Vorim MCP server

by Vorim-AI-Labs·io.github.Vorim-AI-Labs/vorim-mcp-server·v1.1.15·66 stars

No reviews yet

AI agent identity, permissions, trust scores, and tamper-evident audit trails via Vorim AI

B77/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B77/100

full report

Adoption

Growing

66 stars51 downloads/wk

Reviews

Write one

Nobody has reviewed Vorim yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Vorim tools (19, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

vorim_check_permission
Check if an agent has a specific permission scope. Returns allowed (boolean), reason if denied, and remaining quota. Sub-5ms via Redis cache.
vorim_delegate_credential
Delegate a credential to an agent. Creates a scoped delegation with optional rate limits and expiry.
vorim_emit_event
Log an audit event for an agent action. Every agent action should be logged for compliance and traceability. NOTE: events emitted via the MCP server are sent unsigned because the MCP server does not hold the agent's private key. For tamper-evident audit trails sign client-side via @vorim/sdk before emit.
vorim_export_audit
Export a signed audit bundle for a date range. Returns events with a SHA-256 manifest for tamper-proof verification. Window must be <= 90 days; the server returns 400 if from > to or the range exceeds the cap. The returned bundle has up to 1,000,000 events; if truncated, the response carries `truncated: true` and the caller should re-export a narrower window.
vorim_get_agent
Get details of a specific agent by agent_id. Returns name, status, trust score, capabilities, permissions, and metadata.
vorim_grant_permission
Grant a permission scope to an agent. Optionally set expiry and rate limits.
vorim_list_agents
List all agents in the organisation. Supports pagination and filtering by status.
vorim_list_delegations
List credential delegations. Optionally filter by agent_id to see delegations for a specific agent.
vorim_list_permissions
List all active permissions for an agent.
vorim_onboard_check
Check whether the human has approved the onboarding request from vorim_onboard_start.
vorim_onboard_start
Start onboarding a user who does NOT yet have a Vorim API key (device-authorization flow).
vorim_ping
Check Vorim AI API health and connectivity. Returns status, version, and service health.
vorim_register_agent
Register a new AI agent with Vorim. Returns the agent identity (Ed25519 keypair, agent_id, trust score). The private key is shown once — store it securely.
vorim_register_ephemeral
Register an ephemeral agent with a did:key identity. Short-lived agents that auto-expire. Returns agent_id, did:key, and keypair.
vorim_request_token
Request a short-lived access token for an agent. Returns a scoped token for the specified provider.
vorim_revoke_agent
Permanently revoke an agent. This cannot be undone. The agent's identity will be deactivated and its trust score set to 0.
vorim_revoke_permission
Revoke a specific permission scope from an agent.
vorim_update_agentwrite action
Update an agent's metadata (name, description, status).
vorim_verify_trust
Verify an agent's identity and trust score. Public endpoint — no authentication required. Returns trust score (0-100), status, active scopes, and key fingerprint.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings

Code scan3 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 44 days ago12/15
Maintainer identityregistry namespace matches repository owner7/10

Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Vorim compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 77/100; higher than 50% of 4,460 AI and agents servers
Tools: 19; the typical AI and agents server has 6
Tools that change things: 5%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 66; more than 92% of 2,711 AI and agents servers
Downloads a week: 51; more than 43% of 1,538 AI and agents servers with a package

What its tools let an agent do: 18 read · 1 change

Install Vorim in Claude Code, Cursor or VS Code

Runs npx -y @vorim/mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add vorim-mcp-server -- npx -y @vorim/mcp-server

Add to Cursor

What the publisher says

From the Vorim repository's README, as published. We do not edit it. Read it on GitHub

Vorim AI — MCP Server

Give every AI agent its own cryptographic identity, scoped permissions, and a tamper-evident audit trail — directly from Claude Desktop, Cursor, or any MCP-compatible client.

What is Vorim AI?

Vorim AI is the identity and trust layer for autonomous AI agents. It gives each agent its own Ed25519 keypair, time-bounded scoped permissions, hash-linked audit events, and a publicly verifiable trust score — so when an agent does something, you can prove who acted, what they were allowed to do, and what happened.

The protocol underneath (VAIP) is open, MIT-licensed, and submitted to IETF as draft-nyantakyi-vaip-agent-identity-01.

This package is the MCP (Model Context Protocol) server that exposes 19 Vorim tools to any MCP-compatible AI client.

Works with Claude Desktop, Cursor, VS Code, Google Antigravity, and any other MCP client.

Quick Start

npm install -g @vorim/mcp-server

Or run directly with npx:

VORIM_API_KEY=agid_sk_live_... npx @vorim/mcp-server

Configuration

Claude Desktop

Add to ~/Library/Application Support/Claude/claudedesktopconfig.json:

{
  "mcpServers": {
    "vorim": {
      "command": "npx",
      "args": ["@vorim/mcp-server"],
      "env": {
        "VORIM_API_KEY": "agid_sk_live_..."
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "vorim": {
      "command": "npx",
      "args": ["@vorim/mcp-server"],
      "env": {
        "VORIM_API_KEY": "agid_sk_live_..."
      }
    }
  }
}

VS Code

Add to your VS Code MCP settings with the same format.

Google Antigravity

Add to the workspace config at .agents/mcpconfig.json, or the global config at ~/.gemini/config/mcpconfig.json:

{
  "mcpServers": {
    "vorim": {
      "command": "npx",
      "args": ["@vorim/mcp-server"],
      "env": {
        "VORIM_API_KEY": "agid_sk_live_..."
      }
    }
  }
}

You can also add it from the UI: Settings → Customizations → Installed MCP Servers → Add MCP.

Get an API Key

Sign up at vorim.ai (free, no credit card)
Go to Settings > API Keys
Create a key with agents:, audit:, trust:* scopes

Available Tools (19)

Health

Agent Identity

Permissions

Credential Delegation

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Vorim: common questions

Is Vorim MCP server safe?: Mostly: it is graded B (77/100). Read the Vorim safety report
How do I install Vorim?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Vorim need an API key?: Yes. The registry entry asks for VORIM_API_KEY.
Is Vorim maintained?: The last commit was 83 days ago (2026-08-13). The latest release is v1.1.15.
What can I use instead of Vorim?: Servers from other publishers that do the same job: Roast My Design System MCP server, Roast My Design System MCP server and three.ws Provenance MCP server.
How does Vorim compare with other AI and agents MCP servers?: safety score 77/100 (higher than 50% of 4,460 AI and agents servers); tools 19 (the typical AI and agents server has 6); tools that change things 5% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Vorim

Same job from other publishers: the closest match first, then the best rated.

Roast My Design System
Audit your Design System and serve your Agent the rules that keep AI-written UI on-system.
not reviewed
Established
A
Roast My Design System
Audit your Design System and serve your Agent the rules that keep AI-written UI on-system.
not reviewed
Established
A
three.ws Provenance
Append-only, signed, on-chain-verifiable agent action log — record and audit what agents did.
not reviewed
Established
B
Attestix
AI agent identity, signed credentials, delegated authority and governance evidence.
not reviewed
Established
A