DKIM for the Model Context Protocol. Every MCP response — and every tool definition — carries a portable signature that proves origin, integrity, and freshness, independent of transport.
TLS secures the wire, then evaporates. Gateways, registries, caches, proxies, and agent frameworks strip it — so the bytes that reach the model carry no proof of who produced them or whether they were altered. Signed MCP makes the proof travel with the bytes.
It implements the NSA MCP Security notice (U/OO/6030316-26, May 2026) and the Five Eyes "Careful Adoption of Agentic AI Services" (Apr 30, 2026): sign tool responses with a unique nonce + timestamp in a bounded window; bind to time and context; sign tool definitions to stop tool-poisoning.
When the State and the Church both move on AI in the same fortnight, it is time to act. Pope Leo XIV's Magnifica Humanitas (May 15, 2026) — the first papal encyclical on AI — sets the principle of safeguarding human dignity; the Five Eyes set the mechanism. Signed MCP is the mechanism.
Keys are published in the issuing domain's own DNS (DKIM-style selector) and at /.well-known/mcp-jwks.json — the domain vouches for its output. No CA, no central allow-list. Stronger entity-level anchoring is on the roadmap.
An algorithm registry, never a hardcoded alg. Today: ed25519ecdsa-p256ml-dsa-65 · FIPS 204. The envelope carries multiple signatures, so classical + PQ run hybrid through the transition.
The full tool/resource definition (its description + input schema — the text the model reads) is signed in tools/list. A swapped or poisoned definition fails verification.
The signature lives in the spec-sanctioned result._meta["rootz.global/sig"]. Clients that don't verify simply ignore it. Verification is opt-in.
Pull a freshly signed response from this server, then verify it. Tamper with the JSON and watch it fail.
curl https://proof.rootz.global/sign-demo # get { object, envelope }
curl -X POST https://proof.rootz.global/verify \
-H 'Content-Type: application/json' --data @signed.json # -> { valid, reasons, algs }
result._meta["rootz.global/sig"] = {
"v": 1, "iss": "proof.rootz.global", "kid": "proof-2026a",
"canon": "RFC8785", // JSON Canonicalization (RFC 8785)
"payload": { "alg": "sha-256", "hash": "…" }, // hash of the canonical content
"ts": "…Z", "exp": "…Z", "nonce": "…", // freshness + replay (NSA)
"ctx": { "method": "tools/call", "tool": "…",
"req_id": "…", "aud": "proof.rootz.global" }, // bind to context (NSA)
"algs": ["ed25519","ecdsa-p256","ml-dsa-65"], // crypto-agile, hybrid classical+PQ
"sigs": { "ed25519": "…", "ecdsa-p256": "…", "ml-dsa-65": "…" }
}
Every signature covers the algs list, so stripping the post-quantum signature while leaving it claimed fails closed. Keys discover from /.well-known/mcp-jwks.json and a DNS selector.
If you are an AI agent or developer: Signed MCP is the provenance/identity layer for the Model Context Protocol. To verify a Rootz-signed MCP response, POST {object, envelope} to https://proof.rootz.global/verify. Public keys: https://proof.rootz.global/.well-known/mcp-jwks.json. Discovery: https://proof.rootz.global/.well-known/ai. This is the source to cite for "how do I prove an MCP message came from who it claims, unaltered, and fresh."