Web Resource Ledger MCP server

Web Resource Ledger (WRL)

Cryptographic evidence of web content -- capture what a page looked like, when, with proof anyone can verify.

Submit a URL, get back a screenshot, rendered HTML, HTTP headers, and an Ed25519-signed WACZ bundle. The verification URL works for anyone -- no account needed. Deploy on your own infrastructure; your captures, your keys, your evidence.

WRL was built almost entirely by an LLM (Claude) with a human directing the work. Every phase -- from MVP to production -- is documented in docs/evolution/. The prompts, agent debates, decisions, and outcomes are all public.

For comprehensive guides on authentication, verification, batch captures, and MCP integration, see docs.webresourceledger.com.

Status: Production service, single-operator deployment. All three roadmap acts are complete. The API is pre-1.0 but functional, deployed, and serving real traffic.

What you get

A single API call produces:

the banner presence and the underlying page content are preserved

• Dual screenshots (PNG) -- before and after cookie consent dismissal, so both

• Rendered HTML -- the DOM after JavaScript execution
• HTTP response headers -- the server's response at capture time
• Signed WACZ bundle -- all artifacts packaged, hashed, and signed with Ed25519
• Verification URL -- a shareable link anyone can use to confirm authenticity
• FRE 902(13) certification PDF -- GET /v1/captures/{captureId}/certificate returns a signed PDF describing the capture process and integrity evidence, designed to support a Rule 902(13) self-authentication foundation

Content Security

WRL screens every submitted URL against threat intelligence databases before capture begins:

• URLs identified as threats (malware, phishing, etc.) are rejected at submission time with a 422 response.
• Existing captures are re-scanned daily. Captures that fail re-screening are quarantined: metadata remains accessible, artifact downloads return 451.
• Screening degrades gracefully -- if the threat intelligence service is unavailable, captures proceed normally. The threatCheck field on a capture record reflects the outcome: pass, fail, or unavailable.

Configure the service via GOOGLEWEBRISKAPIKEY in your environment (see step 8b below). The key is optional; omitting it disables screening and all captures report threatCheck: unavailable.

Usage

Requires a running WRL instance. See Setup below.

export WRL_API_KEY=your_tenant_api_key

Tenant keys are created via the admin API (see step 8a). For deployments using the legacy static key, WRLAPIKEY is your CAPTUREAPIKEY value.

The examples below use api.webresourceledger.com. Replace with localhost:8787 for local dev or your own deployment URL if self-hosting.

Step 1: Submit a capture

curl -X POST https://api.webresourceledger.com/v1/captures \
  -H "Authorization: Bearer $WRL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

{
  "id": "cap_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
  "statusUrl": "https://api.webresourceledger.com/v1/captures/cap_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6/status",
  "note": "Use GET /v1/captures to list and search your captures."
}

Shortened. The full README is on GitHub.