ProofSlip

What the ProofSlip MCP server does

The ProofSlip MCP server gives MCP-compatible agents access to ProofSlip’s legacy workflow receipt API. Its tools cover four operations: creating a receipt, verifying an existing receipt, checking receipt status, and signing up for an API key.

These receipts are separate from ProofSlip’s newer release-proof/v1 records. The published MCP integration does not create GitHub Actions release proofs. Those proofs are created through a dedicated HTTP endpoint using a GitHub Actions OIDC token, while the MCP package works with the original receipt workflow.

A suitable use case is an agent workflow that needs to submit a receipt, inspect whether a receipt is valid, or poll an asynchronous receipt until its status is available. The service also provides unauthenticated verification and status endpoints for legacy receipts, while receipt creation uses a ProofSlip API key.

How it works

Install and run the package with Node.js through npx:

npx -y @proofslip/mcp-server

The package starts an MCP server that exposes the following tools:

• create_receipt submits a legacy workflow receipt.
• verify_receipt verifies a receipt by its identifier.
• check_status polls the status of a receipt.
• signup creates an API key for the legacy receipt API.

The service’s legacy receipt records are short-lived. They expire after at most 24 hours and are removed by automated cleanup. This retention model differs from release proofs, which remain inspectable after their 90-day validity window.

Setup and configuration

The README documents the package command but does not specify MCP-specific environment variables or client configuration. An MCP client must be able to launch an npx-based stdio server. The signup tool can be used when an API key is needed for legacy receipt creation.

For local development of the ProofSlip application itself, the repository documents Node.js 18 or newer and PostgreSQL, along with variables such as DATABASE_URL, BASE_URL, and PROOFSLIP_API_KEY. Those settings belong to running the application repository and are not identified as required configuration for the published MCP package.

The repository also documents a separate agent skill for Codex, Claude Code, Cursor, and other compatible agents. That skill verifies release-proof URLs and prepares GitHub Actions changes, but it is distinct from the MCP package and its legacy receipt tools.

Tools and capabilities

The ProofSlip MCP server provides a narrow receipt-oriented interface:

• Create a legacy receipt through ProofSlip.
• Verify an existing receipt without requiring public verification credentials.
• Check the current status of a receipt.
• Sign up for an API key used by the legacy receipt API.

The broader ProofSlip service supports public proof URLs, but the MCP listing is specifically tied to the legacy receipt API. If the required evidence is that a particular GitHub Actions job ran for a particular commit, use the release-proof HTTP API or the documented agent skill instead of assuming the MCP tools provide that evidence.

Limitations and notes

The MCP integration does not expose release-proof creation according to the repository documentation. It should not be treated as a way to prove that tests passed, that an entire workflow succeeded, or that a deployment contains a claimed commit.

Legacy receipts have a maximum lifetime of 24 hours and are deleted during automated cleanup. Release-proof URLs can expose repository metadata and submitted context, but those release-proof privacy details do not change the scope of the legacy MCP receipt tools.

ProofSlip is an MCP server for the legacy API, so client compatibility depends on launching the published package as an MCP process. The repository explicitly names Codex, Claude Code, and Cursor for its separate skills-compatible workflows; it does not document client-specific MCP configuration beyond the package command.