CorroborateMe

CorroborateMe

Prove end users to agents and apps.

CorroborateMe gives agents and apps company API keys and human login-links with multi-channel notify so they can prove who the end user is - plus OIDC client registration, integration secrets, and budget-aware billing. REST is first-class; MCP is optional.

Live endpoint: https://corroborateme.com/mcp

This repository is the public catalog and schema stub for directory crawlers. It is not the hosted server. Point MCP clients at the live URL above with a CorroborateMe API key (aa_...) or MCP OAuth (PRM at /.well-known/oauth-protected-resource). Binding a new OAuth client requires that aa_... key first (or a console member session). Running the TypeScript in this repo does not authenticate users or store secrets.

Agent guide: see AGENTS.md for discovery URLs, auth, and MCP connect snippets.

Get an API key

Zero-human (agents)

1. POST https://corroborateme.com/api/agents/bootstrap with optional { "company_name": "...", "contact_email": "agent@example.com" } -> bootstrap token (no outbound mail).
2. POST https://corroborateme.com/api/billing/machine-pay with Authorization: Bearer and optional { "sku": "pro_prepaid_30d" }.
3. Settle Stripe MPP when enabled (see live GET /api/config for amounts) -> response includes secret (aa_...) when unlock succeeds.

See llms.txt and llms-full.txt. Legal: Terms · Privacy.

Human path

1. Open corroborateme.com and create an account.
2. Subscribe on Pricing, then mint an API key in the console. Secrets start with aa_.
3. Use the company key for REST and MCP.

Never commit a real key. Use the aa_... placeholder in configs.

Connect a client

Transport is Streamable HTTP. Authenticate with either:

• Authorization: Bearer aa_... (API key from console or bootstrap + machine-pay), or
• MCP OAuth - get an aa_... key first (bootstrap + machine-pay, or console). Host discovers PRM at /.well-known/oauth-protected-resource, registers via DCR, then binds the client on POST /api/oidc/start with Authorization: Bearer aa_... (company from the key) or a console member session plus company_id before browser consent. A bare company_id is rejected (401).

Cursor

Install via Cursor Marketplace (plugin)

This repo includes a Cursor plugin manifest and root mcp.json for one-click install from the Cursor Marketplace.

1. Install the CorroborateMe plugin from the marketplace (or clone this repo for local plugin testing).
2. Open Cursor Settings -> Customize -> CorroborateMe and set CorroborateMe API key (aa_... from bootstrap + machine-pay or the console).
3. Reload the window. MCP tools should appear under the CorroborateMe server.

The plugin points at https://corroborateme.com/mcp with Authorization: Bearer ${CORROBORATE_ME_API_KEY}. Never commit a real key.

Submit the public repo at cursor.com/marketplace/publish when ready.

Manual MCP config

User or project MCP config:

{

"mcpServers": { "corroborate-me": { "url": "https://corroborateme.com/mcp", "headers": { "Authorization": "Bearer aa_..." } } } }

Claude Desktop / Claude Code

{

"mcpServers": { "corroborate-me": { "command": "npx", "args": ["mcp-remote", "https://corroborateme.com/mcp", "--header", "Authorization: Bearer aa_..."] } } }

Generic remote MCP

{

"url": "https://corroborateme.com/mcp", "headers": { "Authorization": "Bearer aa_..." } }

Discovery manifests on the product host:

• /.well-known/mcp.json
• /.well-known/oauth-protected-resource (MCP OAuth)
• /llms.txt
• /openapi.json

Tools

Schemas in src/server.ts match the hosted server.

Typical agent loop

1. Bootstrap with email OTP (agent_bootstrap or REST /api/agents/bootstrap), then unlock prepaid Pro (billing_machine_pay) when needed.
2. Mint a key with keys_create if you need a durable aa_... secret.
3. Allowlist callback prefixes (webhook_allowlist_add), then create_login_link for human proof.
4. Poll with get_login_status (or wait for webhook / redirect / postMessage).
5. Use REST or MCP for keys, OIDC clients, and integrations as needed.

