acta-mcp — standalone distribution

Source of truth: github.com/Kylewilson04/acta (crates/acta-mcp/)

This repository is the distribution surface for the acta-mcp MCP server binary. All source code, CI pipelines, and reproducible builds live in the acta monorepo. This repo holds the standalone artifact releases and documentation.

Binary releases

Pre-built binaries for every supported platform are published as GitHub Releases on this repository, built by the release-mcp.yml workflow in the monorepo.

Supported platforms

Verify before installing

# 1. Download binary, checksum, and signature
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz.sha256
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz.sig
curl -LO https://github.com/Kylewilson04/acta-mcp/releases/download/mcp-v<VERSION>/acta-mcp-<VERSION>-<TARGET>.tar.gz.cert

# 2. Verify checksum
sha256sum -c acta-mcp-<VERSION>-<TARGET>.tar.gz.sha256

# 3. Verify sigstore/cosign signature (keyless)
cosign verify-blob \
  --certificate acta-mcp-<VERSION>-<TARGET>.tar.gz.cert \
  --signature acta-mcp-<VERSION>-<TARGET>.tar.gz.sig \
  acta-mcp-<VERSION>-<TARGET>.tar.gz

# 4. Verify provenance
tar xzf acta-mcp-<VERSION>-<TARGET>.tar.gz
./acta-mcp --version --json
# Expected output includes:
#   - git_commit: full SHA (not "unknown")
#   - has_release_provenance: true
#   - build_target: the target triple

Full verification guide: RELEASE_VERIFICATION.md

Each release includes:

• acta-mcp-source-<version>-<commit>.tar.gz — deterministic source archive with PROVENANCE.txt
• acta-mcp-<version>-<target>.tar.gz (or .zip) — platform binary
• .sha256 checksum for every artifact
• .sig sigstore/cosign signature + .cert signing certificate (MCP-P1-004)
• .sigstore.json SLSA provenance attestation
• acta-mcp-sbom.spdx.json — Software Bill of Materials
• mcp-manifest.json — full artifact-to-source mapping

Build from source (reproducible)

To build the binary yourself from the tagged source commit:

# Clone the monorepo at the release tag
git clone https://github.com/Kylewilson04/acta
cd acta
git checkout mcp-v<VERSION>

# Export and validate the deterministic source archive
bash scripts/export-mcp-release.sh
bash scripts/mcp-archive-check.sh acta-mcp-source-*.tar.gz

# Build with provenance
ACTA_MCP_GIT_COMMIT=$(git rev-parse HEAD) \
ACTA_MCP_GIT_REF=$(git describe --tags --exact-match) \
ACTA_MCP_BUILD_TARGET=$(rustc -vV | grep host | cut -d' ' -f2) \
cargo build -p acta-mcp --release --locked

# Verify the binary
./target/release/acta-mcp --version
./target/release/acta-mcp --version --json

CI pipeline

The canonical build pipeline is .github/workflows/release-mcp.yml in the acta monorepo. It ensures:

1. Source archive validation — archive content check against required files
2. Toolchain pinning — Rust 1.87.0 with locked dependencies (--locked)
3. Multi-platform builds — 5 targets with format/lint/test then release
4. Provenance injection — ACTA_MCP_GIT_COMMIT, ACTA_MCP_GIT_REF, ACTA_MCP_BUILD_TARGET
5. Binary smoke test — --version --json verifies provenance fields are present
6. Checksums + SBOM + manifest — every artifact is cryptographically bound to source

MCP server

MCP server for Acta — verifiable, structured, portable agent memory.

Every write produces an Ed25519-signed ledger receipt (aea_id) verifiable offline with no server and no database.

• MCP Registry name: mcp-name: io.github.Kylewilson04/acta-mcp

Tools

The authoritative tool registry is api/mcp-tool-registry-v1.json in the monorepo.

Install

Download the binary from Releases and add to your MCP config:

{
  "mcpServers": {
    "acta": {
      "command": "/path/to/acta-mcp",
      "env": {
        "ACTA_URL": "http://localhost:8088",
        "ACTA_TENANT": "my-agent"
      }
    }
  }
}

Environment variables

Configuration fingerprint (CTRL-CFG-001)

At startup, acta-mcp emits a redacted SHA-256 config fingerprint that includes non-sensitive structural config (has_api_key flag, tenant name, backend presence) but never secrets or raw URLs. Use --version --json for the full provenance block.

Verification

curl -s $ACTA_URL/v1/verify/<aea_id>
# → { "found": true, "chain_valid": true, "signatures_valid": true }

curl -s $ACTA_URL/v1/ledger/export | acta-verify -
# → RESULT: VALID

Security invariants

1. No binary may be distributed without release provenance — a binary reporting has_release_provenance: false or git_commit: "unknown" MUST NOT be published as a release artifact.
2. Every release must pass mcp-archive-check.sh — a README-only archive (v1.0.0-rc.1) must never happen again.
3. All artifacts are checksummed AND signed — operators must run mcp-install-verify.sh before configuring any MCP client. Cosign .sig/.cert files prove the artifact was produced by the official CI workflow (MCP-P1-004).
4. Contract digests are embedded at build time — API and tool registry digests enable runtime verification of contract integrity.
5. SLSA provenance attestation — .sigstore.json proves the build environment, source commit, and workflow that produced each artifact (MCP-P1-004).

Prior release notice (MCP-P0-001)

v1.0.0-rc.1 MCP artifacts are UNVERIFIABLE. The standalone archive distributed with that release contained only README.md. No source, lockfile, license, or build provenance was included. Do not distribute or use binaries from that release. Use mcp-v1.0.0-rc.2 or later.