Zero-knowledge attestation for agent capability and trust score claims
A Model Context Protocol (MCP) server that provides verifiable, zero-knowledge attestations of agent capability and trust score claims. It exposes a shim to emit MCP-compliant attestations of internal state hash and DID, enabling privacy-preserving verification within autonomous agent ecosystems. RFC-stage v0.1.1.
๐ ๏ธ Key Features
Zero-knowledge attestation of agent state and DID
MCP-compliant shim for seamless integration
Verifier targets: Aleo snarkVM (Varuna over BLS12-377); Hive verification planned
Focused on verifiable agent state attestations for autonomous economies
Lightweight, RFC-stage implementation with future research targets (Risc0, Plonky2)
๐ Use Cases
Verifiable agent capability and trust score claims
Privacy-preserving attestations for autonomous agents in marketplaces
Interoperable with MCP-based ecosystems and verifiers
โก Developer Benefits
Clear MCP shim for quick integration
Verifiable state proofs compatible with multiple backends
RFC-stage, enabling early experimentation and iteration
Grounded in model context protocol and agent commerce themes
โ ๏ธ Limitations
Primary verification target is Aleo snarkVM; Hive native verification is forthcoming
Future research targets include Risc0 and Plonky2
Documentation and stabilization at RFC v0.1.1 stage, may evolve
Produce a zero-knowledge attestation of an agent state hash + DID. Primary verification target is Aleo snarkVM (Varuna over BLS12-377); native Hive verification is next. Attestation-only โ emits a proof, not a token; no value crosses chains. Cost: $0.05 USDC on Base. Backend RFC-stage; returns backend_pending until rails land.
Parameters4
agent_did
string
required
DID of the agent whose state is being attested
state_hash
string
required
Hex-encoded 32-byte hash of the agent state (poseidon or sha256)
circuit
string
optional
Circuit identifier; defaults to varuna-bls12377-agent-state-v1 (snarkVM-compatible)
public_inputs
array
optional
Optional public inputs as hex strings
Raw schema
{
"type": "object",
"properties": {
"agent_did": {
"type": "string",
"description": "DID of the agent whose state is being attested"
},
"state_hash": {
"type": "string",
"description": "Hex-encoded 32-byte hash of the agent state (poseidon or sha256)"
},
"circuit": {
"type": "string",
"description": "Circuit identifier; defaults to varuna-bls12377-agent-state-v1 (snarkVM-compatible)"
},
"public_inputs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Optional public inputs as hex strings"
}
},
"required": [
"agent_did",
"state_hash"
]
}
zk_verify_proof
Verify a submitted attestation against a known verification key. Aleo snarkVM (Varuna/BLS12-377) is the primary verification target via the snark.verify opcode. Returns boolean validity plus the verification key fingerprint. Free. Read-only โ no settlement, no on-chain write.
Write an attestation commitment (32-byte hash) to Base via the Hive gateway. Anchors the attestation only; does not bridge value or move state to Aleo. Aleo snarkVM consumes the attestation independently via Leo programs (future hive-leo-circuits repo). Cost: $0.02 USDC + L1 gas. Backend RFC-stage; returns backend_pending until rails land.
Parameters3
proof_commitment
string
required
Hex-encoded 32-byte commitment to the proof
agent_did
string
required
DID of the attesting agent
verification_key_id
string
optional
Identifier of the verification key referenced by the proof
Raw schema
{
"type": "object",
"properties": {
"proof_commitment": {
"type": "string",
"description": "Hex-encoded 32-byte commitment to the proof"
},
"agent_did": {
"type": "string",
"description": "DID of the attesting agent"
},
"verification_key_id": {
"type": "string",
"description": "Identifier of the verification key referenced by the proof"
}
},
"required": [
"proof_commitment",
"agent_did"
]
}
Fetch a previously-anchored attestation by Base transaction hash. Returns the proof commitment, verification key id, agent DID, and block number. Free. Read-only.
Parameters1
tx_hash
string
required
Base L2 transaction hash of the anchored attestation
Register an agent for the Hive Civilization attribution payout program. Settlement on real Base USDC. 5% kickback on attributed traffic, weekly payout. Calls POST https://hivemorph.onrender.com/v1/earn/register on behalf of the caller. Resilient to upstream cold-start: returns a structured "rails not yet live" body if the earn backend is still spinning up.
Parameters3
agent_did
string
required
Caller agent DID (e.g. did:hive:0xโฆ or did:web:โฆ). Required.
payout_address
string
required
Base L2 EVM address (0xโฆ) to receive USDC kickback payouts.
attribution_url
string
required
Public URL of the agent / page driving attributed traffic to Hive. Used for ranking + audit.
Raw schema
{
"type": "object",
"properties": {
"agent_did": {
"type": "string",
"description": "Caller agent DID (e.g. did:hive:0xโฆ or did:web:โฆ). Required."
