MCP.Market

KeyHalve - verify sealed documents MCP server

online · 100% uptime
by keyhalve.com·com.keyhalve/verify·v1.0.1
No reviews yet

Free, no-account verification of KeyHalve-sealed documents. Read-only; never receives keys.

A91/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A91/100

full report

Adoption
Growing

0 stars28 downloads/wk

Reviews

Write one

Nobody has reviewed KeyHalve - verify sealed documents yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

KeyHalve - verify sealed documents tools (3)

write = sends, deletes, buys or posts
  • keyhalve_explainFree

    Plain-language explanation of what a KeyHalve verification verdict means and why it can be trusted (blind rail, three-share custody, commitments, revocation). Optionally focused on one topic.

  • keyhalve_statusFree

    Live status of a KeyHalve-sealed document by id: active, revoked (with reason/time), or outside its validity window. Lighter than keyhalve_verify — status only, no integrity or rail checks. Use for "is this still good right now?"

  • keyhalve_verifyFree

    Verify a KeyHalve-sealed document. Accepts a verify URL, the raw text of a KeyHalve QR code, or a document id (vp_…, kh_…, cb_…). Returns the cryptographic verdict: whether the seal exists, its live status (active/revoked/expired), ciphertext integrity against the issuance commitment, the KeyHalve rail's independent attestation, the validity window, and the issuer's trust context. This tool NEVER decrypts sealed contents — any decryption key in the URL fragment is discarded unread; contents are only readable by opening the verify URL in a browser.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan6 source files scanned25/25
  • Live reliabilityremote reachable in 225ms20/20
  • Tool poisoning3 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 13 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 91/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How KeyHalve - verify sealed documents compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
91/100
higher than 85% of 48,255 servers
Tools
3
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
68 ms
faster than 90% of 30,031 servers
Downloads a week
28
more than 15% of 12,191 servers with a package

What its tools let an agent do: 3 read

Install KeyHalve - verify sealed documents in Claude Code, Cursor or VS Code

claude mcp add --transport http verify https://mcp.keyhalve.com/mcp
Add to Cursor

What the publisher says

From the KeyHalve - verify sealed documents repository's README, as published. We do not edit it. Read it on GitHub

KeyHalve verify-MCP

Free, public, no-account MCP server that lets any AI verify KeyHalve-sealed documents — from any platform on the rail (ValidPay, CheckBooks, …). Seal = the door (a platform's paid MCP). Verify = the room (this one, free forever).

  • Endpoint: https://mcp.keyhalve.com/mcp (Streamable HTTP, stateless)
  • Tools: keyhalveverify · keyhalvestatus · keyhalve_explain — all read-only, no auth

The blindness rule

This server never receives decryption keys. A verify URL carries the holder's key share in the #key= fragment; parseInput discards any fragment before any other logic runs, and the response says so. Verification here covers everything provable without the key:

Reading the sealed contents still happens only in the holder's browser — exactly like the web verifier. The overall verdict fails closed: any failed check → FAILED — DO NOT TRUST.

Design notes

Same reasoning as the pinned-key rail client in keyhalve-website.

  • Zero runtime dependencies. WebCrypto only; the whole protocol layer is hand-auditable.

Request bodies are never logged.

  • Stateless. No sessions, no SSE, no KV, no cookies; every POST gets application/json.

(TENANT_MANIFEST in src/verifier.ts); onboarding a platform = one data entry.

  • Tenant-neutral. Platforms come from the same manifest data as the web verifier

prefix — all report NOT verified, never a soft pass.

  • Fail closed. Unreachable rail, malformed share, partial dual-sign binding, unknown id

Develop / deploy

npm ci
npm run typecheck && npm test   # 32 tests
npm run dev                      # wrangler dev

Deploys are manual (deploy.yml via workflowdispatch, same discipline as rail/console). Needs the CLOUDFLAREAPI_TOKEN repo secret; the route mcp.keyhalve.com is a custom domain on the business CF account (same account as the watchdog scheduler).

Directory submissions (Mike-gated)

Submitting to the Claude Connectors Directory / ChatGPT App Directory is an outward-facing step — prepared separately, goes out only on Mike's go.

Listings

Directory-listing assets live in this repo — reuse them, don't invent copy:

  • llms-install.md — AI-agent install steps (Cline's AI-driven install; also the canonical per-client snippets).
  • glama.json — Glama claim file (maintainers; their live schema is maintainers-only).
  • assets/icon-400.png — 400×400 icon (white split-circle glyph on Ink #0E1116, from the brand kit).
  • Descriptions must stay byte-consistent with src/tools.ts and pass the approved-claims register (no "split key", no "tamper-proof", no issuer-identity claims).

Nothing above is checked by us. What we check is on the safety report.

KeyHalve - verify sealed documents: common questions

Is KeyHalve - verify sealed documents MCP server safe?
Yes, by our scan: it is graded A (91/100). Read the KeyHalve - verify sealed documents safety report
How do I install KeyHalve - verify sealed documents?
It runs remotely at mcp.keyhalve.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does KeyHalve - verify sealed documents need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is KeyHalve - verify sealed documents maintained?
The last commit was 54 days ago (2026-09-11). The latest release is v1.0.1.
Is KeyHalve - verify sealed documents up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
What can I use instead of KeyHalve - verify sealed documents?
Servers from other publishers that do the same job: Ouroboros MCP server.
How does KeyHalve - verify sealed documents compare with other MCP servers?
safety score 91/100 (higher than 85% of 48,255 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to KeyHalve - verify sealed documents

Same job from other publishers: the closest match first, then the best rated.

  • Ouroboros
    Pins an acceptance spec; the verify command and expected output never enter the success contract.
    C