Skip to content

KeyHalve - verify sealed documents

by keyhalve.com · remote · local (npm) · no sign-in to list tools · v1.0.1 · published by com.keyhalve

Free, no-account verification of KeyHalve-sealed documents. Read-only; never receives keys.

Changes · 1
CompareRegistry entry

3 tools: 1 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http verify https://mcp.keyhalve.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Changes things 1Claude Code: ask
  • keyhalve_verifyVerify a KeyHalve-sealed document.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify a KeyHalve-sealed document. Accepts a verify URL, the raw text of a KeyHalve QR code, or a document id (vp_…, kh_…, cb_…). Returns the cryptographic verdict: whether the seal exists, its live status (active/revoked/expired), ciphertext integrity against the issuance commitment, the KeyHalve rail's independent attestation, the validity window, and the issuer's trust context. This tool NEVER decrypts sealed contents — any decryption key in the URL fragment is discarded unread; contents are only readable by opening the verify URL in a browser.

    Annotations the server declares

    • title: Verify a sealed document
    • readOnlyHint: true
    • openWorldHint: true
Only reads 2Claude Code: allow
  • keyhalve_explainPlain-language explanation of what a KeyHalve verification verdict means and why it can be trusted (blind rail, three-share custody, commitments, revocation).No findings

    Why it is in this group

    • The name "keyhalve_explain" says "explain": a word for reading.
    Description, as the server wrote it
    Plain-language explanation of what a KeyHalve verification verdict means and why it can be trusted (blind rail, three-share custody, commitments, revocation). Optionally focused on one topic.

    Annotations the server declares

    • title: Explain a KeyHalve verdict
    • readOnlyHint: true
    • openWorldHint: false
  • keyhalve_statusLive status of a KeyHalve-sealed document by id: active, revoked (with reason/time), or outside its validity window.No findings

    Why it is in this group

    • The name "keyhalve_status" says "status": a word for reading.
    Description, as the server wrote it
    Live status of a KeyHalve-sealed document by id: active, revoked (with reason/time), or outside its validity window. Lighter than keyhalve_verify — status only, no integrity or rail checks. Use for "is this still good right now?"

    Annotations the server declares

    • title: Check live document status
    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http verify https://mcp.keyhalve.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__verify__keyhalve_status",
      "mcp__verify__keyhalve_explain"
    ],
    "ask": [
      "mcp__verify__keyhalve_verify"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as verify. Review it before you use it.