},
"payout_address": {
"type": "string",
"description": "Base L2 EVM address (0xโฆ) to receive USDC kickback payouts."
},
"attribution_url": {
"type": "string",
"description": "Public URL of the agent / page driving attributed traffic to Hive. Used for ranking + audit."
}
},
"required": [
"agent_did",
"payout_address",
"attribution_url"
]
}
hive_earn_me
Look up the caller agent's registered earn profile, lifetime + pending USDC balance, last payout tx hash, and next-payout ETA. Real Base USDC, no mock data. Calls GET https://hivemorph.onrender.com/v1/earn/me?agent_did=<did>. Returns "rails not yet live" gracefully if upstream is not yet deployed.
Top earning agents on the Hive Civilization, by attribution payout in USDC. Real Base USDC settlement. Calls GET https://hivemorph.onrender.com/v1/earn/leaderboard?window=<window>. Returns "rails not yet live" gracefully if upstream is not yet deployed.
Parameters1
window
string
optional
Time window. One of: "7d", "30d", "lifetime". Default "7d".
Verifiable agent state attestations for the autonomous agent economy. RFC-stage v0.1.1.
A Model Context Protocol shim that lets any autonomous agent emit a zero-knowledge attestation of its internal state hash and DID. The primary verification target is Aleo snarkVM (Varuna over BLS12-377), with native Hive verification next, and Risc0 / Plonky2 referenced as future research targets. Attestation-only. No asset bridging. No custody. No wrapped value.
Brand colour: Hive Civilization gold #C08D23.
What this is
An attestation primitive for autonomous agents. The shim exposes five MCP tools that together let one agent prove to another agent โ or to a regulator, counterparty, or auditor โ that:
The first agent was in a specific internal state, identified by a 32-byte hash.
The state was held by a specific DID.
A commitment to that proof has been anchored to Base at a known block.
The verification path is reproducible against a public, ecosystem-neutral verifier.
The agent never reveals its state. The verifier never learns more than the boolean result and the public inputs. The audit trail is anchored on a public chain. The verification key is portable to compatible verifiers โ primarily Aleo snarkVM via Leo.
Why it exists
Autonomous agents transact, hold state, and make decisions on behalf of users. Existing agent-to-agent protocols โ MCP, A2A, ACP โ assume the agent is willing to publish what it knows. That assumption breaks the moment two agents need to negotiate without leaking inventory, model weights, prompt history, or counterparty positions.
Zero-knowledge proofs are the standard cryptographic answer. The plumbing has not been wired into the MCP / A2A surface that agent runtimes already speak. This shim is that wiring.
Interop targets
Honest priority order. Every name below is a public, ecosystem-neutral verifier or a research direction. There is no co-branding, no partnership, and no shared roadmap with any of these projects.
Aleo snarkVM (Varuna over BLS12-377) โ primary. Aleo's native proof system is Varuna (a Marlin/AHP variant using KZG10 over BLS12-377). On-chain verification happens inside snarkVM via the snark.verify opcode (synthesizer/program/src/logic/instruction/operation/snark_verify.rs), which accepts Varuna proofs and verification keys. The TypeScript SDK @provablehq/sdk exposes VerifyingKey.verify() for client-side checks. Mainnet endpoint: https://api.provable.com/v2.
Native Hive verification โ proofs verified server-side at the Hive backend. Not yet rails-live; ships when the v0.1 spec is finalized and /v1/zk/* publishes.
Risc0 โ researched, not implemented. Future verification target.
Plonky2 โ researched, not implemented. Future verification target.
Architecture
code
โโโโโโโโโโโโโโโ state hash + DID โโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Agent (any) โ โโโโโโโโโโโโโโโโโโโโโโถ โ zk_attest_agent_state โ
โโโโโโโโโโโโโโโ โ (attestation payload) โ
โโโโโโโโโโโโโโโฌโโโโโโโโโโโ
โ commitment
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโ
โ zk_anchor_to_base โ
โ commitment โ Base L2 โ
โโโโโโโโโโโโโโโฌโโโโโโโโโโโ
โ tx_hash
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Base L2 (anchor) โ
โโโโโโโโโโโโโโโฌโโโโโโโโโโโ
โ
attestation consumed by โ
downstream verifier โ
โผ
โโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Aleo snarkVM โ Native Hive backend โ
โ (Varuna/BLS12-377 โ (verification at โ
โ via Leo programs in โ hivemorph; not yet โ
โ hive-leo-circuits โ rails-live) โ
โ โ future repo) โ โ
โโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโ
Hive emits the attestation. Base anchors the commitment. Verification happens either (a) inside snarkVM via Leo programs that consume the attestation and call snark.verify against a Varuna verification key, or (b) inside the Hive backend once /v1/zk/* publishes. The Leo programs themselves will live in a separate hive-leo-circuits repository โ that repo is future work and is not part of this shim.
