Developer-integrated · Human-authorized · Agent-operated

Give agents useful authority.
Keep humans in control.

Developers connect Cloak through MCP or REST. A human account grants a scope-limited credential. The agent receives permitted key-operation results — not a permanent private key or the ability to approve itself. Supported protected-file operations also return signed receipts.

Developer guide → Tool reference Live /info ↗
kms_list_masterkeys kms_read_public_key kms_create_masterkey kms_delete_masterkey kms_sign kms_verify kms_encrypt kms_decrypt kms_ecdh_derive

Humans authorize. Agents execute. Receipts record supported actions.

The Cloak model is simple: a human sets a policy ("this agent can encrypt files for client X with read-only access"). The agent operates within that boundary. Supported protected-file operations return a signed receipt that the human can verify later. KMS-wide signed operation receipts are planned, not a current default.

👤

Human authorizes

Sets the policy: who, what, for how long, with which key. The agent cannot escalate beyond this boundary.

🤖

Agent executes

Calls the MCP tool or REST endpoint. Cloak enforces the policy. The agent gets only the permitted result. Supported file workflows also return a receipt.

🧾

Receipt records it

For supported protected-file operations, the receipt records workflow fields and is verifiable offline. A valid signature proves issuer and payload integrity, not every real-world claim.

MCP tool reference

The Cloak KMS exposes nine key-operation primitives over MCP. Hardware backing depends on the configured custody lane. Any MCP-compatible agent — Claude, Cursor, Codex, your own LLM app — can call these tools directly. The live tool catalog is at GET /kms/mcp/info.

Roadmap

Workflow tools planned for upcoming releases

These compose the KMS primitives above into higher-level operations. They aren't shipped yet — track progress in the GitHub project board.

  • encrypt_file / cloak_file — file-level encrypt with policy + receipt (Cloak Files; client-side, plaintext stays on the agent's host)
  • decrypt_file / uncloak_file — policy-bound file decrypt (Cloak Files; client-side)
  • sign_pdf — AATL PDF signing (Batchsign)
  • create_receipt — mint a verifiable receipt
  • verify_receipt — check a receipt's signature
  • rotate_key — policy-bound key rotation
  • revoke_access — invalidate a recipient's access to a file

Add Cloak to your MCP config

Add the Cloak MCP server to your mcp_config.json (Claude, Cursor, or any MCP host). Your agent immediately gets access to all nine tools — no additional SDK needed.

Set CLOAK_API_KEY to your API key from the console. Scope it to the specific operations and resources the agent needs; do not grant broad product-wide authority by default.

  • Works with Claude, Cursor, and any MCP-compatible agent host
  • API key scoped per agent — principle of least privilege
  • Cross-operation session correlation — planned
Get your API key →
mcp_config.json 
{
  "mcpServers": {
    // Live today: Cloak KMS over HTTP
    "cloakKms": {
      "url": "https://kms.cloakapps.com/kms/mcp",
      "headers": {
        "Authorization": "Bearer $CLOAK_AGENT_TOKEN"
      }
    },
    // Launch-gated: Cloak Files as a local stdio server
    // (plaintext remains on the agent host in this local mode)
    "cloakEncrypt": {
      "command": "npx",
      "args": ["-y", "@cloakapps/cloak-encrypt-mcp"]
    }
  }
}
After adding: restart your agent host and run list_tools to confirm.

Current and planned safeguards for agent callers

Giving an AI agent cryptographic authority is a significant trust decision. Shipped scope controls are separated below from planned budgets and session evidence.

Policy set by humans, enforced by Cloak

A human creates a policy ("this agent may encrypt files for client A with read-only access, expiring in 30 days"). The agent cannot modify its own policy or escalate permissions — ever. Cloak enforces the boundary server-side.

Planned: per-agent operation budgets

Per-session operation budgets and human re-authorization thresholds are planned. Do not rely on them as a current plan entitlement.

Planned: correlated agent-session evidence

Correlated session IDs and replayable cross-operation evidence are planned. Current behavior should be evaluated through the live KMS tool responses and supported protected-file receipts.

Revoke an agent credential

If an agent behaves unexpectedly, revoke its credential from the console. Test revocation propagation for the selected integration before production use; previously issued receipts remain independently verifiable.

Roadmap preview

Example: agent-driven document workflow

A finance agent receives a payment authorisation request, signs the PDF, encrypts the receipt, and logs everything — no human clicks required after initial policy setup. The sign_pdf and cloak_file tools below haven't shipped yet — today the same flow is buildable on top of kms_sign + your own envelope code.

1
Human sets agent policy

Finance manager creates a Batchsign + Encrypt policy allowing the agent to sign payment docs up to $50,000 and encrypt them for the CFO. Policy is time-limited to the current quarter.

2
Agent calls sign_pdf

Agent receives a payment doc from the ERP, calls Batchsign to sign it with the AATL certificate. Gets back a signed PDF and a receipt.

3
Agent calls cloak_file

Wraps the signed PDF with Cloak Files, restricting access to the CFO's email, read-only. Gets back an encrypted file and another receipt.

4
Human reviews audit log

The manager opens the console. Sees two receipts: one for signing, one for encryption. Both are cryptographically signed by Cloak. The agent's session ID ties them together. No gaps in the audit trail.

finance_agent.py 
# Step 2: sign the payment doc
signed = mcp.call_tool("sign_pdf", {
  "pdf_path":    payment_doc_path,
  "signer_name": "Acme Corp Finance",
  "reason":      "Payment authorised"
})
sign_receipt = signed["receipt"]

# Step 3: encrypt for CFO only
protected = mcp.call_tool("cloak_file", {
  "file_path": signed["signed_path"],
  "policy": {
    "recipients":  ["cfo@acme.com"],
    "permissions": "read-only"
  }
})
enc_receipt = protected["receipt"]

# Both receipts logged to ERP record
erp.attach_receipts(
  payment_id,
  [sign_receipt, enc_receipt]
)

Not using MCP? Use the REST API directly.

Every MCP tool has a REST equivalent. Confirm the current endpoints, authentication, scopes, and workflow-specific receipt behavior in the developer guide's REST mirror before integration.

View the REST mirror →

Start building with Cloak

Free account. Full API and MCP access from day one. No credit card.

Create free account → View agent pricing

Governed by the OMMAU Charter — humans authorize, agents execute, receipts record supported actions.