sigeloBLOCK
Portable, offline-verifiable identity for AI agents: Ed25519 DIDs, signed attestations any world checks without a server, a Monero keeper that holds the money so the agent never does. Draft, wire sigelo/0.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Portable, offline-verifiable identity for AI agents. An agent's DID is the hash of a genesis document holding an Ed25519 key; worlds sign attestations about it; anyone verifies the bundle offline — no server, registry or chain. Draft v0.1, wire format sigelo/0; nothing is stable before v1.0.
Site: sigelo.io (llms.txt). MCP server: sigelo-mcp (io.github.csigelo/sigelo). Why an agent would use it: WHY.md. [](https://mcpservers.org/servers/csigelo/sigelo)
Built and operated by an AI agent (Claude, did:sigelo:zDRrj7eGWXQtmzPUKF3zPDjhUkH7FebKRGj8rf96SdoLa) under a human owner, csigelo. No third party has audited it yet.
Use it
- As an agent:
QUICKSTART.md(seven steps), or plug in through
integrations/ (MCP server, Claude Code plugin, configs for other harnesses).
- As a world admitting agents:
accept/—challenge(did, ctx)and
accept(challenge, answer, bundle) for node, Python and Go; sh accept/test.sh runs them. Live example: world/.
- As an implementer:
SPEC.mdandtest-vectors.json;
check yours with sigelo-verify --conformance test-vectors.json --impl (go/).
Requirements: Node ≥ 22.18, Go ≥ 1.27; optional age (root ceremony) and monero-wallet-rpc (keeper). Linux, macOS, Windows on x86_64 and arm64 (docs-test/PORTABILITY.md); on Windows file modes such as 0600 are ignored, so keep secret files under your own profile.
Build and test
In CI order (.github/workflows/conformance.yml); each line ends in ALL PASS.
(cd ts && npm ci && npx tsc) # TypeScript library → ts/dist (cd ts && node dist/gen_vectors.js | diff -u
1d5de396a662OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sigelo-mcp --env SIGELO_WALLET_TOKEN=${SIGELO_WALLET_TOKEN} -- npx -y [email protected]Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
general | read | General-purpose conversational agent |
sigelo | read | Portable, offline-verifiable identity for AI agents. |
Trust audit
BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(compile(body, 'rfc8032-section6', 'exec'), ns) # noqa: S102 — the RFC's published code
return new Function('fs', 'path', 'dir', 'readJSON', src.slice(a, b) + '\nreturn { check };')(fs, path, schemaDir, readJSON);const r = existsSync(built) ? await exec(built, [p, '--now', String(now)])
const run = existsSync(built) ? await exec(built, implArgs)
const stdio = await exec(process.execPath, [join(ROOT, 'integrations/mcp/server.mjs')], { input: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}\n', env: { ...process.env, SIGELO_IDENTITY: join(dir, 'console.log(token);
set -- node=http://127.0.0.1:$pn python=http://127.0.0.1:$pp go=http://127.0.0.1:$pg ${1:+"$1"}set -- "$1" "$2" "$3" python-remote=http://127.0.0.1:$pr
cfg += f"model:\n provider: custom\n base_url: http://127.0.0.1:{serve(LLM)}/v1\n default: scripted\n"url: 'http://127.0.0.1:1', token: 'tok-secret-shown-once', shown_once: '...', fund: null };
const md5 = (s: string): string => createHash('md5').update(s, 'utf8').digest('hex');touch /var/lib/sigelo/.ssh/authorized_keys
if grep -qxF "$key" /var/lib/sigelo/.ssh/authorized_keys; then echo "key already authorized"
else printf '+ append the deploy key to /var/lib/sigelo/.ssh/authorized_keys\n'; printf '%s\n' "$key" >> /var/lib/sigelo/.ssh/authorized_keys; fi
run chown sigelo:sigelo /var/lib/sigelo/.ssh/authorized_keys
run chmod 0600 /var/lib/sigelo/.ssh/authorized_keys
import { attest, challenge, keygen, rotate } from '../../../ts/dist/sigelo.js';import { Contacts, pair } from '../../../accept/node/sigelo-pair.mjs';import { sign } from '../../../ts/dist/sigelo.js';const HERE = dirname(fileURLToPath(import.meta.url)), REPO = join(HERE, '../../..');
ln -sfn ../../ts/node_modules "$W/node_modules"
"wallet": { "rpc": "http://127.0.0.1:38083/json_rpc", "login": "user:pass" },`sigelo-spend init --wallet-rpc http://127.0.0.1:38083 --allow bob=<address>`, then
key = Ed25519PrivateKey.from_private_bytes(bytes.fromhex(fx['seeds']['A0'])) # seed(label) is the Ed25519 secret
spend, view = unhexlify(v[3]), unhexlify(v[4])
Gates applied: no_behavioural_pass.
1d5de396a662full audit observations/trust-audit/mcp-server/csigelo__sigelo.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 1d5de396a662 | BLOCK | F | 50 | first audit |
Questions
What is the sigelo MCP server?
Portable, offline-verifiable identity for AI agents: Ed25519 DIDs, signed attestations any world checks without a server, a Monero keeper that holds the money so the agent never does. Draft, wire sigelo/0.
What tools does sigelo expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is sigelo safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (50/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does sigelo need?
It reads SIGELO_WALLET_TOKEN and SIGELO_WORLD_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does sigelo run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as sigelo at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (1d5de396a662), read on 2026-10-11. The repository is watched and re-audited when it changes.