# Vouch Protocol MCP server

> Allows AI agents to create identities, sign and verify W3C Verifiable Credentials, and scan for leaked cryptographic keys.

- Repository: https://github.com/vouch-protocol/vouch
- Page: https://hostedmcp.org/servers/vouch-protocol/vouch
- Transport: stdio
- Stars: 27
- Latest version: 3.0.0

## Install

### Claude Code

```sh
claude mcp add --env 'VOUCH_PRIVATE_KEY=<YOUR_VOUCH_PRIVATE_KEY>' --env 'VOUCH_DID=<VOUCH_DID>' vouch -- uvx vouch-mcp
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "vouch": {
      "command": "uvx",
      "args": [
        "vouch-mcp"
      ],
      "env": {
        "VOUCH_PRIVATE_KEY": "<YOUR_VOUCH_PRIVATE_KEY>",
        "VOUCH_DID": "<VOUCH_DID>"
      }
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "vouch": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "vouch-mcp"
      ],
      "env": {
        "VOUCH_PRIVATE_KEY": "<YOUR_VOUCH_PRIVATE_KEY>",
        "VOUCH_DID": "<VOUCH_DID>"
      }
    }
  }
}
```

### VS Code CLI

```sh
code --add-mcp '{"name":"vouch","type":"stdio","command":"uvx","args":["vouch-mcp"],"env":{"VOUCH_PRIVATE_KEY":"<YOUR_VOUCH_PRIVATE_KEY>","VOUCH_DID":"<VOUCH_DID>"}}'
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "vouch": {
      "command": "uvx",
      "args": [
        "vouch-mcp"
      ],
      "env": {
        "VOUCH_PRIVATE_KEY": "<YOUR_VOUCH_PRIVATE_KEY>",
        "VOUCH_DID": "<VOUCH_DID>"
      }
    }
  }
}
```

### Codex

```sh
codex mcp add vouch --env 'VOUCH_PRIVATE_KEY=<YOUR_VOUCH_PRIVATE_KEY>' --env 'VOUCH_DID=<VOUCH_DID>' -- uvx vouch-mcp
```

### Codex config.toml (`~/.codex/config.toml`)

```toml
[mcp_servers.vouch]
command = "uvx"
args = ["vouch-mcp"]

[mcp_servers.vouch.env]
VOUCH_PRIVATE_KEY = "<YOUR_VOUCH_PRIVATE_KEY>"
VOUCH_DID = "<VOUCH_DID>"
```

### Gemini CLI

```sh
gemini mcp add -s user -e 'VOUCH_PRIVATE_KEY=<YOUR_VOUCH_PRIVATE_KEY>' -e 'VOUCH_DID=<VOUCH_DID>' vouch uvx -- vouch-mcp
```

### Gemini settings.json (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "vouch": {
      "command": "uvx",
      "args": [
        "vouch-mcp"
      ],
      "env": {
        "VOUCH_PRIVATE_KEY": "<YOUR_VOUCH_PRIVATE_KEY>",
        "VOUCH_DID": "<VOUCH_DID>"
      }
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `VOUCH_PRIVATE_KEY` | yes | yes | The agent's signing key as a JWK JSON string, held only in this server process. |
| `VOUCH_DID` | yes | no | The agent's DID, e.g. did:web:agent.example.com |
| `VOUCH_MCP_HOST` | no | no | Bind host when VOUCH_MCP_TRANSPORT=http (default 127.0.0.1). |
| `VOUCH_MCP_PORT` | no | no | Bind port when VOUCH_MCP_TRANSPORT=http (default 8080). |
| `VOUCH_MCP_TRANSPORT` | no | no | Transport to serve: 'stdio' (default), 'http' (Streamable HTTP), or 'sse'. |

## FAQ

### What can the vouch-mcp server do?

It allows any MCP client to create an identity, sign and verify credentials, scan for leaked keys, and decode DIDs out of the box.

### How do I set up an agent identity?

You can use the command 'vouch onboard --quick' to generate a working identity, allow-list, verifier, and heartbeat config in one command.

### Does Vouch support post-quantum security?

Yes, it includes a post-quantum profile that carries both eddsa-jcs-2022 and mldsa44-jcs-2024 proofs.