Verax is an MCP server that sits between AI agents and their tools, positioned as "the body an agent asks before acting." Its core goal is to make every tool call an agent makes accountable: calls must first pass through a policy gate and leave a signed decision record before execution; calls that were actually executed leave effect rows, which are later reconciled against the corresponding records. Refusals are recorded just like approvals, and calls that policy cannot decide on its own are held until an operator on the local machine approves them. The ledger is kept on the local machine running the body, and the body is only opened after authorization is configured; there is no default token.
The project is published as @verax-ai/body, requires Node 22.6 or later, and uses @verax-ai/body 0.2.1 or newer. The body speaks the MCP protocol over Streamable HTTP at the /mcp path on VERAX_BIND (default 127.0.0.1:8787); before listening, the issuer, JWKS URL, audience, state directory, and policy file must be configured; verax doctor will point out what is missing. Policy determines which scopes of a token can call which tools, and the default policy packages/proxy/policy/default.json denies every call that is not explicitly listed.
Main capabilities include: a policy gate and signed decision records; refusals recorded equally with approvals; holding when policy cannot decide, pending approval by local verax approve; recording and reconciling effect rows after execution; verax verify can operate offline from a running service, reading only the state directory, verifying the ledger offline, and reporting multiple independent conclusions separately, supporting --key, --effect-key, --witness-key, --checkpoint-key for pinning keys, as well as --json output, with exit code 0 meaning verification passed and 1 meaning it did not; an empty ledger directory will not silently succeed. Records use COSE_Sign1 with algorithm -19 (Ed25519, RFC 9864), not the older -8 (EdDSA).
Other capabilities include: verax witness, where a second process signs effect rows and writes persistent checkpoints, otherwise the witness category remains self; verax halt, which turns subsequent calls into signed refusals, and revoked token ids are rejected before any record is written; verax reconcile matches recorded expenses against card statement exports, labeling matched, ghost, and authorized-but-unpaid lines; the tenant key is derived from the token's issuer and subject, and other tenant ids receive a signature rejection; boundary controls including rate and daily counters, rejection when disk is insufficient (HTTP 507), and an outbound allowlist, with fail-closed handling when counters are unreadable; verax doctor and heartbeats can point out missing or expired items in advance. Heartbeats default to every 10 seconds (VERAX_HEARTBEAT_EVERY_MS, minimum 1000 milliseconds), startup lines in starts.jsonl record the interval since the previous heartbeat, and verax verify <stateDir> can summarize offline. Unreadable, expired, or far-future heartbeats are treated as silent; local monitoring triggers a pause by default, and resuming does not continue automatically, requiring the operator to follow the existing recovery path; remote monitoring only reports silence and cannot pause remotely.
Installation and authorization: elevated verax install and verax approve run a copy of the program that only administrators can modify; a copy modifiable by the account is rejected. On Windows it must be run by a separate administrator account, cannot be elevated within the current account, and requires clearing NODE_OPTIONS and starting PowerShell with -NoProfile; on Linux and macOS a root-owned Node must be used. Installation installs @verax-ai/body from the npm registry into an administrator-owned directory, runs it with that Node after signature verification, and the ledger is stored under the service account. On Windows the token is located at %ProgramData%\Verax\agent-token<your SID>\agent.token; on Linux/macOS it is written to ~/.verax/agent.token by a subprocess running under your uid. If port 8787 is occupied, verax install --port 8797 can be used. Version 0.2.2 and later accept --with-conarium, which downloads @conarium-ai/core via npx and runs it as a subprocess; this feature requires network access.
Applicable scenarios: deployments that need to add policygating, signed audit records, and manual approval steps between agents and tools; scenarios that need receipt reconciliation of executed calls; compliance or forensic scenarios that need offline independent verification of the ledger and can pin verification with their own keys; scenarios that need runtime boundaries such as multi-tenant isolation, rate limiting, pause, and revocation. Limitations and information not provided: the biometric panel (verax desktop, verax operator) has not been released; the authentication panel apps/panel is private and not publicly released; scripts/dev-issuer.mjs and scripts/demo-box.mjs are for development only and are not production authorization servers; on Windows, a copy in an elevated account with a user-writable npm prefix is rejected; a monitor and ledger on the same host share that host's trust, so if both disappear together it does not constitute independent evidence; some COSE libraries do not yet support algorithm -19. Security reporting terms and the threat model are in SECURITY.md and docs/THREAT_MODEL.md in the repository, and the capability matrix is in docs/STATUS.md.
