MCP.Market

OpenWorkProof MCP server

by dengyier·io.github.dengyier/OpenWorkProof·v1.5.0·262 stars
No reviews yet

Verifiable agent work contracts; separate opt-in Codex preview-directory guard.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Established

262 stars367 downloads/wk

Reviews

Write one

Nobody has reviewed OpenWorkProof yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

OpenWorkProof tools (29, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • owp_analyze_repo

    Analyse a repository's structure: file count, languages, dependencies.

  • owp_build_delivery_package

    Export a public, diagnostic, or customer-private delivery package.

  • owp_compute_digest

    Compute the canonical SHA-256 digest of an OpenWorkProof payload.

  • owp_compute_key_id

    Compute the OpenWorkProof ``key_id`` for a given Ed25519 public key.

  • owp_control_observation_validate

    Assess one v0.5 control observation set against its contracts.

  • owp_explain_binding_decision

    Verify and explain one BindingDecision (read-only).

  • owp_generate_keypair

    Generate an Ed25519 signing key pair; this tool takes no input parameters.

  • owp_get_binding_status

    Read the current binding decision head from a ledger (read-only).

  • owp_get_decision

    Prepare, but do not sign or commit, a versioned decision draft.

  • owp_get_schema

    Get the authoritative JSON Schema for an OpenWorkProof object type.

  • owp_get_schema_digest

    Get the frozen SHA-256 digest of an authoritative JSON Schema.

  • owp_get_settlement_readiness

    Derive readiness only; this does not prove payment or settlement.

  • owp_integrity_observation_validate

    Assess one v0.5 population observation set against its contracts.

  • owp_list_domains

    List canonical OpenWorkProof domains; this tool takes no input parameters.

  • owp_render_surface_report

    Return the verified derived report, never payment or acceptance.

  • owp_repo_read

    Forward a repo-read execution to the ledger coordinator.

  • owp_run_testswrite action

    Run tests, write an execution receipt to the ledger, and save test evidence files.

  • owp_run_verificationwrite action

    Write verification results or signed decisions to the ledger, or prepare a draft.

  • owp_scope_compare

    Compare a signed v0.3 scope with one verifier observation.

  • owp_scope_validate

    Intrinsically validate a v0.3 scope without checking authority.

  • owp_sign_payload

    Sign a canonical OpenWorkProof payload with an Ed25519 private key.

  • owp_status

    Replay an OpenWorkProof ledger and return its authoritative state.

  • owp_validate_action_binding_manifest

    Validate one signed ActionBindingManifest (read-only, no authority).

  • owp_validate_judgment_commitment

    Validate one signed JudgmentCommitment (read-only, no authority).

  • owp_validate_profile

    Validate a signed Evidence Lifecycle v0.2, v0.3, or v0.5 profile.

  • owp_verify_nested_claim

    Verify a nested claim (AgentRequest or HumanDecision) against a WorkOrder.

  • owp_verify_signature

    Verify an Ed25519 signature on a signed OpenWorkProof payload.

  • owp_verify_surface_bundle

    Verify and replay one surface bundle without writing or signing.

  • owp_verify_work_orderwrite action

    Verify a WorkOrder's identity bindings and maintainer signature.

Public scan report

scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it

no findings
  • Code scan108 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How OpenWorkProof compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 90% of 4,464 AI and agents servers
Tools
29
the typical AI and agents server has 6
Tools that change things
10%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
262
more than 95% of 2,697 AI and agents servers
Downloads a week
367
more than 83% of 1,515 AI and agents servers with a package

What its tools let an agent do: 26 read · 3 change

Release history: 4 versions in the registry since 2026-08-30, latest 2026-10-27, typically one every 2 days.

Install OpenWorkProof in Claude Code, Cursor or VS Code

claude mcp add OpenWorkProof -- uvx openworkproof
Add to Cursor

What the publisher says

From the OpenWorkProof repository's README, as published. We do not edit it. Read it on GitHub

OpenWorkProof

<!-- mcp-name: io.github.dengyier/OpenWorkProof -->

中文 | English

让智能依人的目的而行动，让每一次行动经得起人的判断。

OpenWorkProof 是 AI Agent 工作契约与可验证执行协议。

它记录谁授权了任务、Agent 实际执行了什么、是否超出约定范围、验证者得出了什么结论， 以及验收者最终接受还是拒绝。每次工作都可以导出为一套签名证据包。第三方不需要接入 原系统，只凭证据包和公钥，就能独立验证整条工作链。

OpenWorkProof 不保证 Agent 的结果一定正确，也不替客户作出验收决定。它确保授权有来源、 执行有证据、验证与验收不会被混为一谈，并把接受、拒绝、撤销和申诉的权利留给人。

安装 · 工作原理 · Human Agency · DeepSeek Harness · 协议文档 · English

Core 公开版本: 1.4.0
DeepSeek Harness 插件候选: 0.1.0, 尚未发布 npm
core focused: 97 passed / 0 failed / 0 skipped
plugin: 80 passed / 0 failed / 0 skipped
candidate: 186 passed / 0 failed / 0 skipped
required-live: 4373 passed / 0 failed / 0 skipped
许可证: Apache-2.0

