Model Context Protocol

Two MCP paths. One consequence boundary.

Protect an existing tool dispatcher with @emilia-protocol/mcp-guard, or add receipt and passkey verification tools to a client with @emilia-protocol/mcp-server. The guard covers only the executor paths it fully mediates.

Protect an MCP tool →Put Gate beside the credential Scan your surface first

EMILIA MCP demo: an AI agent is blocked from releasing $50,000 until a named human signs off, then the payment proceeds with a verifiable receipt.

Executor path

Protect an existing MCP tool

@emilia-protocol/mcp-guard

Wrap the credential-owning dispatcher. Missing or invalid action-bound evidence is refused before the handler runs. Production requires durable provenance and shared atomic consumption state.

Client tools

Add EMILIA verification tools to an MCP client

@emilia-protocol/mcp-server

Expose receipt and passkey verification tools to Claude Desktop, Cursor, Cline, Continue, or another MCP client. Installing this server alone does not mediate another tool’s executor path.

Need the local boundary to hold provider credentials for activated HTTP and MCP paths? EMILIA Host is the private local deployment form of Gate →

✓ RR-1 EnforcedReceipt Required conformance — verified in CI, not asserted.

✓ Missing receipt → 428 Receipt Required

✓ Valid receipt → action runs

✓ Same receipt → replay refused

✓ Forged receipt → refused

Conformance spec →10-minute guide →CI test →

Run the RR-1 gallery locally: FAST=1 node examples/mcp/payment-server.mjs

No receipt, no irreversible action.

Three tiny MCP servers, each with one dangerous tool that refuses to run without a receipt. Run any of them cold — fully offline, no key, no account. Each reads the public Action Risk Manifest and shows the whole loop: 428 refused → a named human signs the exact action → the tool runs → replay refused → forged receipt rejected.

node examples/mcp/payment-server.mjs    # release_payment   — refuses without a receipt
node examples/mcp/github-admin.mjs      # delete_repo       — refuses without a receipt
node examples/mcp/prod-deploy.mjs       # deploy_production — refuses without a receipt
node examples/mcp/supabase-admin.mjs    # run_destructive_sql — refuses without a receipt
node examples/mcp/linear-export.mjs     # export_customer_data — refuses without a receipt

Wrap your own dispatcher with withMcpGuard or a manifest-driven 428 gate — missing receipt → refused, never a silent pass.

Install

One line in any MCP client.

Works in Claude Desktop, Cursor, Cline, Continue, or your own loop. Public read tools need no key; set EP_API_KEY for write operations.

// Claude Desktop / any MCP client — add to your config:
{
  "mcpServers": {
    "emilia": {
      "command": "npx",
      "args": ["-y", "@emilia-protocol/mcp-server"]
    }
  }
}

The flagship: human sign-off

Most MCP servers connect data. This one makes an agent accountable.

01

Agent attempts an irreversible action

release a payment, change a record, deploy

02

EMILIA holds it

428 Receipt Required / signoff_required - the agent cannot proceed alone

03

A named human approves

the signed "yes", bound to the exact action

04

Action proceeds + a receipt is minted

offline-verifiable proof, forever

Reference server + client harness in the repo (mcp-server/passport-demo.mjs); demand side via @emilia-protocol/require-receipt and @emilia-protocol/mcp-guard — add Receipt Required to an MCP server →

What you get today

ep_verify_receipt

Verify any EMILIA authorization receipt offline — signature + Merkle anchor.

ep_verify_signoff

Verify WebAuthn/passkey signoff assertions bound to the exact action.

Public connector tools are verification-only. Rich trust profiles, disputes, delegation, identity continuity, and write APIs require an authenticated EP API key.

Works with your stack

MCP client

npx -y @emilia-protocol/mcp-server

LangChain.js

withGuard() · @emilia-protocol/langchain

CrewAI / AutoGen

guard() decorator · examples/

Any Node service

@emilia-protocol/require-receipt -> 428

MCP tool guard

@emilia-protocol/mcp-guard → signoff + receipt

Verify in JS

@emilia-protocol/verify

Verify in Python

pip install emilia-verify

Authorization receipts verify offline in JavaScript and Python — minted anywhere, checked anywhere. See the 5-minute quickstart.

Find us

npmOfficial MCP Registry

Source →Agent Guard

FAQ

What does the EMILIA MCP server do?

It adds EMILIA verification tools to an MCP client: verify authorization receipts and passkey signoffs. To protect an existing tool dispatcher, use the separate @emilia-protocol/mcp-guard package at the real executor boundary. Rich trust-profile and policy-evaluation APIs require an authenticated EP API key.

How do I install it?

Add it to any MCP client (Claude Desktop, Cursor, Cline, Continue) in one line: command "npx" with args ["-y", "@emilia-protocol/mcp-server"]. Public verification tools need no key; set EP_API_KEY for rich trust APIs or write operations.

How is this different from permissions or OAuth?

Permissions gate access locally and leave no portable proof. EMILIA mints a signed, offline-verifiable authorization receipt bound to the exact action and the named human who approved it — a credential a counterparty can verify without calling home.

Is it open source?

Yes — Apache-2.0, and its models are formally analyzed (26 TLA+ invariants checked by TLC in CI).

FURTHER READING

MCP Authorization Best Practices in 2026 — why scope-level OAuth stops short for tools that move money or trigger irreversible state, and what the next authorization layer adds.