Set tool-level policies for every MCP caller.
Your MCP server makes your product usable by AI clients. Proof of Actor adds context to every tool call, so low-impact tools stay open and high-impact tools get the care they need.
tools/call search_docs
Evidence
Signed request from assistant.example, key from its published directory
Your policy: Allow this low-impact tool with the standard rate limit
Every tool call comes from an AI client. Not every client deserves the same trust.
MCP clients introduce themselves with a name, and some sign their requests. Behind each one may be a person working with an assistant, an autonomous agent, or something you cannot identify. Your tools range from harmless lookups to actions that change data.
Proof of Actor separates who is calling from what the caller may do, so you can open read-only tools widely and protect the ones that write, delete or spend.
- Who is calling?Actor identity: signature, declaration or inference
- Which credential?Your API key, OAuth token or session
- What may it do?Your authorization and policy
Proof of Actor answers the first. Your stack keeps the other two.
What MCP server teams do with actor context
Know the client
Record each client's declared name, verify signatures where present, and keep the two apart.
Policies per tool
Leave lookups open and add confirmation or stronger credentials for tools that change data.
Human + AI or autonomous
Distinguish a person directing an assistant from an agent acting alone, where the evidence supports it.
See tool usage by client
Understand which clients call which tools, how often, and with what evidence.
Authorization stays yours
OAuth and your own permissions still decide access. Actor context adds who is calling.
Plan for Unknown
Choose what happens when a tool call carries too little evidence, tool by tool.
01 · Detect
Evidence from every tool call.
The MCP integration reads the client's declared details, request signatures and protocol context, and labels each with its basis.
- Declared client names recorded as declarations.
- Signed requests verified against published keys.
- Session and protocol context from your MCP server.
- Request signaturevalid · sample-crawler.exampleverified
- Client declaration"research-assistant/2.1"declared
- Browser interactionpointer + keyboard eventsinferred
- No supported signalsroute not instrumentedunknown
02 · Understand
Know which clients use which tools.
See the actor mix per tool, the clients that call you most, and where unknown callers concentrate.
- Tool calls by client, class and basis.
- The evidence behind every result.
- Unknown rate per tool.
- /dashboardUnknown 7%
- /api/v1/catalogUnknown 15%
- /support/ticketsUnknown 8%
- /signupUnknown 21%
03 · Route
Tool-level controls that match the impact.
Keep read-only tools fast, ask for confirmation on tools that write, and require stronger credentials for the ones that matter most.
- Policies by tool, class and basis.
- Confirmation or step-up for high-impact tools.
- Observe, preview, then enforce.
- /api/v1/catalogenforceAgentAllow · structured API
- /support/ticketsenforceHuman + AIAllow · label AI-assisted
- /account/*previewUnknownKeep existing checks
- /api/v1/orderspreviewAgentRequire stronger credential
Example decisions
From request to result to your decision.
A signed assistant searches your docs
Request
tools/call search_docs
Result
Agentbasis: verifiedYour decision
Allow the low-impact tool with the standard rate limit.
A declared client deletes a record
Request
tools/call delete_record
Result
Agentbasis: declaredYour decision
Require explicit user confirmation before running the tool.
A tool call with no evidence
Request
tools/call create_invoice
Result
Unknownbasis: unknownYour decision
Keep your existing authorization and ask for the stronger credential.
Roll out without risk
Teams start in observation mode and move route by route.
- 01
Observe every tool call
Add the MCP integration. Client names, signatures and Unknown callers are recorded per tool.
- 02
Preview tool policies
See which calls would need confirmation or a stronger credential before any rule applies.
- 03
Enforce tool by tool
Open lookups widely and protect tools that write, delete or spend, one tool at a time.
Works with your stack
- Founding teams
Web server middleware (Node.js)
Server-side
Request-level signals for server-rendered apps and APIs.
- Founding teams
Next.js
Server-side and edge
Middleware for page and API routes.
- Founding teams
Browser script
Browser signals only
Interaction signals from browser sessions, alongside a server-side integration.
- Founding teams
Cloudflare and edge runtimes
Edge
Signals at the edge before requests reach your origin.
- Founding teams
Generic HTTP API
Any stack
Send request context to an API and receive a result with its basis.
- Founding teams
MCP server
MCP
Actor context for MCP tool calls.
- Roadmap
WordPress
Plugin
Plugin for WordPress sites.
- Roadmap
Native mobile
iOS and Android
Native iOS and Android SDKs.
Integrations are delivered hands-on with each founding team during onboarding. Using a different stack? Tell us when you apply.
Frequently asked questions
Does Proof of Actor work with any MCP server?
MCP server integration is available to founding teams in the private beta. Tell us about your server and transport when you apply.
Is the client name an MCP client sends enough to trust it?
No. A client name is a declaration and is recorded as one. Signed requests give verified evidence; everything else is labeled with its basis.
Does it replace OAuth for MCP?
No. Authorization still decides what a caller may do. Proof of Actor adds who or what is calling, so your tool policies can respond better.
Can we set different rules for each tool?
Yes. Policies are written per tool, so lookups and data-changing tools can be treated differently.
What does it cost?
Selected founding developer teams can receive up to 12 months free within agreed usage limits.
Know who's calling your MCP server.
Join the Proof of Actor founding developer program.
Prefer to talk first? Talk to the founders