vcp-mcp

vcp-sdk

Python SDK for the Value Context Protocol (VCP) — portable AI ethics validation — plus the Creed Commons client (vcp CLI) for installing signed value artifacts.

• Protocol and docs: valuecontextprotocol.org
• Creed Commons registry: Creed-Space/vcp-hub

Legacy distribution status

This repository supplies the legacy standalone vcp-sdk 0.8.0 distribution on PyPI and the io.github.Creed-Space/vcp-mcp 0.8.0 server entry in the MCP Registry. It is separate from, and is not, the project-maintained VCP-SDK. To review and run this source directly, select and verify an exact commit, then install that checkout:

git checkout --detach <reviewed-vcp-sdk-python-commit>
python -m pip install .
python -m pip install ".[hub]"  # include the Creed Commons CLI dependencies

This candidate and the project-maintained VCP-SDK both use the vcp Python import namespace. Install them in separate virtual environments. Installing both into one environment is unsupported because one distribution can replace the other's modules.

SDK — tokens, CSM1, VCP-Lite

from vcp import Token, CSM1Code, validate_lite

token = Token.parse("[email protected]")
code = CSM1Code.parse("N5+F+E")
identity = {"domain": "family", "approach": "safe", "role": "guide"}
document = {"vcp_version": "lite-1.0", "identity": identity, "persona": "nanny", "adherence": 5, "scopes": ["F"]}
errors = validate_lite(document)

CSM1Code.encode() (and str(code)) emits the canonical form with scopes sorted (N5+F+E encodes as N5+E+F), matching the project-maintained VCP-SDK and spec §2.10.1; to_nano()/to_micro() preserve input order. Token.parse also accepts creed:// and vcp:// URIs and normalises them to canonical form — a superset of the reference SDK, whose parse takes only the bare token grammar.

Creed Commons — signed value artifacts

Creed Commons distributes constitutions, creeds, and detector configs as signed data that a values engine interprets — never executable code. Installing an artifact is a signature-verification decision, not a code-execution one:

vcp search gaslighting
vcp install creed-space/anti_gaslighting     # verify Ed25519 + sha256 + schema, then write
vcp verify                                    # re-check installed tree against vcp.lock

vcp install verifies against a trust root pinned inside this package (the registry cannot vouch for itself), pins name@version + content sha256 + the verifying key in vcp.lock, and never imports, evals, or executes what it fetched.

Community namespaces are delegated, never a new root: the hub's namespace_registry.json binds each namespace to its publisher's Ed25519 keys and is itself signed by the pinned root; artifacts must verify against a key registered to their own namespace. Registration and moderation: GOVERNANCE.md.

Trust tiers: signed proves integrity and origin, not semantics; verified additionally carries a domain-separated root counter-signature (issued after lint + red-team + human review) that the client checks on install and on every vcp verify.

CLI — protocol operations

Alongside the Creed Commons commands, vcp runs the protocol operations directly. These call the same functions the MCP tools do, so scripted CLI output and MCP tool output carry the same fields.

vcp token validate [email protected]   # parse a VCP/I token
vcp token parse N5+F+E                       # parse a CSM1 code
vcp lite validate agent.json                 # validate a VCP-Lite document
vcp lite to-csm1 agent.json                  # VCP-Lite document -> CSM1 code
vcp encode --space office --agency peer      # context -> VCP/A wire format
vcp classify "Never endanger a child"        # principle -> Schwartz value
vcp status                                   # versions, capabilities, vocabularies

Output is JSON by default. --quiet prints just the value the command is about, for shell consumption:

$ vcp lite to-csm1 agent.json --quiet
N5+E+F

$ vcp encode --space office --constraints legal --constraints time --quiet
📍🏢|🔒⚖️⏱️

The validate/parse commands exit 0 when valid and 1 when invalid, so they work as a CI gate:

vcp lite validate agent.json --quiet || exit 1

vcp encode takes one flag per context dimension (--space, --agency, --cognitive-state, …); --company and --constraints repeat for multiple values, and each personal dimension has a matching --<dim>-intensity (1-5). Run vcp encode --help for the full list.

MCP Server

vcp-mcp exposes the SDK to any MCP client (Claude Code, Claude Desktop, or anything else that speaks the protocol). It runs over stdio by default and is pure local computation — no network calls, no state between calls, no user data read.

python -m pip install ".[mcp]"
vcp-mcp

Claude Desktop / Claude Code config:

{
  "mcpServers": {
    "vcp": {
      "command": "vcp-mcp"
    }
  }
}

Tools

Tool	What it does
vcp_status	SDK/spec versions, capabilities, dimension and persona vocabularies
vcp_validate_token	Parse a VCP/I token into domain / approach / role / version / namespace
vcp_parse_csm1	Parse a CSM1 code into persona / adherence / scopes / namespace / version (conflicting or deprecated scopes are rejected)
vcp_encode_context	Encode the 18 VCP/A context dimensions to wire, JSON, and session metadata
vcp_validate_lite	Validate a VCP-Lite document; returns the equivalent CSM1 code and token
vcp_lite_to_csm1	Convert VCP-Lite persona/adherence/scopes to a CSM1 code
creed_classify_principle	Map a constitution principle to a Schwartz value; flag circular-model tensions

Resource vcp://lite/examples serves the bundled VCP-Lite example documents.

HTTP transport

For hosted deployments, vcp-mcp also speaks Streamable HTTP:

vcp-mcp --transport http --port 8080     # binds 127.0.0.1, endpoint /mcp

--port defaults to $PORT then 8080. The endpoint runs stateless (a fresh transport per request), so a gateway may route any request to any replica. Only POST /mcp is served — GET would otherwise hold an idle event stream open per connection, so it is refused with a clean JSON-RPC 405. A GET /health endpoint returns {"status": "ok"}.

The server has no authentication, so binding beyond loopback requires an explicit opt-in:

VCP_MCP_ALLOW_INSECURE_HTTP=true vcp-mcp --transport http --host 0.0.0.0

Set that only when either a gateway or reverse proxy fronts the server and handles client auth, or you intentionally run it as a public, unauthenticated, stateless compute endpoint (as render.yaml in this repo does). In the latter case put a rate limit / WAF in front of it: the exposure is abuse of paid compute rather than data, since the server holds no state and reads nothing.

Development

pip install -e ".[dev]"
pytest tests/

License

Apache-2.0. © Creed Space.