How do I install the touchstone mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `TOUCHSTONE_RECORDER`, `TOUCHSTONE_SUBJECT`, `TOUCHSTONE_API_KEY`, `TOUCHSTONE_SIGNING_KEY`, `TOUCHSTONE_BASE_URL` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Touchstone MCP Server

Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.

Local serverstdio

What is the Touchstone MCP Server?

Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.

The short version

This server runs on your machine and holds your Ed25519 signing key. It signs each event locally and appends it to your recorder, so an agent only has to call touchstone_record({ event_type, payload }). The key never leaves this process. Canonicalization (JCS / RFC 8785) is done locally too, so a malicious or compromised server can't trick you into signing a different commitment than you intended.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
touchstone_record	JCS-canonicalizes payload, signs the commitment locally, appends the entry
touchstone_disclose	Create a shareable /d/<token> disclosure link (proxies to the service)
touchstone_verify	Verify a disclosure bundle (proxies to the service)
touchstone_recorder_info	Fetch your recorder's public info / checkpoint state

How to install the Touchstone MCP Server

{
  "mcpServers": {
    "touchstone": {
      "command": "npx",
      "args": ["-y", "@touchstone-cv/mcp"],
      "env": {
        "TOUCHSTONE_RECORDER": "your-value",
        "TOUCHSTONE_SUBJECT": "your-value",
        "TOUCHSTONE_API_KEY": "your-value",
        "TOUCHSTONE_SIGNING_KEY": "your-value",
        "TOUCHSTONE_BASE_URL": "your-value"
      }
    }
  }
}

Add to claude_desktop_config.json, then restart Claude Desktop.

Configuration

Variable	Description	Required
TOUCHSTONE_RECORDER	Configuration value read at startup.	Optional
TOUCHSTONE_SUBJECT	Configuration value read at startup.	Optional
TOUCHSTONE_API_KEY	Credential the server authenticates with.	Yes
TOUCHSTONE_SIGNING_KEY	Credential the server authenticates with.	Yes
TOUCHSTONE_BASE_URL	Endpoint or connection string the server talks to.	Yes

Example prompts to try

“Use Touchstone to touchstone record.”
“Use Touchstone to touchstone disclose.”
“Use Touchstone to touchstone verify.”

Frequently asked questions

Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.

Alternatives to the Touchstone MCP Server

NVD Database

Queries the NIST National Vulnerability Database (NVD) via its API.

DatabasesPython★ 14

Cursor Trivy

Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.

Security & IdentityPython★ 10

Autonomous Cyber Red Team

View on ApifyForge | Use on Apify Store

Security & IdentityRemote

Opzyai Vibe Check

Free no-account URL security scan: 0-100 Launch Readiness score for any live site in ~15 seconds.