公开发布状态请直接回读 PyPI、 GitHub Release 与 MCP Registry。 Core 1.4.0 已发布到 PyPI、GitHub Release 与 MCP Registry；DeepSeek Harness 插件 0.1.0 仍是本地候选，尚未发布 npm 或插件市场。两者是独立的发布事实。

Agent 说 完成了，还缺什么

MCP 连接 Agent 与工具，A2A 连接 Agent 与 Agent。它们解决如何连接和通信，不能单独 证明一次工作是否获得授权、是否按约执行，以及最终由谁验收。

设想一家 AI 服务商让 Agent 修改客户的代码仓库。Agent 提交了补丁，也说测试已经通过。 客户仍然需要回答：

  1. 谁授权 Agent 修改这个仓库？
  2. 它是否只使用了允许的工具、路径、配额和期限？
  3. 补丁、测试和报告是否来自同一次执行？
  4. 验证通过是否被错误地写成客户已经接受？
  5. 发生争议时，第三方能否在不接入双方系统的情况下复核事实？

日志能告诉人系统输出了什么，却很难独立证明授权、因果关系和最终验收。平台也不能只用 自己的数据库证明自己可信。

OpenWorkProof 把一次 Agent 工作变成一条可以带走、保存和复核的证据链：

客户冻结任务与验收条件
        ↓
有权主体签署授权
        ↓
Agent 执行，每个重要动作留下签名凭证
        ↓
Verifier 独立验证证据与因果链
        ↓
Acceptor 独立接受或拒绝
        ↓
第三方离线复核完整结果

OpenWorkProof 不让 Agent 变得更聪明。它让 Agent 的工作更值得委托。

OpenWorkProof 是什么

OpenWorkProof 是可以嵌入现有 Agent、CI、MCP 和多 Agent 编排器的开放协议层。 它把六类事实连接起来：

最终交付的不是一份只能在原平台查看的日志，而是一套可离线验证的签名证据包。持有证据包 和公钥的第三方，可以独立复核授权来源、执行范围、证据摘要、验证结论和验收结果。

它不是什么

OpenWorkProof 不是 Agent OS，也不是新的模型或编排框架。它不负责替 Agent 规划任务， 也不声称能够判断所有业务结果是否正确。

Human Agency Profile 是授权边界，不是员工评分、绩效监控、法律责任转移、自动担责、资金托管或合规认证。

OpenWorkProof 也不托管资金，不执行付款，不代替法律仲裁。协议状态可以证明证据达到某个 阶段，但不能制造外部商业事实。

工作原理

一条完整工作链由以下对象组成：

WorkOrder -> CapabilityGrant -> PolicyDecision -> ActionReceipt
          -> VerificationDecision -> AcceptanceDecision

协议使用 Ed25519 签名、规范化 JSON、追加式账本和内容摘要。修改 WorkOrder、授权、 receipt、证据、公钥或因果父集，离线回放都会失败并关闭流程。

详细 Schema 位于 specs，当前实现与历史快照位于 docs/status.md。

六个角色，各自保留边界

角色分离的目的不是增加组织层级，而是防止同一个 Agent 同时充当执行者、验证者和最终 验收者。系统可以自动化流程，但不能让权力边界在自动化中消失。

Human Agency：能力越强，人的决定权越不能消失

CapabilityGrant 表示系统允许 Agent 使用哪些能力。Human Agency Profile 表示人愿意 让 Agent 自主使用这些能力中的哪一部分。真正有效的权限取以下三者的交集：

WorkOrder 允许的范围
∩ CapabilityGrant 授予的能力
∩ active HumanAgencyProfile 中人的选择

Human Agency Profile 具有三个工程特征：

  • WorkOrder 绑定：profile 不能被挪到另一项任务使用；
  • Acceptor 签名：只有被指定的人类权威可以改变 active profile；
  • 机器可验证：执行前可以确定某个动作是 allowed、reserved 还是 denied。

reserved 动作不会先执行再提醒，而是在执行前返回 AGENCYHUMANDECISION_REQUIRED。appeal 是签名复核请求，只记录异议， 不恢复或扩大权限。只有 Acceptor 签名的 transition 才能撤销当前 profile 或将其替换为另一个 Acceptor 签名的 profile。

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

OpenWorkProof: common questions

Is OpenWorkProof MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the OpenWorkProof safety report
How do I install OpenWorkProof?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does OpenWorkProof need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is OpenWorkProof maintained?
The last commit was 6 days ago (2026-10-27). The latest release is v1.5.0.
What can I use instead of OpenWorkProof?
Servers from other publishers that do the same job: HOL Guard MCP server, IWE (iwe.md) MCP server and SuperCompress MCP server.
How does OpenWorkProof compare with other AI and agents MCP servers?
safety score 92/100 (higher than 90% of 4,464 AI and agents servers); tools 29 (the typical AI and agents server has 6); tools that change things 10% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to OpenWorkProof

Same job from other publishers: the closest match first, then the best rated.

  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • IWE (iwe.md)
    Markdown knowledge base as agent memory. Runs against the notes directory it is started in.
    A
  • SuperCompress
    Compress coding-agent context ~64%. Hosted Neural Keep MCP for Cursor/Claude/Codex.
    B
  • DCC-MCP Core
    Agent control plane for DCC and engine hosts: one MCP endpoint, one tool contract.
    A
  • Ausca
    Pay-per-call APIs and MCP services for agents, no accounts or keys, with verifiable receipts.
    A