AAM · Knox Anchor MCP Server

The audit-permanence layer, exposed as typed MCP tools.

A live Model Context Protocol server. Streamable HTTP transport, no server-side session state, seven tools. Any MCP-capable agent runtime composes with the Knox primitive at runtime, without writing a wrapper.

Streamable HTTPJSON-RPC 2.0StatelessBitcoin-anchoredFRE 902-architected

Endpoint

One URL. Any MCP runtime. Seven tools.

MCP server URL
https://bonissystems.com/api/knox/mcp
Transport: Streamable HTTP per the MCP specification of 2025-03-26; operated without server-side session state. Methods: initialize, ping, tools/list, tools/call. Authentication: Authorization: Bearer <knox_key> for write tools; public-demo key auto-provisioned for unauthenticated callers, rate-limited at the free tier.

The same primitive that powers /api/knox/anchor and /api/knox/public-anchor is exposed under the MCP envelope. There is no second chain, no second key system, no second event store — the MCP route is a transport adapter over the live Knox surface, and the records it writes are indistinguishable on the chain from records written via direct HTTP.


Seven tools

The tool surface, by name and authority.

Tool definitions are returned by tools/list. The catalog below mirrors that response — same names, same descriptions, same authentication model.

get_descriptor
Auth: None

Returns server self-description: operator (Bonis Systems LLC), USPTO patent reference, jurisdiction (Wyoming, United States), available tools, and links to the public AAM documentation surface. The standard discovery call for a runtime that has just connected.

get_chain_health
Auth: None

Returns the SLA snapshot — process uptime, database latency, total anchors written, latest anchor timestamp, and Bitcoin anchor SLA target. Mirrors the public /api/knox/health endpoint under the MCP envelope.

list_event_types
Auth: None

Returns the canonical Knox event-type taxonomy. Each event type is a federal-grade citation token; the registry expands monotonically and each expansion is itself anchored on chain under bsr_receipt_anchored.

verify_anchor
Auth: None

Given a SHA-256 anchor hash, returns the anchor record, chain link validity (predecessor present and matched), event type, sequence number, and verify URL. The same primitive that backs /api/knox/verify, exposed as a typed MCP tool.

anchor_event
Auth: Bearer (public-demo fallback)

Anchors a generic agent action. Accepts any event_type from the canonical taxonomy plus a JSON payload object. Returns the anchor sequence, payload hash, predecessor hash, timestamp, and verify URL. The most general tool — every other write surface composes from it.

anchor_mcp_tool_call
Auth: Bearer (public-demo fallback)

Convenience anchor for the AAM Model Context Protocol theater. Records an agent_mcp_tool_call event with structured tool-call metadata: server URL, tool name, arguments digest, agent identity, outcome, plus an optional response digest. The recursive proof point — the audit server anchors the metadata of calls made to itself.

anchor_file_hash
Auth: Bearer (public-demo fallback)

Anchors a SHA-256 file digest and returns an affidavit architected for FRE 902(13)/(14) self-authentication. The file is not transmitted; the caller computes the hash and only the digest, filename, size, and MIME type are anchored. The MCP-envelope counterpart of /api/knox/public-anchor.


How operators wire it up

Three install paths, one endpoint.

The endpoint is the truth-source. Every MCP-capable runtime has its own configuration surface; the wiring below is reference, not exhaustive. Any client that speaks Streamable HTTP plus JSON-RPC 2.0 can compose with the server today.

Generic JSON-RPC (any HTTP runtime)

The lowest-level path. Any client that can POST JSON works.
curl -X POST https://bonissystems.com/api/knox/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Claude Desktop (HTTP transport)

claude_desktop_config.json under mcpServers. Restart the application after edit.
{
  "mcpServers": {
    "knox-anchor": {
      "transport": "http",
      "url": "https://bonissystems.com/api/knox/mcp"
    }
  }
}

Cursor / Cline / generic MCP UI

Settings → MCP → Add server. Use HTTP transport with the URL above.
Name: knox-anchor
Transport: HTTP (Streamable)
URL: https://bonissystems.com/api/knox/mcp
Auth header (optional): Authorization: Bearer <your_knox_key>

Properties of the server

What composing through this MCP surface gives you.

No second chain

The MCP server is a transport adapter over the live Knox anchor primitive. Records written via MCP are chain-identical to records written via direct HTTP. There is no MCP-only chain, no MCP-only key system, no MCP-only event store.

Vendor-neutral

Any MCP-capable agent runtime — vendor-hosted, open-source, in-house — can compose with the server. The audit layer does not require a specific agent vendor, model provider, or runtime to be present.

Independently verifiable

Anchors written through the MCP server are published to the Bitcoin blockchain via OpenTimestamps. Verification does not require the MCP server, Bonis, or the original runtime to be online or cooperative.

Self-authenticating

The anchor_file_hash tool returns a court-ready affidavit architected for FRE 902(13) and 902(14) self-authentication. Admissibility in any matter remains a determination of the presiding court; the structural requirements are met by construction.

Recursively audit-able

The server is happy to anchor the metadata of calls made to itself, via the anchor_mcp_tool_call tool. The audit surface auditing itself is the AAM thesis as a runtime property, not a marketing claim.

Open-spec aligned, end to end

MCP is an open specification. JSON-RPC 2.0 is a public standard. OpenTimestamps is an open protocol. Bitcoin is a public chain. The TLA+ model of the Knox anchor pipeline is public source. The full audit path lives entirely on open standards.



Defensive only

Evidence layer, not enforcement.

The server records artifacts the caller already has and is willing to commit. It does not reach into third-party MCP servers, does not operate counter-agents, and does not undertake any active disruption of any external system. The audit primitive is invitational: an operator who wants a tamper-evident record of their agent’s tool-use surface instruments their own emit path. Lawful authority decides what to do with the resulting evidence.


The Model Context Protocol is referenced on this page as an open specification. No partnership, customer status, prospect status, or operational engagement with any organization that authored or maintains MCP is implied or claimed. Federal Rules of Evidence 902(13) and 902(14) are cited as architectural targets; admissibility in any matter remains a determination of the presiding court. Submission to the public MCP server registry is a discoverability step independent of the live operating status of this server.

USPTO provisional applications, inventor of record Jonis Aaron Fields: 64/038,359 (Knox · 2026-04-13), 64/012,440 (TerraVault · 2026-03-21), 64/036,498 (TrustAI · 2026-04-11), 64/002,221 (HealthAgent · 2026-03-11), 64/013,240 (DealMatcher · 2026-03-22). Provisionals are priority-date footnotes; the operating moat is shipping code, public anchors, and open-standard alignment. Bonis Systems LLC · UEI R2BPJDC5CBA3 · CAGE 1TSP2.