Banks are starting to give AI agents work: gathering evidence for a case, checking a trade before an officer looks at it, keeping a file in order. sdk/mirror-mcp.js makes Mirror's checks callable by any agent that speaks the Model Context Protocol (MCP), including Claude, with the same guarantees a bank's own code gets. Every signed answer is verified before the agent sees it. Raw trade data is refused before anything leaves the machine.
Connect it#
The server is one file with no dependencies. It speaks MCP over standard input and output, so it runs beside the agent, inside the bank. In Claude Code:
claude mcp add mirror -- node sdk/mirror-mcp.jsIn a desktop client's configuration file:
{ "mcpServers": { "mirror": {
"command": "node",
"args": ["sdk/mirror-mcp.js"],
"env": { "MIRROR_BASE_URL": "https://mirror-operator.vasileburuian94.workers.dev" } } } }Configuration comes from the environment only, never from a tool argument, so a credential never appears in the agent's conversation:
| Variable | What it is |
|---|---|
MIRROR_BASE_URL | The operator. The live one by default |
MIRROR_SESSION_TOKEN | A member session, minted outside the agent: sign the login challenge with mirror-bander sign-login, then POST /auth/session. Mint it from a delegated desk key with only the scopes the agent needs |
MIRROR_PILOT_TOKEN | The shared pilot token, if no session is given |
MIRROR_JWKS_FILE | A pinned key set, so mirror_verify_record needs no network at all |
The tools#
| Tool | What it does | Reads or writes |
|---|---|---|
mirror_health | Is the operator up; is the independence gate enforced; how is state stored | Reads |
mirror_refusals | The signed list of what Mirror cannot do, verified | Reads |
mirror_residency | Where the operator processes and stores, signed, checked against the jurisdiction you require | Reads |
mirror_public_registry | Ratified table hashes, member and witness keys and the ledger head, verified | Reads |
mirror_corridor_certificate | How much a ratified table can hide, verified | Reads |
mirror_validation_dossier | The determinism proof, decision table and parameter inventory, re-run and verified (model-risk pack) | Reads |
mirror_verify_record | Checks any signed record without trusting the operator: its signature and, for a verdict, every member-signed input and the recomputed join | Local check |
mirror_reconcile | Submits the commitments for one shipment and returns the verified reading | Writes a verdict |
mirror_exposure_commit | Posts a duplicate-financing claim made by the bander (duplicate financing) | Writes |
mirror_exposure_check | Asks whether documents your member committed are financed elsewhere at the same time | Reads |
What an agent cannot do with it#
There is no tool for any of these, so no instruction to the agent can reach one:
- Band a value. Banding happens in the bander, inside the bank, with the network sealed. The agent submits only what the bander produced, and a raw field in a tool call is refused before a request is made.
- Hold a key. The server holds no member key and no corridor secret. A session token is minted outside and can be scoped and revoked.
- Score, rank, or file. Mirror gives one of three readings and makes no filing decision. The server's own instructions to the model say so: a divergent reading is a reason to look, not proof of wrongdoing.
Why verification matters more for an agent#
An agent summarises what tools return, and a summary of a forged answer reads like a summary of a real one. So the server rejects an answer whose signature does not verify before the agent sees it: a changed verdict comes back as a tool error, never as a result. mirror_verify_record lets the agent, or the officer reviewing its work, re-check any record it was shown.
The honest boundary#
- A verified record proves who signed it, not that its inputs were true. The agent does not make Mirror's answers more right.
- The agent's summary is the agent's. The tool output is the operator's answer as verified; what the agent says about it is not signed by anyone.
- A credential is a credential. An agent holding a session can act for the member within its scopes. Delegate narrowly and revoke when the work is done.
- The protocol versions are the ones this file implements (2024-11-05 to 2025-11-25). It offers tools only: no resources, no prompts, no sampling.
- Tested by
server/mcp.test.js, which runs the server as a separate process against a running operator and speaks to it as an MCP client would.