# Mirror for AI agents

Banks are starting to give AI agents work: gathering evidence for a case, checking a trade before an officer looks at it, keeping a file in order. `sdk/mirror-mcp.js` makes Mirror's checks callable by any agent that speaks the Model Context Protocol (MCP), including Claude, with the same guarantees a bank's own code gets. Every signed answer is verified before the agent sees it. Raw trade data is refused before anything leaves the machine.

## Connect it

The server is one file with no dependencies. It speaks MCP over standard input and output, so it runs beside the agent, inside the bank. In Claude Code:

```
claude mcp add mirror -- node sdk/mirror-mcp.js
```

In a desktop client's configuration file:

```json
{ "mcpServers": { "mirror": {
    "command": "node",
    "args": ["sdk/mirror-mcp.js"],
    "env": { "MIRROR_BASE_URL": "https://mirror-operator.vasileburuian94.workers.dev" } } } }
```

Configuration comes from the environment only, never from a tool argument, so a credential never appears in the agent's conversation:

| Variable | What it is |
|---|---|
| `MIRROR_BASE_URL` | The operator. The live one by default |
| `MIRROR_SESSION_TOKEN` | A member session, minted outside the agent: sign the login challenge with `mirror-bander sign-login`, then `POST /auth/session`. Mint it from a **delegated desk key** with only the scopes the agent needs |
| `MIRROR_PILOT_TOKEN` | The shared pilot token, if no session is given |
| `MIRROR_JWKS_FILE` | A pinned key set, so `mirror_verify_record` needs no network at all |

## The tools

| Tool | What it does | Reads or writes |
|---|---|---|
| `mirror_health` | Is the operator up; is the independence gate enforced; how is state stored | Reads |
| `mirror_refusals` | The signed list of what Mirror cannot do, verified | Reads |
| `mirror_residency` | Where the operator processes and stores, signed, checked against the jurisdiction you require | Reads |
| `mirror_public_registry` | Ratified table hashes, member and witness keys and the ledger head, verified | Reads |
| `mirror_corridor_certificate` | How much a ratified table can hide, verified | Reads |
| `mirror_validation_dossier` | The determinism proof, decision table and parameter inventory, re-run and verified ([model-risk pack](/model-risk.md)) | Reads |
| `mirror_verify_record` | Checks any signed record without trusting the operator: its signature and, for a verdict, every member-signed input and the recomputed join | Local check |
| `mirror_reconcile` | Submits the commitments for one shipment and returns the verified reading | Writes a verdict |
| `mirror_exposure_commit` | Posts a duplicate-financing claim made by the bander ([duplicate financing](/double-financing.md)) | Writes |
| `mirror_exposure_check` | Asks whether documents your member committed are financed elsewhere at the same time | Reads |

## What an agent cannot do with it

There is no tool for any of these, so no instruction to the agent can reach one:

- **Band a value.** Banding happens in the bander, inside the bank, with the network sealed. The agent submits only what the bander produced, and a raw field in a tool call is refused before a request is made.
- **Hold a key.** The server holds no member key and no corridor secret. A session token is minted outside and can be scoped and revoked.
- **Score, rank, or file.** Mirror gives one of three readings and makes no filing decision. The server's own instructions to the model say so: a divergent reading is a reason to look, not proof of wrongdoing.

## Why verification matters more for an agent

An agent summarises what tools return, and a summary of a forged answer reads like a summary of a real one. So the server rejects an answer whose signature does not verify before the agent sees it: a changed verdict comes back as a tool error, never as a result. `mirror_verify_record` lets the agent, or the officer reviewing its work, re-check any record it was shown.

## The honest boundary

- **A verified record proves who signed it, not that its inputs were true.** The agent does not make Mirror's answers more right.
- **The agent's summary is the agent's.** The tool output is the operator's answer as verified; what the agent says about it is not signed by anyone.
- **A credential is a credential.** An agent holding a session can act for the member within its scopes. Delegate narrowly and revoke when the work is done.
- **The protocol versions are the ones this file implements** (2024-11-05 to 2025-11-25). It offers tools only: no resources, no prompts, no sampling.
- Tested by `server/mcp.test.js`, which runs the server as a separate process against a running operator and speaks to it as an MCP client would.