George Lambert
369f9210bd
Public DEC-654 still requires a caller bearer; anonymous session now returns that guidance as a tool error instead of silent valid:false. Error text names JWT and API key, Grok bearer_token_file, and local stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key. Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.
61 lines
2.7 KiB
Go
61 lines
2.7 KiB
Go
package tools
|
|
|
|
import "github.com/modelcontextprotocol/go-sdk/mcp"
|
|
|
|
const instructions = "Digests-only timestamping. " +
|
|
"Public HTTP (mcp.verae.ai / mcp.veraetime.net): every write needs Authorization: Bearer " +
|
|
"<VeraeTime JWT or Verae API key> on each tools/call — no host-login fallback. " +
|
|
"Grok Build: set bearer_token_file to a file that holds only the raw token (e.g. ~/.verae/mcp-bearer from access_token), " +
|
|
"or run this binary with -transport stdio so the laptop ~/.verae/auth.properties host login is used. " +
|
|
"Do not paste tokens into chat. Stdio/trusted-local HTTP may use the host login when no caller bearer is sent."
|
|
|
|
// NewServer builds an MCP server with the full Verae timestamping tool set.
|
|
func NewServer(d *Deps) *mcp.Server {
|
|
s := mcp.NewServer(&mcp.Implementation{
|
|
Name: "verae-timestamping",
|
|
Version: "0.1.0",
|
|
}, &mcp.ServerOptions{
|
|
Instructions: instructions,
|
|
})
|
|
Register(s, d)
|
|
return s
|
|
}
|
|
|
|
// Register adds stamp, stamp_batch, verify, hash_report, signup, login, session, create_user.
|
|
func Register(s *mcp.Server, d *Deps) {
|
|
if d == nil {
|
|
d = &Deps{}
|
|
}
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "stamp",
|
|
Description: "Commit a SHA-256. scope=local is the leaf file ledger. scope=global posts the digest to api.veraetime.net and reuses the first CID unless restamp is true. Optional metadata is sent as a verae-meta-git/1 history; blank values do not delete fields.",
|
|
}, d.stamp)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "stamp_batch",
|
|
Description: "Commit up to 500 SHA-256 digests at once. scope=global (default) needs your Verae API key and charges each new digest to your account (your own repeats are free); returns one receipt entry per digest, in order, with the credits charged and your balance.",
|
|
}, d.stampBatch)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "verify",
|
|
Description: "Check a receipt. want_scope=global asks api.veraetime.net (central source of truth).",
|
|
}, d.verify)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "hash_report",
|
|
Description: "JSON-array history of receipts for one SHA-256 (Carfax).",
|
|
}, d.hashReport)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "signup",
|
|
Description: "Create a VeraeTime user account. Role is user. Does not replace the stored JWT.",
|
|
}, d.signup)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "login",
|
|
Description: "Log in to api.veraetime.net. Stores the JWT on this host and does not return it.",
|
|
}, d.login)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "session",
|
|
Description: "Validate the stored VeraeTime JWT. Returns valid, username, role, and expires_at.",
|
|
}, d.session)
|
|
mcp.AddTool(s, &mcp.Tool{
|
|
Name: "create_user",
|
|
Description: "Create a VeraeTime user. The stored JWT must belong to an admin.",
|
|
}, d.createUser)
|
|
}
|