FractalAI Post Quantum Proofs

What FractalAI Post-Quantum Proofs MCP server does

FractalAI Post-Quantum Proofs MCP server connects MCP clients to the public FractalAI deployment at https://fractalai.net.co. It exposes post-quantum signature verification, signature issuance, provenance sealing, AI decision attestation, and x402 payment discovery through MCP over stdio.

The direct signature format used by the tools is ML-DSA-65, also known as Dilithium-3, at NIST FIPS 204 Category 3. The service is relevant to the 🔑 Cryptography category when an agent needs a signed record that can be checked against a public key or retained as evidence of what was submitted.

How it works

Free operations can be called directly. verify_proof checks a supplied signed byte sequence, signature, and public key, then returns a validity result and verdict. x402_checkout reports the payment requirements for a resource, including the amount, USDC asset, Base network, treasury address, accepted payment entries, and the service’s x402 manifest.

Paid operations use a two-step facilitator-less x402 flow. First, call the target tool without payment_tx_hash; the response contains the exact accepts[] payment challenge. Transfer the specified USDC on Base to the returned payTo address, wait for confirmation, and call the same tool again with the transaction hash. Each transaction hash pays for one call, and the service applies anti-replay enforcement.

The FractalAI Post-Quantum Proofs MCP server sends requests to the configured FractalAI endpoint; the repository does not provide a local cryptographic implementation or mock deployment. The returned signature proves that the exact submitted bytes were signed by the service key. It does not establish that the signed content is true.

Setup and configuration

From the repository’s integrations/mcp directory, install dependencies and build the server:

npm install
npm run build

Run the resulting entrypoint with node dist/index.js. It communicates over standard input and output using MCP; diagnostic logging is written to stderr so stdout remains available for JSON-RPC traffic.

An MCP client can register the server with the built dist/index.js path. Claude Desktop uses a configuration entry with command set to node and the absolute entrypoint path in args. The optional FRACTALAI_BASE_URL environment variable overrides the default public endpoint, https://fractalai.net.co.

Tools and capabilities

• verify_proof: Free verification of an ML-DSA-65/Dilithium-3 signature using a base64 signed message, signature, and public key.
• x402_checkout: Free inspection of live payment requirements and the .well-known/x402.json manifest.
• pqc_sign: Purchases one signature over a message’s SHA-256 digest or over a supplied hexadecimal hash. The listed price is $0.02 USDC.
• seal_provenance: Purchases a content seal containing a drand round, a self-contained ML-DSA-65/Dilithium-3 signature, and an attempted on-chain anchor. The listed price is $0.05 USDC.
• attest_decision: Purchases a record of a declared AI decision containing input hash, output, model, timestamp, append-only Black Box chaining, an on-chain VAID-1 anchor attempt, and a self-contained signature. The listed price is $0.05 USDC.

The provenance and decision tools also write a separate on-chain anchor using the server’s node-bound Dilithium-2 key. That anchor is additional to the ML-DSA-65/Dilithium-3 signature returned for direct verification.

Limitations and notes

FractalAI Post-Quantum Proofs MCP server depends on the live public service and its network availability. Paid tools do not return fabricated results when payment is missing; they return the payment challenge instead. The caller must handle the USDC transfer on Base and provide the confirmed transaction hash.

A provenance seal is a provenance record, not a content audit. A decision attestation notarizes what an agent declared and does not assess whether the decision was correct. ML-DSA-65/Dilithium-3 is described as resistant to known classical and quantum attacks under NIST FIPS 204, but it is not presented as unbreakable. The service’s separate on-chain anchor uses a node-bound Dilithium-2 key, so it should not be confused with the direct signature format used by the tools.