Attestable MCP Server

This project is a remotely verifiable MCP server that uses trusted execution environments (such as Intel SGX) and the RA-TLS protocol to ensure that clients can verify the authenticity and integrity of the code running on the server.

Security Developer tools #Remote verification #MCP protocol #Trusted computing #SGX .Python

rating : 2 points

downloads : 15

update time : 2025-04-29

What is Attestable MCP Server?

This is a secure server implementation of the Model Context Protocol (MCP) that allows clients to verify its authenticity before connecting. It uses Intel SGX secure hardware to generate cryptographic proof that the server is running the exact code you expect.

How does remote attestation work?

The server provides a special certificate during connection that contains hardware-verified measurements of its running code. Clients can compare these measurements against known-good values to ensure the server hasn't been tampered with.

When should you use this?

Ideal for sensitive AI model deployments where you need to verify server integrity, or for regulatory compliance scenarios requiring proof of secure computation environments.

Key Features

Client-Verifiable IntegrityClients can cryptographically verify the server is running approved code before sharing sensitive data

Hardware-Protected ExecutionRuns in Intel SGX secure enclaves that protect against host system compromise

Reproducible BuildsAll build artifacts are verifiable against GitHub Actions logs for complete transparency

Benefits and Considerations

Benefits

Eliminates trust in server operators - verify code yourself

Protects against supply chain attacks and runtime tampering

Maintains confidentiality even if the host system is compromised

Considerations

Requires Intel SGX compatible hardware for full security benefits

Slightly higher performance overhead than regular servers

Initial setup requires understanding of attestation concepts

Getting Started

Build the Server

Compile the server inside a secure environment to generate attestation materials

Generate Security Keys

Create cryptographic keys for the secure enclave

Package for SGX

Prepare the server for secure hardware execution

Run Securely

Start the server with hardware protection enabled

Usage Scenarios

Secure Model DeploymentDeploy sensitive AI models with verifiable integrity guarantees

Regulatory ComplianceDemonstrate secure computation environment for auditors

Frequently Asked Questions

Can I use this without SGX hardware?

How do clients verify the server?

Where can I find the reference measurements?

Learn More

MCP Specification

Official protocol documentation

RA-TLS Explained

Technical details of remote attestation TLS

Intel SGX Overview

Official documentation for the security technology

🚀 Attestable MCP Server

This project provides a remotely attestable MCP server, enabling MCP clients to verify the running code on the server and enhancing data governance through remote attestation technology.

🚀 Quick Start

To start the MCP server, you can use the following commands:

# MCP server startup command
go run main.go --listen :8080

# Build and run using Docker
docker build -t mcp-server .
docker run -p 8080:8080 mcp-server

✨ Features

MCP clients can remotely attest the code running on any MCP server.
MCP servers can optionally remotely attest MCP clients.

📦 Installation

Dependencies

Intel SGX hardware
Gramine
Python 3.13
Ubuntu 22.04
Intel SGX enclaves

📚 Documentation

Overview

This project includes an MCP server that can be remotely attested by MCP clients. To achieve this, a Trusted Execution Environment (TEE) is used, which generates a certificate representing the currently running code. This certificate is sent to the MCP client during the TLS handshake, proving that the server is running the same code built on GitHub Actions. By independently building and running the code in secure hardware or a trusted environment, these values can be verified for consistency.

The protocol used for remote attestation between the client and the server is RA-TLS, an extension of TLS that adds machine and code-specific measurements that can be independently verified by the MCP client.

The key attestation feature of the certificate is that it embeds an SGX report into the standard X.509 extension field and encodes it using the TCG DICE "Tagged Evidence" OID. These SGX reports and the complete Intel SGX certificate chain are included. In addition to the SGX report, the certificate contains evidence statements, the most important of which is "pubkey-hash", which contains the hash of the ephemeral public key (in DER format) of the MCP server running in the memory image generated by the trusted execution environment.

Generating Signed Artifacts

The GitHub Actions script in this repository is executed on a self-hosted GitHub runner located in a Trusted Execution Environment (TEE). This action builds a Docker container containing the attestable MCP server and generates a signed proof of the code running in the TEE. This Docker image is signed by GitHub. You can independently generate the same values with or without secure hardware and obtain the same values by querying the running server.