# MCP Server Attestation

Validates tool manifests with Ed25519 signatures and polices spawn calls at runtime. Useful for shielding MCP setups against injected commands and rogue updates.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: studiomeyer-io
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/studiomeyer-io/mcp-server-attestation
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-server-attestation

## What it does

The server brings cryptographic integrity to MCP tooling by verifying manifest signatures and screening process execution. It inspects parameters against a strict default-deny rule set that weeds out shell metacharacters, traversal sequences, and backtracking regex patterns.

The project provides three pieces: an integration library, the `mcp-attest` CLI, and the reference `mcp-attest-demo` server communicating over stdio. Inside the reference server are tools to make keypairs, draft manifest templates, sign files, and inspect spawn arguments.

Running this package requires Node.js 20 or newer, relying strictly on internal `node:crypto` primitives without third-party cryptographic dependencies.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add server-attestation -- npx -y mcp-attest-demo
```

### Codex

**Platform CLI**
```bash
codex mcp add mcp-server-attestation -- npx -y mcp-attest-demo
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp-server-attestation": {
            "command": "npx",
            "args": [
                "-y",
                "mcp-attest-demo"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp-server-attestation": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "mcp-attest-demo"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mcp-server-attestation npx -y mcp-attest-demo
```

## When to use it
- verify Ed25519 cryptographic signatures on MCP manifests
- intercept unauthorized process execution before `child_process.spawn`
- filter dangerous shell metacharacters and directory traversal paths
- generate cryptographic keypairs to sign tool configurations

## Example prompts
- Draft a fresh manifest blueprint using `attest_generate_manifest_template`
- Inspect the command arguments for `/usr/bin/echo` with `attest_inspect_spawn`
- Generate a new signing keypair using `attest_keygen`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md