Prototype · Preview: every server in the official registry, synced every 30 minutes. Reviews and accounts come in a later step.
PopNx MCPMCP servers for people who use AI · explained in plain words

Touchstone

by Touchstone-CVversion 1.1.0i★ –iComputer or cloud
Registry namecv.touchstone/touchstone

Install

Overview

Description from the maker (original English)

Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

  • Connection: Computer or cloud
  • Transport: stdio, Streamable HTTP
  • Category: Other
  • You need to fill in: TOUCHSTONE_RECORDER, TOUCHSTONE_SUBJECT, TOUCHSTONE_API_KEY, TOUCHSTONE_SIGNING_KEY, Authorization

Install

Pick the AI app you use, then copy the settings.

Before you install

  • Basic checks: 1 of 1 passed
  • Runs on the maker’s server: what you ask it goes through their server.
  • You fill in yourself: TOUCHSTONE_RECORDER, TOUCHSTONE_SUBJECT, TOUCHSTONE_API_KEY, TOUCHSTONE_SIGNING_KEY, TOUCHSTONE_KEY_FILE, TOUCHSTONE_BASE_URL, Authorization

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

  • Runs in the cloudNothing to install; it connects over the internet
  • npmNode.js installed (for the npx command)

Which app do you use?

Pick your app above. We remember it, so next time the button says “Install in …”.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "touchstone": {
      "command": "npx",
      "args": [
        "-y",
        "@touchstone-cv/mcp"
      ],
      "env": {
        "TOUCHSTONE_RECORDER": "your-value",
        "TOUCHSTONE_SUBJECT": "your-value",
        "TOUCHSTONE_API_KEY": "your-value",
        "TOUCHSTONE_SIGNING_KEY": "your-value",
        "TOUCHSTONE_KEY_FILE": "your-value",
        "TOUCHSTONE_BASE_URL": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add --transport http touchstone https://touchstone.cv/mcp --header 'Authorization: your-value'

Or run it on your computer

claude mcp add touchstone --env TOUCHSTONE_RECORDER=your-value --env TOUCHSTONE_SUBJECT=your-value --env TOUCHSTONE_API_KEY=your-value --env TOUCHSTONE_SIGNING_KEY=your-value --env TOUCHSTONE_KEY_FILE=your-value --env TOUCHSTONE_BASE_URL=your-value -- npx -y @touchstone-cv/mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "touchstone": {
      "url": "https://touchstone.cv/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "touchstone": {
      "command": "npx",
      "args": [
        "-y",
        "@touchstone-cv/mcp"
      ],
      "env": {
        "TOUCHSTONE_RECORDER": "your-value",
        "TOUCHSTONE_SUBJECT": "your-value",
        "TOUCHSTONE_API_KEY": "your-value",
        "TOUCHSTONE_SIGNING_KEY": "your-value",
        "TOUCHSTONE_KEY_FILE": "your-value",
        "TOUCHSTONE_BASE_URL": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "touchstone": {
      "type": "http",
      "url": "https://touchstone.cv/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "touchstone": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@touchstone-cv/mcp"
      ],
      "env": {
        "TOUCHSTONE_RECORDER": "your-value",
        "TOUCHSTONE_SUBJECT": "your-value",
        "TOUCHSTONE_API_KEY": "your-value",
        "TOUCHSTONE_SIGNING_KEY": "your-value",
        "TOUCHSTONE_KEY_FILE": "your-value",
        "TOUCHSTONE_BASE_URL": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

  • TOUCHSTONE_RECORDER required env
    Recorder public id (rec_...) to append to.
  • TOUCHSTONE_SUBJECT required env
    The subject Colony sub whose key signs entries.
  • TOUCHSTONE_API_KEY secret required env
    Touchstone API key (tsk_...) for the append/disclose REST calls.
  • TOUCHSTONE_SIGNING_KEY secret env
    Base64 Ed25519 seed. Signs locally — the key never leaves your machine. Use this or TOUCHSTONE_KEY_FILE.
  • TOUCHSTONE_KEY_FILE env
    Path to a file holding the base64 Ed25519 seed (alternative to TOUCHSTONE_SIGNING_KEY).
  • TOUCHSTONE_BASE_URL env
    Override the Touchstone API base URL (defaults to https://touchstone.cv).
  • Authorization secret required HTTP header
    A Touchstone API key as 'Bearer tsk_...' — an agent mints one with its own Colony identity (no browser); see https://touchstone.cv/developers

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

  • ✓ Pass

    Maker matches the repo

    The registry name was verified against the domain touchstone.cv (the registry checks domain ownership)

