Kakunin MCP

What kakunin-ai/kakunin-mcp MCP server does

The kakunin-ai/kakunin-mcp MCP server exposes Kakunin's AI agent compliance API through Model Context Protocol. It is intended for agents that need to establish whether a requested operation is within their assigned authority, inspect their current behavioral risk, and record events associated with their activity.

Authorization checks use the active X.509 certificate and evaluate the agent's permitted action scope, financial limits, and certificate revocation status. The service is described as using X.509 identity issued through AWS KMS and as being aligned with MiCA and the EU AI Act. Those compliance references describe the service's intended context; they do not replace an application's own legal or operational review.

How it works

The kakunin-ai/kakunin-mcp MCP server acts on behalf of one Kakunin agent, identified by an agent ID. A Kakunin API key authenticates requests, while the server uses the configured base URL to reach the API. The default endpoint is https://kakunin.ai, with an optional override for other environments.

verify_agent_scope accepts an action description, venue, and USD amount. It returns whether the action is allowed, along with a reason, certificate status, and permitted actions. check_risk_score requires no input and returns the rolling 30-day score, a low/medium/high band, the drift trend, and guidance. audit_log_append records a behavioral event and returns a risk score and transaction ID. Events with a score of at least 0.85 trigger a certificate revocation check.

Setup and configuration

The kakunin-ai/kakunin-mcp MCP server requires Node.js 18 or newer, a Kakunin API key, and an agent ID obtained through the Kakunin dashboard. Configure it as a local stdio server with:

{
  "command": "npx",
  "args": ["-y", "@kakunin/mcp"],
  "env": {
    "KAKUNIN_API_KEY": "kak_live_...",
    "KAKUNIN_AGENT_ID": "agt_..."
  }
}

KAKUNIN_API_KEY accepts live or test keys, and KAKUNIN_AGENT_ID selects the agent represented by the server. KAKUNIN_BASE_URL is optional and changes the API base URL. Test keys use Kakunin's sandbox CA, have no cost, and include 100 free certificates per day according to the provided setup notes.

Tools and capabilities

• Verify whether a proposed action fits the certificate and permitted scope.
• Check financial limits and certificate revocation status before execution.
• Read a 30-day risk score, risk band, trend, and recommended guidance.
• Append structured behavioral events to an immutable audit log.
• Receive a transaction ID and risk result after an audit append.

The README identifies Claude and Cursor as supported usage contexts, as well as other MCP-compatible runtimes. The server does not itself execute the proposed business action; verify_agent_scope supplies an authorization result for the calling workflow to use.