verify a passport manifest (signature + temporal + inputs hash)
attest_custody_appendC16Append a signed node to a custody chain (taint propagation)
attest_custody_verifyC16Verify hash linkage, signatures, and taint propagation
attest_custody_proofC16Get a Merkle inclusion proof for a custody node
attest_cargo_registerC17Register a versioned cargo type (definition_hash pinned)
attest_cargo_validateC17Validate a payload against a registered cargo schema
attest_cargo_snapshotC17Registry snapshot with Merkle root for version pinning
attest_warranty_issueC18Issue a signed warranty committing an agent to a claim
attest_warranty_breachC18Report a breach — signed breach record returned
attest_warranty_getC18Retrieve a warranty by ID
attest_gate_evaluateC19THE HEADLINE TOOL — Gate evaluation with signed C18 receipt
attest_inspect_sampleC20Probabilistic secondary inspection, signed inspection record
attest_smsh_verifyC8/C12Verify a SMSH-Stamp v1 receipt
attest_absence_buildC13Build a sorted Merkle tree for provable non-membership
attest_absence_proveC13Prove an event is absent from an audit window
attest_absence_verifyC13Verify a non-membership proof against a root
attest_meta—Return layer/spec/patent metadata for all claims

Endpoints

ToolBackend URL
attest_passport_issuePOST https://hivemorph.onrender.com/v1/attest/passport/issue
attest_passport_verifyPOST https://hivemorph.onrender.com/v1/attest/passport/verify
attest_custody_appendPOST https://hivemorph.onrender.com/v1/attest/custody/append
attest_custody_verifyPOST https://hivemorph.onrender.com/v1/attest/custody/verify
attest_custody_proofGET https://hivemorph.onrender.com/v1/attest/custody/{chain_id}/proof/{index}
attest_cargo_registerPOST https://hivemorph.onrender.com/v1/attest/cargo/register
attest_cargo_validatePOST https://hivemorph.onrender.com/v1/attest/cargo/validate
attest_cargo_snapshotGET https://hivemorph.onrender.com/v1/attest/cargo/snapshot
attest_warranty_issuePOST https://hivemorph.onrender.com/v1/attest/warranty/issue
attest_warranty_breachPOST https://hivemorph.onrender.com/v1/attest/warranty/breach
attest_warranty_getGET https://hivemorph.onrender.com/v1/attest/warranty/{id}
attest_gate_evaluatePOST https://hivemorph.onrender.com/v1/attest/gate/evaluate
attest_inspect_samplePOST https://hivemorph.onrender.com/v1/attest/inspect/sample
attest_smsh_verifyPOST https://hivemorph.onrender.com/v1/attest/smsh/verify
attest_absence_buildPOST https://hivemorph.onrender.com/v1/attest/absence/build
attest_absence_provePOST https://hivemorph.onrender.com/v1/attest/absence/prove
attest_absence_verifyPOST https://hivemorph.onrender.com/v1/attest/absence/verify
attest_meta(local — no backend call)

Connect (Claude Desktop)

Add to your claude_desktop_config.json:

json
{  "mcpServers": {    "hive-mcp-attest": {      "command": "node",      "args": ["/path/to/hive-mcp-attest/server.js"],      "env": {        "HIVE_BASE": "https://hivemorph.onrender.com"      }    }  }}

Or connect via Streamable-HTTP (MCP 2024-11-05):

json
{  "mcpServers": {    "hive-mcp-attest": {      "url": "https://hive-mcp-attest.onrender.com/mcp",      "transport": "streamable-http"    }  }}

Environment variables

VariableDefaultDescription
HIVE_BASEhttps://hivemorph.onrender.comBackend hivemorph URL
PORT3000Server port

Cryptographic guarantees

All attestation primitives use:

  • Ed25519 — signing key generated at backend startup (or loaded from HIVE_ATTEST_PRIVATE_KEY_B64URL)
  • RFC 8785 JCS — deterministic canonicalization for all signing operations
  • SHA-256 — payload hashing, Merkle tree nodes
  • No mocked signatures — every signature is a real 64-byte Ed25519 output

Patent

Reference implementation of USPTO Provisional 64/055,601 — HiveAttest claims C8/C12/C13/C15-C20.