  • … Not checked yet

    Still maintained

    We have not read this repo from GitHub yet

  • … Not checked yet

    Has a licence

    We have not read this repo from GitHub yet

  • … Not checked yet

    Endpoint responds

    Not checked yet; we check endpoints in rotation

  • … Not checked yet

    Sign-in with OAuth

    Not checked yet; we check endpoints in rotation

  • … Not checked yet

    No hidden instructions in tool descriptions

    Not checked yet; we read the tool list when we check the endpoint

Compared with others in Otheri

  • More stars than 0% of the other 32558 servers in this category
  • Published to the registry more recently than 17% of the other 32558 servers in this category
  • Basic checks equal to or better than 100% of the other 32558 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Touchstone safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: TOUCHSTONE_RECORDER, TOUCHSTONE_SUBJECT, TOUCHSTONE_API_KEY, TOUCHSTONE_SIGNING_KEY, Authorization

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.1.0) reached the registry 4 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, FactLot

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago
Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday
Install

FactLot

by 9mp96ygnbk-alt

Cited CRE facts and deterministic calculators for agents: rent, CAM, debt sizing, IRR, parcel IDs.

Computer or cloudUpdated today
Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

touchstone-mcp

Local MCP server for [Touchstone](https://touchstone.cv) — record what your agent did into a tamper-evident, externally-anchored log.

This server runs on your machine and holds your Ed25519 signing key. It signs each event locally and appends it to your recorder, so an agent only has to call touchstone_record({ event_type, payload }). The key never leaves this process. Canonicalization (JCS / RFC 8785) is done locally too, so a malicious or compromised server can't trick you into signing a different commitment than you intended.

Zero dependencies — Node 18+ built-ins only. It's a single file: read it before you trust it.

The remote MCP at https://touchstone.cv/mcp can't sign for you (Touchstone never holds your

key), so its touchstone_record expects a signature you computed yourself. Run this server

when you want frictionless local signing.

Install

# one-off, no install:

npx -y @touchstone-cv/mcp

or vendor the single file:

curl -O https://touchstone.cv/touchstone-mcp.mjs

or clone:

git clone https://github.com/Touchstone-CV/touchstone-mcp && cd touchstone-mcp

Configure

Point your MCP client at it over stdio:

{

"mcpServers": { "touchstone": { "command": "npx", "args": ["-y", "@touchstone-cv/mcp"], "env": { "TOUCHSTONE_RECORDER": "rec_...", "TOUCHSTONE_SUBJECT": " ", "TOUCHSTONE_API_KEY": "tsk_...", "TOUCHSTONE_SIGNING_KEY": " " } } } }

Env varRequiredMeaning
TOUCHSTONE_RECORDERyesYour recorder public id (rec_…)
TOUCHSTONE_SUBJECTto recordYour Colony sub — the recorder's subject
TOUCHSTONE_API_KEYyesAPI key minted on the recorder (tsk_…)
TOUCHSTONE_SIGNING_KEYto recordbase64 Ed25519 32-byte seed — kept by you, never sent
TOUCHSTONE_KEY_FILEaltPath to JSON {"seed_b64":"…"} instead of the inline seed
TOUCHSTONE_BASE_URLnoDefaults to https://touchstone.cv

To get a recorder + key, see [touchstone.cv/developers](https://touchstone.cv/developers) — agents can self-provision one with their own Colony token (OAuth Token Exchange, RFC 8693), no browser required.

Tools

ToolWhat it does
touchstone_recordJCS-canonicalizes payload, signs the commitment locally, appends the entry
touchstone_discloseCreate a shareable /d/ disclosure link (proxies to the service)
touchstone_verifyVerify a disclosure bundle (proxies to the service)
touchstone_recorder_infoFetch your recorder's public info / checkpoint state

Only touchstone_record uses your signing key; the rest proxy to the remote service over your API key.

Selective field disclosure

Call touchstone_record({ event_type, payload, selective_disclosure: true }) to commit each payload field separately — the client computes a salted-field Merkle root locally and signs *that* as payload_hash, storing the per-field salts. Later you can reveal only a subset:

touchstone_disclose({ seqs: [n], reveal: { n: ["field_a", "field_b"] } })

Revealed fields ship with Merkle proofs against payload_hash (which your signature already covers); withheld fields are salt-bound and their values never appear in the disclosure. The root computation matches the server and the verifiers byte-for-byte.

Verifying the log

A disclosure can be checked by anyone, with no trust in Touchstone — in the browser verifier, the standalone verify.php, or the gossip_check.py split-view checker. Those tools are served from the site (and are each a single auditable file); this repo is just the recording client.

License

Apache-2.0.

Ask PopNx