English Français العربية

KeyHalve - verify sealed documents

السجل الرسمي الإنتاجية

Free, no-account verification of KeyHalve-sealed documents. Read-only; never receives keys.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http keyhalve-verify-sealed-documents 'https://mcp.keyhalve.com/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "keyhalve-verify-sealed-documents": {
            "type": "http",
            "url": "https://mcp.keyhalve.com/mcp"
        }
    }
}
NPM package @keyhalve/verify-mcp
Claude Code 
claude mcp add keyhalve-verify-sealed-documents -- npx -y @keyhalve/verify-mcp@0.1.0
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "keyhalve-verify-sealed-documents": {
            "command": "npx",
            "args": [
                "-y",
                "@keyhalve/verify-mcp@0.1.0"
            ]
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. KeyHalve verify-MCP
  2. The blindness rule
  3. Design notes
  4. Develop / deploy
  5. Directory submissions (Mike-gated)
  6. Listings

KeyHalve verify-MCP

Free, public, no-account MCP server that lets any AI verify KeyHalve-sealed documents — from any platform on the rail (ValidPay, CheckBooks, …). Seal = the door (a platform's paid MCP). Verify = the room (this one, free forever).

  • Endpoint: https://mcp.keyhalve.com/mcp (Streamable HTTP, stateless)
  • Tools: keyhalve_verify · keyhalve_status · keyhalve_explain — all read-only, no auth

The blindness rule

This server never receives decryption keys. A verify URL carries the holder's key share in the #key= fragment; parseInput discards any fragment before any other logic runs, and the response says so. Verification here covers everything provable without the key:

CheckMeaning
statusactive / revoked (with reason) on the issuing platform
ciphertext integritySHA-256 of the served ciphertext = commitment recorded at issuance (v2)
rail attestationEd25519-verified against the pinned rail key; dual-sign content binding when present
time lockvalidity window judged client-side (Patent D semantics)
issuer trustfail-closed: declared at best, never proof

Reading the sealed contents still happens only in the holder's browser — exactly like the web verifier. The overall verdict fails closed: any failed check → FAILED — DO NOT TRUST.

Design notes

  • Zero runtime dependencies. WebCrypto only; the whole protocol layer is hand-auditable. Same reasoning as the pinned-key rail client in keyhalve-website.
  • Stateless. No sessions, no SSE, no KV, no cookies; every POST gets application/json. Request bodies are never logged.
  • Tenant-neutral. Platforms come from the same manifest data as the web verifier (TENANT_MANIFEST in src/verifier.ts); onboarding a platform = one data entry.
  • Fail closed. Unreachable rail, malformed share, partial dual-sign binding, unknown id prefix — all report NOT verified, never a soft pass.

Develop / deploy

npm ci
npm run typecheck && npm test   # 32 tests
npm run dev                      # wrangler dev

Deploys are manual (deploy.yml via workflow_dispatch, same discipline as rail/console). Needs the CLOUDFLARE_API_TOKEN repo secret; the route mcp.keyhalve.com is a custom domain on the business CF account (same account as the watchdog scheduler).

Directory submissions (Mike-gated)

Submitting to the Claude Connectors Directory / ChatGPT App Directory is an outward-facing step — prepared separately, goes out only on Mike's go.

Listings

Directory-listing assets live in this repo — reuse them, don't invent copy:

  • llms-install.md — AI-agent install steps (Cline's AI-driven install; also the canonical per-client snippets).
  • glama.json — Glama claim file (maintainers; their live schema is maintainers-only).
  • assets/icon-400.png — 400×400 icon (white split-circle glyph on Ink #0E1116, from the brand kit).
  • Descriptions must stay byte-consistent with src/tools.ts and pass the approved-claims register (no "split key", no "tamper-proof", no issuer-identity claims).

الأسئلة الشائعة

ما هو KeyHalve - verify sealed documents؟

Free, no-account verification of KeyHalve-sealed documents. Read-only; never receives keys.

كيف أثبّت KeyHalve - verify sealed documents؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http keyhalve-verify-sealed-documents 'https://mcp.keyhalve.com/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج KeyHalve - verify sealed documents إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل KeyHalve - verify sealed documents مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون KeyHalve - verify sealed documents؟

ينشره keyhalve. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.