# Acta — Verifiable Agent Memory

**Category:** 🧠 Knowledge & Memory  
**Repository:** https://github.com/Kylewilson04/acta-mcp.git  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/acta-verifiable-agent-memory

## Description
Verifiable agent memory with signed ledger receipts — verify every write offline.

## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):

```json
"mcpServers": {
  "acta-verifiable-agent-memory": {
    "command": "npx",
    "args": ["-y","acta-verifiable-agent-memory"]
  }
}
```

## Documentation & README

# acta-mcp — standalone distribution

> **Source of truth:** [github.com/Kylewilson04/acta](https://github.com/Kylewilson04/acta) (`crates/acta-mcp/`)

This repository is the **distribution surface** for the acta-mcp MCP server binary.
All source code, CI pipelines, and reproducible builds live in the
[acta monorepo](https://github.com/Kylewilson04/acta). This repo holds the
standalone artifact releases and documentation.

## Binary releases

Pre-built binaries for every supported platform are published as GitHub
Releases on **this** repository, built by the
[release-mcp.yml](https://github.com/Kylewilson04/acta/blob/main/.github/workflows/release-mcp.yml)
workflow in the monorepo.

### Supported platforms

| Platform | Target triple | Archive |
|----------|--------------|---------|
| Linux x86_64 | `x86_64-unknown-linux-musl` | `.tar.gz` |
| Linux ARM64 | `aarch64-unknown-linux-musl` | `.tar.gz` |
| macOS x86_64 | `x86_64-apple-darwin` | `.tar.gz` |
| macOS ARM64 | `aarch64-apple-darwin` | `.tar.gz` |
| Windows x86_64 | `x86_64-pc-windows-msvc` | `.zip` |

### Verify before installing

```bash
# 1. Download binary, checksum, and signature
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz.sha256
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz.sig
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz.cert

# 2. Verify checksum
sha256sum -c acta-mcp-<VERSION>-<TARGET>.tar.gz.sha256

# 3. Verify sigstore/cosign signature (keyless)
cosign verify-blob \
  --certificate acta-mcp-<VERSION>-<TARGET>.tar.gz.cert \
  --signature acta-mcp-<VERSION>-<TARGET>.tar.gz.sig \
  acta-mcp-<VERSION>-<TARGET>.tar.gz

# 4. Verify provenance
tar xzf acta-mcp-<VERSION>-<TARGET>.tar.gz
./acta-mcp --version --json
# Expected output includes:
#   - git_commit: full SHA (not "unknown")
#   - has_release_provenance: true
#   - build_target: the target triple
```

Full verification guide: [`RELEASE_VERIFICATION.md`](https://github.com/Kylewilson04/acta/blob/main/docs/RELEASE_VERIFICATION.md)

Each release includes:
- `acta-mcp-source-<version>-<commit>.tar.gz` — deterministic source archive with `PROVENANCE.txt`
- `acta-mcp-<version>-<target>.tar.gz` (or `.zip`) — platform binary
- `.sha256` checksum for every artifact
- `.sig` sigstore/cosign signature + `.cert` signing certificate (MCP-P1-004)
- `.sigstore.json` SLSA provenance attestation
- `acta-mcp-sbom.spdx.json` — Software Bill of Materials
- `mcp-manifest.json` — full artifact-to-source mapping

## Build from source (reproducible)

To build the binary yourself from the tagged source commit:

```bash
# Clone the monorepo at the release tag
git clone https://github.com/Kylewilson04/acta
cd acta
git checkout mcp-v<VERSION>

# Export and validate the deterministic source archive
bash scripts/export-mcp-release.sh
bash scripts/mcp-archive-check.sh acta-mcp-source-*.tar.gz

# Build with provenance
ACTA_MCP_GIT_COMMIT=$(git rev-parse HEAD) \
ACTA_MCP_GIT_REF=$(git describe --tags --exact-match) \
ACTA_MCP_BUILD_TARGET=$(rustc -vV | grep host | cut -d' ' -f2) \
cargo build -p acta-mcp --release --locked

# Verify the binary
./target/release/acta-mcp --version
./target/release/acta-mcp --version --json
```

### CI pipeline

The canonical build pipeline is `.github/workflows/release-mcp.yml` in the
acta monorepo. It ensures:

