EAD Factory MCP Server

EAD Factory MCP

EAD Factory MCP — Digital Trust services APIs for your agents.

This MCP server bridges any MCP-compatible agent (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, VS Code, JetBrains, Zed) to EADTrust's Digital Trust services: Evidence Manager (qualified digital evidence + timestamping) and Signature Manager (electronic signature workflows).

Need credentials? See: Get your testing credentials here!!

Quick start

npx -y @g-digital/mcp-ead-factory

You will need Okta credentials (OKTA_CLIENT_ID + OKTA_CLIENT_SECRET) and at least the Evidence Manager + Signature Manager base URLs for the environment you target (see Environment URLs).

Where to install

This MCP is published to every major MCP distribution channel by the g-digital MCP distribution pipeline. Pick whichever fits your stack:

Every channel ships the same MCP server contract; the tools and env-var configuration below apply regardless of which install path you choose.

Tools

Evidence Manager

Signature Manager

Register the MCP in your client

Claude Code (CLI, recommended)

claude mcp add --scope user ead-factory -- npx -y @g-digital/mcp-ead-factory

You can then export the required env vars in your shell, or set them per-invocation. To inspect or remove:

claude mcp list
claude mcp remove ead-factory

Claude Desktop / Cursor / Windsurf / Cline / JetBrains / Zed

Add the block below to your client's MCP configuration file (path varies by client and OS — see your client's documentation).

{
  "mcpServers": {
    "ead-factory": {
      "command": "npx",
      "args": ["-y", "@g-digital/mcp-ead-factory"],
      "env": {
        "API_BASE_URL": "",
        "SIGNATURE_API_BASE_URL": "",
        "OKTA_TOKEN_URL": "",
        "OKTA_CLIENT_ID": "",
        "OKTA_CLIENT_SECRET": "<PASTE_OKTA_CLIENT_SECRET_HERE>",
        "OKTA_SCOPE": "",
        "HTTP_PORT": "3000",
        "POLL_INTERVAL_MS": "3000",
        "POLL_MAX_ATTEMPTS": "20",
        "TRANSPORT": "stdio",
        "FULL_FLOW_EMAIL_BASE": "",
        "FULL_FLOW_FILE_PATH": ""
      }
    }
  }
}

VS Code

{
  "servers": {
    "ead-factory": {
      "command": "npx",
      "args": ["-y", "@g-digital/mcp-ead-factory"],
      "env": {
        "API_BASE_URL": "",
        "SIGNATURE_API_BASE_URL": "",
        "OKTA_TOKEN_URL": "",
        "OKTA_CLIENT_ID": "",
        "OKTA_CLIENT_SECRET": "<PASTE_OKTA_CLIENT_SECRET_HERE>",
        "OKTA_SCOPE": "",
        "TRANSPORT": "stdio"
      }
    }
  }
}

Docker (HTTP transport)

For containerised deployments (Cloud Run, Fargate, fly.io, on-prem Kubernetes), pull the image from Docker Hub and run with TRANSPORT=http:

docker run -d --name ead-factory \
  -p 3000:3000 \
  -e API_BASE_URL=https://api.pre.gcloudfactory.com/digital-trust \
  -e SIGNATURE_API_BASE_URL=https://api.pre.gcloudfactory.com/digital-trust \
  -e OKTA_TOKEN_URL=https://sso.garrigues.io.builders/oauth2/aus653dgdgTFL2mhw417/v1/token \
  -e OKTA_CLIENT_ID=<your-client-id> \
  -e OKTA_CLIENT_SECRET=<your-client-secret> \
  -e OKTA_SCOPE=token \
  -e TRANSPORT=http \
  -e HTTP_PORT=3000 \
  gdigital/ead-factory:latest

The container exposes /mcp (Okta Bearer auth required) and /health (unauthenticated) on port 3000. See Remote deployment for the auth contract.

Behind a corporate TLS-inspection proxy (PaloAlto, Netskope, Zscaler, etc.): mount your corporate CA bundle and set NODE_EXTRA_CA_CERTS, otherwise outbound HTTPS to Okta / EAD APIs fails with self-signed certificate in certificate chain:

-v /path/to/corp-ca-bundle.pem:/etc/ssl/certs/corp-ca-bundle.pem:ro \
-e NODE_EXTRA_CA_CERTS=/etc/ssl/certs/corp-ca-bundle.pem

Docker (stdio, spawned by an MCP client)

For local desktop clients that want to spawn the MCP inside a container rather than via npx:

{
  "mcpServers": {
    "ead-factory": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "API_BASE_URL",
        "-e", "SIGNATURE_API_BASE_URL",
        "-e", "OKTA_TOKEN_URL",
        "-e", "OKTA_CLIENT_ID",
        "-e", "OKTA_CLIENT_SECRET",
        "-e", "OKTA_SCOPE",
        "-e", "TRANSPORT=stdio",
        "gdigital/ead-factory:latest"
      ],
      "env": {
        "API_BASE_URL": "",
        "SIGNATURE_API_BASE_URL": "",
        "OKTA_TOKEN_URL": "",
        "OKTA_CLIENT_ID": "",
        "OKTA_CLIENT_SECRET": "<PASTE_OKTA_CLIENT_SECRET_HERE>",
        "OKTA_SCOPE": "token"
      }
    }
  }
}

Bundled skills (Claude Code)

This package ships with two /slash commands for Claude Code under .claude/commands/:

• /create-internal-evidence — guides the full evidence-creation flow (interactive or fast mode)
• /create-signature-request — guides signature-request creation (guided, fast, or full-flow mode)

To enable them, copy the markdown files from the installed package into your Claude Code commands directory:

# Global — available in all projects
npm pack @g-digital/mcp-ead-factory --pack-destination /tmp
mkdir -p ~/.claude/commands && tar -xzf /tmp/g-digital-mcp-ead-factory-*.tgz -C /tmp \
  && cp /tmp/package/.claude/commands/*.md ~/.claude/commands/

Then restart Claude Code so the new commands are picked up.

Configuration

Environment URLs

AWS

OCI

Remote deployment (HTTP + Bearer auth)

Set TRANSPORT=http to run the server as an HTTP service. The /mcp endpoint requires a valid Okta Bearer token (verified against the introspection endpoint derived from OKTA_TOKEN_URL). The /health endpoint is unauthenticated for monitoring.

Architecture

Client (Claude Code / MCP client)
  │
  ├─ stdio ──► McpServer
  │
  └─ HTTP  ──► Express + Bearer auth (Okta introspect) ──► StreamableHTTP ──► McpServer
                                                                │
                                                          tools/call
                                                                │
                                                                ▼
                                                      workflow.service
                                                       ├── auth.service         (Okta client_credentials → token cache)
                                                       ├── hash.service         (SHA-256 from local file)
                                                       ├── evidence.service     (POST /api/v1/private/evidences)
                                                       └── s3-upload.service    (PUT presigned URL + retry)

generate_evidence — Input schema

API endpoints consumed

• POST {OKTA_TOKEN_URL} — OAuth client_credentials token
• POST {API_BASE_URL}/api/v1/private/evidences — register evidence
• GET {API_BASE_URL}/api/v1/private/evidences/{id} — fetch evidence
• PUT <presigned-s3-url> — upload file binary

License

MIT

Badges