alpacahq / alpacahq/alpaca-mcp-server

Add optional AOTrust notarization for agent-executed trades (x402, Ed25519 PDR)

Abierto
#120 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
961
Forks
311
Merge medio
2 d 13 h
PR fusionados (30 d)
4

Descripción

Hi! Great MCP server — we've been running a similar FastMCP production service and know how much care this stack takes.

I'd like to propose an **optional** integration: cryptographic receipts for agent-executed trades.

**The gap:** when an AI agent executes a trade via your MCP server, the agent's principal usually has no tamper-evident, independently-verifiable record of *what* the agent did, *when*, and *under which authorization*. Internal logs work, but they're self-issued — an auditor has to trust the operator.

**What AOTrust adds:** a 239-byte Ed25519-signed receipt (PDR — Provenance Data Record) that proves a specific action happened at a specific time. Receipts are anchored to NEAR blockchain daily, so anyone can verify them offline — no account, no install, no trust in our servers:

```
verify.aotrust.link/?pdr=
```

or programmatically via the public API. The PDR binary spec and an offline Python verifier are open source.

**Proposed change:** add `aotrust-protocol` (on PyPI, MIT) as an *optional* dependency. One line per call site:

```python
from agent_notary import AOTrustTool
receipt = AOTrustTool.run(work_hash=trade_hash) # → Ed25519 PDR, $0.01 x402 (or free tier)
```

- Payment: x402 protocol, $0.01 USDC on Base (EIP-3009), plus a free anonymous tier (5 receipts/IP/24h)
- Works as plain HTTP — no wallet needed on the server side
- Spec + offline verifier + SDK: https://github.com/GitSerge-crypto/aotrust-skills
- Discovery: https://shield.aotrust.link/.well-known/x402.json

Happy to adjust scope (e.g., only for `get_trade_history`-adjacent write ops, or behind a feature flag) — and happy to answer any questions about the trust model. We don't need to trust the notary: spec + offline verifier + daily NEAR anchor means anyone can check receipts independently.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Línea de trabajo

Start by locating the MCP trade-execution entry points, especially write operations adjacent to get_trade_history, then review the linked AOTrust PDR specification and offline verifier. Before implementation, clarify receipt scope, optional-dependency and feature-flag behavior, and x402 payment handling; done should include independently verifiable receipts without affecting users who do not enable the integration.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
blockchain, python
Área
backend, blockchain, security
Tipo de issue
Nueva funcionalidad
Dificultad
5/5
Tiempo estimado
Más de una semana
Estado de actividad
Activo
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.