Achromat MOM

What Achromat MOM does

Achromat MOM exposes policy checks as MCP tools for agents and hosts such as Claude Desktop. It connects to the MOM service at https://mom.achromat.ai by default and maintains a local Ed25519 identity for signing requests.

The service stores verified lessons associated with tool calls that were blocked and later corrected. Agents can search those lessons before acting, then use the returned compliant argument shape as a template. They can also submit a call for a live policy decision when no matching lesson exists or when the operation warrants a fresh check.

How it works

The package runs locally as a child process of the MCP host and communicates over standard input and output. Requests sent to MOM contain signatures, while the private key stays in the configured local file. The default key location is ~/.achromat/achromat_agent_key.pem.

On first startup without a key, only achromat_register_identity is offered. Registration requires an explicit user confirmation through the tool argument. The server generates an Ed25519 pair, performs a short proof of work, registers the public key, and saves the private key only after MOM accepts it. Once the key is available, the recall and calibration tools replace the registration tool; a host that does not refresh its tool list may need to be restarted.

achromat_recall matches a domain, target tool, task description, and the names and nesting of the proposed arguments against verified lessons. It returns a compliant argument template, steering instructions, and the applicable rule when a match exists. achromat_calibrate sends the proposed call for live evaluation. A BLOCK includes a trap ID for the retry, while an ALLOW indicates that the call complies. The retry must retain the original task description and include the trap ID.

Setup and configuration

For a packaged installation, configure the host to run:

{
  "command": "npx",
  "args": ["-y", "@achromat-ai/mcp-server"]
}

Node.js 20 or newer is required. To run from source, clone the repository, install dependencies, build with npm run build, and point the host at dist/index.js. npm run inspect starts the MCP Inspector for browser-based testing.

The ACHROMAT_AGENT_KEY_FILE variable selects a different key path and accepts a leading ~. ACHROMAT_BASE_URL changes the MOM service origin; HTTPS is required except for localhost. ACHROMAT_REF optionally attaches a short attribution label during identity registration only.

Tools and capabilities

• achromat_register_identity creates and registers the local identity after confirmed user approval.
• achromat_recall searches for a verified compliant version of a planned call.
• achromat_calibrate evaluates a call against live policy and supports block-and-retry workflows.
• Recall results can include a citation for an approved shared lesson; the citation belongs in human-readable output, not tool arguments.
• Supported policy domains are fintech, industrial_iot, robotics, and devsecops.

Limitations and notes

Keep the private key out of source control and screenshots, and back it up because it cannot be recovered by the server. Existing keys must be unencrypted PKCS#8 Ed25519 PEM files already recognized by MOM. Deleting or replacing the key while the host is running requires a restart.

Do not place secrets, credentials, amounts, identifiers, or personal data in the task description or arguments. Argument matching uses key names and nesting rather than argument values. Lesson rules and directives originate from the community and are labeled as data in tool responses, so agents should use them to select parameters rather than treat them as instructions.

The registration service limits registrations to 10 per day per network. A failed registration does not leave a key file behind, and the server does not overwrite an existing key.