satledger

npx add-mcp 'https://api.satledger.org/mcp'

The whole ledger. No account to start.

satledger's MCP server exposes fourteen tools. timestamp_receipt needs nothing from you but a SHA-256 digest: send it, receive a Time-Stamp Authority's signed RFC 3161 token over it — evidence that the data you hashed existed at that time, verifiable without trusting or contacting us. provision_workspace and top_up_workspace buy, and refill, a tamper-evident ledger for your agents over the same payment. The other eleven are the ledger: create agents, record what they did, anchor it, export and verify it — under the key the purchase returns, metered in the units it bought.

$ npx add-mcp 'https://api.satledger.org/mcp'

TOOLS: 14 AUTH: none to buy · your key to operate RECEIPT: first 3 a day free · then 0.05 USDC · 0.50 for up to 10 WORKSPACE: 0.50 or 15 USDC TRANSPORT: streamable http

The receipt

You hash your data yourself. Only the digest is sent — the data never leaves your side — and nothing about the request is kept here afterwards. The token that comes back is the whole deliverable. There is no account to create and no key to hold.

The workspace

provision_workspace buys a ledger: every event your agents record is ed25519-signed and hash-chained, and the export is something your own customers verify offline. The call takes no arguments — the payment names the tier, 0.50 USDC for 2,500 units or 15 USDC for 100,000, and every workspace carries 10,000 free units besides. It returns an API key exactly once, with the next calls to make. top_up_workspace adds units to a workspace you already hold: send its key in _meta["satledger/api-key"] beside the payment, and nothing new is created.

The ledger operations

Every operation the HTTP API offers is a tool here, with the same unit costs: create_agent (1 unit), record_action (1), fund_agent (1), record_usage (1), anchor_agent (100 — a public Time-Stamp Authority signs your state), and free reads: export_agent, list_agents, describe_agent, list_actions, list_anchors, workspace_balance. Authenticate with the workspace key in _meta["satledger/api-key"], or as an api_key argument if your client cannot set _meta (prefer _meta: arguments are logged). Running out of units answers with the exact top-up call, not a bare refusal.

What you pay, and when

initialize and tools/list are free, so any agent can discover the tools and read their schemas without paying. Only tools/call costs anything, over x402, carried in _meta["x402/payment"]. An unpaid call answers with a PaymentRequired quote, including the top-up — the price is readable by anyone; the key is only needed to settle.

Calling it directly

The endpoint is ordinary JSON-RPC over HTTP, so nothing about MCP is required to use it:

$ curl -s https://api.satledger.org/mcp \ -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' {"result":{"tools":[{"name":"timestamp_receipt",...}, {"name":"provision_workspace",...}, {"name":"top_up_workspace",...}]}}

An unpaid tools/call answers with an x402 PaymentRequired challenge naming what it will accept, in both structuredContent and content[0].text.

Verifying what you get back

Check the token against the Time-Stamp Authority, not against us:

$ openssl ts -reply -in token.tsr -text

We cannot backdate one. Issuing a token for a time in the past would need the authority's private key, which we do not have.

What it proves, and what it does not

It proves the data you hashed existed by that time. It says nothing about what was hashed — a digest is not the document. And it bounds the time from above only: anyone can stamp an old file today, so a token is evidence of existence by a moment, never of creation at it.

Try it before paying

Your first three receipts each day are free, no payment and no wallet needed. They are the real thing — the same signed token, the same offline verification — so you can see it work before you pay for the fourth. After that, 0.05 USDC per receipt over x402.

Several digests at once

Send up to ten in a single call and a single payment, at the same price each. They are bound to one timestamp by a Merkle root, and every receipt still verifies on its own.

What is still HTTP

One thing. The only thing still fetched over HTTP is the export archive: export_agent builds the bundle, runs the customer-side verifier over it and returns the summary, and the archive's bytes come from the URL it hands back, with your key in X-API-Key, free. Everything else — buying, refilling, recording, anchoring, reading — is a tool call. The same operations exist as an HTTP API at api.satledger.org for anything that is not an MCP client; both run on one meter.