Guide

Admission control

Attestation turns the record into a gate: protected resources admit only agents that are running the AER collector right now, in a live recorded session. An unattested client has no token and is denied at the door.

How it works

The collector mints a short-lived EdDSA attestation token for the running session and a specific audience, and attaches it as X-AER-Attestation to matching outbound requests. The resource verifies the token offline against AER’s published JWKS, checks the audience and optionally checks revocation. Tokens live for five minutes, carry the tenant, agent and session identity and can be bound to a holder with DPoP or an mTLS client certificate thumbprint.

Protect an MCP server

@adastracomputing/aer-mcp-guard mounts in front of any HTTP MCP endpoint (Streamable HTTP and SSE; stdio has no network admission point). It has no dependency on the MCP SDK.

import { honoMcpGuard } from '@adastracomputing/aer-mcp-guard/hono';

app.use('/mcp', honoMcpGuard({ audience: 'mcp://payments-prod' }));
// claims available at c.get('aerAttestation'); mount your MCP handler after.

Express and a framework-neutral core (guardMcpRequest) are also exported. On denial the guard returns an HTTP status plus a JSON-RPC 2.0 error: 401 for a missing, malformed, expired or wrong-audience token, 403 for a valid but revoked token and 503 when revocation checking is unreachable and the guard is fail-closed.

Protect anything else

@adastracomputing/aer-resource-node verifies tokens at any Node resource: offline against a cached JWKS, with optional live revocation via POST /v1/attestations/introspect using a verifier key your tenant mints.

Scopes are least privilege

A token carries only the intersection of what the agent requested and what an operator granted for that agent and audience. With no grant the token carries no scopes, so a resource can insist on tools.read and deny everything else by default.

Client side

// aer.config.json
{
  "protected_resources": [
    { "host": "mcp.internal", "audience": "mcp://internal-tools" },
    { "host": ".corp.example", "audience": "https://corp.example" }
  ]
}

Injection is HTTPS-only, never overwrites a caller-supplied header and never follows a token across origins on redirect. Per-resource enforcement can also block egress outright when no valid token is available (enforcement: "block" with fail_closed or fail_open behaviour when AER is unreachable).