Pulse Verity MCP server

@pipeworx/pulse-verity

Crypto index prices that come with a proof. Every observation from the Pulse Verity Index is signed with ECDSA P-256, so an agent that acted on a price can later demonstrate exactly which price it acted on — and that demonstration holds with the agent, the gateway and Pulse all offline.

Part of Pipeworx — an MCP gateway connecting AI agents to 1679+ live data sources.

This is the first source in the catalogue that hands back something checkable. Every other price feed here gives you a number you must take on trust.

Tools

individually signed. Symbols Pulse does not serve are named in not_served rather than silently dropped.

• pulsesignedprice(symbol) — current signed print for one asset.
• pulsesignedbatch(symbols[]) — up to 100 assets in one call, each row

nearest a past moment, plus delta_ms. For settling contracts and reconstructing a price at a timestamp.

• pulsesettlementprint(symbol, at) — the signed print Pulse recorded

cadence across 6,700+ observed assets. Unsigned (see below).

• pulseverifyprint(print) — check a print. Returns valid: true|false.
• pulseassetcatalog(limit?, offset?, band?, status?) — coverage and measured

• pulsekeyring() — the public keys, algorithm and canonical format. Keyless.

Auth

A platform key is wired (PLATFORMPULSEKEY), so callers need no key of their own. _apiKey is still accepted for anyone bringing theirs.

The key lives in the encrypted platformkeys KEYSTORE, not in a Cloudflare secret binding — scripts/pwcall.sh platform-key-put PLATFORMPULSEKEY < file (fleet #2007, docs/platform-key-store-plan.md). Do not reach for wrangler secret put for a new key here: the gateway sits one binding under Cloudflare's 250-text-binding ceiling, and a check-gateway-bindings gate blocks the deploy for EVERY lane the moment the secret count rises above its committed baseline. This pack was built that way by mistake first and reddened the gateway deploy until the key was moved into the keystore and the individual binding deleted; scripts/pwcall.sh platform-key-status should show bindingunderneath: false for it.

Free and self-serve at : 60 requests a minute, 25,000 a month, no card. pulseverifyprint and pulsekeyring need no key at all. The keyless /sample endpoint upstream covers only BTC/ETH/SOL; everything wider needs the key.

How verification works, and what "local" means

Canonical string, signed with ECDSA P-256 / SHA-256, signature as IEEE-P1363 r||s in base64:

pulse-index-v1\n{symbol}\n{priceText}\n{at}\n{grade}

pulseverifyprint recomputes this in the worker. Pulse is never asked whether a print is valid, so Pulse cannot vouch for a print it did not sign, and an offline or compromised source cannot turn an invalid print into a valid one. What is not local is key distribution: a kid we have not seen before costs one fetch of the public ring, which is then cached. Every response says which happened in key_source, because "verified locally" is a security claim and should not be made vaguely.

Verified live 2026-09-16, independently of Pulse's own code, with tamper controls — a verifier that only ever returns true proves nothing:

The priceText trap

Shortened. The full README is on GitHub.