Preview — not for production reliance
Agentic Root TrustPowered by Sectigo
Documentation

Docs More

MCP server

Connect AI agents and assistants to the directory over the Model Context Protocol.

Agentic Root Trust runs a remote Model Context Protocol server. Through it, AI assistants and agents can look up domains, resolve SPIFFE trust domains and check signed assertions.

Endpoint: https://mcp.svid.io/mcp (Streamable HTTP)

Quickstart

Claude Code

sh
claude mcp add --transport http art https://mcp.svid.io/mcp

Claude Desktop and claude.ai: go to Settings → Connectors → Add custom connector, then paste https://mcp.svid.io/mcp.

Other MCP clients: use the URL directly with any client that supports Streamable HTTP. A stdio-only client can bridge with mcp-remote:

json
{ "mcpServers": { "art": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.svid.io/mcp"] } } }

Then ask, for example:

  • "What evidence does the directory have for payments.example.com?"
  • "Is spiffe://agents.payments.example.com/agent/checkout authorized for org_7k3m9q2x8d5f1h4j6n0p2r4t8v?"
  • "What changed in the directory feed recently?"

Tools

Tool Use it to
search_domains Browse the directory, or search by domain prefix.
get_domain See one domain's evidence: separate indicators for domain control, organization identity, representative authority and issuer authorization, plus the latest TLS observation (historical, revocation unchecked), claims, delegations and issuer bindings. There is no trust score.
resolve_trust_domain Get the signed assertion for an exact trust domain, plus a decoded view that is clearly marked unverified.
verify_spiffe_id Check whether a SPIFFE ID is authorized for the organization you expect. It verifies the assertion signature, issuer, audience, validity, organization, path scope and bundle digest.
get_changes Read the public lifecycle feed (activations, rotations, suspensions, withdrawals).
get_jwks See the directory's assertion-signing keys.
get_openapi Get a route index of the API, or the full OpenAPI document.
explain Read short built-in docs: the three checks, evidence types, the assertion, verification steps, key rotation, the change feed.

Resources: art://openapi, art://docs/verification, art://jwks.

Organization tools (optional)

Send a directory service token with the request to add four read-only tools for your organization:

sh
claude mcp add --transport http art https://mcp.svid.io/mcp --header "Authorization: Bearer art_st_..."
Tool Use it to
list_my_claims List your organization's domain claims and their state.
get_claim See one claim's checks, evidence status and next actions.
list_my_bindings List your organization's issuer bindings.
get_binding See one binding with its version history.

Create service tokens in the console. A viewer scope is enough for these tools.

What verify_spiffe_id does and does not tell you

It returns authorized_for_org (true or false), the reasons, assertion_exp and bundle_url.

It checks It does not check
The directory signed the assertion (ES256) The workload's X.509-SVID certificate chain
Issuer, audience and validity window That the workload holds its private key
The exact trust domain and the expected organization ID Anything about agent safety
The SPIFFE ID path is inside the approved scope
The served bundle matches the signed digest

Validate the SVID itself with mTLS against the approved bundle. The tool fetches the directory's keys live for convenience. A production relying party must pin the keys and issuer out of band; see verification. The answer is valid only until assertion_exp (at most 5 minutes).

Safety

  • Read-only. Nothing in the MCP server can change directory state. Trust-changing actions need a passkey step-up in the console, which no token or agent can perform.
  • Untrusted data is labelled. Domain names, organization names and certificate subjects are third-party data. Every result keeps them in a data field and says they are data, not instructions.
  • Tokens are not kept. A service token is forwarded to the directory for that one request. It is never stored or logged.
  • Rate limit. 60 requests per minute per client (IPv4 address or IPv6 /64). Every request counts, and JSON-RPC batches are not accepted: send one message per request.

Reference

Item Value
Endpoint https://mcp.svid.io/mcp
Transport Streamable HTTP, stateless, JSON responses (no sessions, no SSE stream)
Protocol versions 2025-11-25, 2025-06-18, 2025-03-26 and older SDK-supported versions
Server card https://mcp.svid.io/.well-known/mcp-server-card
Authentication None, or Authorization: Bearer art_st_... for the organization tools
Rate limit 60 requests per minute per IPv4 address or IPv6 /64 (every method counts)
Batches Not supported (one JSON-RPC message per request)
Every result includes request_id (quote it when reporting a problem), links, data, untrusted_data_notice