# Achromat MOM

An MCP server that checks an agent's tool calls against policy and hands back a corrected version before anything executes.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1
- Author: achromat-ai
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/achromat-ai/achromat-mcp-server
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/achromat-mom

## What it does

Agents run into blocked calls all the time: a payment, a SQL statement, a command sent to equipment. Achromat MOM keeps a record of calls that policy stopped and the versions that were later allowed. The server exposes that record to your agent as ordinary tools, so it can ask for the permitted form up front.

It runs on your machine. The host starts it as a child process and they talk over stdio. Requests to MOM are signed with an Ed25519 key held locally, and only the signature travels. On first use there is no key, so the server offers `achromat_register_identity`; your agent asks whether to set one up. Say yes and it generates the key pair, does a short proof of work, registers the public half, and writes the private half to `~/.achromat/achromat_agent_key.pem`, readable only by you. Node.js 20 or newer is required.

After that `achromat_recall` and `achromat_calibrate` take over. Recall matches on the tool name and the shape of the arguments, and returns compliant arguments plus a steering directive when it finds a lesson. Calibrate checks the call against live policy. A `BLOCK` verdict comes with a `trap_id`: adjust the arguments as directed and retry with the same `task_description` and that `trap_id`. The key file is your identity — lose it and it cannot be recovered, so keep it out of git. Set `ACHROMAT_AGENT_KEY_FILE` to store it elsewhere.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://mom.achromat.ai/mcp`
- Environment variables: `ACHROMAT_AGENT_KEY_FILE`, `ACHROMAT_BASE_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http mcp-server https://mom.achromat.ai/mcp
```

2. **Platform CLI**
```bash
claude mcp add --env ACHROMAT_AGENT_KEY_FILE=<ACHROMAT_AGENT_KEY_FILE> --env ACHROMAT_BASE_URL=<ACHROMAT_BASE_URL> --transport stdio achromat-mom -- npx -y @achromat-ai/mcp-server
```
Replace <…> with your own values

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add achromat-mom --url https://mom.achromat.ai/mcp
```

2. **Platform CLI**
```bash
codex mcp add achromat-mom --env ACHROMAT_AGENT_KEY_FILE=<ACHROMAT_AGENT_KEY_FILE> --env ACHROMAT_BASE_URL=<ACHROMAT_BASE_URL> -- npx -y @achromat-ai/mcp-server
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "achromat-mom": {
            "url": "https://mom.achromat.ai/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "achromat-mom": {
            "command": "npx",
            "args": [
                "-y",
                "@achromat-ai/mcp-server"
            ],
            "env": {
                "ACHROMAT_AGENT_KEY_FILE": "<ACHROMAT_AGENT_KEY_FILE>",
                "ACHROMAT_BASE_URL": "<ACHROMAT_BASE_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "achromat-mom": {
            "type": "http",
            "url": "https://mom.achromat.ai/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "achromat-mom": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@achromat-ai/mcp-server"
            ],
            "env": {
                "ACHROMAT_AGENT_KEY_FILE": "<ACHROMAT_AGENT_KEY_FILE>",
                "ACHROMAT_BASE_URL": "<ACHROMAT_BASE_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http achromat-mom https://mom.achromat.ai/mcp
```

2. **Platform CLI**
```bash
gemini mcp add -e ACHROMAT_AGENT_KEY_FILE=<ACHROMAT_AGENT_KEY_FILE> -e ACHROMAT_BASE_URL=<ACHROMAT_BASE_URL> achromat-mom npx -y @achromat-ai/mcp-server
```
Replace <…> with your own values

## When to use it
- find the allowed form of a call before running it
- check payment arguments against current policy
- recover from a block and retry the call correctly
- avoid writing integration code per host
- keep the signing key on your own machine

## Example prompts
- Use `achromat_recall` to check whether this call is allowed, domain `fintech`
- Run `achromat_calibrate` on this call and show me the verdict
- I got a `BLOCK` — fix the arguments per the directive and retry with the same `task_description` and `trap_id`

## Similar
- [protect-mcp](https://affpapa.org/en/nevibecode/plugins/protect-mcp.md) — plugin · ★ 41823
- [mom-test](https://affpapa.org/en/nevibecode/skills/mom-test.md) — skill · 5600 installs
- [agentic-supply-chain-detection](https://affpapa.org/en/nevibecode/skills/agentic-supply-chain-detection.md) — skill · ★ 7121
- [cli-policy-audit](https://affpapa.org/en/nevibecode/skills/cli-policy-audit.md) — skill · 952 installs
- [Signet MCP Tools](https://affpapa.org/en/nevibecode/mcp/signet-mcp-tools.md) — MCP server · ★ 40
- [openfuse-mcp](https://affpapa.org/en/nevibecode/mcp/openfuse-mcp.md) — MCP server · ★ 18

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md