Zero-knowledge attestation for agent capability and trust score claims
io.github.srotzin/hive-mcp-zk-attestation MCP Server
This MCP server provides verifiable agent state attestations for the autonomous agent economy. It is an “RFC-stage v0.1.1” Model Context Protocol shim that allows an autonomous agent to emit a zero-knowledge attestation of its internal state hash and DID. Verification targets are Aleo snarkVM (Varuna over BLS12-377).
🛠️ Key Features
Zero-knowledge attestation of internal state hash
Zero-knowledge attestation of DID
Primary verification: Aleo snarkVM (Varuna over BLS12-377)
Native Hive verification planned/next; Risc0 / Plonky2 noted for future research
Tool count: 8
🚀 Use Cases
Verifying agent capability and trust score claims via ZK attestations
Emitting attestations from agents operating under MCP
Trust verification workflows centered on Aleo snarkVM
⚡ Developer Benefits
Standardized MCP shim for emitting internal-state attestations
Verifiable claims focused on state hash and DID
Clear verification path for Aleo snarkVM; Hive support and other proving systems referenced as next steps
⚠️ Limitations
Native Hive verification and Risc0/Plonky2 are described as “next”/future research targets, not primary capabilities
RFC-stage v0.1.1 indicates early specification maturity
Produce a zero-knowledge attestation of an agent state hash + DID. Primary verification target is Aleo snarkVM (Varuna over BLS12-377); native Hive verification is next. Attestation-only — emits a proof, not a token; no value crosses chains. Cost: $0.05 USDC on Base. Backend RFC-stage; returns backend_pending until rails land.
Parameters4
agent_did
string
required
DID of the agent whose state is being attested
state_hash
string
required
Hex-encoded 32-byte hash of the agent state (poseidon or sha256)
circuit
string
optional
Circuit identifier; defaults to varuna-bls12377-agent-state-v1 (snarkVM-compatible)
public_inputs
array
optional
Optional public inputs as hex strings
Raw schema
{
"type": "object",
"properties": {
"agent_did": {
"type": "string",
"description": "DID of the agent whose state is being attested"
},
"state_hash": {
"type": "string",
"description": "Hex-encoded 32-byte hash of the agent state (poseidon or sha256)"
},
"circuit": {
"type": "string",
"description": "Circuit identifier; defaults to varuna-bls12377-agent-state-v1 (snarkVM-compatible)"
},
"public_inputs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Optional public inputs as hex strings"
}
},
"required": [
"agent_did",
"state_hash"
]
}
zk_verify_proof
Verify a submitted attestation against a known verification key. Aleo snarkVM (Varuna/BLS12-377) is the primary verification target via the snark.verify opcode. Returns boolean validity plus the verification key fingerprint. Free. Read-only — no settlement, no on-chain write.
Write an attestation commitment (32-byte hash) to Base via the Hive gateway. Anchors the attestation only; does not bridge value or move state to Aleo. Aleo snarkVM consumes the attestation independently via Leo programs (future hive-leo-circuits repo). Cost: $0.02 USDC + L1 gas. Backend RFC-stage; returns backend_pending until rails land.
Parameters3
proof_commitment
string
required
Hex-encoded 32-byte commitment to the proof
agent_did
string
required
DID of the attesting agent
verification_key_id
string
optional
Identifier of the verification key referenced by the proof
Raw schema
{
"type": "object",
"properties": {
"proof_commitment": {
"type": "string",
"description": "Hex-encoded 32-byte commitment to the proof"
},
"agent_did": {
"type": "string",
"description": "DID of the attesting agent"
},
"verification_key_id": {
"type": "string",
"description": "Identifier of the verification key referenced by the proof"
}
},
"required": [
"proof_commitment",
"agent_did"
]
}
Fetch a previously-anchored attestation by Base transaction hash. Returns the proof commitment, verification key id, agent DID, and block number. Free. Read-only.
Parameters1
tx_hash
string
required
Base L2 transaction hash of the anchored attestation
Register an agent for the Hive Civilization attribution payout program. Settlement on real Base USDC. 5% kickback on attributed traffic, weekly payout. Calls POST https://hivemorph.onrender.com/v1/earn/register on behalf of the caller. Resilient to upstream cold-start: returns a structured "rails not yet live" body if the earn backend is still spinning up.
Parameters3
agent_did
string
required
Caller agent DID (e.g. did:hive:0x… or did:web:…). Required.
payout_address
string
required
Base L2 EVM address (0x…) to receive USDC kickback payouts.
attribution_url
string
required
Public URL of the agent / page driving attributed traffic to Hive. Used for ranking + audit.
Raw schema
{
"type": "object",
"properties": {
"agent_did": {
"type": "string",
"description": "Caller agent DID (e.g. did:hive:0x… or did:web:…). Required."
