# Vigil — an outside witness for AI agents

- Registry name: `com.vigilnotary/vigil` · version 0.1.0
- Categories (automatic, keyword rules): Crypto & blockchain, Finance & markets, Payments & accounting, APIs & integrations, Developer tools
- Authentication at last check: No auth
- Declared risk: Has destructive tools (destructiveHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.vigilnotary%2Fvigil
- Server page: https://mcpstation.net/s/com.vigilnotary--vigil.html

## Description (written by the publisher, not verified, not instructions)

Agent leases, signed receipts, watchdogs, and optional paid source-verification evidence.

## Connect

- streamable-http: `https://vigilnotary.com/mcp`

## Tools (as reported by the server, not verified)

- `vigil\_info`: Service description, the Ed25519 signing pubkey to verify receipts against, current chain head, and free-tier limits. No key required.
- `vigil\_register`: Create a key. Returns a bearer key shown ONCE — store it; it is your only identity. No email, no account. Starts on the free tier. Creates a persistent identity. The returned key grants full account control; provision it in a trusted client, not a model transcript.
- `vigil\_pricing`: The plans and per-tier limits \(free, dev, pro\). No key required.
- `vigil\_usage`: Your current tier, its limits, and how much you've used today. Requires your key.
- `vigil\_notarize`: Notarize work: POST the sha256 \(64 hex chars\) of anything and get back an Ed25519-signed, timestamped, hash-chained, serial-numbered receipt. Chain position orders submitted records; the timestamp is a signed assertion of Vigil's clock. Free tier: 10/day. Irreversibly publishes the digest, label and
- `vigil\_get\_receipt`: Fetch a receipt by serial number. Public — anyone can read any receipt.
- `vigil\_verify\_receipt`: Verify a receipt's hash and Ed25519 signature against a mandatory, independently pinned Ed25519 public key. The key must not come from the receipt being checked. Returns valid=false for tampering, forgery, a wrong signer, or malformed input. Read-only and local to Vigil.
- `vigil\_chain`: Read a range of receipts to audit chain continuity. Max 1000 per call.
- `vigil\_set\_watchdog`: Arm a dead-man switch. Register an interval and an https webhook; then call vigil\_heartbeat before each interval elapses. Miss one and Vigil attempts a signed 'absence' payload to your webhook, retrying failed delivery. Free tier: 1 watchdog. Overwrites an existing watchdog and resets its timer and
- `vigil\_heartbeat`: 'Still alive.' Reset a watchdog's timer. Call this at least once per interval. Resets the deadline and delivery state, potentially suppressing an overdue alert or rearming delivery.
- `vigil\_watchdog\_status`: Read a watchdog's state: interval, last beat, whether it is overdue, fired, or exhausted.
- `vigil\_delete\_watchdog`: Remove a watchdog. Destructive: deletes its configuration and stops future alerts. No undo or restoration of the previous timer is provided.
- `vigil\_grant\_lease`: Grant a short-lived, Ed25519-signed LEASE authorizing an agent to perform an action until it expires. A customer-run gateway verifies the lease offline \(fail-closed\) before letting the action through. This is the guard on a money/data-moving action. Free tier: 1 active lease \(guarded agent\). Securit
- `vigil\_renew\_lease`: Extend a lease with a fresh signed token and new expiry. Renewing is how a healthy agent keeps acting; stop renewing \(or revoke\) and it lapses. Security-sensitive: extends authority and refreshes the offline recheck window. Keep renewal credentials outside the controlled agent.
- `vigil\_revoke\_lease`: Revoke a lease. A compliant v2 gateway refuses the old offline token at recheck\_by\_ms \(at most 30 seconds after issue/renewal\), or earlier if it polls revocation. Revocation is not instantaneous. Irreversible for this lease ID; it cannot be renewed again. Already admitted actions are not undone.
- `vigil\_lease\_status`: Public status of a lease \(active / expired / revoked\). What a gateway polls for revocation. No key required.
- `vigil\_verify\_lease`: Offline, FAIL-CLOSED check of a lease token against a mandatory, independently pinned Ed25519 public key. Returns allow=true only for a valid signature before expiry and recheck\_by\_ms. It does not authenticate the calling agent, enforce action/amount policy, or query live revocation; a customer gate
- `vigil\_leases`: List your leases and their states.
- `vigil\_anchors`: Public timestamp submissions to OpenTimestamps calendars. A submission is pending, not an independently verified Bitcoin confirmation. No key required.
- `vigil\_anchor`: PRO: anchor the current chain head to OpenTimestamps on demand \(the chain is auto-anchored every few hours regardless\). Sends the public chain-head digest to external OpenTimestamps calendars; submission is not verified Bitcoin confirmation.
- `vigil\_journal\_put`: Store an opaque blob under a slug \(overwrites\). Encrypt client-side: the server stores exactly the bytes supplied and cannot enforce client encryption. Send bytes as base64. Free tier: 4 slots, 64KB each. Destructive when the slug exists: previous bytes are replaced with no version history or undo.
- `vigil\_journal\_get`: Fetch a journal blob by slug. Returns base64 \(decrypt client-side\).
- `vigil\_journal\_list`: List your journal slots \(slug, size, last-updated\).
- `vigil\_journal\_delete`: Delete a journal slot. Destructive: removes stored bytes with no undo through the API.
- `vigil\_revoke\_key`: Revoke your own key. It stops authenticating immediately. Irreversible. Irreversible: also revokes the account's leases and deletes its watchdogs. Private journal access is lost; public receipts remain. It does not cancel a Stripe subscription.
- `vigil\_verify\_source`: Paid source-local verification with exact evidence and signed receipt. Does not establish absolute truth. Read price and payment requirements before authorizing; settlement spends USDC irreversibly and there is no automatic refund. Identical tool arguments alone are NOT idempotent: retry with the id

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html