MCP server

The Writ MCP server wraps the gate as MCP tools. A developer installs it once; every agent in their setup can then ask Writ before a consequential write.

Install

git clone https://github.com/AvenueDAdmin/writ   # private repo
cd writ/mcp-server
pip install -r requirements.txt
export WRIT_API_KEY="writ_..."        # required; POST /v1/keys with an email for a free one
export WRIT_SPONSOR_TOKEN="..."       # only for sponsor tools (grant, revoke, reinstate);
                                     # use the tenant's sponsor token (writ_sp_...), shown once at key issuance

Claude Code:

claude mcp add writ --env WRIT_API_KEY="$WRIT_API_KEY" -- python /path/to/mcp-server/server.py

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "writ": {
      "command": "python",
      "args": ["/path/to/mcp-server/server.py"],
      "env": { "WRIT_API_KEY": "writ_..." }
    }
  }
}

The enforce-before-write loop

1. writ_check(sponsor_id, agent_id, verb, target, purpose) — before the write.
2. ALLOW returns a 90-second authToken bound to that exact write.
3. writ_verify_token(auth_token, verb, target, purpose) — immediately before executing, to prove the authorization still matches what is being done.
4. DENY means do not proceed. STEP_UP means a human sponsor approves (via writ_grant or the dashboard), then check again.

Instrument your codebase

Your agent can gate its own writes. After installing the MCP server, give it a prompt like this:

Walk this codebase and find every consequential write: database mutations, refunds, provisioning, deploys, outbound emails and messages, file deletions, and any external API call that changes state. For each one, call writ_check (sponsor_id, agent_id, verb, target, purpose) immediately before the write, and call writ_verify_token on the returned auth token right before executing. If the decision is DENY, do not perform the write. If it is STEP_UP, stop and tell me a human sponsor must approve it.

The agent scans with its own model — it knows your code — and Writ supplies the gate. From then on every write is ALLOW or DENY, with a receipt stored either way. Review the agent’s diff before merging; writ_receipts shows everything that got gated. Use writ_policy to set per-verb modes (allow, deny, require_grant, step_up) for the tenant.

Tools

Try it with no key: writ_sandbox, then writ_check with verb="demo_write".

Audit log

Every decision lands in the tenant’s audit log — see Audit log for live streaming, SIEM ingestion, and hash-chained tamper evidence.