# AGA - Attested Governance Artifacts MCP server

> Provides verifiable, signed decision records for AI agent tool calls using hash-chained receipts and evidence bundles for offline auditing.

- Repository: https://github.com/attestedintelligence/aga-mcp-server
- Page: https://hostedmcp.org/servers/attestedintelligence/aga-mcp-server
- Transport: stdio
- Stars: 0
- License: MIT
- Latest version: 3.6.2

## Install

### Claude Code

```sh
claude mcp add --env 'AGA_GATEWAY_KEY=<YOUR_AGA_GATEWAY_KEY>' aga-mcp-server -- npx -y @attested-intelligence/aga-mcp-server
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "aga-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@attested-intelligence/aga-mcp-server"
      ],
      "env": {
        "AGA_GATEWAY_KEY": "<YOUR_AGA_GATEWAY_KEY>"
      }
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "aga-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@attested-intelligence/aga-mcp-server"
      ],
      "env": {
        "AGA_GATEWAY_KEY": "<YOUR_AGA_GATEWAY_KEY>"
      }
    }
  }
}
```

### VS Code CLI

```sh
code --add-mcp '{"name":"aga-mcp-server","type":"stdio","command":"npx","args":["-y","@attested-intelligence/aga-mcp-server"],"env":{"AGA_GATEWAY_KEY":"<YOUR_AGA_GATEWAY_KEY>"}}'
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "aga-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@attested-intelligence/aga-mcp-server"
      ],
      "env": {
        "AGA_GATEWAY_KEY": "<YOUR_AGA_GATEWAY_KEY>"
      }
    }
  }
}
```

### Codex

```sh
codex mcp add aga-mcp-server --env 'AGA_GATEWAY_KEY=<YOUR_AGA_GATEWAY_KEY>' -- npx -y @attested-intelligence/aga-mcp-server
```

### Codex config.toml (`~/.codex/config.toml`)

```toml
[mcp_servers.aga-mcp-server]
command = "npx"
args = ["-y", "@attested-intelligence/aga-mcp-server"]

[mcp_servers.aga-mcp-server.env]
AGA_GATEWAY_KEY = "<YOUR_AGA_GATEWAY_KEY>"
```

### Gemini CLI

```sh
gemini mcp add -s user -e 'AGA_GATEWAY_KEY=<YOUR_AGA_GATEWAY_KEY>' aga-mcp-server npx -- -y @attested-intelligence/aga-mcp-server
```

### Gemini settings.json (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "aga-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@attested-intelligence/aga-mcp-server"
      ],
      "env": {
        "AGA_GATEWAY_KEY": "<YOUR_AGA_GATEWAY_KEY>"
      }
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `AGA_GATEWAY_KEY` | no | yes | Ed25519 seed, 64 hex characters, that signs this server's evidence-bundle receipts and checkpoint, so gateway_public_key (get_server_info) is the same after a restart and can be pinned. Set in your MCP client's configuration, the seed sits inside the governed client's trust domain. Receipts are kept in memory only; save a generate_evidence_bundle result before the server stops. Unset or invalid: a new key each start, warned on stderr. When set, even to an invalid value, AGA_GATEWAY_KEY_FILE is not read. |
| `AGA_GATEWAY_KEY_FILE` | no | no | Path to a file holding the 64-hex Ed25519 seed; read only when AGA_GATEWAY_KEY is unset or empty, with the same effect. A stdio server started by your MCP client runs as the client's OS user, so the file sits inside the governed client's trust domain. Missing, unreadable or invalid: a new key each start, warned on stderr. |

## FAQ

### Can I verify these records offline?

Yes, receipts are collected into evidence bundles that can be verified offline by anyone holding the published format and the public key, without needing a network callback.