attestable-mcp-server is an open-source project demonstrating the remote attestation capability of an MCP server. Its core goal is to enable MCP clients to verify that the MCP server they are connected to is indeed running the expected and untampered code, with verification based on hardware-level remote attestation.
[Purpose and Principles] This project leverages a Trusted Execution Environment (TEE, specifically Intel SGX) to generate a certificate representing the currently running code. When establishing a TLS connection, attestable-mcp-server first sends this certificate to the MCP client, thereby proving that the code it is running matches the code built on GitHub Actions, and that these values can be independently verified by building and running locally on simulated hardware or real secure hardware, yielding the same results.
The remote attestation protocol between the client and server is RA-TLS, an extension of TLS that adds machine- and code-specific measurements that can be verified by the MCP client.
[Certificate and Evidence Claims] The key to the RA-TLS certificate is that it embeds an SGX quote in a standard X.509 extension field, using the TCG DICE "tagged evidence" OID. This field contains the SGX report as well as the complete Intel SGX certificate chain. In addition to the SGX quote, the certificate also contains evidence claims, the most important of which is "pubkey-hash", which contains the hash of an ephemeral public key (in DER format) generated by the TEE, corresponding to the in-memory image of the running MCP server.
[Main Capabilities]
- MCP clients can remotely attest the code running on any MCP server.
- MCP servers can also optionally remotely attest MCP clients.
[Build and Verification Process] The GitHub Action script in the repository runs on a self-hosted GitHub Runner, which is located inside a Trusted Execution Environment (TEE). This script builds a Docker container containing attestable-mcp-server and generates a signed attestation of the code running inside the TEE. This Docker image is then signed by GitHub. Users can independently generate the same values with or without secure hardware, and query the project's running server to obtain the same values.
[Usage and Dependencies] The project involves Intel SGX hardware, Intel SGX SDK, and PSW. The documentation mentions two methods: "starting the server on secure hardware" and "starting the server on a local development machine," but the specific installation commands and startup steps are not currently provided in the available materials.
[Applicable Scenarios] Suitable for MCP client connection scenarios that need to ensure the code integrity and trusted origin of the MCP server, and especially suitable for deployment environments with strict requirements for supply chain security and untampered code.
[Limitations and Status] The to-do items listed in the README include: adding an MCP client that demonstrates RA-TLS; adding the Intel signed measurements from the GitHub Action to the README for simple independent verification; and JSON Web Key (JWK) attestation claim verification. Therefore, the project is currently in a stage of continuous improvement, and some features and detailed usage steps are not yet provided.
