@Cellar Door/ Server

npm version tests license NIST

𓉸 Passage Protocol · exit-door · entry-door · mcp · langchain · vercel · eliza · eas · erc-8004 · sign · python

⚠️ Pre-release software — no formal security audit has been conducted. This project is published for transparency, review, and community feedback. It should not be used in production systems where security guarantees are required. If you find a vulnerability, please report it to [email protected].

Give any MCP-compatible AI (Claude, Cursor, Windsurf) the ability to create and verify agent departure records.

Ecosystem

Package	Language	Description
cellar-door-exit	TypeScript	Core protocol (reference impl)
cellar-door-exit	Python	Core protocol
cellar-door-entry	TypeScript	Arrival/entry markers
@cellar-door/langchain	TypeScript	LangChain integration
cellar-door-langchain	Python	LangChain integration
@cellar-door/vercel-ai-sdk	TypeScript	Vercel AI SDK
@cellar-door/mcp-server	TypeScript	MCP server ← you are here
@cellar-door/eliza	TypeScript	ElizaOS plugin
@cellar-door/eas	TypeScript	EAS attestation anchoring
@cellar-door/erc-8004	TypeScript	ERC-8004 identity/reputation
@cellar-door/sign-protocol	TypeScript	Sign Protocol attestation

Paper · Website

Quick Start

Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "cellar-door": {
      "command": "npx",
      "args": ["@cellar-door/mcp-server"],
      "env": {
        "CELLAR_DOOR_SERVER_POLICY": "STRICT"
      }
    }
  }
}

Restart Claude Desktop. You can now say:

"Create a departure record for my agent leaving platform-x.example.com"

Claude will call the quick_exit tool and return a signed, verifiable EXIT marker.

Cursor / Windsurf

npm install @cellar-door/mcp-server

Point your MCP client at the server. It exposes 7 tools automatically.

Tools

EXIT Tools

Tool	Description
generate_identity	Generate an Ed25519 DID keypair for signing
quick_exit	One-shot: create + sign a departure marker
create_exit_marker	Create and sign a marker with full options
verify_exit_marker	Verify a marker from JSON

ENTRY Tools

Tool	Description
verify_and_admit	Verify EXIT marker, evaluate admission policy, create arrival
evaluate_admission	Check if EXIT marker meets an admission policy
verify_transfer	Verify a complete EXIT→ENTRY transfer chain
list_admission_policies	List available admission policy presets

⚠️ Security: Admission Policy

IMPORTANT: By default, the server uses STRICT admission policy when no policy is specified by the LLM. This is intentional; an LLM can freely choose the most permissive policy (OPEN_DOOR) or omit the parameter entirely to bypass admission checks.

For production deployments, always set a server-side policy override using one of:

• Environment variable: CELLAR_DOOR_SERVER_POLICY=STRICT (or EMERGENCY_ONLY)
• Constructor option: createServer({ serverPolicy: "STRICT" })

When serverPolicy is set, any LLM-provided admissionPolicy parameter is ignored.

Policy	Behavior
OPEN_DOOR	Accept any departure with a valid signature
STRICT	Voluntary only, <24h old, requires lineage + stateSnapshot modules
EMERGENCY_ONLY	Accept only emergency exits

Sample Conversation (Claude Desktop)

User: I need to leave Platform X. Can you create a departure record?

Claude: I'll create a signed EXIT marker for your departure from Platform X.

→ Calls: quick_exit({ origin: "did:web:platform-x.example.com", reason: "Migrating to new platform" })

Claude: Here's your signed departure marker:
- ID: exit:abc123...
- Subject: did:key:z6Mk...
- Origin: did:web:platform-x.example.com
- Exit Type: Voluntary
- Signature: ✅ Verified

User: Now verify this on Platform Y and create my arrival.

→ Calls: verify_and_admit({
    exitMarkerJson: "{...}",
    destination: "did:web:platform-y.example.com",
    admissionPolicy: "STRICT"
  })

Claude: ✅ Admitted. Arrival marker created with continuity verified.

Programmatic Usage

import { createServer } from "@cellar-door/mcp-server";

const server = createServer({
  serverPolicy: "STRICT",  // Lock admission policy server-side
});

Example Tool Calls

Quick Exit

{
  "name": "quick_exit",
  "arguments": { "origin": "did:example:my-agent", "reason": "Task complete" }
}

Verify and Admit

{
  "name": "verify_and_admit",
  "arguments": {
    "exitMarkerJson": "{...exit marker JSON...}",
    "destination": "did:example:new-platform",
    "admissionPolicy": "OPEN_DOOR"
  }
}

Verify Transfer

{
  "name": "verify_transfer",
  "arguments": {
    "exitMarkerJson": "{...exit marker...}",
    "arrivalMarkerJson": "{...arrival marker...}"
  }
}

Production Deployment

⚠️ Authentication: The MCP server does not include built-in authentication. In production, deploy behind an authenticated reverse proxy or API gateway. Do not expose MCP tools directly to untrusted clients.

⚠️ Disclaimer

WARNING: Automated admission decisions should be reviewed by platform operators. This integration does not constitute legal advice. Platforms are responsible for their own admission policies and the consequences of admitting agents.

License

Apache-2.0