Operate with MCP

Operator check

Configure bounded MCP custody

Provide complete artifact bytes, filename, and MIME type through the installed MCP tool schema. Grant only the operation required; MCP authority remains false.

Substantive records: /reference/mcp · /trust/threat-boundaries

Expected: The tool input and permission boundary match the installed schema.

Exact mechanic

Call the exact MCP verifier tool

import { callReceizTool, createReceizMcpRuntime, parseReceizMcpToolResult } from "@receiz/mcp-server";

const artifactBase64 = process.env.RECEIZ_ARTIFACT_BASE64;
if (!artifactBase64) throw new Error("RECEIZ_ARTIFACT_BASE64 is required");
const runtime = createReceizMcpRuntime();
const toolResult = await callReceizTool(runtime, "receiz_artifact_verify", {
  artifactBase64,
  filename: "proof.receiz",
  mimeType: "application/octet-stream",
});
if (toolResult.isError) throw new Error(toolResult.content[0]?.text ?? "MCP verification failed");
const result = parseReceizMcpToolResult(toolResult);
console.log(result);

Mechanic

receiz_artifact_verify

Authentication and account boundary

MCP executes an allowed tool beneath complete artifact custody; MCP authority is false.

Exact source

node_modules/@receiz/mcp-server/dist/operations.d.ts · SHA-256 9bcc44ccdd7abe00ce7e0e92b5820554759965487dc6f9ee86b71a44a34b606a

Expected: The installed MCP server returns the SDK verification result and artifact binding.

Exact mechanic

Verify outside the model response

import { createReceizClient } from "@receiz/sdk";

const encoded = process.env.RECEIZ_ARTIFACT_BASE64;
if (!encoded) throw new Error("RECEIZ_ARTIFACT_BASE64 is required");
const artifactBytes = Uint8Array.from(Buffer.from(encoded, "base64"));
const receiz = createReceizClient();
const verification = await receiz.verification.verifyArtifact(artifactBytes);
if (verification.status !== "verified-artifact") throw new Error(verification.status);
console.log(verification.status);

Mechanic

receiz.verification.verifyArtifact

Authentication and account boundary

Account-free local verification.

Exact source

node_modules/@receiz/sdk/dist/index.d.ts · SHA-256 3278d551808697d9936ffdf75931358c903bb0cc5a211191b611d4474895f6be

Expected: The installed SDK independently returns its exact status for the same bytes.

Exact mechanic

Run mcp:test

pnpm mcp:test

Mechanic

pnpm mcp:test

Authentication and account boundary

Authorized local repository checkout; the command proves only the checked repository boundary.

Exact source

package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b

Expected: Installed tool schemas, permissions, SDK delegation, and non-authority contracts pass.