OpenWorkProof MCP
The OpenWorkProof MCP server: an agent verifies signed work records of an AI agent and exports evidence for independent review.
- 261 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Accepts and returns signing key material through general tools, so production keys must not go to the model.
- The Codex protection mode runs checks on your machine.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/openworkproofDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Accepts and returns signing key material through general tools, so production keys must not go to the model.
- The Codex protection mode runs checks on your machine.
This is third-party code. Review the repository files before installing.
What it does
OpenWorkProof (OWP) is an open-source toolkit for people who use AI agents and want to check what an agent was allowed to do, what it recorded and whether its evidence holds up. The local stdio MCP server gives the client 32 tools: review of signed records about a task and actions, verification of exported evidence bundles, export of a bundle for another reviewer and a reference workflow for reviewing Slips alerts, where alerts are grouped into cases and actions are only simulated. An experimental Codex protection is enabled separately: text edits are allowed only inside one preview directory. The decision to accept or reject a result stays with a human, and connecting OWP to an agent does not restrict it by itself.
Who it is for. Teams that hand real work to agents and want to check records of actions and signatures without trusting the agent itself.
Good fit when
- A reviewer checks an evidence bundle exported from an agent workflow.
- A security analyst goes through the Slips sample alerts and verifies the signed bundle.
- A team adds evidence verification to a GitHub Action before accepting a result.
- Codex edits a copy of a page only in the `preview` directory and other requests are rejected.
Not a fit when
- You need automatic supervision of every agent on a computer, which OWP does not provide.
- Production SOC protection is expected, while the alert review here is a reference implementation with simulated actions.
- Private signing keys would have to be passed to the model in conversation.
Example request
Get the sample alerts with `owp_soc_sample_alerts`, analyse them with `owp_soc_analyze_slips` and verify the returned bundle with `owp_soc_verify_bundle`.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
It needs Python 3.10 or newer and `uv`. Records of an agent's work have to come from your integration, since OWP does not watch every agent and tool. An `UNKNOWN` status without independent trusted keys is expected and does not mean a failed install. Alert review uses a deterministic investigation stub and simulated actions, and there is no live SOC and no detection accuracy test. General key generation and signing tools accept and return private keys, so keep production keys out of model conversations.
How to disable. Remove the openworkproof entry from the MCP configuration and the CLI with `uv tool uninstall openworkproof`. The Codex protection is removed following the first-run guide in the documentation.
FAQ
How do I connect OpenWorkProof?
Add an `mcpServers` entry with the command `uvx` and the argument `openworkproof==1.6.1`. No OWP cloud account is required, and `uvx` downloads the package itself.
What does the UNKNOWN status mean?
The check found no independent trust information, such as keys and checkpoints. This is normal for the synthetic sample, and for working bundles supply trusted keys.
How do I verify an evidence bundle from the console?
For a core bundle run `owp surface-verify <path>`, for an acceptance bundle `owp acceptance-bundle-verify <path>`, for SOC output `owp-aisoc verify <path>`. Formats and trust requirements differ.
How do I enable Codex protection?
Install the CLI (`uv tool install --python 3.12 'openworkproof==1.6.1'`), then `owp-guard install`, `enable`, `doctor` and `run` in the project. The feature is experimental, so start with a test copy.
Is there a skill for alert review?
Yes, `npx skills add dengyier/OpenWorkProof --skill openworkproof-soc-review`. It gives the agent a procedure for the tools but configures neither MCP nor protection.
Discussion
No questions or reviews yet.
Related
MCP serversOpen-source adversary emulation for AI agents, LLM apps and MCP servers, checked against OWASP catalogs
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
An MCP memory server for agents plus a free gate that stops dangerous commands before they run
A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
README in short
The repository describes scenarios: reviewing agent work records, Codex preview protection and alert review. The documentation separately explains what a verification result means and what it does not prove.