VERAX MCP server

Verax

The body an agent asks before it acts.

Verax is an MCP server that sits between an agent and its tools. Every tool call passes a policy gate and leaves a signed decision record before anything runs; every call that ran leaves an effect row that is reconciled against its record afterwards. A refusal is recorded the same way as an approval. A call the policy will not decide alone is held until an operator on this machine approves it. The ledger stays on the machine the body runs on, and the body opens only when its authorization is configured: there is no default token.

By VERAX Teknoloji. Sister projects: Conarium · Tugra · Cedulon. Decision records use the Cedulon record format.

What ships

The three packages are published together and carry the same version; the capability matrix in docs/STATUS.md names the current one, and it is the version on npm. The body is also listed in the MCP registry as io.github.verax-ai/verax. What that version carries, what it does not, and the test holding each row up are in the capability matrix at the top of docs/STATUS.md.

Read the ledger back without us

A ledger only the vendor's running service can read is evidence a buyer rents, not evidence they hold. verax verify reads a state directory on its own — no body listening, nothing on the network — and states four things separately, because they fail separately:

$ verax verify ./verax-state
ledger        ./verax-state
decisions     6
effects       4 (4 bound to a decision, 0 with none)
signatures    6 verify, 0 do not
chain         unbroken
verified with the key carried in these files
              verified against the key carried in the records themselves: this
              shows the files are internally consistent, not that the key was
              ever trusted. Pin a key you hold to check that.

VERIFIED

That last pair of lines is the point. Checking a ledger against the key lying next to it proves the files agree with each other and nothing more — anything able to write the ledger could write that key too. Pass --key to verify against a copy you hold, and the answer says a key you supplied instead. --json prints the same result for a pipeline; the exit code is 0 when it verifies and 1 when it does not, and a directory with no ledger in it is never quiet success.

Install

npm install -g @verax-ai/body
verax --help
verax doctor

Node 22.6 or newer. The body speaks MCP over Streamable HTTP at /mcp on VERAX_BIND (default 127.0.0.1:8787) and needs an issuer, a JWKS URL, an audience, a state directory and a policy file before it listens; verax doctor names what is missing. The variables and the run steps are in packages/body/README.md.

Tools

The policy decides which of these a token's scopes may call; packages/proxy/policy/default.json denies what it does not name.

Shortened. The full README is on GitHub.