Paceproof MCP server

<!-- mcp-name: io.github.RudrenduPaul/paceproof -->

PaceProof

PaceProof verifies Ed25519-signed compute-attestation records from any provider and tells you exactly which ones are real.

A record with a missing, malformed, or tampered signature never gets folded into a "verified" total; it's counted and reported separately, every time, in both human-readable and --json output.

PaceProof does not sign or generate attestations. It is a neutral, read-only ingest/verify/report/dashboard layer over records that are already signed somewhere else. Point it at a directory, file, or URL of signed records and it tells you, verifiably, what compute was actually run, by whom, and whether every record's signature checks out.

Install

paceproof-cli is published to both npm and PyPI:

npm install -g paceproof-cli
# or
pip install paceproof-cli

Both commands install a paceproof binary. paceproof-cli is also available as an alias on both registries if you need to disambiguate from another tool on your PATH.

To build from source instead (useful if you're contributing, or want the exact repo state rather than a published release):

TypeScript (npm package, includes the MCP server):

git clone https://github.com/RudrenduPaul/PaceProof.git
cd PaceProof/packages/cli-ts
npm install
npm run build
node dist/bin.js --help

Python (PyPI package, independent reimplementation):

git clone https://github.com/RudrenduPaul/PaceProof.git
cd PaceProof/packages/cli-py
pip install -e .
paceproof --help

Both the published npm install -g paceproof-cli and pip install paceproof-cli commands above were run fresh in a clean environment as part of writing this README, and the quickstart output below is real output from those installs, not fabricated.

Table of Contents

• Features
• Quickstart
• CLI command reference
• Library API reference
• How verification works
• Comparison
• What PaceProof is, and why it exists
• FAQ
• Contributing
• License

Quickstart

paceproof init
paceproof report ./paceproof-example

paceproof init generates a fresh Ed25519 example keypair and 7 example attestation records: 3 validly signed, and 4 intentionally broken (a tampered payload, a wrong-key signature, a malformed signature, and a missing signature) so verify/report have real failure modes to demonstrate, not just a happy path.

Real output from an actual run against the published npm package:

$ paceproof report ./paceproof-example

PaceProof report -- source: ./paceproof-example
generated at: 2026-08-04T02:54:30.898Z

== VERIFIED ==
  records: 3
  compute total: 144.50 gpu_hours

== UNVERIFIED (never counted in verified totals above) ==
  records: 4
  compute total: 1009 gpu_hours
  reasons:
    - rec-004: signature does not match record contents
    - rec-005: signature does not match record contents
    - rec-006: signature must decode to 64 bytes, got 4
    - rec-007: schema validation failed: (root) must have required property 'signature'

Shortened. The full README is on GitHub.