Stats
Actions
Available In
Tags
aip-claude-code
A Claude Code plugin that adds AIP-signed identity to outgoing MCP tool calls.
What it does
Wraps a single upstream HTTP MCP server with an Ed25519-signed JWT (CompactToken). Every tool call Claude makes through the proxy carries a verifiable identity claim that upstream services and policy proxies (like AIP Gateway) can verify, scope-check, and audit.
Claude Code aip-proxy (this plugin) Upstream MCP server
─────────── ─────────────────────── ──────────────────
│ │ │
│ tools/call │ │
├───────────────────────────▶│ │
│ │ HTTP POST + Authorization: │
│ │ Bearer <AIP CompactToken> │
│ ├─────────────────────────────▶│
│ │ │ Verify token
│ │ │ Check scope
│ │ │ Audit ✓
│ │ 200 OK │
│ │◀─────────────────────────────┤
│ result │ │
│◀───────────────────────────┤ │
Install
The primary install path is the Claude Code marketplace, not npm:
claude plugin marketplace add sunilp/aip-claude-code
claude plugin install aip-claude-code@aip-claude-code
Configure on first run with the upstream MCP URL:
claude plugin config aip-claude-code upstreamUrl=https://your-mcp.example.com/mcp
Optional: tighten scope and TTL.
claude plugin config aip-claude-code scope=tool:search,tool:read tokenTtlSeconds=120
The npm package exists for distribution and version pinning. It is not a standalone Node library; the binaries require Claude Code's plugin runtime to set up environment variables.
Generate an identity
/aip:keygen
Copy the printed publicKey (z-prefixed multibase) and add it to your upstream MCP server's or AIP Gateway's trust list.
Use it
Once installed, an mcp__aip-proxy__aip_forward tool is available in your sessions. Claude can call upstream tools through it; each call carries an AIP token. The plugin's aip-tool-auth skill explains usage.
Inspect
/aip:status # identity + audit entry count
/aip:audit # tail the audit log (last 20)
/aip:audit --n=100
Audit log lives at ${CLAUDE_PLUGIN_DATA}/audit.jsonl.
Architecture
| Layer | Where it runs |
|---|---|
| MCP stdio server | bin/aip-mcp-proxy.mjs (spawned by Claude Code) |
| Sign + forward | Per tool call, signed CompactToken (EdDSA) attached as Authorization: Bearer |
| Audit hooks | PreToolUse + PostToolUse, JSONL append |
| Slash commands | bin/aip-cli.mjs invoked by /aip:* |
What the token claims
{
"iss": "aip:key:ed25519:<your-multibase-pubkey>",
"sub": "https://upstream.example.com/mcp",
"scope": ["tool:*"],
"max_depth": 0,
"iat": 1714000000,
"exp": 1714000300
}
Signed with EdDSA. Verifiable by anyone holding your multibase public key.
v0.1 limitations
- Compact mode only (single-hop). Chained mode (multi-hop delegation via Biscuit) is v0.2.
- One upstream MCP server per install. Multi-upstream is v0.2.
- Local JSONL audit only.
- No web-of-trust, no policy enforcement at the hook layer (hooks are audit-only).
Develop
git clone https://github.com/sunilp/aip-claude-code
cd aip-claude-code
npm install
npm test # 27 tests across identity, audit log, sign, proxy, hooks, CLI, e2e
npm run build # produces bin/*.mjs
Protocol
- Spec and quickstart: https://sunilprakash.com/aip/
- IETF Internet-Draft: https://datatracker.ietf.org/doc/draft-prakash-aip/
- arXiv paper: https://arxiv.org/abs/2603.24775
- TypeScript SDK: https://github.com/sunilp/aip-node
- Reference implementation: https://github.com/sunilp/aip
- Drop-in policy proxy: https://github.com/sunilp/aip-gateway
License
Apache-2.0
