@certynix/mcp — Official Certynix MCP Server

Expose the Certynix Trust Infrastructure to AI agents via Model Context Protocol. Connect Claude Desktop, Cursor, Windsurf, LangChain, CrewAI, and any MCP-compatible system to the Certynix API.

What is this?

@certynix/mcp is an MCP (Model Context Protocol) server that acts as a bridge between AI agents and the Certynix API. It exposes the Trust Infrastructure capabilities as tools, resources, and prompts that any MCP client can consume.

Use cases:

• AI agent that automatically registers assets in a CI/CD pipeline
• Claude verifying the authenticity of a contract before analyzing it
• Agent monitoring Exposure Alerts and taking corrective actions
• Audit automation: audit log listing and analysis via prompt
• Document approval workflow integration

Installation

npm install -g @certynix/mcp

Configuration

Environment variables

# REQUIRED
CERTYNIX_API_KEY=cnx_live_sk_...   # Production key
# or
CERTYNIX_API_KEY=cnx_test_sk_...   # Sandbox key (auto-detected)

# OPTIONAL
CERTYNIX_BASE_URL=https://api.certynix.com  # Auto-detected from key prefix
CERTYNIX_TIMEOUT=30000                       # Request timeout in ms (default: 30000)
MCP_TRANSPORT=stdio                          # stdio | sse (default: stdio)
MCP_PORT=3100                                # SSE port (default: 3100, sse only)
MCP_LOG_LEVEL=info                           # debug | info | warn | error

Sandbox mode

API keys prefixed with cnx_test_sk_ automatically connect to the sandbox environment (https://sandbox.certynix.com). No configuration needed.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "certynix": {
      "command": "npx",
      "args": ["-y", "@certynix/mcp"],
      "env": {
        "CERTYNIX_API_KEY": "cnx_live_sk_..."
      }
    }
  }
}

Or if installed globally:

{
  "mcpServers": {
    "certynix": {
      "command": "certynix-mcp",
      "env": {
        "CERTYNIX_API_KEY": "cnx_live_sk_..."
      }
    }
  }
}

Cursor / Windsurf

Add to ~/.cursor/mcp.json (Cursor) or the equivalent Windsurf config:

{
  "mcpServers": {
    "certynix": {
      "command": "certynix-mcp",
      "env": {
        "CERTYNIX_API_KEY": "cnx_live_sk_..."
      }
    }
  }
}

SSE Transport (remote agents)

# Start SSE server
CERTYNIX_API_KEY=cnx_live_sk_... MCP_TRANSPORT=sse MCP_PORT=3100 certynix-mcp

# Endpoints:
# SSE:          http://localhost:3100/sse
# Messages:     http://localhost:3100/message
# Health check: http://localhost:3100/health

Docker

FROM node:20-alpine
RUN npm install -g @certynix/mcp
ENV MCP_TRANSPORT=sse
ENV MCP_PORT=3100
EXPOSE 3100
CMD ["certynix-mcp"]

Tools (14)

| Tool | Description | |------|-------------| | register_asset | Register a digital asset via SHA-256 hash, public URL, or base64 file content | | verify_asset | Publicly verify asset authenticity — no auth required, no quota consumed | | list_assets | List organization assets with status and date filters, cursor pagination | | get_asset | Fetch a specific asset by ID with full metadata and event history | | delete_asset | Soft delete an asset — irreversible, requires confirm: true | | list_alerts | List Exposure Alerts with severity and resolved status filters | | get_trust_score | Get Trust Score V2: score 0-100, 4-pillar breakdown, active penalties | | list_audit_logs | List complete audit trail with action type and date range filters | | create_api_key | Create a new API Key — full key shown only once, store immediately | | list_api_keys | List API Keys — prefix only, full key never returned | | revoke_api_key | Revoke an API Key immediately — irreversible, requires confirm: true | | create_webhook | Create a webhook endpoint — signing_secret shown only at creation | | list_webhooks | List webhooks — signing_secret never returned in listings | | verify_webhook_signature | Local HMAC-SHA256 webhook signature verification (no API call) |

Usage examples with Claude

"Register this document on Certynix:
 SHA-256 hash: a3f4b2c1d8e9f0123456789abcdef0123456789abcdef0123456789abcdef01
 filename: service-contract-2026.pdf"

"Verify if the file with hash e3b0c44298fc1c149afbf4c8996fb924...
 has been certified by anyone"

"List the last 10 high-severity Exposure Alerts"

"Generate a security review of our organization"

"Create an API Key called 'CI/CD Pipeline - GitHub Actions'"

"Show me all active Exposure Alerts"

"What is our current Trust Score?"

Resources (4)

| URI | Description | |-----|-------------| | certynix://organization/info | Authenticated organization info: name, plan, Trust Score | | certynix://organization/trust-score | Trust Score V2 with component breakdown and active penalties | | certynix://assets/{asset_id} | Full asset metadata by ID (URI template) | | certynix://alerts/active | Active (unresolved) Exposure Alerts |

Prompts (2)

| Prompt | Description | |--------|-------------| | certynix_audit_report | Generate a structured audit report for a period (last_7_days, last_30_days, custom) | | certynix_security_review | Complete organization security analysis: Trust Score, penalties, API Keys, alerts, recommendations |

Security

• API Key never exposed: masked in all logs as cnx_live_sk_***
• Sensitive fields sanitized: api_key, secret, token, password, signing_secret replaced with *** in all outputs
• Destructive actions require confirmation: delete_asset and revoke_api_key require confirm: true
• organization_id never accepted as parameter: always resolved server-side via API Key
• Webhook verification is constant-time: prevents HMAC timing attacks
• Anti-replay protection: webhook timestamps older than 5 minutes are rejected
• Signing secret shown only once: at webhook creation — never returned in listings

Changelog

See CHANGELOG.md for release history.