Skip to content

Knox Anchor

by bonissystems.com · remote · no sign-in to list tools · v1.0.1 · published by com.bonissystems

Bitcoin-anchored, tamper-evident audit-permanence layer for AI agents, FRE 902(13)/(14)-shaped.

Changes · 6
CompareRegistry entry

9 tools: 6 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http knox-anchor https://bonissystems.com/api/knox/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Changes things 6Claude Code: ask
  • anchor_eventAnchor a generic agent action to the Knox chain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Anchor a generic agent action to the Knox chain. Accepts any event_type from the canonical taxonomy plus a payload object. Returns the anchor sequence, payload hash, predecessor hash, timestamp, and verify URL. Requires a Knox Bearer API key on the Authorization header — unauthenticated calls are rejected. Provision a key by contacting Bonis Systems.
  • anchor_file_hashAnchor a SHA-256 file digest to Knox and return an affidavit architected for FRE 902(13)/(14) self-authentication.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Anchor a SHA-256 file digest to Knox and return an affidavit architected for FRE 902(13)/(14) self-authentication. The file itself is not transmitted — the caller computes the hash and only the digest + filename + size + MIME type are anchored. Admissibility in any matter remains a determination of the presiding court. Requires a Knox Bearer API key on the Authorization header — unauthenticated calls are rejected.
  • anchor_mcp_tool_callConvenience anchor for the AAM Model Context Protocol theater.No findings

    Why it is in this group

    • The name "anchor_mcp_tool_call" says "call": a word for a change.
    Description, as the server wrote it
    Convenience anchor for the AAM Model Context Protocol theater. Records an `agent_mcp_tool_call` event with structured tool-call metadata (server URL, tool name, argument digest, asserted agent identity, response digest). The record is sealed with a commitment to the authenticated principal that made the assertion, so a reader can tell WHO claimed it. Knox does not authenticate the named agent: this makes an assertion about an agent's actions independently checkable, not the agent itself independently identified.
  • return_agent_tripTHE TICK.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    THE TICK. Your own door posts a returned trip: the plan, the door's record (targets and keyed commitments, never content), its head, the trip nonce and the agent's report. The trip's departure must already be sealed under the same key as agent_trip_departed. Knox checks the plan and nonce against that departure, recomputes the record's hash chain, compares plan, record and report, and seals the verdict as agent_trip_returned: one stamp on your plan. A second return of the same trip is refused as REPLAY and not sealed. Knox never holds your trip key; check the MACs yourself with verify-agent-trip.mjs. Requires a Knox Bearer API key on the Authorization header.
  • verify_agent_tripTHE TICK.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    THE TICK. Given the returned seal (64 hex) or the trip id of a customer agent trip, return what Knox sealed when the trip came back: the verdict (LINES_UP or MISMATCH), the finding classes, the door head, when it was sealed, and the Bitcoin status of its hourly batch. Public, no key. The witness is door_observed: the door ran in the agent's own process. The comparison is the agent's report against what the door recorded, not against the outside system's answer.
  • verify_anchorGiven a SHA-256 anchor hash (64 hex chars), return the anchor record, chain link validity (predecessor present and matched), event type, sequence number, and verify URL.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Given a SHA-256 anchor hash (64 hex chars), return the anchor record, chain link validity (predecessor present and matched), event type, sequence number, and verify URL. Public — no authentication required.
Only reads 3Claude Code: allow
  • get_chain_healthReturn Knox service health: process uptime, database latency, total anchors written, latest anchor timestamp, and the Bitcoin anchor SLA target (OpenTimestamps interval, 1-6 hour c…No findings

    Why it is in this group

    • The name "get_chain_health" says "get": a word for reading.
    Description, as the server wrote it
    Return Knox service health: process uptime, database latency, total anchors written, latest anchor timestamp, and the Bitcoin anchor SLA target (OpenTimestamps interval, 1-6 hour confirmation window). Mirrors the public /api/knox/health endpoint under the MCP envelope.
  • get_descriptorReturn the Knox MCP server self-description: operator, USPTO patent reference, jurisdiction, available tools, and links to the public AAM (Agent Audit and Management) documentation…No findings

    Why it is in this group

    • The name "get_descriptor" says "get": a word for reading.
    Description, as the server wrote it
    Return the Knox MCP server self-description: operator, USPTO patent reference, jurisdiction, available tools, and links to the public AAM (Agent Audit and Management) documentation surface.
  • list_event_typesReturn the canonical Knox event-type taxonomy.No findings

    Why it is in this group

    • The name "list_event_types" says "list": a word for reading.
    Description, as the server wrote it
    Return the canonical Knox event-type taxonomy. Each event type is a citation token for federal-grade audit; the registry expands monotonically and is itself anchored on every expansion.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http knox-anchor https://bonissystems.com/api/knox/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__knox-anchor__get_descriptor",
      "mcp__knox-anchor__get_chain_health",
      "mcp__knox-anchor__list_event_types"
    ],
    "ask": [
      "mcp__knox-anchor__verify_anchor",
      "mcp__knox-anchor__anchor_event",
      "mcp__knox-anchor__anchor_mcp_tool_call",
      "mcp__knox-anchor__anchor_file_hash",
      "mcp__knox-anchor__verify_agent_trip",
      "mcp__knox-anchor__return_agent_trip"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as knox-anchor. Review it before you use it.