alpacahq / alpacahq/alpaca-mcp-server
Add optional AOTrust notarization for agent-executed trades (x402, Ed25519 PDR)
- Lenguaje dominante
- Python
- Estrellas
- 961
- Forks
- 311
- Merge medio
- 2 d 13 h
- PR fusionados (30 d)
- 4
Descripción
Hi! Great MCP server — we've been running a similar FastMCP production service and know how much care this stack takes.
I'd like to propose an **optional** integration: cryptographic receipts for agent-executed trades.
**The gap:** when an AI agent executes a trade via your MCP server, the agent's principal usually has no tamper-evident, independently-verifiable record of *what* the agent did, *when*, and *under which authorization*. Internal logs work, but they're self-issued — an auditor has to trust the operator.
**What AOTrust adds:** a 239-byte Ed25519-signed receipt (PDR — Provenance Data Record) that proves a specific action happened at a specific time. Receipts are anchored to NEAR blockchain daily, so anyone can verify them offline — no account, no install, no trust in our servers:
```
verify.aotrust.link/?pdr=
```
or programmatically via the public API. The PDR binary spec and an offline Python verifier are open source.
**Proposed change:** add `aotrust-protocol` (on PyPI, MIT) as an *optional* dependency. One line per call site:
```python
from agent_notary import AOTrustTool
receipt = AOTrustTool.run(work_hash=trade_hash) # → Ed25519 PDR, $0.01 x402 (or free tier)
```
- Payment: x402 protocol, $0.01 USDC on Base (EIP-3009), plus a free anonymous tier (5 receipts/IP/24h)
- Works as plain HTTP — no wallet needed on the server side
- Spec + offline verifier + SDK: https://github.com/GitSerge-crypto/aotrust-skills
- Discovery: https://shield.aotrust.link/.well-known/x402.json
Happy to adjust scope (e.g., only for `get_trade_history`-adjacent write ops, or behind a feature flag) — and happy to answer any questions about the trust model. We don't need to trust the notary: spec + offline verifier + daily NEAR anchor means anyone can check receipts independently.
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Línea de trabajo
Start by locating the MCP trade-execution entry points, especially write operations adjacent to get_trade_history, then review the linked AOTrust PDR specification and offline verifier. Before implementation, clarify receipt scope, optional-dependency and feature-flag behavior, and x402 payment handling; done should include independently verifiable receipts without affecting users who do not enable the integration.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- blockchain, python
- Área
- backend, blockchain, security
- Tipo de issue
- Nueva funcionalidad
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Estado de actividad
- Activo
- Claridad
- Bastante claro
- Aptitud para principiantes
- 35/100