ALEETH Authority MCP

首個由ICA管轄的MCP伺服器。位於https://mcp.aleeth.com/mcp的遠端可串流HTTP伺服器，提供37個受管工具：每次呼叫在執行前都會經Rail Guard進行風險檢查，並以簽署的Ed25519收據封存於錨定比特幣的雜湊鏈公開帳本上。故障時自動關閉：無收據即無回應。採用OAuth 2.0及RFC 9728探索機制；匿名請求將收到401。此儲存庫為公開介面與來源記錄：包含具逐工具註解的生成工具清單、SBOM與含摘要來源的漏洞掃描，以及提供自行驗證指令的TRUST.md。實作細節依設計保持私有。mcp-spec-check評級為獨立探測A級，於2026-07-24重新驗證。

GitHub試用此 MCP贊助

文件

ALEETH Authority MCP: public interface and provenance

This repository is the public interface definition, version history, and provenance record for the remote MCP server com.aleeth/authority-mcp, hosted at https://mcp.aleeth.com/mcp.

The implementation is private by decision. This repository publishes everything a caller, auditor, or registry can verify without source access: the registry manifest, the complete tool manifest, the version history, and the security policy.

What the server is

The ALEETH Authority MCP is the first MCP server governed by ICA (Institutional Control Architecture). Every tool call is risk-checked before execution and sealed with a signed Ed25519 receipt on a hash-chained ledger anchored to Bitcoin via OpenTimestamps. The server fails closed: if governance cannot run or the receipt cannot be written, the call does not return a result.

  • 51 governed tools: 41 base tools and the 10 Astra plane tools the deployed server declares (see tools/manifest.json)
  • Transport: MCP streamable HTTP, TLS only
  • Authentication: OAuth 2.0 bearer tokens; discovery per RFC 9728 at https://mcp.aleeth.com/.well-known/oauth-protected-resource
  • Anonymous calls are refused with 401

What is in this repository

FileWhat it isHow it is produced
server.jsonThe manifest published to the official MCP registryMaintained by ALEETH, versioned here
tools/manifest.jsonAll 51 tools: names, descriptions, input schemasGENERATED from the live server by an export script, run by the server's own live check against https://mcp.aleeth.com/mcp; never hand-edited, so it cannot drift from what the server actually serves
CHANGELOG.mdVersion historyCurated from the implementation repository's history
SECURITY.mdDisclosure contact and security postureMaintained by ALEETH

Verify the running server yourself

None of the following requires permission from ALEETH or access to the source.

  1. Protocol and auth conformance (black-box): npx mcp-spec-check https://mcp.aleeth.com/mcp --bearer <token> Read-only credentials are available on request: security@aleeth.com. Current independent grade: A (7 pass, 0 fail, 1 warn), last re-verified 2026-07-24.
  2. Anonymous access is refused: curl -s -o /dev/null -w "%{http_code}" -X POST https://mcp.aleeth.com/mcp returns 401, with authorization-server discovery served per RFC 9728.
  3. Receipts verify publicly: any receipt hash from a governed call verifies at https://imperium.aleeth.com/api/receipts/verify/<hash>, and offline against the pinnable trust anchor at https://imperium.aleeth.com/.well-known/ica-trust-anchor.json (public keys, SHA-256 DER fingerprints, and an offline verification recipe: you verify with a key you hold, with zero calls to ALEETH).
  4. Measured latency, floor included: see performance/ for a live end-to-end run against production and a local server-overhead run, each published with its full run conditions and the enforced decision-timing floor disclosed.
  5. The full proof surface: https://aleeth.com/proof

Why the source is private

Publication is not a precondition for verification. The checks that matter for a hosted remote server probe the running service: protocol conformance, authentication behavior, error contracts, and the receipt ledger. A static scan of this repository can verify the interface and the provenance; runtime governance claims are backed by the signed, Bitcoin-anchored receipt chain, which is public.

Background reading: "Stateless Is Not Governed", https://publications.aleeth.com/stateless-is-not-governed/

Contact

ALEETH is a brand of The Schreck Group, Inc. AI has met its match. Truth.™