},
"payout_address": {
"type": "string",
"description": "Base L2 EVM address (0x…) to receive USDC kickback payouts."
},
"attribution_url": {
"type": "string",
"description": "Public URL of the agent / page driving attributed traffic to Hive. Used for ranking + audit."
}
},
"required": [
"agent_did",
"payout_address",
"attribution_url"
]
}
hive_earn_me
Look up the caller agent's registered earn profile, lifetime + pending USDC balance, last payout tx hash, and next-payout ETA. Real Base USDC, no mock data. Calls GET https://hivemorph.onrender.com/v1/earn/me?agent_did=<did>. Returns "rails not yet live" gracefully if upstream is not yet deployed.
Top earning agents on the Hive Civilization, by attribution payout in USDC. Real Base USDC settlement. Calls GET https://hivemorph.onrender.com/v1/earn/leaderboard?window=<window>. Returns "rails not yet live" gracefully if upstream is not yet deployed.
Parameters1
window
string
optional
Time window. One of: "7d", "30d", "lifetime". Default "7d".
Verifiable agent state attestations for the autonomous agent economy. RFC-stage v0.1.1.
A Model Context Protocol shim that lets any autonomous agent emit a zero-knowledge attestation of its internal state hash and DID. The primary verification target is Aleo snarkVM (Varuna over BLS12-377), with native Hive verification next, and Risc0 / Plonky2 referenced as future research targets. Attestation-only. No asset bridging. No custody. No wrapped value.
Brand colour: Hive Civilization gold #C08D23.
What this is
An attestation primitive for autonomous agents. The shim exposes five MCP tools that together let one agent prove to another agent — or to a regulator, counterparty, or auditor — that:
The first agent was in a specific internal state, identified by a 32-byte hash.
The state was held by a specific DID.
A commitment to that proof has been anchored to Base at a known block.
The verification path is reproducible against a public, ecosystem-neutral verifier.
The agent never reveals its state. The verifier never learns more than the boolean result and the public inputs. The audit trail is anchored on a public chain. The verification key is portable to compatible verifiers — primarily Aleo snarkVM via Leo.
Why it exists
Autonomous agents transact, hold state, and make decisions on behalf of users. Existing agent-to-agent protocols — MCP, A2A, ACP — assume the agent is willing to publish what it knows. That assumption breaks the moment two agents need to negotiate without leaking inventory, model weights, prompt history, or counterparty positions.
Zero-knowledge proofs are the standard cryptographic answer. The plumbing has not been wired into the MCP / A2A surface that agent runtimes already speak. This shim is that wiring.
Interop targets
Honest priority order. Every name below is a public, ecosystem-neutral verifier or a research direction. There is no co-branding, no partnership, and no shared roadmap with any of these projects.
Aleo snarkVM (Varuna over BLS12-377) — primary. Aleo's native proof system is Varuna (a Marlin/AHP variant using KZG10 over BLS12-377). On-chain verification happens inside snarkVM via the snark.verify opcode (synthesizer/program/src/logic/instruction/operation/snark_verify.rs), which accepts Varuna proofs and verification keys. The TypeScript SDK @provablehq/sdk exposes VerifyingKey.verify() for client-side checks. Mainnet endpoint: https://api.provable.com/v2.
Native Hive verification — proofs verified server-side at the Hive backend. Not yet rails-live; ships when the v0.1 spec is finalized and /v1/zk/* publishes.
Risc0 — researched, not implemented. Future verification target.
Plonky2 — researched, not implemented. Future verification target.
Architecture
code
┌─────────────┐ state hash + DID ┌────────────────────────┐
│ Agent (any) │ ─────────────────────▶ │ zk_attest_agent_state │
└─────────────┘ │ (attestation payload) │
└─────────────┬──────────┘
│ commitment
▼
┌────────────────────────┐
│ zk_anchor_to_base │
│ commitment → Base L2 │
└─────────────┬──────────┘
│ tx_hash
▼
┌────────────────────────┐
│ Base L2 (anchor) │
└─────────────┬──────────┘
│
attestation consumed by │
downstream verifier │
▼
┌──────────────────────┬─────────────────────────┐
│ Aleo snarkVM │ Native Hive backend │
│ (Varuna/BLS12-377 │ (verification at │
│ via Leo programs in │ hivemorph; not yet │
│ hive-leo-circuits │ rails-live) │
│ — future repo) │ │
└──────────────────────┴─────────────────────────┘
Hive emits the attestation. Base anchors the commitment. Verification happens either (a) inside snarkVM via Leo programs that consume the attestation and call snark.verify against a Varuna verification key, or (b) inside the Hive backend once /v1/zk/* publishes. The Leo programs themselves will live in a separate hive-leo-circuits repository — that repo is future work and is not part of this shim.
