@yebo/mcp-server

Add hardware-bound human authorization to any AI agent in one line.

The Yebo MCP Authorization Server connects Claude Desktop, Cursor, and any MCP-compatible AI tool to the Yebo authorization network. Every high-impact action your AI agent wants to take must be approved by you — biometrically, on your phone, from your Secure Enclave.

Quick Start

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "yebo": {
      "command": "npx",
      "args": ["-y", "@yebo/mcp-server"],
      "env": {
        "YEBO_API_KEY": "yk_live_your_key_here"
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "yebo": {
      "command": "npx",
      "args": ["-y", "@yebo/mcp-server"],
      "env": {
        "YEBO_API_KEY": "yk_live_your_key_here"
      }
    }
  }
}

Get your API key at yebo.dev/developer.

Tools

| Tool | What it does | |------|-------------| | yebo_preflight | Check if an action is allowed before executing. Returns ALLOW, DENY, or REQUIRE_APPROVAL. | | yebo_authorize | Submit an intent for biometric human approval. Returns a mandate_id and challenge_url. | | yebo_verify | Check if a mandate has been approved. Returns valid: true and a pai_token when the human approves. | | yebo_receipt | Fetch the Yebo Authorization Certificate (YAC) — ECDSA-signed proof of authorization. |

Authorization Flow

AI Agent calls yebo_preflight(capability, amount, counterparty)
  → ALLOW: proceed directly
  → REQUIRE_APPROVAL: call yebo_authorize(...)
      → Human receives push notification on Yebo mobile app
      → Human reviews action details and approves with Face ID / Touch ID
      → Biometric signature created in Secure Enclave (never leaves device)
  → Poll yebo_verify(mandate_id) until valid: true
  → Execute the action
  → Call yebo_receipt(mandate_id) for audit proof (YAC)

Environment Variables

| Variable | Required | Default | Description | |----------|----------|---------|-------------| | YEBO_API_KEY | Yes | — | Your Yebo API key | | YEBO_GATEWAY_URL | No | https://gateway.yebo.dev | Override the gateway URL |

Security

• Private keys never leave the device's Secure Enclave (iOS) or Android Keystore
• Every authorization is backed by a SHA-256 policy hash — policy changes invalidate old mandates
• 12 Sentinel invariants enforced on every execution — no bypass
• Full audit trail with hash-chained ledger entries

Links

• Yebo Developer Docs
• Yebo Authorization Certificate (YAC) Schema
• Yebo Trust Score
• Multi-Agent Compliance