Warrant MCP
Stop AI agents from acting without a signed human approval. Issue Ed25519-signed warrants, render them for user review, and verify them before any high-stakes action runs. The local preview needs no key or account. No public Warrant endpoint is deployed yet.
How it works
Three steps. The agent cannot forge or skip any of them.
Agent proposes an action
Before executing pay, transfer, delete, grant, accept, file, send, or execute, the agent calls warrant_issue with the verb and the exact values it intends to use.
User reads and signs
warrant_render surfaces a clear English summary: "Pay $1,200 to Acme Ltd on 2026-09-14." The user sees precisely what they are approving — not a prompt that could be reworded after the fact.
Agent verifies before acting
warrant_verify checks the Ed25519 signature against the payload. If the warrant is tampered with, the check fails. The agent proceeds only on a clean result.
10 tools in the local core
Start the local server to use them. Public access remains pending founder approval.
warrant_issue
Issue a signed warrant. Provide verb and values; returns signed dict and rendering for approval. Verbs: pay, transfer, delete, grant, accept, file, send, execute.
warrant_verify
Verify a warrant. Checks the Ed25519 signature using the public key embedded in the warrant. Returns {valid:true} when the signature is intact; {valid:false, error:<reason>} on any failure.
warrant_render
Render a warrant as human-readable text for review. The rendering is injective — no two distinct payloads produce the same output. Returns {text, lines}.
warrant_revoke
Revoke a warrant by its warrant_id. After revocation, warrant_verify returns {valid:false} even if the signature is intact. Revocation is checked before expiry. Idempotent — revoking again is a no-op.
warrant_list
List warrants. Requires WARRANT_ISSUE_DB. Active by default; include_expired/include_revoked widen the result. Returns {warrants, total, limit, offset}. Paginate via limit and offset.
warrant_stats
Summary counts from the issuance store. Requires WARRANT_ISSUE_DB. Returns {total_issued, active, expired, revoked}. active+expired+revoked=total_issued.
warrant_get
Look up a single warrant by warrant_id. Requires WARRANT_ISSUE_DB. Returns {warrant_id, verb, summary, issued_at, expires_at, revoked}, or NOT_FOUND if the ID is absent from the store.
warrant_purge
Remove expired warrant records. Requires WARRANT_ISSUE_DB. Deletes expired on/before before_utc (default: now). Verb filter for one class. Returns {deleted, purged_before}. Idempotent.
warrant_reissue
Reissue a warrant with a fresh TTL, copying verb and values. Blocked if revoked. Returns new dict, rendering, and reissued_from (original warrant_id).
warrant_schema
Return the list of supported verbs and their field specs. No arguments required. Optional verb filter returns one verb. Returns {verbs: [{verb, fields: [{name, type, label}]}]}.
# Supported verbs pay · transfer · delete · grant · accept · file · send · execute
Local preview config
Start Warrant on port 8004, then add this to your Claude Desktop or Cursor MCP settings file.
{
"mcpServers": {
"warrant": {
"url": "http://localhost:8004/mcp"
}
}
}Why cryptographic warrants?
Prompts can be reworded
A prompt saying "you approved the payment" can say anything the model inferred. A warrant is a frozen, signed structure — the approved values cannot be changed after the user signs.
No server trust required
The public key is embedded in every warrant. Any party — agent, auditor, or court — can verify the signature offline. There is no authority to phone home to.
Injective rendering
warrant_render produces output that uniquely identifies the warrant. Two different approvals cannot produce the same text, so a user reading the summary sees exactly what they are approving.
Works with any agent stack
Standard MCP transport over HTTP. Works with Claude Desktop, Cursor, any MCP-compatible agent framework, or a raw HTTP call. No SDK, no vendor lock-in.
Try the local preview
Start the server locally, then add its localhost URL to your MCP config.