English Français العربية

Touchstone

السجل الرسمي الأمن

Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http touchstone 'https://touchstone.cv/mcp' --header 'Authorization: <A Touchstone API key as '\''Bearer tsk_...'\'' — an agent mints one with its own Colony identity (no browser); see https://touchstone.cv/developers>'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "touchstone": {
            "type": "http",
            "url": "https://touchstone.cv/mcp",
            "headers": {
                "Authorization": "<A Touchstone API key as 'Bearer tsk_...' — an agent mints one with its own Colony identity (no browser); see https://touchstone.cv/developers>"
            }
        }
    }
}
NPM package @touchstone-cv/mcp
Claude Code 
claude mcp add touchstone -e 'TOUCHSTONE_RECORDER=<TOUCHSTONE_RECORDER>' -e 'TOUCHSTONE_SUBJECT=<TOUCHSTONE_SUBJECT>' -e 'TOUCHSTONE_API_KEY=<your touchstone_api_key>' -e 'TOUCHSTONE_SIGNING_KEY=<your touchstone_signing_key>' -e 'TOUCHSTONE_KEY_FILE=<TOUCHSTONE_KEY_FILE>' -e 'TOUCHSTONE_BASE_URL=<TOUCHSTONE_BASE_URL>' -- npx -y @touchstone-cv/mcp@0.3.1
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "touchstone": {
            "command": "npx",
            "args": [
                "-y",
                "@touchstone-cv/mcp@0.3.1"
            ],
            "env": {
                "TOUCHSTONE_RECORDER": "<TOUCHSTONE_RECORDER>",
                "TOUCHSTONE_SUBJECT": "<TOUCHSTONE_SUBJECT>",
                "TOUCHSTONE_API_KEY": "<your touchstone_api_key>",
                "TOUCHSTONE_SIGNING_KEY": "<your touchstone_signing_key>",
                "TOUCHSTONE_KEY_FILE": "<TOUCHSTONE_KEY_FILE>",
                "TOUCHSTONE_BASE_URL": "<TOUCHSTONE_BASE_URL>"
            }
        }
    }
}

متغيرات البيئة

  • TOUCHSTONE_RECORDER إلزامي Recorder public id (rec_...) to append to.
  • TOUCHSTONE_SUBJECT إلزامي The subject Colony sub whose key signs entries.
  • TOUCHSTONE_API_KEY إلزامي سري Touchstone API key (tsk_...) for the append/disclose REST calls.
  • TOUCHSTONE_SIGNING_KEY سري Base64 Ed25519 seed. Signs locally — the key never leaves your machine. Use this or TOUCHSTONE_KEY_FILE.
  • TOUCHSTONE_KEY_FILE Path to a file holding the base64 Ed25519 seed (alternative to TOUCHSTONE_SIGNING_KEY).
  • TOUCHSTONE_BASE_URL Override the Touchstone API base URL (defaults to https://touchstone.cv).

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. touchstone-mcp
  2. Install
  3. Configure
  4. Tools
  5. Verifying the log
  6. License

touchstone-mcp

Local MCP server for Touchstone — record what your agent did into a tamper-evident, externally-anchored log.

This server runs on your machine and holds your Ed25519 signing key. It signs each event locally and appends it to your recorder, so an agent only has to call touchstone_record({ event_type, payload }). The key never leaves this process. Canonicalization (JCS / RFC 8785) is done locally too, so a malicious or compromised server can't trick you into signing a different commitment than you intended.

Zero dependencies — Node 18+ built-ins only. It's a single file: read it before you trust it.

The remote MCP at https://touchstone.cv/mcp can't sign for you (Touchstone never holds your key), so its touchstone_record expects a signature you computed yourself. Run this server when you want frictionless local signing.

Install

# one-off, no install:
npx -y @touchstone-cv/mcp

# or vendor the single file:
curl -O https://touchstone.cv/touchstone-mcp.mjs

# or clone:
git clone https://github.com/Touchstone-CV/touchstone-mcp && cd touchstone-mcp

Configure

Point your MCP client at it over stdio:

{
  "mcpServers": {
    "touchstone": {
      "command": "npx",
      "args": ["-y", "@touchstone-cv/mcp"],
      "env": {
        "TOUCHSTONE_RECORDER": "rec_...",
        "TOUCHSTONE_SUBJECT": "<your-colony-sub>",
        "TOUCHSTONE_API_KEY": "tsk_...",
        "TOUCHSTONE_SIGNING_KEY": "<base64 Ed25519 32-byte seed>"
      }
    }
  }
}
Env varRequiredMeaning
TOUCHSTONE_RECORDERyesYour recorder public id (rec_…)
TOUCHSTONE_SUBJECTto recordYour Colony sub — the recorder's subject
TOUCHSTONE_API_KEYyesAPI key minted on the recorder (tsk_…)
TOUCHSTONE_SIGNING_KEYto recordbase64 Ed25519 32-byte seed — kept by you, never sent
TOUCHSTONE_KEY_FILEaltPath to JSON {"seed_b64":"…"} instead of the inline seed
TOUCHSTONE_BASE_URLnoDefaults to https://touchstone.cv

To get a recorder + key, see touchstone.cv/developers — agents can self-provision one with their own Colony token (OAuth Token Exchange, RFC 8693), no browser required.

Tools

ToolWhat it does
touchstone_recordJCS-canonicalizes payload, signs the commitment locally, appends the entry
touchstone_discloseCreate a shareable /d/<token> disclosure link (proxies to the service)
touchstone_verifyVerify a disclosure bundle (proxies to the service)
touchstone_recorder_infoFetch your recorder's public info / checkpoint state

Only touchstone_record uses your signing key; the rest proxy to the remote service over your API key.

Selective field disclosure

Call touchstone_record({ event_type, payload, selective_disclosure: true }) to commit each payload field separately — the client computes a salted-field Merkle root locally and signs that as payload_hash, storing the per-field salts. Later you can reveal only a subset:

touchstone_disclose({ seqs: [n], reveal: { n: ["field_a", "field_b"] } })

Revealed fields ship with Merkle proofs against payload_hash (which your signature already covers); withheld fields are salt-bound and their values never appear in the disclosure. The root computation matches the server and the verifiers byte-for-byte.

Verifying the log

A disclosure can be checked by anyone, with no trust in Touchstone — in the browser verifier, the standalone verify.php, or the gossip_check.py split-view checker. Those tools are served from the site (and are each a single auditable file); this repo is just the recording client.

License

Apache-2.0.

الأسئلة الشائعة

ما هو Touchstone؟

Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.

كيف أثبّت Touchstone؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http touchstone 'https://touchstone.cv/mcp' --header 'Authorization: <A Touchstone API key as '\''Bearer tsk_...'\'' — an agent mints one with its own Colony identity (no browser); see https://touchstone.cv/developers>'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج Touchstone إلى مفتاح API؟

نعم. يتطلب TOUCHSTONE_RECORDER, TOUCHSTONE_SUBJECT, TOUCHSTONE_API_KEY, TOUCHSTONE_SIGNING_KEY, Authorization، وتضبطها في إعداداته.

هل Touchstone مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص Apache-2.0.

من يصون Touchstone؟

ينشره Touchstone-CV. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.