MCP Server Attestation — Claude Code MCP server: how to install
Validates tool manifests with Ed25519 signatures and polices spawn calls at runtime. Useful for shielding MCP setups against injected commands and rogue updates.
claude mcp add server-attestation -- npx -y mcp-attest-demoWhat MCP Server Attestation does
The server brings cryptographic integrity to MCP tooling by verifying manifest signatures and screening process execution. It inspects parameters against a strict default-deny rule set that weeds out shell metacharacters, traversal sequences, and backtracking regex patterns.
The project provides three pieces: an integration library, the mcp-attest CLI, and the reference mcp-attest-demo server communicating over stdio. Inside the reference server are tools to make keypairs, draft manifest templates, sign files, and inspect spawn arguments.
Running this package requires Node.js 20 or newer, relying strictly on internal node:crypto primitives without third-party cryptographic dependencies.
What it helps with
- verify Ed25519 cryptographic signatures on MCP manifests
- intercept unauthorized process execution before
child_process.spawn - filter dangerous shell metacharacters and directory traversal paths
- generate cryptographic keypairs to sign tool configurations
Example prompts for the agent
- Draft a fresh manifest blueprint using
attest_generate_manifest_template - Inspect the command arguments for
/usr/bin/echowithattest_inspect_spawn - Generate a new signing keypair using
attest_keygen
How to install MCP Server Attestation
Platform CLI
claude mcp add server-attestation -- npx -y mcp-attest-demoPlatform CLI
codex mcp add mcp-server-attestation -- npx -y mcp-attest-demoConfig file
{
"mcpServers": {
"mcp-server-attestation": {
"command": "npx",
"args": [
"-y",
"mcp-attest-demo"
]
}
}
}Config file
{
"servers": {
"mcp-server-attestation": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcp-attest-demo"
]
}
}
}Platform CLI
gemini mcp add mcp-server-attestation npx -y mcp-attest-demoStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about MCP Server Attestation
How to install MCP Server Attestation in Claude Code?
Run claude mcp add mcp-server-attestation -- npx -y mcp-attest-demo in your terminal to register the reference server.
What does MCP Server Attestation do?
It adds Ed25519 manifest verification and runtime spawn gating to prevent tool tampering and argument injection in MCP environments.
How does key pinning work?
It uses a Trust-on-First-Use model where the public key gets recorded in ~/.mcp-attest/trust.json during the initial verification. Any subsequent key change raises a pin mismatch error.