Inventor: Stephen A. Rotzin. Filed May 2 2026.

Layer

Layer C — Reference Grade. Wire format is normative. Production-grade is Layer B.

Every tool description ends with: "Reference-grade implementation. Wire format normative; production-grade is Layer B."

License

MIT © 2026 Stephen A. Rotzin / Hive Civilization

Source: README.md at commit a5557bc

Tools

18

attest_passport_issue

Issue a Pre-Action Attestation Manifest (C15: hive-passport). Signs with Ed25519 over RFC 8785 JCS-canonical body. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersinputsaction_idrequiredagent_didrequiredintended_oprequiredttl_secondstarget_resourcerequired

attest_passport_verify

Verify a Pre-Action Attestation Manifest (C15: hive-passport). Checks Ed25519 signature, temporal validity, and optionally observed inputs hash. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersmanifestrequiredobserved_inputs

attest_custody_append

Append a node to a custody chain (C16: hive-custody). Taint propagates: once tainted, always tainted. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parameterspayloadchain_idrequiredagent_didrequiredtaint_statustransform_idrequired

attest_custody_verify

Verify a custody chain: hash linkage, Ed25519 signatures, and taint propagation (C16). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersnodesrequired

attest_custody_proof

Retrieve a Merkle inclusion proof for a specific node in a custody chain (C16). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersindexrequiredchain_idrequired

attest_cargo_register

Register a versioned cargo type in the HiveAttest registry (C17: hive-cargo-taxonomy). Pins a definition hash for version-anchoring. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersidrequirednamerequiredschemarequiredversionrequiredsupersedessensitivityrequired

attest_cargo_validate

Validate a payload against a registered cargo type schema (C17). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parameterspayloadrequiredversionrequiredcargo_type_idrequired

attest_cargo_snapshot

Get a registry snapshot with Merkle root for version pinning (C17). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Takes no parameters.

attest_warranty_issue

Issue an attestation warranty committing an agent to a claim (C18: hive-attestation-warranty). Signed with Ed25519. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersclaimrequiredscopeaction_idrequiredagent_didrequiredexpires_at

attest_warranty_breach

Report a warranty breach. Marks the warranty as breached and returns a signed breach record (C18). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersevidencewarranty_idrequiredbreach_descriptionrequired

attest_warranty_get

Retrieve a warranty by ID (C18). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parameterswarranty_idrequired

attest_gate_evaluate

THE HEADLINE TOOL. Evaluate whether an agent may proceed through the HiveAttest gate (C19: hive-gate-enforcer). Verifies passport signature + expiry, cargo registry membership, and warranty status. Every response (allow OR deny) includes a signed C18-format receipt of the gate decision. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parameterscontextcustody_rootwarranty_idscargo_manifestpassport_manifestrequired

attest_inspect_sample

Probabilistic secondary inspection of a record batch (C20: hive-secondary-inspection). Returns a signed inspection record. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersseedrecordsrequiredsample_idrequiredsample_rate

attest_smsh_verify

Verify a SMSH-Stamp v1 receipt (C8/C12: smsh-stamp-verifier). Validates schema, version, algorithm, timestamp, and Ed25519 signature. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersreceiptrequiredpubkey_b64urlmax_age_seconds

attest_absence_build

Build a sorted Merkle tree for an audit window (enables cryptographic non-membership proofs, C13: prov-absence). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parameterseventsrequiredwindow_idrequired

attest_absence_prove

Prove that a query event is NOT a member of a previously-built audit window (C13). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersqueryrequiredwindow_idrequired

attest_absence_verify

Verify a non-membership proof against an expected Merkle root (C13). Reference-grade implementation. Wire format normative; production-grade is Layer B.

Parametersproofrequiredroot_hexrequired

attest_meta

Return HiveAttest layer/spec/patent metadata for all claims. Useful for agent introspection. Reference-grade implementation. Wire format normative; production-grade is Layer B.

Takes no parameters.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts