# Sequesign MCP server

> Enables AI agents to produce cryptographically verifiable receipts of delegated work that can be verified offline.

- Repository: https://github.com/Sequesign/mcp
- Page: https://hostedmcp.org/servers/sequesign/mcp
- Transport: stdio
- Stars: 0
- License: Apache-2.0
- Latest version: 0.4.1

## Install

### Claude Code

```sh
claude mcp add --env SEQUESIGN_AGENT_PRIVATE_KEY=<YOUR_SEQUESIGN_AGENT_PRIVATE_KEY> --env SEQUESIGN_API_KEY=<YOUR_SEQUESIGN_API_KEY> --env SEQUESIGN_TEMPLATE_REGISTRY_TOKEN=<YOUR_SEQUESIGN_TEMPLATE_REGISTRY_TOKEN> mcp -- npx -y @sequesign/mcp
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@sequesign/mcp"
      ],
      "env": {
        "SEQUESIGN_AGENT_PRIVATE_KEY": "<YOUR_SEQUESIGN_AGENT_PRIVATE_KEY>",
        "SEQUESIGN_API_KEY": "<YOUR_SEQUESIGN_API_KEY>",
        "SEQUESIGN_TEMPLATE_REGISTRY_TOKEN": "<YOUR_SEQUESIGN_TEMPLATE_REGISTRY_TOKEN>"
      }
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@sequesign/mcp"
      ],
      "env": {
        "SEQUESIGN_AGENT_PRIVATE_KEY": "<YOUR_SEQUESIGN_AGENT_PRIVATE_KEY>",
        "SEQUESIGN_API_KEY": "<YOUR_SEQUESIGN_API_KEY>",
        "SEQUESIGN_TEMPLATE_REGISTRY_TOKEN": "<YOUR_SEQUESIGN_TEMPLATE_REGISTRY_TOKEN>"
      }
    }
  }
}
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@sequesign/mcp"
      ],
      "env": {
        "SEQUESIGN_AGENT_PRIVATE_KEY": "<YOUR_SEQUESIGN_AGENT_PRIVATE_KEY>",
        "SEQUESIGN_API_KEY": "<YOUR_SEQUESIGN_API_KEY>",
        "SEQUESIGN_TEMPLATE_REGISTRY_TOKEN": "<YOUR_SEQUESIGN_TEMPLATE_REGISTRY_TOKEN>"
      }
    }
  }
}
```

### Codex (`~/.codex/config.toml`)

```toml
[mcp_servers.mcp]
command = "npx"
args = ["-y", "@sequesign/mcp"]

[mcp_servers.mcp.env]
SEQUESIGN_AGENT_PRIVATE_KEY = "<YOUR_SEQUESIGN_AGENT_PRIVATE_KEY>"
SEQUESIGN_API_KEY = "<YOUR_SEQUESIGN_API_KEY>"
SEQUESIGN_TEMPLATE_REGISTRY_TOKEN = "<YOUR_SEQUESIGN_TEMPLATE_REGISTRY_TOKEN>"
```

### Gemini CLI (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@sequesign/mcp"
      ],
      "env": {
        "SEQUESIGN_AGENT_PRIVATE_KEY": "<YOUR_SEQUESIGN_AGENT_PRIVATE_KEY>",
        "SEQUESIGN_API_KEY": "<YOUR_SEQUESIGN_API_KEY>",
        "SEQUESIGN_TEMPLATE_REGISTRY_TOKEN": "<YOUR_SEQUESIGN_TEMPLATE_REGISTRY_TOKEN>"
      }
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `SEQUESIGN_AGENT_PRIVATE_KEY` | no | yes | Ed25519 PKCS#8 private-key PEM for the agent. In managed mode, the key registered to your API key. In direct mode, omit to mint an ephemeral key per session. |
| `SEQUESIGN_API_KEY` | no | yes | Sequesign write-class API key (from the dashboard). Required for managed mode; in direct mode it authenticates the hosted witness. |
| `SEQUESIGN_TEMPLATE_REGISTRY_TOKEN` | no | yes | Read-only bearer token for an account-scoped template registry (discovery only; never used in verification). Omit for a public registry. |
| `SEQUESIGN_MODE` | no | no | Transport: 'direct' (default; sign locally, an independent witness co-signs) or 'managed' (route through the Sequesign broker for a registered identity). |
| `SEQUESIGN_PACKAGE_DIR` | no | no | Directory where sealed receipt packages are written. Defaults to a temporary directory. |
| `SEQUESIGN_TEMPLATE_REGISTRY_URL` | no | no | Base URL of a read-only dynamic template registry (e.g. https://dashboard-api.sequesign.com/v1/registry). When set, direct-mode sessions and the discovery tools resolve templates published there in addition to the bundled ones, falling back to bundled offline. Omit to use only the bundled templates. |

## Tools (8)

- `sequesign_start_session`
- `sequesign_record_action`
- `sequesign_record_approval`
- `sequesign_record_counterparty_attestation`
- `sequesign_approve_receipt`
- `sequesign_countersign_receipt`
- `sequesign_finalize`
- `sequesign_verify`

## FAQ

### How can I verify a receipt offline?

You can use the `sequesign_verify` tool to perform an integrity self-check of the local package, a third-party external check, or verify a broker-stored receipt using a URL.

### What is the difference between direct and managed modes?

In direct mode, the agent's signing key stays local and the witness only co-signs a hash. Managed mode requires an API key and a registered agent private key to use the Sequesign broker.

### Can I add approvals to a receipt after it has been finalized?

Yes, you can use `sequesign_approve_receipt` or `sequesign_countersign_receipt` to attach independently-witnessed satellites to an already-sealed receipt without modifying it.