Vouchwell MCP server

Vouchwell

Tamper-evident receipts for AI agent actions.

Formerly Proofwire. Renamed after 0.5.0 because another company was

already using the name. The proofwire and @proofwire/ packages point

here; existing logs, settings, hubs and evidence keep working unchanged.

Your agents spend money, send mail, and touch customer data. When something goes wrong, "our logs say it didn't" is not an answer — your logs are a text file you can edit.

Vouchwell makes every agent action policy-gated before it runs and cryptographically provable afterwards. One line of config. No code change.

Run it standalone on one machine, or as a hub your whole organisation writes to — with shared policy, an approvals inbox, tenant isolation, and independent witnesses that make a hosted log worth believing.

Check a real log in your browser → Then try to cheat it: edit a receipt, cut the tail off, invent your own witnesses. Nothing you paste leaves the page.

npm install -g vouchwell
vw init

Then wrap any MCP server:

// .mcp.json — before
{ "command": "npx", "args": ["-y", "@acme/mcp-crm"] }

// after
{ "command": "vw", "args": ["proxy", "--namespace", "crm", "--", "npx", "-y", "@acme/mcp-crm"] }

That is the whole integration. Every tool call now hits your policy first, and every decision — allowed, blocked, or escalated to a human — lands in an append-only log that an outside party can verify without trusting you.

See it in one command

git clone https://github.com/vouchwell/vouchwell && cd vouchwell
npm install
npm run demo

The demo runs a real agent session through a real proxy, then attacks the resulting log four ways and shows each attack being caught:

1. An agent works through a queue of tasks
  ran      ops.query        a harmless read
  ran      ops.refund       $45 refund — inside budget
  ran      ops.refund       $30 refund — $75 committed
  BLOCKED  ops.refund       $90 refund — would reach $165
           budget refunds.daily would be exceeded: 75 already committed plus 90 proposed…
  BLOCKED  ops.query        destructive SQL
  ran      ops.send_email   outbound mail            (approved by dana@acme.test)
  BLOCKED  ops.query        a live credential in the args

3. Four ways to cover your tracks, and what each one costs
  Edit a receipt in place    ✓ caught — signature does not verify
  Delete a receipt           ✓ caught — expected seq 6, found 8
  Re-sign the whole chain    ✓ caught — checkpoint covers 11 entries, log holds 8
  Truncate the log           ✓ caught — entries have been removed

For teams: the hub

docker compose up -d
docker compose exec hub node packages/server/src/bin.js bootstrap

That runs on your machine over plain HTTP, for trying it out. For a real server with a domain, automatic HTTPS and a hardened setup, use deploy/: docs/DEPLOY.md walks through it end to end.

Built and driven for real: CI's docker job builds this image, boots it,

registers a log, signs and pushes receipts, checkpoints, fetches the bundle back

and verifies it, confirms a bad token is refused, and checks the container

actually runs read-only and non-root (scripts/docker-smoke.mjs). It also caught

a real bug: a receipt missing an actor field crashed the hub with a raw SQLite

error instead of a clean 4xx — fixed in buildReceipt/verifyReceipt. The two-

container witnessing flow below (docker compose up -d witness, vw remote add

--name witness, vw cosign --remote witness) was run by hand against both

containers, through to vw check --witnesses 1 on the resulting bundle.

Shortened. The full README is on GitHub.