PCRZERO — MCP server

Issue and verify signed receipts for agent actions from any MCP-speaking agent. PCRZERO adjudicates an attestation document against a policy and hands back a cryptographically signed receipt pair — durable, independently checkable proof that this decision was made, by these keys, over this document. Anyone can verify a receipt, offline, without an account and without trusting us.

• Website: pcrzero.com
• Sign up / API keys: pcrzero.com/signup
• API: api.pcrzero.com
• Hosted MCP: https://mcp.pcrzero.com/mcp (streamable-http, Mode A)
• Package: @scytalex-llc/pcrzero-mcp · registry name com.pcrzero/mcp

Install

Stdio (default)

Your agent host launches the process; nothing listens on a port.

Claude Code

claude mcp add pcrzero -e PCRZERO_API_KEY=<your-key> -- npx -y @scytalex-llc/pcrzero-mcp

Claude Desktop / any JSON-configured MCP client

{
  "mcpServers": {
    "PCRZERO": {
      "command": "npx",
      "args": ["-y", "@scytalex-llc/pcrzero-mcp"],
      "env": { "PCRZERO_API_KEY": "<your-key>" }
    }
  }
}

No key yet? Leave env out. verify_receipt and get_keyset work with no API key and no account — only the metered tool needs one.

Requires Node 22 or later.

Hosted (public)

The public streamable-http endpoint is:

https://mcp.pcrzero.com/mcp

Mode A only: send Authorization: Bearer ak_live_… (or X-PCRZERO-API-KEY) for issue_receipt. Free tools work without a key and are rate-limited.

Streamable-http (self-host / Bazaar agents)

stdio cannot be indexed by marketplaces that require a network MCP endpoint. v0.2.0 adds streamable-http alongside stdio. Prefer the hosted URL above unless you are running your own listener.

# Default: loopback, Mode A (per-client API key header — process env key disabled)
npx -y @scytalex-llc/pcrzero-mcp --http
# equivalent:
PCRZERO_MCP_TRANSPORT=http npx -y @scytalex-llc/pcrzero-mcp

| Variable / flag | Default | Meaning | | --- | --- | --- | | --http / PCRZERO_MCP_TRANSPORT=http | off (stdio) | Enable streamable-http | | --host / PCRZERO_MCP_HTTP_HOST | 127.0.0.1 | Bind address | | --port / PCRZERO_MCP_HTTP_PORT | 3333 | Listen port | | --path / PCRZERO_MCP_HTTP_PATH | /mcp | MCP endpoint path | | --auth / PCRZERO_MCP_AUTH_MODE | client_key | client_key (Mode A) or env_key (Mode B) | | PCRZERO_MCP_CORS_ORIGINS | (empty) | Comma allowlist; empty = no CORS | | PCRZERO_MCP_ALLOWED_HOSTS | localhost,127.0.0.1 | Host header allowlist | | PCRZERO_MCP_MAX_BODY_BYTES | 1048576 | Request body cap | | PCRZERO_MCP_FREE_TOOL_RPM | 60 | Free-tool rate limit per client | | PCRZERO_MCP_AUTH_FAIL_RPM | 20 | Auth-failure throttle per source IP | | PCRZERO_MCP_REQUIRE_TLS | off | Log HTTPS reminder when non-loopback |

Mode A — client_key (default, required for remote/Bazaar): each client supplies its own PCRZERO API key on the HTTP request via:

• Authorization: Bearer ak_live_… or
• X-PCRZERO-API-KEY: ak_live_…

Configure that header in your MCP client’s secure settings. Never paste API keys into chat. The process env key is not used for issue_receipt in this mode (prevents a shared metered key on a multi-client listener).

Mode B — env_key (local sidecar only): uses PCRZERO_API_KEY from the environment. Bind must be loopback (127.0.0.1 / localhost). Binding 0.0.0.0 with env_key refuses to start.

TLS: for any non-loopback deploy, terminate HTTPS at a reverse proxy (Caddy, nginx, cloud load balancer). The binary may speak cleartext HTTP on loopback for local agents.

Example reverse-proxy sketch (TLS terminator in front of loopback MCP):

# TLS terminates here; proxy to 127.0.0.1:3333
location /mcp {
  proxy_pass http://127.0.0.1:3333/mcp;
  proxy_http_version 1.1;
  proxy_set_header Host $host;
  proxy_set_header Authorization $http_authorization;
  proxy_buffering off;
}

The three tools

| Tool | Cost | What it does | | --- | --- | --- | | issue_receipt | Metered — bills one receipt_verifications unit per call | Adjudicates an attestation document against a policy on the live API and returns the verdict with a signed receipt pair. A fail verdict bills exactly like a pass: you are paying for the adjudication, not for the answer you wanted. The only tool here that spends. Always requires an API key (stdio env or HTTP header). | | verify_receipt | Free, and it stays free | Checks a PCRZERO receipt pair against the signing keyset: whether the signature holds, and whether the receipt says what it appears to say. Offline by default — supply keyset and this call touches the network not at all; omit it and the server fetches the public keyset once. keyset_source in the result tells you which happened, every time. | | get_keyset | Free | Returns the current PCRZERO signing keyset — key ids, public halves, each key’s status. Public and unauthenticated. The same document an outside party fetches to check a receipt without trusting us. |

On streamable-http, free tools are public with per-client rate limits; auth failures are throttled per source IP (session id is not in that bucket — rotating Mcp-Session-Id cannot reset the spray limit).

Current pricing is published at pcrzero.com — it is deliberately not baked into this README or into any tool description.

Auth, exactly

Stdio: PCRZERO_API_KEY in the server’s environment, via your MCP client configuration.

Streamable-http Mode A: per-request/session key header (see above). Mode B: env key on loopback only.

The key is sent as Authorization: Bearer on outbound issue_receipt calls to api.pcrzero.com and used nowhere else: the key never appears in tool results, error text, SSE/HTTP bodies, or logs — not even redacted. With no key, issue_receipt refuses cleanly (auth_missing) and the two free tools keep working.

API errors pass through verbatim (code, message, request_id). This server never rewrites, retries, or softens a billing refusal.

Verify without trusting us

A PCRZERO receipt is checkable by anyone holding the public keyset — including people who are not our customers and never will be. Call get_keyset once (or fetch https://api.pcrzero.com/v1/keys yourself), pin it, and verify_receipt runs entirely offline from then on. If we disappeared tomorrow, every receipt ever issued would still verify.

Transport & scope

• stdio — local host, process env key, no listen socket.
• streamable-http — optional network listener for remote agents / registry indexers that require it. Default bind is loopback; remote multi-client use requires Mode A per-client keys.

No receipt storage, no key-management tools — key management is a human path at pcrzero.com by design. No /env, /debug, or open /metrics surfaces.

Proprietary — © Scytalex LLC. The receipt verification path is free to use for anyone, forever.