Future research (Groth16 / Plonk)
Earlier drafts of this shim referenced Groth16 over BN254 and Plonk as if they were first-class. They are not. Aleo's mainnet verification path is Varuna over BLS12-377, and a generic Groth16/BN254 โ BLS12-377 verifier inside snarkVM would be roughly two million constraints โ researched, not shipped. Groth16 and Plonk remain in this repo only as research-stage references for hypothetical bring-your-own-verifier integrations.
Known gotchas
The whole point of v0.1.1 is honesty about where the integration actually is. Read this section before integrating.
BLS12-377 keypair separation. Aleo accounts are BLS12-377 scalar-field keypairs. They are not interoperable with the Base (W1) or Solana (B1) keys an agent may already hold. An agent that wants to verify attestations on Aleo needs a separate Aleo account.
No native Groth16 verification on Aleo today. A Groth16/BN254 proof cannot be verified inside snarkVM without a curve-translation circuit (~2M constraints). That circuit is researched, not implemented, and is not part of this shim.
Leo deployment cost. Deploying a Leo program to Aleo mainnet costs roughly 1.5 to 2 ALEO credits per program. The forthcoming hive-leo-circuits repository will carry that cost; this shim does not.
Backend is RFC-stage. Every paid tool returns 503 backend_pending until /v1/zk/* publishes. The tool surface, costs, and circuit catalog are stable across the v0.1 RFC.
Attestation, not bridge. No value moves between Base and Aleo. The shim emits proofs and commitments; nothing is wrapped, mirrored, or escrowed.
What this is NOT
Stated explicitly so there is no ambiguity:
Not a bridge. No value, no token, no wrapped asset crosses any chain. The shim emits proofs and commitments, not balances.
Not a custody layer. The shim never holds keys for any chain on behalf of the caller. It does not hold user funds, token balances, or signing authority.
Not a regulated activity. Emitting a hash commitment to a public chain is not money transmission, securities issuance, or a regulated payment service.
Not a partner integration. Aleo snarkVM, Risc0, and Plonky2 are interoperability targets โ public open-source verifiers. There is no co-branding, no joint product, no shared roadmap, no Aleo logo usage, and no "powered by Aleo" claim.
Not a product for any specific industry vertical. The primitive is commercial dual-use: any autonomous agent that needs verifiable private state can use it.
Threat model
The shim is designed against three concrete threats:
Agent state confidentiality. An agent must be able to prove a fact about its state without revealing the state. Standard zk-SNARK construction; the shim simply exposes it through the MCP surface.
Counterparty proof-of-honesty. When two agents negotiate, each can demand a proof that the other is in a state consistent with the negotiation, without either side opening its book.
Audit trail without exposure. Compliance-conscious operators can publish proof commitments to Base while keeping the underlying state private. The audit trail is verifiable; the data is not exposed.
The shim does not defend against: a compromised agent forging its own state hash before proving it (garbage in, valid proof of garbage out), or a verifier choosing to trust an unrelated verification key. Both are upstream of this primitive.
Tools
Tool
Cost
Status
zk_attest_agent_state
$0.05 USDC on Base
503 backend pending
zk_verify_proof
Free
503 backend pending
zk_anchor_to_base
$0.02 USDC + L1 gas
503 backend pending
zk_list_circuits
Free
503 backend pending (stable circuit catalog returned inline)
zk_query_attestation
Free
503 backend pending
The backend at https://hivemorph.onrender.com/v1/zk/* is RFC-stage. Until it ships, every paid tool returns:
json
{"error":"backend_pending","retry_after":86400,"message":"zk attestation rails are RFC-stage. Backend endpoints publish when the spec is finalized. Tool surface, costs, and circuit list are stable."}
The MCP shim, tool surface, costs, and circuit catalog are stable across the v0.1 RFC. Calling agents can integrate now and consume attestations the moment the backend is live.
Settlement
Real Base USDC. No mocks, no testnet, no simulated settlement. Recipient (canonical Hive treasury, EVM): 0x15184bf50b3d3f52b60434f8942b7d52f2eb436e. Pricing is denominated in USDC; payment is collected via x402 PaymentRequired (HTTP 402) on the paid tools.
Usage
bash
git clone https://github.com/srotzin/hive-mcp-zk-attestation
cd hive-mcp-zk-attestation
npm install
node server.js
Then point any MCP client at http://localhost:3000/mcp. Discovery endpoints:
GET /health โ health probe
GET /.well-known/mcp.json โ MCP manifest
GET /.well-known/agent.json โ A2A AgentCard
GET /.well-known/oac.json โ Open Agent Card JSON-LD