Securely Attest MCP Server Integrity

This is an MCP server that is remotely attestable by MCP clients, using a trusted execution environment (TEE) to generate a certificate representing the exact code currently running. The server presents this certificate during the TLS handshake, before an MCP client connects, using RA-TLS - an extension to TLS that adds machine- and code-specific measurements a client can independently verify. The certificate embeds an SGX quote in the standardized X.509 extension field defined by the TCG DICE "tagged evidence" OID, which in turn carries the full SGX report and Intel SGX certificate chain, plus evidence claims including a "pubkey-hash" claim - the hash of the ephemeral public key (DER format) the TEE generates for the running server's memory image. A client can independently rebuild the same code (on emulated or secure hardware) and confirm the resulting values match what the running server presents, proving the server is running the exact code built on GitHub Actions. Signed artifacts are produced by a self-hosted GitHub runner running inside a TEE: the action builds a Docker container for the server and generates a signed attestation of the code running inside the TEE, with the resulting image signed by GitHub.

Use it when an MCP client needs cryptographic proof that a server is running specific, unmodified code - for example, verifying a hosted MCP server hasn't been tampered with before sending it sensitive requests. It optionally supports the reverse direction too: an MCP server can remotely attest its clients. Do NOT expect a ready-made MCP client demonstrating RA-TLS verification yet - the project's own TODO list still has this as unimplemented, along with publishing Intel-signed measurements in the README for simpler independent verification. Running it requires Intel SGX hardware (or emulation) plus Gramine, Python 3.13, Ubuntu 22.04, and the Intel SGX SDK & PSW - it is not a lightweight or hardware-agnostic deployment.

Remote code attestation via an RA-TLS certificate embedding an SGX quote and a pubkey-hash claim tied to the TEE's ephemeral key, verifiable by rebuilding the same code independently. Optional reverse attestation of MCP clients by the server. Signed, reproducible build artifacts produced via a self-hosted GitHub Actions runner inside a TEE. Roadmapped but not yet shipped: JSON Web Key (JWK) attestation claim validation, per the project's own future-plans notes.

Requires Intel SGX Hardware, Gramine, Python 3.13, Ubuntu 22.04, and the Intel SGX SDK & PSW. Build and package the server through Gramine's gsc tool, then run the resulting image with device mounts for the SGX provisioning and enclave devices on secure hardware, or without them for local development.

uv sync
docker build -t attestable-mcp-server .
gramine-sgx-gen-private-key
git clone https://github.com/gramineproject/gsc docker/gsc
cd docker/gsc
uv run ./gsc build-gramine --rm --no-cache -c ../gramine_base.config.yaml gramine_base
uv run ./gsc build -c ../attestable-mcp-server.config.yaml --rm attestable-mcp-server ../attestable-mcp-server.manifest
uv run ./gsc sign-image -c ../attestable-mcp-server.config.yaml  attestable-mcp-server "$HOME"/.config/gramine/enclave-key.pem
uv run ./gsc info-image gsc-attestable-mcp-server

Teams running or consuming an MCP server in a context where verifiable, tamper-evident code execution matters - confidential-computing and security-conscious deployments that need cryptographic proof of what code is actually running.