How to connect AffixIO MCP

What is the Model Context Protocol?

The Model Context Protocol (MCP) is an open standard for connecting AI assistants and agents to external tools and data sources. Instead of copying API docs into every chat, the client discovers tools, calls them with structured arguments, and receives typed results.

AffixIO publishes a remote MCP server so Claude and compatible vetted clients can run zk_prove, zk_verify, and Merkle lookups without you operating proof infrastructure locally. Proof generation runs on api.affix-io.com (Noir with Barretenberg). The MCP layer handles auth, tool routing, and formatted responses.

This guide covers public connection methods only. It does not describe internal keys, circuit bytecode, or proprietary rule engines.

Endpoint and transport

Four ways to connect

All paths below use the same hosted endpoint. Pick the one that matches your client.

claude mcp add --transport http affixio-proof https://affix-io.com/mcp

https://affix-io.com/mcp

OAuth flow (what happens behind Connect)

Remote MCP clients follow standard OAuth 2.0. You approve access once; the client stores a Bearer token for subsequent tool calls.

1. Discovery. The client reads /.well-known/oauth-authorization-server on affix-io.com for authorisation and token endpoints.
2. Registration. Many clients self-register via POST /oauth/register (dynamic client registration).
3. Authorisation. You approve access at /oauth/authorize with PKCE. Claude uses callback https://claude.ai/api/mcp/auth_callback.
4. Token. The client exchanges the code at POST /oauth/token and receives a Bearer access token.
5. MCP session. Authenticated requests hit POST /mcp with JSON-RPC style MCP messages. Unauthenticated requests receive HTTP 401.

Your first tool call

After connecting, ask Claude to list tools or run a simple proof. A safe starting pattern:

1. Call zk_list_circuits to see available circuit ids.
2. Call zk_scenario_match with a plain-language scenario to get suggested circuit and fields.
3. Call zk_prove with synthetic test data (not real PII).
4. Call zk_merkle_proof with the returned digest to fetch an inclusion proof.

Example: yes/no circuit (synthetic)

In chat, you might say: “Use zk_prove with circuit yesno and fields condition_greater1, condition_greater2, condition_greater3 all set to 1. Set request_attestation true.”

Core starter circuits:

• yesno — three boolean conditions (each 0 or 1).
• health_age — age and threshold integers.
• kyc — five rule fields (rule1 through rule5).

Responses include proof_ref (short audit token), proof_digest, and optional merkle_root when anchored.

MCP tool reference (public names)

Tool names and descriptions are exposed through MCP tools/list. Grouped overview:

Prove and verify

zk_prove accepts circuit_id, fields, optional labels and summary, and request_attestation for PQC signing.

Post-quantum attestation

Standalone ML-DSA-65 sign and verify paths. Also available inline on prove via request_attestation: true.

Merkle audit

Leaves record lifecycle events including generated, verified, and proof_requested. Public root: GET https://api.affix-io.com/v1/merkle/root.

QR, barcode, offline tickets

Discovery and health

Post-quantum cryptography (PQC) over MCP

Long-lived proof bundles face harvest-now-decrypt-later risk if they rely only on classical signatures. AffixIO attaches optional ML-DSA-65 attestation (NIST FIPS 204 lattice signatures) on prove and verify outcomes.

From MCP, set request_attestation: true on zk_prove or call zk_attest / zk_attest_verify directly. Responses can include signed_at, payload_digest, mldsa_signature_b64, and algorithm ML-DSA-65.

For procurement context see post-quantum attestation field note, WP-036 PQC sandbox, and WP-041 US federal PQC executive order.

Merkle audit from chat

When a proof is generated or verified through the API, AffixIO can append a leaf to the audit Merkle tree. MCP tools let you pull inclusion proofs without retrieving source data.

• zk_merkle_proof — fetch inclusion steps for a digest (records a proof_requested audit event).
• zk_merkle_verify — check a leaf hash and proof path against a root.
• zk_governance_stats — summary counts from the audit layer.

Browser alternative: Merkle verifier tool. API reference: integration patterns and OpenAPI.

Data handling in AI clients

The MCP connector is designed for governance workflows: yes/no outcomes, audit references, and shareable proof bundles. Store proof_ref in your logs; avoid retaining raw proof hex or source payloads unless your policy requires it.

Troubleshooting