Achromat MOM MCP server

Achromat MCP server

An MCP server that lets any MCP host (Claude Desktop, an IDE, an agent framework) use Achromat MOM as native tools. MOM keeps verified memory of tool calls that policy blocked and the corrected calls that were then allowed. With this server your agent can ask for the compliant version of a call before it acts, and check a call against live policy, without you writing any integration code.

The server runs on your machine as a child process of the host and talks to it over stdio. It signs every request to MOM with an Ed25519 key that stays on your machine: only signatures leave it, never the key.

Add it to Claude Desktop

Open the configuration file:

Add the server under mcpServers, then restart Claude Desktop:

{
  "mcpServers": {
    "achromat": {
      "command": "npx",
      "args": ["-y", "@achromat-ai/mcp-server"]
    }
  }
}

That is the whole setup. Requires Node.js 20 or newer; -y lets npx install the package without asking. Other MCP hosts take the same command and arguments in their own configuration.

First use: your agent sets up the identity

Every request to MOM is signed, so the server needs a key that MOM knows. You do not create or register one yourself. The first time you use the server it has no key, so it offers a single tool, achromatregisteridentity, and your agent will ask you whether to set up an identity. If you say yes, the server:

1. generates an Ed25519 key pair on your machine,
2. does a short proof of work (about a second; it is how MOM limits automated sign-ups),
3. registers the public key with MOM, and
4. saves the private key to ~/.achromat/achromatagentkey.pem, readable only by you.

Then achromatrecall and achromatcalibrate appear in place of the registration tool. If your host does not refresh its tool list by itself, restart it once.

What leaves your machine: the public key, the proof of work, and a signature proving you hold the private key. The private key never does. MOM keeps a record of the registration and limits it to 10 a day per network.

The key file is the identity. Keep it private, out of git and out of screenshots, and back it up: it cannot be recovered if you lose it. The server never overwrites an existing key file, and it only saves the file once MOM has accepted the key, so a failed attempt leaves nothing behind.

Choosing where the key lives

By default the key is at ~/.achromat/achromatagentkey.pem. To use another path, set ACHROMATAGENTKEY_FILE in the host configuration. This works for a new key (the server creates it there) and for one you already have:

{
  "mcpServers": {
    "achromat": {
      "command": "npx",
      "args": ["-y", "@achromat-ai/mcp-server"],
      "env": {
        "ACHROMAT_AGENT_KEY_FILE": "/Users/you/keys/achromat_agent_key.pem"
      }
    }
  }
}

On Windows use the full path with escaped backslashes, for example "C:\\Users\\you\\keys\\achromatagentkey.pem". A leading ~ is expanded by the server. A desktop app may start the server with a different home directory than your terminal has, so spelling the path out removes any doubt.

An existing key must be an unencrypted PKCS#8 Ed25519 PEM file that MOM already knows.

Run from source

git clone https://github.com/achromat-ai/achromat-mcp-server.git
cd achromat-mcp-server
npm install
npm run build

Point the host at the build instead of npx:

{
  "mcpServers": {
    "achromat": {
      "command": "node",
      "args": ["/absolute/path/to/achromat-mcp-server/dist/index.js"]
    }
  }
}

To try the tools in a browser without a host, use the MCP Inspector:

npm run inspect

Tools

achromatregisteridentity

Shortened. The full README is on GitHub.