@treeship/mcp

Drop-in Treeship attestation for MCP tool calls. One import change, every tool call gets a signed receipt and appears in the session receipt timeline.

Install

npm install @treeship/mcp

Requires the treeship CLI binary in PATH. Pick whichever install path you trust:

# One-liner (installs CLI, runs init, asks before instrumenting detected
# agents; no tty: skipped unless TREESHIP_SETUP_YES=1):
curl -fsSL https://www.treeship.dev/setup | sh

# Or read it first, then install via npm (no shell pipe):
curl -fsSL https://www.treeship.dev/setup.sh   # inspect
npm install -g treeship && treeship init       # install

Inspect before you trust

Source for this bridge: https://github.com/zerkerlabs/treeship/tree/main/bridges/mcp

Every receipt this bridge produces can be verified locally, without trusting our hub:

npm install -g treeship
treeship package verify <path-to-receipt.treeship>

package verify is the native CLI verifier -- it does not phone home and does not require the hub. (A separate WASM build, @treeship/core-wasm / @treeship/verify, does the same signature and Merkle checks in a browser; that's what runs the receipt page, not this command.) So once you have a receipt (your own or someone else's), you can confirm exactly what was captured, by whom, and that the signatures hold, entirely offline.

Two ways to use it

As an MCP server (new in 0.10.1) — add it to your agent's MCP config:

{
  "mcpServers": {
    "treeship": {
      "command": "npx",
      "args": ["-y", "@treeship/mcp"],
      "env": { "TREESHIP_ACTOR": "agent://your-agent" }
    }
  }
}

The server exposes 9 tools your agent can call: treeship_session_status, treeship_session_event, treeship_attest_action, treeship_verify, treeship_session_report, treeship_mint_challenge, treeship_present, treeship_verify_presentation, treeship_attest_handoff. Use these to read or write the active Treeship session, or to run the A2A liveness handshake, from any MCP-compatible client.

As a library — wrap your existing MCP client. Every callTool() gets signed automatically.

Library usage

Change one import. Everything else stays the same.

// Before (no attestation):
import { Client } from '@modelcontextprotocol/sdk'

// After (every tool call attested):
import { Client } from '@treeship/mcp'

const client = new Client({ name: 'my-agent', version: '1.0' }, {})
await client.connect(transport)

const result = await client.callTool({
  name: 'brave_search',
  arguments: { query: 'AI safety 2026' }
})

// Treeship metadata attached to result
console.log(result._treeship)
// { intent: 'art_aaa', tool: 'brave_search', actor: 'agent://mcp-my-agent' }

What happens automatically

Every callTool() does three things:

1. Intent (awaited before the call) -- signed artifact proving what was about to happen [AUTO]
2. Receipt (fire-and-forget after the call) -- signed artifact proving what happened [AUTO]
3. Session event -- agent.called_tool event emitted to the active session's event log so the tool call appears in the receipt timeline, agent graph, and side effects [AUTO]

All three are automatic. The signed artifacts are Merkle-proven. The session event makes them human-readable in the receipt.

What is captured

| Field | Source | Status | |-------|--------|--------| | MCP tool name | params.name | AUTO -- always captured | | Input content | SHA-256 digest only | AUTO -- never raw content | | Output content | SHA-256 digest only | AUTO -- never raw content | | Duration | Date.now() delta | AUTO | | Exit code | isError flag | AUTO | | Error message | error.message | AUTO -- only on failure | | Actor URI | TREESHIP_ACTOR env or default; start the session as the same actor so the bridge's receipts chain onto it | AUTO | | Model | Not captured by MCP bridge | NOT YET CAPTURED -- set TREESHIP_MODEL env var with treeship wrap | | Token counts | Not captured by MCP bridge | NOT YET CAPTURED -- set TREESHIP_TOKENS_IN/OUT env vars | | Provider | Not captured by MCP bridge | NOT YET CAPTURED -- set TREESHIP_PROVIDER env var |

Integration status

| Runtime | Status | Notes | |---------|--------|-------| | Generic MCP server | Tested (unit tests) | 3 tests covering Client export and subclass | | Claude Code MCP | Shipped | Used by the official plugin and treeship add; stdio MCP — same code path as generic client | | Cursor MCP | Documented + same client | treeship add cursor writes ~/.cursor/mcp.json; see integrations/cursor/ — run a quick E2E when upgrading the bridge | | Hermes | Not yet tested | Hermes transport compatibility to be confirmed |

Kill switch

treeship halt <actor> (or *) stops the bridge: every callTool asks treeship halt list first and, under a standing halt this ship signed, refuses before the server sees the call, signs the refusal as blocked.v1 on the session, and throws TreeshipHaltedError (with halt, blocked, and the lift command in the message). A check that cannot run fails open, said once on stderr; TREESHIP_STRICT=1 makes it refuse. treeship halt --lift <actor> ends it.

Environment variables

| Variable | Effect | |----------|--------| | TREESHIP_DISABLE=1 | Full passthrough, zero attestation | | TREESHIP_ACTOR | Override default actor URI. Artifacts chain onto the open session whoever the actor is; the actor is signed into each one. Start the session as the same identity so the session and the artifacts name one actor | | TREESHIP_APPROVAL_NONCE | Bind all calls to an approval | | TREESHIP_STRICT=1 | A signing failure fails the tool call; a halt check that cannot run refuses it | | TREESHIP_MODEL | Model name for cost tracking (via treeship wrap) | | TREESHIP_TOKENS_IN | Input token count (via treeship wrap) | | TREESHIP_TOKENS_OUT | Output token count (via treeship wrap) | | TREESHIP_PROVIDER | Provider name e.g. "anthropic" (via treeship wrap) |

Runtime compatibility

Attestation paths (tool-call intent + receipt, session events) still shell out to the treeship CLI for filesystem access to the keystore and session log. Those paths need Node with the binary on PATH.

Verification helpers (verifyReceipt, verifyCertificate, crossVerify) are WASM-backed since v0.9.1 and run anywhere WebAssembly + fetch are available:

| Runtime | Verification | Attest paths | |---------|-------------|--------------| | Node.js 18+ | yes | yes | | Deno | yes | no | | Browser | yes | no | | Vercel Edge | yes | no | | Cloudflare Workers | yes | no | | AWS Lambda (Node) | yes | no |

For read-only consumers (dashboards, third-party MCP audit tools) that only need verification, depend on @treeship/verify instead — zero MCP dependency, zero subprocess, pure WASM.

Design rules

• A signing/attestation error fails open by default: the tool call still completes. TREESHIP_STRICT=1 fails closed instead. A standing halt (treeship halt <actor>) always refuses the call, regardless of TREESHIP_STRICT
• Only hashes are stored, never raw content
• Intent attestation is awaited (proof of what was about to happen)
• Receipt attestation is fire-and-forget (never blocks response)
• Session events are best-effort (no active session = silent no-op)
• TREESHIP_DISABLE=1 produces zero overhead
• Verification helpers are graceful -- a runtime without WASM support will surface a clear error rather than crashing the MCP client

License

Apache-2.0