dekimu-mcp 0.1.0 is live on the public npm registry. Running npx @dekimuhq/dekimu-mcp starts a local MCP server that gives any agent three tools: mint a tamper-evident receipt for an action it just took, verify a receipt offline, and run a reproducible GDPR obligation check against a bundled snapshot. It runs on your machine, keeps its signing key in your home directory, sends nothing anywhere at runtime, and is MIT-licensed.
mint_action_receipt takes a description of the action and returns a dekimu.mcp.action.v1 receipt: a canonicalised body signed with Ed25519 by a key the server generates on first run and stores at ~/.dekimu-mcp/key.json. verify_receipt recomputes the signed bytes and checks signature and structure; it returns a result, never throws, and needs no network. gdpr_obligation_check takes a described processing activity and evaluates it against a point-in-time GDPR obligation snapshot vendored into the package (the current snapshot is dated 2026-06-08), so the same input gives the same answer on any machine, today or next year. It is a reproducible check, not legal advice.
Setup is the usual MCP config entry: command npx, args -y @dekimuhq/dekimu-mcp, under whatever name you like. Three smaller tools ride along in the same package: a read-only lookup of the autonomy policy tier for a domain, a reader for a local ecosystem-digest file, and operate_capability, an opt-in door into the Dekimu ecosystem that only goes online once you configure an agent credential and fails closed without one. The default install makes no network calls.
Receipts are self-signed by your local key. They are tamper-evident by construction, alter any field and verification breaks, and they verify offline. But the issuer is you, not a Dekimu trusted issuer. A self-signed receipt proves that whoever holds that key recorded the action as described and that nobody changed the record since; it does not prove to a third party who holds the key. And a receipt proves the tool call happened as recorded, not that the tool's result was correct or safe. Both limits are printed in the README because a receipt that overstates itself is worse than a log line.
A self-signed receipt proves the record was not altered. It does not prove who wrote it. Say which one you have.
Anchored mode is off by default. Set DEKIMU_RECEIPT_MODE to anchored or both and point DEKIMU_ANCHORED_ISSUER_MODULE at a module that exports createAnchoredIssuer(), and the mint path emits a registered ar.action.v1 receipt instead of, or alongside, the local one. The tool name becomes the verb, the inputs and result become salted commits so raw payloads never enter the receipt, and when the call ran under a capability mandate the mandate id and the caveats it consumed are bound into the signed body. The envelope can optionally be wrapped as a W3C Verifiable Credential. The signing and anchoring keys live in the injected issuer, never in the server.
Dekimu Hub is that trusted issuer. It anchors receipts to the public verifier at verify.dekimu.com, which checks a receipt against the issuer's registered key and the daily Merkle root. Issuer trust is published as a signed list, mirrored version by version in anchors-trusted-issuers-chain. The primitives are standard (Ed25519); the composition is under external security review, which is pending. Until it passes, the ceiling on every claim here is designed for, pending external review.
Everything Dekimu publishes as open source now lives on one page, dekimu.com/open-source: the Anchored Receipts specification (anchors-spec, CC0) and the append-only anchors-trusted-issuers-chain, the dekimu-mcp server and the agents.txt package on npm, regulation-as-code (legal obligations as typed predicates over an evidence corpus), and claude-memory (decaying file-based memory for Claude Code). All of it is MIT, Apache-2.0 or CC0; all of it interoperates with Dekimu Hub as the reference implementation; and verify.dekimu.com is the public verifier for the receipts Hub issues.
This post was drafted by an AI system from Dekimu's public engineering record and published with automated checks, without per-post human editing.
← Back to blog