Securely Attest MCP Server Integrity

Attestable MCP Server is an MCP server that supports remote attestation: it proves to a connecting MCP client, during the TLS handshake, that it is running the exact code built by a specific GitHub Actions run, rather than asking the client to trust the operator's word. It runs inside a trusted execution environment (Intel SGX) and uses RA-TLS, a TLS extension that carries machine- and code-specific measurements an MCP client can verify. The RA-TLS certificate embeds an SGX quote in a standard X.509 extension (the TCG DICE "tagged evidence" OID), which itself carries the SGX report, the full Intel SGX certificate chain, and evidence claims - most importantly a "pubkey-hash" claim, the hash of the ephemeral public key the TEE generated for the running server's memory image. A self-hosted GitHub Actions runner, itself inside a TEE, builds a Docker image of the server and produces a signed attestation of the code inside it; anyone can independently rebuild the same image, with or without secure hardware, and confirm it yields the same measurement values as the live server.

Use it when an MCP client needs cryptographic proof that the server it's talking to is running specific, unmodified, auditable code - for instance, verifying that an MCP server handling sensitive data hasn't been tampered with since it was built. It optionally works the other way too: an MCP server can remotely attest its connecting MCP clients. As of this README there is no reference MCP client shipped that demonstrates RA-TLS verification end-to-end (listed as a TODO), and Intel-signed measurements for simple independent verification against the GitHub Action build are not yet published in the repo either. Running it in its attested mode requires real Intel SGX hardware - it isn't something you can fully exercise without that hardware, though the server itself can still be built and run locally without attestation for development.

MCP clients can remotely attest the code running on any MCP server exposing this mechanism; MCP servers can optionally remotely attest MCP clients in return. Building and running it requires Intel SGX hardware, Gramine, Python 3.13, Ubuntu 22.04, and the Intel SGX SDK & PSW.

uv sync
docker build -t attestable-mcp-server .
gramine-sgx-gen-private-key
git clone https://github.com/gramineproject/gsc docker/gsc
cd docker/gsc
uv run ./gsc build-gramine --rm --no-cache -c ../gramine_base.config.yaml gramine_base
uv run ./gsc build -c ../attestable-mcp-server.config.yaml --rm attestable-mcp-server ../attestable-mcp-server.manifest
uv run ./gsc sign-image -c ../attestable-mcp-server.config.yaml  attestable-mcp-server "$HOME"/.config/gramine/enclave-key.pem
uv run ./gsc info-image gsc-attestable-mcp-server

On secure hardware, start the signed image with docker run -itp --device=/dev/sgx_provision:/dev/sgx/provision --device=/dev/sgx_enclave:/dev/sgx/enclave -v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket -p 8000:8000 --rm gsc-attestable-mcp-server. On a local development machine without secure hardware, docker run -p 8000:8000 --rm gsc-attestable-mcp-server runs the same image.

Teams building or consuming MCP servers for sensitive workloads who need independently verifiable proof of exactly what code is running, based on Intel SGX confidential computing rather than trust in the server operator.