SecureStamp MCP Guard

SecureStamp MCP Guard is the local/distributable MCP wrapper for the SecureStamp Agent Trust Layer. It lets MCP-compatible hosts ask SecureStamp for Proof-of-Intent before sensitive tool calls.

The strategic product surface is now the Remote MCP Guard at mcp.securestamp.online; this package remains the local stdio option for clients that prefer running the guard inside their own agent environment.

Tools

• authorize_action
• analyze_message_intent
• verify_counterparty
• create_action_challenge
• get_safe_next_step
• issue_action_receipt

The Guard authorizes, challenges, blocks or emits receipts. It never executes payments, deletes data or performs external destructive actions.

Local stdio usage

Requires Node.js 20+. The wrapper speaks the MCP stdio transport (newline-delimited JSON-RPC) and has no runtime dependencies — it only proxies to the SecureStamp Action API over HTTPS.

SECURESTAMP_API_KEY=ss_live_... securestamp-mcp-guard

Optional (defaults to production):

SECURESTAMP_API_BASE=https://securestamp.online

Claude Desktop / Cursor / any stdio MCP host

Add the wrapper to your host's MCP config (example: Claude Desktop claude_desktop_config.json). Keep the key secret — never commit it:

{
  "mcpServers": {
    "securestamp-guard": {
      "command": "npx",
      "args": ["-y", "@securestamp/mcp-guard"],
      "env": {
        "SECURESTAMP_API_KEY": "ss_live_...",
        "SECURESTAMP_API_BASE": "https://securestamp.online"
      }
    }
  }
}

Until the package is published to npm, point command/args at a local build instead: "command": "node", "args": ["<repo>/packages/mcp-guard/dist/server.js"] (run pnpm --filter @securestamp/mcp-guard build first).

Security model

• API key must include action:authorize.
• Raw message text and plaintext monetary instructions should not be sent to tools.
• Monetary instruction matching is fingerprinted by SecureStamp server-side.
• Tool schemas are closed and intentionally small.
• Every backing API call is tenant-scoped, rate-limited and audited by SecureStamp.

Remote MCP Guard

For always-on usage, configure compatible MCP hosts against:

https://mcp.securestamp.online/mcp

Use an MCP client created in the SecureStamp dashboard. Remote clients can restrict allowed tools, allowed client names, allowed origins and rate limits. The remote service accepts two auth modes: API key (ss_live_…) and delegated login sessions (ss_sess_…). Both staging (https://mcp-staging.securestamp.online/mcp) and production (https://mcp.securestamp.online/mcp) are live.

Distribution status

Package-ready, not yet published. bin → ./dist/server.js (built by tsc, shebang preserved); files ships only dist + README.md + package.json; publishConfig remaps exports/main/types to the built dist output at publish time (applied by pnpm publish — this is a pnpm workspace). Verified with pnpm pack (13.4 kB, 26 files, no source, no secrets). Licensed Apache-2.0 (LICENSE ships in the package). Publish with pnpm publish --filter @securestamp/mcp-guard when authorized. See docs/mcp-guard/MARKETPLACE-READINESS.md. Full distribution docs, connection examples and security model live under docs/mcp-guard/.