For AI

TKeeper lets an agent host discover permitted identities and request signatures through MCP. An authority document limits what each identity can sign. The system that performs the action verifies the signature before acting.

MCP

Build the mcp feature with the authority modules the agent needs:

./gradlew shadowJar -Pkeeper.features=mcp,agentic-payments,digital-assets -Pkeeper.platforms=ecc

POST /mcp serves MCP 2026-07-28 over Streamable HTTP. It uses the public Keeper server's authentication. The agent host supplies its Keeper token; the model does not need the token. The endpoint supports server/discover, tools/list, and tools/call.

The tool list reflects the token's permissions. Every call checks permission again for its target key. identity.describe_authority returns metadata.description and a JSON Schema for the command. The schema describes valid input; the authority policy decides whether that input is allowed. See MCP connection and tools for setup and the full tool list.

Govern an MCP action

A package release is one example of a governed MCP action. The same tool can request signatures for other typed actions when their executing services verify the result. This authority binds release approval to the package name, version, registry, and artifact digest:

schemaVersion: verdict.authority/v1
id: package-release
type: custom
version: 1.0.0
metadata:
  description: Authorize a package release to the configured registry.
config:
  fields:
    packageName: { type: string }
    version: { type: string }
    registry: { type: string }
    artifactSha256: { type: string }
    nonce: { type: string }
    expiresAt: { type: time }
  effects:
    - type: package.publish
      fields:
        packageName: "$packageName"
        version: "$version"
        registry: "$registry"
        artifactSha256: "$artifactSha256"
policy:
  id: package-release
  fallback: DENY
  approvers:
    release-owner:
      algorithm: ED25519
      publicKey64: "..."
  allow:
    - id: publish-sdk
      where:
        - "packageName == '@example/sdk'"
        - "registry == 'https://registry.npmjs.org'"
        - "effect.one(effects, 'package.publish')"
      approvals:
        threshold: 1
        approvers: [release-owner]

Attach the authority to the signing key through a digest-pinned OCI reference. Give the agent host tkeeper.key.<keyId>.sign only for that key. It can call identity.describe_authority to inspect the command schema, then submit:

POST /mcp HTTP/1.1
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: action.sign
X-JWT-TOKEN: <raw-jwt>

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"action.sign","arguments":{"keyId":"agent-release","command":{"type":"custom","authorityId":"package-release","artifact":{"scheme":"ECDSA","hash":"SHA256","typed":{"packageName":"@example/sdk","version":"2.4.0","registry":"https://registry.npmjs.org","artifactSha256":"<sha256-of-package-tarball>","nonce":"n-123","expiresAt":"2030-01-02T03:04:05Z"}}}},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}

TKeeper first returns APPROVAL_REQUIRED. The release owner reviews the package and build, signs the exact request hash, and the host resubmits the unchanged command with that approval. See four-eye control for the proof format.

The publishing service has registry access. It verifies the TKeeper signature against agent-release and the exact command, compares artifactSha256 with the package tarball it will publish, checks expiresAt, and consumes nonce once. A different tarball needs a new approval. The publisher must be the only path to the registry for this workflow; direct publish credentials would bypass the check. TKeeper authorizes the release command and does not inspect the package for malware.

Agentic payments

The agentic-payments feature adds AP2 (ap2.mandate) and Mastercard Verifiable Intent (mcintent.mandate). Both require a P-256 key and ES256. A policy can limit merchants, payment methods, each purchase, and the total request. For example, the AP2 purchase authority allows the configured shop and card, at most USD 100 per purchase and USD 150 per request; the MC VI authority applies the same limits.

var artifact = new Ap2Mandates(PaymentRequestMode.PAIRED, signingInput, disclosures);
var command = Command.of("test:ap2/purchases", artifact);
var credential = client.signature().compose(
        Sign.of(p256KeyId, command), PaymentCredential.class).credential();

signingInput is the encoded JWS header and payload joined by .; disclosures contains every referenced SD-JWT disclosure. Keeper checks their commitments, runs the authority policy, signs the exact JWS input, and returns a credential layer. Use McMandates for MC VI. The recipient must verify the credential chain, audience, expiry, replay rules, and merchant identity.