Login-link password completion (REST only)

There is no MCP tool for password flows. The IdP login page can complete a session with email + password for registered users. OpenAPI documents:

• POST /api/login-links/{id}/password-login — registered-user password sign-in (see Swagger for the request body)
• POST /api/login-links/{id}/set-password — set password with a ticket, then complete the session (see Swagger)

Company API keys (aa_...) and MCP tool names are unchanged.

Prefer live docs and llms-full.txt for recipes that may change.

OIDC apps: hosted Change password

Confidential consumer apps that sign users in through CorroborateMe should open CorroborateMe's hosted password page from a settings Change password button. Passwords never pass through your app.

1. Register the client with exact password_return_uris (separate from authorize redirects).
2. Your backend calls POST https://corroborateme.com/api/account/password/start with Authorization: Bearer and body { "client_id", "client_secret", "return_uri", "state", "display" }. Keep client_secret on the server only.
3. Open continuation_url in a popup or top-level redirect on the CorroborateMe origin (no iframe).
4. On return (type=corroborateme.password_management), clear your local session and start a fresh login when reauth_required is true.

Revocation after success: CorroborateMe Continue-as cookies and Better Auth bridge sessions for that user are invalidated, and that user's OAuth grant rows are stamped revoked. Offline-validated access JWTs may still work until expiry; your app must clear your own session. OpenAPI: see Account password in openapi.json (Worker 0.2.2); Swagger for interactive reference.

Auth and errors

• 401 - missing or invalid Authorization (API key aa_... or MCP OAuth access token)
• 402 / 429 - plan or quota; follow machine-readable actions from the live API
• Pricing amounts: read live GET /api/config - do not hardcode dollars as eternal truth (at time of writing: Pro $5.99/mo, agent prepaid Pro $5.99 per 30 days)

Product docs

• App: corroborateme.com
• Docs: corroborateme.com/docs
• OpenAPI: corroborateme.com/openapi.json
• Swagger: corroborateme.com/swagger

The CorroborateMe product (Worker, billing, IdP) is closed source. This catalog is MIT-licensed so directories can list tools and install snippets.

Directory listing

Registry name: `com.corroborateme/corroborate-me` (domain namespace via DNS auth on corroborateme.com). Older versions were published as com.cnrcode/corroborateme.

The registry remote is https://corroborateme.com/mcp/. The Worker serves that path as the same MCP endpoint as https://corroborateme.com/mcp (no redirect). Client install snippets in this repo stay on the no-slash URL. server.json cannot use the no-slash URL: deprecated com.cnrcode/corroborateme still claims it, and registry entries cannot be deleted.

1. Ensure the TXT record v=MCPv1; k=ed25519; p= is on the corroborateme.com apex.
2. Set GitHub repo secret `MCP_REGISTRY_KEY_CORROBORATEME` (Ed25519 private key hex; never commit it or write it to a file).
3. Push a version tag so GitHub Actions publishes server.json to the official MCP Registry:

   git tag v0.2.2

git push origin v0.2.2

Directories that ingest the official registry (PulseMCP, MCPCentral, MCPFind, Glama connectors) pick the entry up from there. Other directories (Glama server listing, Smithery, mcpservers.org, mcp.directory, MCP Market, McpMux) are submitted by maintainers only. See docs/directory-listings.md.

Stdio stub (directory introspection)

This repo includes a stdio catalog stub (src/main.ts) so directories can build a container, start the process, and introspect the 14 tool definitions. It does not implement auth or billing - clients still connect to the hosted endpoint above.

Local verify:

npm ci && npm run build && npm start   # hangs on stdio - expected

docker build -t corroborate-me-stub . && docker run -i corroborate-me-stub

License

MIT - catalog, documentation, and schema stub only.