Touchstone — Claude Code MCP server: audit agent actions
Touchstone records agent activity in an externally anchored log and signs entries on your machine. Use it to share or verify recorded actions.
claude mcp add --env TOUCHSTONE_RECORDER=<TOUCHSTONE_RECORDER> --env TOUCHSTONE_SUBJECT=<TOUCHSTONE_SUBJECT> --env TOUCHSTONE_API_KEY=<TOUCHSTONE_API_KEY> --env TOUCHSTONE_SIGNING_KEY=<TOUCHSTONE_SIGNING_KEY> --env TOUCHSTONE_KEY_FILE=<TOUCHSTONE_KEY_FILE> --transport stdio touchstone -- npx -y @touchstone-cv/mcpWhat Touchstone does
This local MCP server sends agent events to a Touchstone recorder. It canonicalizes each payload and signs it with an Ed25519 key on your machine; the key stays in the server process. The server uses stdio and needs Node 18+, a recorder ID and an API key. Recording also requires a subject and signing key.
Use touchstone_disclose to create a shareable disclosure link, or touchstone_verify to check a disclosure bundle. Those tools contact the remote service. Selective disclosure lets you reveal chosen fields while keeping others hidden. Disclosure and verification therefore depend on that service.
What it helps with
- write agent actions to a signed audit log
- create a shareable link for a recorded event
- check a disclosure bundle
- reveal selected event fields with Merkle proofs
Example prompts for the agent
- Record this agent action with
touchstone_record. - Create a disclosure link for sequence
nusingtouchstone_disclose. - Check this disclosure bundle with
touchstone_verify.
How to install Touchstone
1Platform CLI
claude mcp add --env TOUCHSTONE_RECORDER=<TOUCHSTONE_RECORDER> --env TOUCHSTONE_SUBJECT=<TOUCHSTONE_SUBJECT> --env TOUCHSTONE_API_KEY=<TOUCHSTONE_API_KEY> --env TOUCHSTONE_SIGNING_KEY=<TOUCHSTONE_SIGNING_KEY> --env TOUCHSTONE_KEY_FILE=<TOUCHSTONE_KEY_FILE> --transport stdio touchstone -- npx -y @touchstone-cv/mcpReplace <…> with your own values. 1 more environment variable is in the server README
2Platform CLI: remote server
claude mcp add --transport http touchstone https://touchstone.cv/mcp1Platform CLI: remote server
codex mcp add touchstone --url https://touchstone.cv/mcp2Platform CLI
codex mcp add touchstone --env TOUCHSTONE_RECORDER=<TOUCHSTONE_RECORDER> --env TOUCHSTONE_SUBJECT=<TOUCHSTONE_SUBJECT> --env TOUCHSTONE_API_KEY=<TOUCHSTONE_API_KEY> --env TOUCHSTONE_SIGNING_KEY=<TOUCHSTONE_SIGNING_KEY> --env TOUCHSTONE_KEY_FILE=<TOUCHSTONE_KEY_FILE> -- npx -y @touchstone-cv/mcpReplace <…> with your own values. 1 more environment variable is in the server README
Config file
{
"mcpServers": {
"touchstone": {
"url": "https://touchstone.cv/mcp"
}
}
}{
"mcpServers": {
"touchstone": {
"command": "npx",
"args": [
"-y",
"@touchstone-cv/mcp"
],
"env": {
"TOUCHSTONE_RECORDER": "<TOUCHSTONE_RECORDER>",
"TOUCHSTONE_SUBJECT": "<TOUCHSTONE_SUBJECT>",
"TOUCHSTONE_API_KEY": "<TOUCHSTONE_API_KEY>",
"TOUCHSTONE_SIGNING_KEY": "<TOUCHSTONE_SIGNING_KEY>",
"TOUCHSTONE_KEY_FILE": "<TOUCHSTONE_KEY_FILE>"
}
}
}
}Replace <…> with your own values. 1 more environment variable is in the server README
Config file
{
"servers": {
"touchstone": {
"type": "http",
"url": "https://touchstone.cv/mcp"
}
}
}{
"servers": {
"touchstone": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@touchstone-cv/mcp"
],
"env": {
"TOUCHSTONE_RECORDER": "<TOUCHSTONE_RECORDER>",
"TOUCHSTONE_SUBJECT": "<TOUCHSTONE_SUBJECT>",
"TOUCHSTONE_API_KEY": "<TOUCHSTONE_API_KEY>",
"TOUCHSTONE_SIGNING_KEY": "<TOUCHSTONE_SIGNING_KEY>",
"TOUCHSTONE_KEY_FILE": "<TOUCHSTONE_KEY_FILE>"
}
}
}
}Replace <…> with your own values. 1 more environment variable is in the server README
1Platform CLI: remote server
gemini mcp add -t http touchstone https://touchstone.cv/mcp2Platform CLI
gemini mcp add -e TOUCHSTONE_RECORDER=<TOUCHSTONE_RECORDER> -e TOUCHSTONE_SUBJECT=<TOUCHSTONE_SUBJECT> -e TOUCHSTONE_API_KEY=<TOUCHSTONE_API_KEY> -e TOUCHSTONE_SIGNING_KEY=<TOUCHSTONE_SIGNING_KEY> -e TOUCHSTONE_KEY_FILE=<TOUCHSTONE_KEY_FILE> touchstone npx -y @touchstone-cv/mcpReplace <…> with your own values. 1 more environment variable is in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Touchstone
How do I install Touchstone in Claude Code?
Add the local server with `claude mcp add touchstone -e TOUCHSTONE_RECORDER=<TOUCHSTONE_RECORDER> -e TOUCHSTONE_SUBJECT=<TOUCHSTONE_SUBJECT> -e TOUCHSTONE_API_KEY=<TOUCHSTONE_API_KEY> -e TOUCHSTONE_SIGNING_KEY=<TOUCHSTONE_SIGNING_KEY> -- npx -y @touchstone-cv/mcp`. Set the recorder ID, subject, API key and signing key for recording.
What does Touchstone do?
It records agent events in a log, signs them with a local key, and provides tools to disclose and verify entries.
Can I share only some fields from an event?
Yes. Record with selective_disclosure: true, then choose which fields to reveal. Hidden values stay out of the disclosure; revealed fields include Merkle proofs.
