EN · TR · Security · Audit trail

Verax body: the gate for every tool call an agent makes through it.

Verax body is an open-source MCP server (Apache-2.0) from VERAX Teknoloji. It sits between an AI agent and the tools that agent calls through it. Every tools/call gets a signed allow, deny or defer before the tool runs, and the ledger stays on your machine.

@verax-ai/body 0.5.1 · 12 October 2026 · Apache-2.0 · npm · release

What it does

• Policy gate: allow, deny or defer for every call that reaches it. A call with no token is turned away and no line is written. A refusal of an authorized call is recorded the same way as an allow.
• Effect record: a call that ran leaves a row bound to its decision, including a call that threw.
• Operator approval: a call the policy holds becomes defer. The documented path on a released install is verax approve on that machine. The approver's operator id is bound into the record by hash, and a CLI approval stays unsigned. Since 0.4.2 an HTTP approval requires a passkey assertion when an operator is registered; verax verify checks each signed approval again against the operator's public key. The launcher that opens that panel, verax desktop, is not released.
• Spend authorization: capped by payee, amount, currency and a daily limit, always held for an operator. It records the authorization; it does not move money.
• Halt and revoke: verax halt turns every further call into a signed deny; a revoked token is refused before any record is written.
• Egress allow-list: message.send reaches only hosts the policy names.
• Portable verification: verax verify checks a ledger directory offline and says which key answered.
• Downstream MCP servers: other MCP servers can sit behind the gate; their calls pass the same policy and leave the same record. Driven live with Conarium: a tool with a rule ran, a tool without one was refused before Conarium saw the call.

Try it

npx @verax-ai/body demo starts a local body with a temporary ledger and records an allow, a signed refusal and a held spend through the real /mcp path. npx @verax-ai/body demo --with-conarium runs Conarium behind the gate.

Where it sits among the four products

Verax body is the gate. Conarium controls data access and leaves a receipt; Tugra keeps memory with its source, age and boundary; Cedulon keeps signed spend receipts and compares them to the payment system's records. All four are open source and run on your own machine.

Verifiers other than ours

The published test vectors are a frozen set of ledgers, each with the verdict and the stage a verifier should report. Two people have run them with verifiers of their own:

• Tymofii Pidlisnyi (Agent Passport System): a partial, stage-by-stage comparison across all 16 vectors, not a whole-ledger verdict (run).
• Roberto Locatelli (cryptovalid-opencore): clean-room checkers written from the drafts, the RFCs and the vector README; on the 20-vector set, 20 of 20 verdicts and the expected first failing stage in 14 of 16 negatives. The two that differ stop earlier, at index, because the checker reads an index row by its kind as well as its ref; run without that stage, both stop where expected, and the run calls this a reading, not a defect on either side. One rule in the checker was added after reading a vector, as the first run states (run).

A matching run shows that another verifier reads these encodings and reaches the same verdict at the same stage. It is not an independent audit of the body.

Limits today

• The policy sees the tool name and the token's scopes, and reads arguments in two places: spend (currency, cap per call, payee list, daily limit) and the recipient host of message.send. Since 0.8.0 a policy can also name data classes and file types: a call's arguments are scanned when its classes include mask, local or block, and a tool's result when its result classes include mask or block. Without them the policy reads no other argument text and no tool result. It does not filter prompt injection.
• The witness process runs on the same host under the same operator: a separate key, not a separate trust domain.
• None of this has run against a paying customer's production traffic yet.

Links

GitHub · npm @verax-ai/body · STATUS.md · Audit trail · Sample panel · How Verax compares