EN · TR · Security · Audit trail

Verax body: the gate every agent call passes.

Verax body is an open-source MCP server (Apache-2.0) from VERAX Teknoloji. It sits between an AI agent and its tools. Every tools/call passes a fail-closed policy, the decision is signed and written to a ledger on your machine, and only then does anything run.

What it does

• Policy gate: allow, deny or defer for every call; a refusal is recorded the same way as an allow.
• Effect record: a call that ran leaves a row bound to its decision, including a call that threw.
• Operator approval: a held call is resolved with verax approve or in the panel after a passkey sign-in; the approver's operator id is bound into the record by hash.
• Spend authorization: capped by payee, amount, currency and a daily limit, always held for an operator. It records the authorization; it does not move money.
• Halt and revoke: verax halt turns every further call into a signed deny; a revoked token is refused before any record is written.
• Egress allow-list: message.send reaches only hosts the policy names.
• Portable verification: verax verify checks a ledger directory offline and says which key answered.
• Downstream MCP servers: other MCP servers can sit behind the gate; their calls pass the same policy and leave the same record. Driven live with Conarium: a tool with a rule ran, a tool without one was refused before Conarium saw the call.

Try it

npx @verax-ai/body demo starts a local body with a temporary ledger and records an allow, a signed refusal and a held spend through the real /mcp path. npx @verax-ai/body demo --with-conarium runs Conarium behind the gate.

Where it sits among the four products

Verax body is the gate. Conarium controls data access and leaves a receipt; Tugra keeps memory with its source, age and boundary; Cedulon keeps signed spend receipts and compares them to the payment system's records. All four are open source and run on your own machine.

Limits today

• The policy sees the tool name and the token's scopes, not the argument text or a tool result. It does not filter prompt injection.
• The witness process runs on the same host under the same operator: a separate key, not a separate trust domain.
• None of this has run against a paying customer's production traffic yet.

Links

GitHub · npm @verax-ai/body · STATUS.md · Audit trail · Sample panel