countwerk-mcp

MCP server for countwerk: a number on the internet. Your agents bump it for 3 millionths of a dollar; only you can turn it back. The op token lives in server config; the model calls tools and never sees a credential. Custody IS the guarantee.

Run

COUNTWERK_NS=my-agent COUNTWERK_TOKEN=cw_o_... npx countwerk-mcp

Claude Code:

claude mcp add countwerk -e COUNTWERK_NS=my-agent -e COUNTWERK_TOKEN=cw_o_... -- npx countwerk-mcp

Config (env): COUNTWERK_NS and COUNTWERK_TOKEN required; COUNTWERK_URL optional (default https://countwerk.ai); COUNTWERK_ADMIN_TOKEN unlocks the admin tools and is deliberately absent from every example here.

No namespace yet? Funding is signup: POST /v1/<ns>/fund returns a 402 with x402 payment instructions; the first settled payment mints your tokens. See countwerk.ai/llms.txt.

Tools

Default profile (op token), task-shaped:

| tool | does | |---|---| | count | increment a counter, get the new value | | count_many | up to 1000 increments, one durable commit | | read | counters + dcount estimates, one call | | dcount_add | add items to a distinct count | | dcount_merge | merge shard dcounts into a total | | check_guard | increment and compare against a cap: {value, remaining, exceeded} | | balance | prepaid balance |

check_guard is a budget signal the model consults, not an enforcer: the model supplies the cap and could ignore the answer. Enforcement lives with whoever holds the tokens; the counter stays truthful for the operator either way. Counters are increment-only, so no tool here can move one down.

With COUNTWERK_ADMIN_TOKEN set, the lifecycle verbs appear: snapshot_create/list/delete, restore, restore_key, reset, archive, hydrate, delete. Do not give an autonomous agent the admin profile; it exists for operator-driven sessions.

Mechanics you get for free: retryable: true errors are retried once (safe: a failed call did not apply), permanent faults are surfaced with a do-not-retry note, and a transport failure is surfaced as "outcome unknown: read before re-sending" instead of blind-resent. The API is at-least-once and does not deduplicate retries; server-side limit/ttl_seconds caps (set once on a counter's first write) hold regardless. No wallet, no auto-funding: 402s surface to the operator by design.

Develop

npm i && npm test

The skill variant (agent holds the token, plain curl) lives at countwerk/skill.