3ec1f0516b
feat(mcp): optional receipt_format on stamp/verify (text/PDF/JSON/MD/CSV/TSV)
...
test-and-deploy / test (push) Failing after 12m55s
test-and-deploy / deploy-138 (push) Has been cancelled
Add receipt_format to stamp and verify. Omitted → text; receipt|PDF-Receipt → PDF;
JSON-Receipt → JSON; MD|MD-Receipt; CSV|CSV-Receipt; TSV|TSV-Receipt.
Stamp always returns receipts[] and adds artifacts[] in the chosen format.
Stdio writes ~/.verae/receipts (0600); public MCP returns content_text/content_base64 only.
Verify accepts inline receipt or receipt_path (stdio), parses id, and re-emits an artifact.
Vendors pdfcert (+ slim statuslang, gofpdf) for CERT-01 PDF. Also lands welcome tool
and email-username helpers already wired into register/public paths.
2026-10-20 16:02:20 -04:00
13d1c5851b
fix(mcp): require xVerae- commercial key when EDGE_URL set; batch via edge
2026-10-17 00:26:50 -04:00
d49c51c349
feat: single-billing edge path for MCP + open public signup
...
test-and-deploy / test (push) Successful in 14s
test-and-deploy / deploy-138 (push) Failing after 15m9s
- Public signup no longer requires a caller bearer (POST /auth/signup)
- create_user remains admin-only (POST /auth/users)
- Optional VERAE_MCP_EDGE_URL bills global stamps via zap.verae.ai
- Clearer public auth errors and instructions for Grok/clients
2026-10-12 14:59:31 -04:00
369f9210bd
fix(auth): clear public write errors and Grok client path
...
test-and-deploy / test (push) Failing after 12m11s
test-and-deploy / deploy-138 (push) Has been cancelled
Public DEC-654 still requires a caller bearer; anonymous session now
returns that guidance as a tool error instead of silent valid:false.
Error text names JWT and API key, Grok bearer_token_file, and local
stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key.
Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.
2026-10-12 14:09:22 -04:00
Cursor Agent
deb0e251de
Send global stamps as a verae-meta-git/1 history.
...
Optional metadata or restamp builds the same commit history as node-red. A call that omits both stays digest-only with restamp false. Local and shared stamps reject metadata.
2026-10-11 05:37:24 +00:00
Grok Bot
ec899f5e11
Public server: anonymous verify/hash_report never rate limited (DEC-660); stamp_batch tool charged per item with the caller's key (DEC-659); 402 balance message passed through (DEC-658)
2026-10-10 15:26:37 -04:00
George Lambert
10c8634a53
D write-only lockdown (DEC-654): public HTTP server needs the caller's own Verae key/OAuth bearer for stamp (any scope), signup, create_user, session; login refused; no host-login fallback for writes; anonymous verify/hash_report kept, rate limited 30/min per client (burst 15), 600/min overall
2026-10-10 13:06:57 -04:00
d379931bd1
feat: MCP Streamable HTTP server with full tool set
...
Wire go-sdk Streamable HTTP at /mcp with stamp, verify, hash_report,
signup, login, session, create_user. Route global/CID to VeraeTime and
local|shared to FileLedger; resolve Authorization bearer via authctx.
Flags/env for transport, host, port, require-bearer, URLs, ledger path.
2026-09-29 12:07:44 -04:00
