English Français العربية

Deus Witness

Official registry AI and agents

Checks every MCP tool call of your agent with an independent witness and gives signed receipts.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

PYPI package deus-witness
Claude Code 
claude mcp add deus-witness -e 'DEUS_WITNESS_KEY=<your deus_witness_key>' -e 'DEUS_WITNESS_URL=https://witness.sipkigroup.com' -- uvx deus-witness==0.2.40 -- '<upstream_command>'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "deus-witness": {
            "command": "uvx",
            "args": [
                "deus-witness==0.2.40",
                "--",
                "<upstream_command>"
            ],
            "env": {
                "DEUS_WITNESS_KEY": "<your deus_witness_key>",
                "DEUS_WITNESS_URL": "https://witness.sipkigroup.com"
            }
        }
    }
}

Environment variables

  • DEUS_WITNESS_KEY required secret Agent key (dwk_...) created in your Deus Witness account.
  • DEUS_WITNESS_URL Witness service URL.

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Deus Witness
  2. What is here
  3. Use it
  4. Honest limits
  5. Verify the receipts yourself
  6. Security, contributing, license

Deus Witness

An independent witness for AI-agent tool calls. Your agent asks before it acts; a witness that is not the agent's operator checks the call against a mandate you signed, and answers allow, deny or defer (wait for you). Every answer is a signed, append-only, independently verifiable receipt - so "what did the agent do, and who allowed it" has an answer you do not have to take on trust.

Status: early (0.x). The specification is an unpublished individual draft (not an IETF standard, not submitted anywhere). The evidence so far is our own simulations and independent implementations written inside one project; there are no external audits or deployments yet. Treat it as something to test and attack, not as a certified security boundary. Reports of bypasses are the most valuable thing you can send us.

What is here

PathWhatLicense
spec/Draft specification of the action receipt (draft-deus-aar-05, plus history and errata) and the test vectors (spec/vectors)Apache-2.0
verifier_js/Independent clean-room verifier in JavaScriptApache-2.0
verifier_swift/Independent clean-room verifier in Swift (source; build with ./build.sh)Apache-2.0
sdk-ts/@deus-witness/sdk (npm): TypeScript client, no dependenciesApache-2.0
python/deus-witness (PyPI): Python thin client - MCP proxy, Claude Code hook, doctor, SDK. Registry name io.github.sipkigroup/witnessApache-2.0
contract/HTTP API contract (OpenAPI), WebAuthn signing profile, contract stubApache-2.0
integrations/Examples: Vercel AI SDK, curlApache-2.0
docs/Teams, recovery, anchors, verifying receiptsApache-2.0

Not here: the Witness cloud service (server, web app, deployment). It is not open source. The hosted service is offered under separate Terms of Use published on the website (not part of this license). You can implement your own witness from spec/ and contract/.

Use it

The hosted service is at https://witness.sipkigroup.com. From TypeScript: npm install @deus-witness/sdk (see sdk-ts/README.md). From Python, or to put any MCP server behind the witness: pip install deus-witness or, with no install, uvx deus-witness -- <your MCP server command> (MCP Registry: io.github.sipkigroup/witness; see python/README.md; setup: https://witness.sipkigroup.com/dl/docs/quickstart.html). Any other language: speak HTTP, see contract/openapi.yaml and integrations/.

Honest limits

  • A witness cannot know what an action really does beyond what the tool map and the operator's description say; it checks the call against your mandate. Routes that do not go through the witness are not covered.
  • The TypeScript client does not verify receipt signatures yet (the verifiers here do). Do not treat an allow seen through it as cryptographically checked.
  • If the witness is unreachable, calls should be blocked (fail closed). That is a safety choice that costs availability.

Verify the receipts yourself

python3 spec/vectors/check_vectors.py              # the abstract spec vectors through the reference model of the spec (no dependencies)
(cd verifier_js && npm ci && npm test)             # the same vectors through the JavaScript verifier
(cd verifier_swift && ./build.sh && ./aarc --quiet --extra extra-vectors)

If two implementations disagree on a vector, one of them (or the spec) is wrong - please open an issue with the vector.

Security, contributing, license

Frequently asked questions

What is Deus Witness?

Checks every MCP tool call of your agent with an independent witness and gives signed receipts.

How do I install Deus Witness?

It runs on your machine. In Claude Code: claude mcp add deus-witness -e 'DEUS_WITNESS_KEY=<your deus_witness_key>' -e 'DEUS_WITNESS_URL=https://witness.sipkigroup.com' -- uvx deus-witness==0.2.40 -- '<upstream_command>'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Deus Witness need an API key?

Yes. It expects DEUS_WITNESS_KEY, which you set in its configuration.

Is Deus Witness open source?

Yes. Its code is on GitHub under the Apache-2.0 license.

Who maintains Deus Witness?

It is published by sipkigroup. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.