VaultGraph MCP Server

The official MCP server for VaultGraph — the trust and verification platform for AI agents.

Use this package to let any MCP-compatible client submit signed JobReceipts to VaultGraph without embedding the full SDK into the host application.

Install

Run it on demand with npx:

npx @vaultgraph/mcp-server --api-key $VAULTGRAPH_API_KEY --deployment-id $VAULTGRAPH_DEPLOYMENT_ID --private-key $VAULTGRAPH_PRIVATE_KEY

Or install it globally:

npm install -g @vaultgraph/mcp-server

Prerequisites

1. Sign up at app.vaultgraph.com and create your organization
2. Follow Setup to create your vendor API key
3. Create at least one agent and one deployment in VaultGraph
4. Register the deployment public key as an active signing key on that deployment

Claude Desktop configuration

Add this server to your claude_desktop_config.json:

{
  "mcpServers": {
    "vaultgraph": {
      "command": "npx",
      "args": ["@vaultgraph/mcp-server"],
      "env": {
        "VAULTGRAPH_API_KEY": "vk_your_api_key_here",
        "VAULTGRAPH_DEPLOYMENT_ID": "dep_yourdeployid",
        "VAULTGRAPH_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
      }
    }
  }
}

CLI options

| Option | Env Variable | Required | Description | | ----------------- | -------------------------- | -------- | ----------------------------------------------------------- | | --api-key | VAULTGRAPH_API_KEY | Yes | Vendor API key | | --deployment-id | VAULTGRAPH_DEPLOYMENT_ID | Yes | Deployment short ID (dep_...) used for receipt submission | | --private-key | VAULTGRAPH_PRIVATE_KEY | Yes | PEM-encoded Ed25519 private key for signing JobReceipts | | --api-url | VAULTGRAPH_API_URL | No | API base URL. Defaults to https://app.vaultgraph.com |

Available tools

submit_receipt

Submit a signed JobReceipt to VaultGraph for trust score tracking.

| Parameter | Type | Required | Description | | ------------ | ------ | -------- | ----------------------------------------------------------------------------- | | job_id | string | Yes | Unique job or interaction identifier | | resolution | string | Yes | One of success, partial, or failed | | context | any | No | Interaction context payload. Strings and objects are hashed before submission | | metadata | object | No | Additional receipt metadata stored with the signed payload | | telemetry | object | No | Structured runtime telemetry included in the signed receipt payload |

Example MCP tool call:

{
  "job_id": "job-42",
  "resolution": "success",
  "context": {
    "summary": "Handled customer refund request",
    "messages": [
      { "role": "user", "text": "I need a refund" },
      { "role": "assistant", "text": "Refund approved" }
    ]
  },
  "metadata": {
    "channel": "email",
    "attempt": 2,
    "workflow": "refund"
  },
  "telemetry": {
    "source": "manual",
    "run_kind": "support_reply",
    "external_run_id": "req_123",
    "flags": {
      "has_inputs": true,
      "has_output": false,
      "has_error": true,
      "has_action": true
    },
    "error": {
      "name": "TimeoutError"
    },
    "events": [
      {
        "kind": "run_started",
        "started_at": "2026-05-03T10:00:00.000Z"
      },
      {
        "kind": "tool_failed",
        "completed_at": "2026-05-03T10:00:02.000Z",
        "tool_name": "crm_lookup",
        "error": { "name": "TimeoutError" }
      },
      {
        "kind": "run_failed",
        "completed_at": "2026-05-03T10:00:02.500Z",
        "error": { "name": "TimeoutError" }
      }
    ]
  }
}

For the field-by-field schema and the portal run-detail behavior, see Receipt Telemetry.

Signing keys

VaultGraph expects receipts to be signed by a key whose public key is registered as an active signing key on the deployment you submit against. You must provide the matching Ed25519 private key to the MCP server with VAULTGRAPH_PRIVATE_KEY or --private-key.

Generate one locally with Node.js:

node -e "
const { generateKeyPairSync } = require('crypto');
const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
  privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
  publicKeyEncoding: { format: 'pem', type: 'spki' },
});
console.log(privateKey, publicKey);
"

Then register the matching public key on the deployment in the portal UI, and set the private key with VAULTGRAPH_PRIVATE_KEY or pass it via --private-key.

Links

• Platform: app.vaultgraph.com
• Website: vaultgraph.com
• npm: @vaultgraph/mcp-server