MCP server · public integrity tier

Verify our receipts from inside your own AI client.

citability.dev runs a Model Context Protocol server at https://citability.dev/mcp. Connect it to Claude, or any MCP client that speaks streamable HTTP, and check our audit receipts yourself. The integrity tools below need no account and no API key: the point of a receipt is that you do not have to trust us to check it.

01 /Connect

Claude Code

One command in your terminal, then the tools appear in your next session.

claude mcp add --transport http citability https://citability.dev/mcp

Claude Desktop and claude.ai

Settings → Connectors → Add custom connector, then paste https://citability.dev/mcp as the URL. Leave authentication empty.

Any other MCP client

Add this to your client's MCP server configuration. The endpoint speaks JSON-RPC 2.0 over streamable HTTP.

{
  "mcpServers": {
    "citability": {
      "type": "http",
      "url": "https://citability.dev/mcp"
    }
  }
}

02 /What you can do without an account

verifyReceipttool · no auth

Hand it any receipt id. The server re-computes the sha256 hash chain from the stored payload and tells you whether the receipt is genuine and untampered. An unknown id returns found: false, never an error.

citability://methodology/receiptsresource · no auth

The receipt methodology in markdown: what gets signed, the canonical field order, and how the prevSha256 chain links every receipt to the one before it.

citability://calibration/latestresource · no auth

The latest calibration receipt as JSON, the same document published at /.well-known/calibration-latest.

03 /Example: verify a real receipt

Ask your client to "verify receipt rcpt_MSPI2XRL283A72 with citability", or send the JSON-RPC call directly. The response tells you whether the stored payload still matches its signature, and links the public verification page for the same receipt.

POST https://citability.dev/mcp
{
  "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {
    "name": "verifyReceipt",
    "arguments": { "receiptId": "rcpt_MSPI2XRL283A72" }
  }
}

{
  "found": true,
  "hashValid": true,
  "receipt": { "verdict": "absent", "query": "...", "sha256": "..." },
  "verifyUrl": "https://citability.dev/r/rcpt_MSPI2XRL283A72"
}

04 /Operator tools

The same endpoint lists the operator action catalog: scans, audits, monitoring, and reporting. Those tools require a signed-in citability.dev session or an agent credential, and the audit runner additionally requires explicit human approval per call. Each tool publishes its required scopes in its listing, so your client can see up front what it may and may not do. Machine-readable discovery lives at /.well-known/agent.json.