Costheta

What the costheta MCP server does

The costheta MCP server is documented as a public verifier for costheta decision certificates. Its purpose is to let a consumer check whether a certificate is internally consistent and signed by the expected keys. The source description connects costheta with physical randomness obtained from cosmic-ray detections, while the verifier repository focuses on checking certificates rather than describing how those decisions are produced.

A certificate body is first checked against its canonical hash. The verifier then checks two cryptographic signatures: an Ed25519 signature following RFC 8032 and an ML-DSA signature following FIPS 204. The public keys used for those checks are published at costheta.dev/keys.

How it works

A consumer supplies or receives a costheta decision certificate, then runs the documented verification process against the certificate's body and signatures. The body hash provides a check that the signed content matches its canonical representation. Signature verification uses the published public keys, allowing the consumer to test authenticity without relying only on the certificate's embedded data.

The certificate format referenced by the repository is version 0.3. Its specification is maintained in the costheta federation proposal repository. Applications that need interoperability should use that specification when interpreting certificate fields and should account for the stated format version.

Tools and capabilities

The documented costheta MCP server capabilities are certificate-validation operations:

• Check the canonical hash of a certificate body.
• Verify an Ed25519 signature using RFC 8032 rules.
• Verify an ML-DSA signature using FIPS 204 rules.
• Use public verification keys published at costheta.dev/keys.

These capabilities support validation of an existing certificate. The provided material does not document decision-generation tools, cosmic-ray data access, paid decision requests, or named MCP tool identifiers.

Limitations and notes

The repository is described as a public verifier, not as a source for producing new decisions. Its description also says that the implementation code will land shortly, so the available implementation may be incomplete relative to the certificate specification. No installation command, transport, MCP client configuration, environment variables, license, or client-specific integration is provided in the supplied material.

The verifier depends on the certificate format and public-key material referenced by the project. Changes to the federation proposal, the v0.3 format, or the keys published at costheta.dev/keys may affect interoperability. Review those sources before building a production validation flow.