Skip to main content
The official MCP server for VaultGraph — the trust and verification platform for AI agents. Use this package to let any MCP-compatible client submit signed JobReceipts to VaultGraph without embedding the full SDK into the host application.

​
Install

Run it on demand with npx: 
npx @vaultgraph/mcp-server --api-key $VAULTGRAPH_API_KEY --deployment-id $VAULTGRAPH_DEPLOYMENT_ID --private-key $VAULTGRAPH_PRIVATE_KEY
Or install it globally: 
npm install -g @vaultgraph/mcp-server

​
Prerequisites

  1. Sign up at app.vaultgraph.com and create your organization
  2. Follow Setup to create your vendor API key
  3. Create at least one agent and one deployment in VaultGraph
  4. Register the deployment public key as an active signing key on that deployment

​
Claude Desktop configuration

Add this server to your claude_desktop_config.json: 
{
  "mcpServers": {
    "vaultgraph": {
      "command": "npx",
      "args": ["@vaultgraph/mcp-server"],
      "env": {
        "VAULTGRAPH_API_KEY": "vk_your_api_key_here",
        "VAULTGRAPH_DEPLOYMENT_ID": "dep_yourdeployid",
        "VAULTGRAPH_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
      }
    }
  }
}

​
CLI options

OptionEnv VariableRequiredDescription
--api-keyVAULTGRAPH_API_KEYYesVendor API key
--deployment-idVAULTGRAPH_DEPLOYMENT_IDYesDeployment short ID (dep_...) used for receipt submission
--private-keyVAULTGRAPH_PRIVATE_KEYYesPEM-encoded Ed25519 private key for signing JobReceipts
--api-urlVAULTGRAPH_API_URLNoAPI base URL. Defaults to https://app.vaultgraph.com

​
Available tools

​
submit_receipt

Submit a signed JobReceipt to VaultGraph for trust score tracking.
ParameterTypeRequiredDescription
job_idstringYesUnique job or interaction identifier
resolutionstringYesOne of success, partial, or failed
contextanyNoInteraction context payload. Strings and objects are hashed before submission
metadataobjectNoAdditional receipt metadata stored with the signed payload
Example MCP tool call: 
{
  "job_id": "job-42",
  "resolution": "success",
  "context": {
    "summary": "Handled customer refund request",
    "messages": [
      { "role": "user", "text": "I need a refund" },
      { "role": "assistant", "text": "Refund approved" }
    ]
  },
  "metadata": {
    "channel": "email",
    "attempt": 2,
    "workflow": "refund"
  }
}

​
Signing keys

VaultGraph expects receipts to be signed by a key whose public key is registered as an active signing key on the deployment you submit against. You must provide the matching Ed25519 private key to the MCP server with VAULTGRAPH_PRIVATE_KEY or --private-key. Generate one locally with Node.js: 
node -e "
const { generateKeyPairSync } = require('crypto');
const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
  privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
  publicKeyEncoding: { format: 'pem', type: 'spki' },
});
console.log(privateKey, publicKey);
"
Then register the matching public key on the deployment in the portal UI, and set the private key with VAULTGRAPH_PRIVATE_KEY or pass it via --private-key.