Future research (Groth16 / Plonk)
Earlier drafts of this shim referenced Groth16 over BN254 and Plonk as if they were first-class. They are not. Aleo's mainnet verification path is Varuna over BLS12-377, and a generic Groth16/BN254 → BLS12-377 verifier inside snarkVM would be roughly two million constraints — researched, not shipped. Groth16 and Plonk remain in this repo only as research-stage references for hypothetical bring-your-own-verifier integrations.
Known gotchas
The whole point of v0.1.1 is honesty about where the integration actually is. Read this section before integrating.
BLS12-377 keypair separation. Aleo accounts are BLS12-377 scalar-field keypairs. They are not interoperable with the Base (W1) or Solana (B1) keys an agent may already hold. An agent that wants to verify attestations on Aleo needs a separate Aleo account.
No native Groth16 verification on Aleo today. A Groth16/BN254 proof cannot be verified inside snarkVM without a curve-translation circuit (~2M constraints). That circuit is researched, not implemented, and is not part of this shim.
Leo deployment cost. Deploying a Leo program to Aleo mainnet costs roughly 1.5 to 2 ALEO credits per program. The forthcoming hive-leo-circuits repository will carry that cost; this shim does not.
Backend is RFC-stage. Every paid tool returns 503 backend_pending until /v1/zk/* publishes. The tool surface, costs, and circuit catalog are stable across the v0.1 RFC.
Attestation, not bridge. No value moves between Base and Aleo. The shim emits proofs and commitments; nothing is wrapped, mirrored, or escrowed.
What this is NOT
Stated explicitly so there is no ambiguity:
Not a bridge. No value, no token, no wrapped asset crosses any chain. The shim emits proofs and commitments, not balances.
Not a custody layer. The shim never holds keys for any chain on behalf of the caller. It does not hold user funds, token balances, or signing authority.
Not a regulated activity. Emitting a hash commitment to a public chain is not money transmission, securities issuance, or a regulated payment service.
Not a partner integration. Aleo snarkVM, Risc0, and Plonky2 are interoperability targets — public open-source verifiers. There is no co-branding, no joint product, no shared roadmap, no Aleo logo usage, and no "powered by Aleo" claim.
Not a product for any specific industry vertical. The primitive is commercial dual-use: any autonomous agent that needs verifiable private state can use it.
Threat model
The shim is designed against three concrete threats:
Agent state confidentiality. An agent must be able to prove a fact about its state without revealing the state. Standard zk-SNARK construction; the shim simply exposes it through the MCP surface.
Counterparty proof-of-honesty. When two agents negotiate, each can demand a proof that the other is in a state consistent with the negotiation, without either side opening its book.
Audit trail without exposure. Compliance-conscious operators can publish proof commitments to Base while keeping the underlying state private. The audit trail is verifiable; the data is not exposed.
The shim does not defend against: a compromised agent forging its own state hash before proving it (garbage in, valid proof of garbage out), or a verifier choosing to trust an unrelated verification key. Both are upstream of this primitive.
Tools
Tool
Cost
Status
zk_attest_agent_state
$0.05 USDC on Base
503 backend pending
zk_verify_proof
Free
503 backend pending
zk_anchor_to_base
$0.02 USDC + L1 gas
503 backend pending
zk_list_circuits
Free
503 backend pending (stable circuit catalog returned inline)
zk_query_attestation
Free
503 backend pending
The backend at https://hivemorph.onrender.com/v1/zk/* is RFC-stage. Until it ships, every paid tool returns:
json
{"error":"backend_pending","retry_after":86400,"message":"zk attestation rails are RFC-stage. Backend endpoints publish when the spec is finalized. Tool surface, costs, and circuit list are stable."}
The MCP shim, tool surface, costs, and circuit catalog are stable across the v0.1 RFC. Calling agents can integrate now and consume attestations the moment the backend is live.
Settlement
Real Base USDC. No mocks, no testnet, no simulated settlement. Recipient (canonical Hive treasury, EVM): 0x15184bf50b3d3f52b60434f8942b7d52f2eb436e. Pricing is denominated in USDC; payment is collected via x402 PaymentRequired (HTTP 402) on the paid tools.
Usage
bash
git clone https://github.com/srotzin/hive-mcp-zk-attestation
cd hive-mcp-zk-attestation
npm install
node server.js
Then point any MCP client at http://localhost:3000/mcp. Discovery endpoints:
GET /health — health probe
GET /.well-known/mcp.json — MCP manifest
GET /.well-known/agent.json — A2A AgentCard
GET /.well-known/oac.json — Open Agent Card JSON-LD