honesty-mcp

honesty-mcp

[Try the kits in your browser →](https://lkopietz3-byte.github.io/honesty-kits/) · Part of honesty kits, a family of small checks for the claims an AI product makes.

An MCP (Model Context Protocol) server that exposes eleven already-built, zero-runtime-dependency "honesty SDK" TypeScript libraries as tools any MCP-compatible coding agent (Claude Code, Claude Desktop, or any other MCP client) can call while building or auditing a product — grounded-citation checking, evidence corroboration grading, payout/mutation-invariance checks (scenario-tested, not a formal proof for every possible input), trust/ authenticity scoring, provenance-claim validation, a claims registry, a tamper-evident audit chain, and recommendation/decision grading plus engine-vs-human divergence, plus scaffolding for two runtime-library kits that don't fit the "check this content" shape.

This server is thin by design: every tool is a Zod input schema plus a handler that imports and calls the real, unmodified export from the wrapped kit. It does not reimplement any of the underlying logic.

Quickstart

claude mcp add honesty-mcp -- npx -y honesty-mcp

Then ask your coding agent to run check_grounding on a draft answer and its sources. Each sentence comes back as grounded, placeholder, ungrounded or invalid (a citation whose source is missing from the evidence). It checks structure only: it does not decide whether a source is true.

Thirteen tools are listed by default. The three paths that run JavaScript the agent sends are off unless you set HONESTY_MCP_ENABLE_CODE_EXEC=1; read A note on the code-execution tools first.

Install

honesty-mcp is published on npm and wraps its eleven sibling "honesty SDK" kits as ordinary registry dependencies (semver ranges, not local file: paths) — npm install (or a plain npx) resolves everything from the public registry, with nothing else to check out first.

The fastest way to run it, with no install step at all:

npx honesty-mcp

Or add it to a project:

npm install honesty-mcp

Adding it to an MCP client

Claude Code:

claude mcp add honesty-mcp -- npx -y honesty-mcp

Any other MCP client that reads an mcpServers config (Claude Desktop's claude_desktop_config.json uses the same shape):

{

"mcpServers": { "honesty-mcp": { "command": "npx", "args": ["-y", "honesty-mcp"] } } }

Three of the tools run JavaScript that the calling agent sends, so they are off by default. To use them, add the environment variable HONESTY_MCP_ENABLE_CODE_EXEC=1 to the server's environment (see A note on the code-execution tools first):

claude mcp add -e HONESTY_MCP_ENABLE_CODE_EXEC=1 honesty-mcp -- npx -y honesty-mcp

{

"mcpServers": { "honesty-mcp": { "command": "npx", "args": ["-y", "honesty-mcp"], "env": { "HONESTY_MCP_ENABLE_CODE_EXEC": "1" } } } }

The server runs on the stdio transport — it reads JSON-RPC requests from stdin and writes responses to stdout, logging only a one-line startup banner to stderr so stdout stays a clean JSON-RPC channel. This is the transport Claude Code, Claude Desktop, and most local/CLI MCP client integrations expect for a locally-run server; it is not an HTTP server and has no port to browse to.

Listing in the MCP registry

honesty-mcp also ships a server.json (validated against the official schema) so it can be listed on the official MCP registry, under the name io.github.lkopietz3-byte/honesty-mcp. Listing is a manual, one-time step the maintainer runs after this package is on npm — it is not run as part of this repo's CI or npm publish. Exact commands, from the registry's own docs (publishing guide, CLI reference):

# 1. Install the publisher CLI (macOS/Linux)

curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher sudo mv mcp-publisher /usr/local/bin/

2. Log in with GitHub (proves ownership of the io.github.lkopietz3-byte namespace)

mcp-publisher login github

3. Publish (validates server.json against the schema, then submits it)

mcp-publisher publish

package.json's mcpName field (io.github.lkopietz3-byte/honesty-mcp) must match server.json's name field exactly — that's how the registry verifies the npm package and the registry listing belong to the same publisher (see package-types.mdx, "Ownership Verification").

Tools

9 content-checking kits, 12 tools (kits 1–9: hand one of these real content or data, get back a structured verdict):

2 scaffolding tools (agent-receipt-kit, cost-governor-kit — these are runtime libraries a project *installs and imports into its own running code*, not something checked on-demand the same way; see the code comments in src/tools/agentReceiptScaffold.ts / costGovernorScaffold.ts for why a "check this content" shape would misrepresent them):

That's 9 kits, 12 content-checking tool slots (payout-invariance-kit, audit-chain-kit, and advice-ledger-kit each got 2 tools instead of 1, since each bundles two genuinely distinct operations — runtime check vs. static grep; append vs. verify; grading one decision vs. measuring divergence across a whole population — that read better as separate, single-purpose MCP tools than as one tool with a mode switch) plus 2 scaffolding tools = 14 tools total.

That is 14 tools when code execution is enabled. With it off (the default), check_mutation_invariance is not listed, so a client sees 13.

A note on the code-execution tools

These tools are off by default. check_payout_invariance (runtime mode) and check_mutation_invariance wrap kit functions whose real signature takes an actual JavaScript function (a ranking function, a mutation closure); there is no way to represent a function as MCP JSON arguments. Both tools accept that function as a source-code string and build the real function via the Function constructor, inside the worker that src/lib/runFunctionJob.ts starts after the co