ProofJSON · MCP server

ProofJSON MCP server

Let an AI agent (Claude Desktop, Cursor, …) assess invoices before payment via the Model Context Protocol.

Local stdio only. There is no public remote MCP yet — run it locally. v1 is supplied_data_only: it does not independently verify supplier IBAN ownership, sanctions status or external payment history unless external trust adapters are configured. allow is not a guarantee the invoice is safe.

Repo: github.com/proofjson/mcp-proofjson · MIT · v0.1.1

Tools (exactly three)

assess_invoice_before_payment → allow review block with reasons, confidence, scope, checks performed/not performed.
verify_proofjson_proof → verify a proof for structure, hash and signature (not real-world truth).
list_proofjson_packs → the live Pack Tasks.

No arbitrary fetch, browser, shell, filesystem, proxy or internal scoring exposed.

Install

git clone https://github.com/proofjson/mcp-proofjson
cd mcp-proofjson
npm install
npm run build

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "proofjson": {
      "command": "node",
      "args": ["/ABSOLUTE/PATH/mcp-proofjson/dist/index.js"]
    }
  }
}

Cursor

Add to .cursor/mcp.json (or Cursor Settings → MCP):

{ "mcpServers": { "proofjson": { "command": "node", "args": ["/ABSOLUTE/PATH/mcp-proofjson/dist/index.js"] } } }

Examples

review Invoice IBAN differs from the expected IBAN you supplied → "Ask a human approver to confirm the supplier bank account before payment."

allow Supplier, amount, currency and IBAN match the supplied expectations and policy → "No issue found within the supplied data and policy" (not a guarantee).

block A configured policy rule fails (e.g. duplicate invoice id, or payment to an unknown supplier when policy forbids it) → automated payment should stop.

Security model

Thin client of the public ProofJSON API — no engine, scoring, secrets or infra in the package.
Calls only /v1/assess/invoice and /a2a/card over HTTPS.
The assessment engine runs server-side (results-only). The user's invoice content is processed to produce the decision and not retained by default.

Why no public remote MCP yet

A remote MCP that decides on payments needs auth, rate limits, audit logs, tenant isolation, abuse monitoring, documented retention, a tested remote transport and a security review first. Until then: local stdio only.

GitHub · X @ProofJSON · OpenAPI · Capability · GPT Action · Privacy · Terms · Home