MCP server
@mintid/verifier-mcp: the verifier-service contract operations as Model Context Protocol tools — transport-only, with no external runtime dependencies, inside your own perimeter.
Overview
@mintid/verifier-mcp is an MCP server you run inside your own perimeter, next to the verifier service you already deploy yourself. Registered as a local MCP server in your agent runtime, it makes the contract operations available as tools that any MCP-capable framework can list and call.
Like @mintid/verifier-client — its only dependency and its transport — it is transport-only: no cryptography, no chain access, no replay store, no policy, and no external runtime dependencies. The single-use value, the session identifier and the ten-second expiry are generated by the verifying core; no tool argument can set them.
The three tools
One tool per operation of the frozen contract — no aggregate helpers, no convenience wrappers that could reorder a flow:
| Tool | Contract operation |
|---|---|
| build information | GET /v1/build-info |
| create a challenge | POST /v1/challenges |
| validate a presentation | POST /v1/presentations |
The contract is untouched by this package: same request and response shapes, same closed reason-code vocabulary, same decisions as every other client in every other language.
Error semantics (the part that survives the protocol hop)
A rejection is a successful tool result. A presentation that fails — replayed nonce, stale status root, missing predicate — comes back as { accepted: false, reason_code }, so the calling agent can reason about why instead of retrying blindly.
Only transport failures are tool errors: a body the service cannot parse, proven chain state unavailable (fail-closed — retry later, never bypass), or the service unreachable. Branch on data, not on exceptions.
Trust boundary
This server is part of your verifier deployment. Run it inside your perimeter, pointed exclusively at your own service instance: pointing it at anyone else’s service would hand them the acceptance decision, which is your obligation as a registered verifier.
The server persists nothing and logs nothing; your service keeps the only decision record.