1. **Source archive validation** — archive content check against required files
2. **Toolchain pinning** — Rust 1.87.0 with locked dependencies (`--locked`)
3. **Multi-platform builds** — 5 targets with format/lint/test then release
4. **Provenance injection** — `ACTA_MCP_GIT_COMMIT`, `ACTA_MCP_GIT_REF`, `ACTA_MCP_BUILD_TARGET`
5. **Binary smoke test** — `--version --json` verifies provenance fields are present
6. **Checksums + SBOM + manifest** — every artifact is cryptographically bound to source

## MCP server

MCP server for **Acta** — verifiable, structured, portable agent memory.

Every write produces an Ed25519-signed ledger receipt (`aea_id`) verifiable offline
with no server and no database.

- MCP Registry name: `mcp-name: io.github.Kylewilson04/acta-mcp`

### Tools

| Tool | Description |
|------|-------------|
| `acta_write_intent` | Store a standing or task intent |
| `acta_write_claim` | Append a signed subject→predicate→object claim |
| `acta_commit_memory` | Store a note/observation/document chunk |
| `acta_read_context` | Compile a signed context bundle (intents + claims + memory) |
| `acta_get_state_root` | Current signed ledger state root |
| `acta_verify` | Verify the full ledger chain offline |
| `acta_answer_lookup` | Check the verifiable answer cache before expensive work |
| `acta_answer_put` | Memoize a final answer with a signed provenance receipt |

The authoritative tool registry is
[`api/mcp-tool-registry-v1.json`](https://github.com/Kylewilson04/acta/blob/main/crates/acta-mcp/api/mcp-tool-registry-v1.json)
in the monorepo.

### Install

Download the binary from [Releases](https://github.com/Kylewilson04/acta-mcp/releases) and add to your MCP config:

```json
{
  "mcpServers": {
    "acta": {
      "command": "/path/to/acta-mcp",
      "env": {
        "ACTA_URL": "http://localhost:8088",
        "ACTA_TENANT": "my-agent"
      }
    }
  }
}
```

### Environment variables

| Variable | Default | Description |
|---|---|---|
| `ACTA_URL` | `http://127.0.0.1:8088` | Acta server base URL |
| `ACTA_TENANT` | `default` | Tenant / agent identifier |
| `ACTA_API_KEY` | — | API key when server auth is enabled |
| `ACTA_CONNECT_TIMEOUT` | `5` | Backend connect timeout in seconds |
| `ACTA_REQUEST_TIMEOUT` | `30` | Backend request timeout in seconds |

### Configuration fingerprint (CTRL-CFG-001)

At startup, acta-mcp emits a redacted SHA-256 config fingerprint that includes
non-sensitive structural config (has_api_key flag, tenant name, backend presence)
but never secrets or raw URLs. Use `--version --json` for the full provenance block.

### Verification

```bash
curl -s $ACTA_URL/v1/verify/<aea_id>
# → { "found": true, "chain_valid": true, "signatures_valid": true }

curl -s $ACTA_URL/v1/ledger/export | acta-verify -
# → RESULT: VALID
```

## Security invariants

1. **No binary may be distributed without release provenance** — a binary reporting
   `has_release_provenance: false` or `git_commit: "unknown"` MUST NOT be
   published as a release artifact.
2. **Every release must pass `mcp-archive-check.sh`** — a README-only archive
   (v1.0.0-rc.1) must never happen again.
3. **All artifacts are checksummed AND signed** — operators must run `mcp-install-verify.sh`
   before configuring any MCP client. Cosign `.sig`/`.cert` files prove the
   artifact was produced by the official CI workflow (MCP-P1-004).
4. **Contract digests are embedded at build time** — API and tool registry
   digests enable runtime verification of contract integrity.
5. **SLSA provenance attestation** — `.sigstore.json` proves the build
   environment, source commit, and workflow that produced each artifact
   (MCP-P1-004).

## Prior release notice (MCP-P0-001)

**v1.0.0-rc.1 MCP artifacts are UNVERIFIABLE.** The standalone archive distributed
with that release contained only `README.md`. No source, lockfile, license, or
build provenance was included. **Do not distribute or use binaries from that
release.** Use mcp-v1.0.0-rc.2 or later.