# Writ MCP server

> Enforces commit-time policy checks for AI agent writes with ALLOW, DENY, or STEP_UP decisions and a tamper-evident audit log.

- Repository: https://github.com/AvenueDAdmin/pywrit
- Page: https://hostedmcp.org/servers/avenuedadmin/writ
- Transport: stdio
- Stars: 2
- License: MIT
- Latest version: 0.1.2

## Install

### Claude Code

```sh
claude mcp add --env WRIT_API_KEY=<YOUR_WRIT_API_KEY> --env WRIT_SPONSOR_TOKEN=<YOUR_WRIT_SPONSOR_TOKEN> writ -- uvx writ-mcp
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "writ": {
      "command": "uvx",
      "args": [
        "writ-mcp"
      ],
      "env": {
        "WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
        "WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
      }
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "writ": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "writ-mcp"
      ],
      "env": {
        "WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
        "WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
      }
    }
  }
}
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "writ": {
      "command": "uvx",
      "args": [
        "writ-mcp"
      ],
      "env": {
        "WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
        "WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
      }
    }
  }
}
```

### Codex (`~/.codex/config.toml`)

```toml
[mcp_servers.writ]
command = "uvx"
args = ["writ-mcp"]

[mcp_servers.writ.env]
WRIT_API_KEY = "<YOUR_WRIT_API_KEY>"
WRIT_SPONSOR_TOKEN = "<YOUR_WRIT_SPONSOR_TOKEN>"
```

### Gemini CLI (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "writ": {
      "command": "uvx",
      "args": [
        "writ-mcp"
      ],
      "env": {
        "WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
        "WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
      }
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `WRIT_API_KEY` | yes | yes | Writ API key (get one free at https://withwrit.com) |
| `WRIT_SPONSOR_TOKEN` | no | yes | Writ sponsor token, only required for sponsor tools (grant, revoke, reinstate) |
| `WRIT_BASE_URL` | no | no | Optional custom Writ API base URL (default: https://api.withwrit.com) |

## Tools (15)

- `writ_check`
- `writ_verify_token`
- `writ_grant`
- `writ_receipts`
- `writ_policy`
- `writ_sandbox`
- `writ_github_installations`
- `writ_github_set_threshold`
- `writ_github_toggle_pr_comments`
- `writ_manifests`
- `writ_explain_receipt`
- `writ_tenant_notify`
- `writ_principals`
- `writ_verbs`
- `writ_keys`

## FAQ

### How does the check-before-write loop work?

The agent calls writ_check to receive an ALLOW, DENY, or STEP_UP decision; an ALLOW provides a 90-second authToken which is then verified via writ_verify_token before execution.

### Can I try Writ without an API key?

Yes, you can use the writ_sandbox tool for a free 90-second demo grant without needing a key.

### What happens if a STEP_UP decision is returned?

A human sponsor must approve the action via writ_grant or the dashboard before the agent can proceed.