Add the server. Verify is free. Issue needs a key.

verify — no key

Claude Code:

claude mcp add --transport http pcrzero https://mcp.pcrzero.com/mcp

Any JSON-configured MCP client:

{
  "mcpServers": {
    "PCRZERO": {
      "type": "streamable-http",
      "url": "https://mcp.pcrzero.com/mcp"
    }
  }
}

Ask the agent for verify_receipt on the published specimen rcp_pom_synthetic_119_0001, or run it above. Same bytes, same verifier.

issue — key, metered

issue_receipt bills one unit whether the verdict is pass or fail. On the hosted URL the key is Authorization: Bearer ak_live_…. Without it, issue refuses and the two verify tools keep working.

There is no signup page yet. This call mails a confirmation link, and the key is shown once on the page that link opens — copy it before you close the tab.

curl -X POST https://api.pcrzero.com/v1/signup \
  -H 'content-type: application/json' \
  -d '{"email":"you@company.com"}'

the three tools

1. issue_receiptmetered

   Adjudicates an attestation document against a policy and returns the verdict together with a signed receipt pair. Every call bills one receipt_verifications unit, and a fail verdict bills exactly like a pass — you are paying for the adjudication, not for the answer you wanted.

2. verify_receiptfree

   Checks a PCRZERO receipt pair against the signing keyset: whether the signature holds, and whether the receipt says what it appears to say. Free, with no API key and no account, and it stays free. Offline by default — supply keyset and this call touches the network not at all; the result field keyset_source tells you which of the two happened, every time.

3. get_keysetfree

   Returns the current PCRZERO signing keyset — key ids, public halves, each key’s status. Public and unauthenticated — the same document an outside party fetches to check a PCRZERO receipt without trusting us.