cipherandrow-mcp

This repository is the open, public interface for the Cipher & Row MCP server: the

exact tool JSON Schemas, copy-paste client configs, and integration guides. The

verification engine, scoring model, and infrastructure are proprietary (see

`NOTICE`); this repo is the contract you build against, kept in sync with the

live server.

> Who this is for: engineers building AI agent carrier vetting, autonomous

> dispatch, brokerage automation, and freight-fraud-prevention systems - and security

> reviewers evaluating how the server resists prompt injection.

Why it exists

An AI agent in freight reads untrusted text all day and can be talked into fraud - a fake

carrier, a spoofed broker, a double-brokering scam. The fix is to never let the model

*decide* trust from the conversation, but to *verify* against authoritative records the

attacker can't reach. This MCP server is that air-gapped verification layer: you

verify by DOT / MC / CAB number against FMCSA, surety-bond, sanctions, and registry

data, and get back structured evidence plus a canonical trust score - not a persuadable

opinion. Full model: `docs/PROMPT-INJECTION-DEFENSE.md`.

Quickstart

Claude Code

claude mcp add --transport http cipher-row https://mcp.cipherandrow.com/mcp
# then run /mcp in a session and choose Authenticate

Claude Desktop / stdio clients - paste `mcp-config/claude-desktop.json`

into your `claude_desktop_config.json`.

Cursor, Windsurf, others - see `mcp-config/cursor-and-other-clients.md`.

Raw HTTP - OAuth 2.1 + PKCE, or an `Authorization: Bearer cr_live_...` key:

curl -sS https://mcp.cipherandrow.com/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer cr_live_YOUR_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
        "name":"cr_verify_carrier","arguments":{"dot_number":"53467"}}}'

Auth in depth: `docs/AUTHENTICATION.md`.

The 8 Phase 1 tools

Full manifest: `schemas/tools.json` · Human reference:

`docs/TOOLS.md`.

**The surface is verification + a watchlist. No tool posts a load, moves money, or

messages a counterparty** - so even a hijacked agent's blast radius is bounded by design.

Repository map

├── schemas/            JSON Schemas (draft 2020-12) for all 8 tools + tools.json manifest
├── mcp-config/         Copy-paste client configs (Claude Desktop/Code, Cursor, generic)
├── docs/
│   ├── PROMPT-INJECTION-DEFENSE.md   Air-gapped verification: how the server resists injection
│   ├── API-TO-MCP.md                 Append-only audit trail + multi-signal scores over MCP
│   ├── AUTHENTICATION.md             OAuth 2.1 + PKCE and API-key auth
│   ├── RATE-LIMITS.md                Per-tier, per-category ceilings
│   └── TOOLS.md                      Human-readable tool reference
├── examples/
│   ├── vet-a-carrier.md              End-to-end disambiguate → verify → decide → monitor
│   └── sample-responses/             Illustrative response shapes
├── SECURITY.md         Responsible disclosure + security posture
├── LICENSE             MIT (this interface repo)
└── NOTICE              What is open here vs. what stays proprietary

How it verifies (the short version)

1. Disambiguate with `cr_search_registry` (identity only, no score).

2. Verify with `cr_verify_carrier` / `cr_verify_broker` - profile, fraud signals, and

a canonical 0-100 trust score with a per-factor breakdown, computed server-side

from independent regulated signals. The entity being scored has no channel to inflate

its own score.

3. Decide in your agent, on the evidence and verdict - not on the conversation.

4. Monitor with `cr_add_partner` so authority, insurance, and bond changes reach you

between deals. Every verification call is written to a server-side audit log.

Details: `docs/API-TO-MCP.md`.

Coverage

• United States - live FMCSA authority, insurance (BIPD/cargo/bond), safety and

inspection history, surety bonds (BMC-84/85), sanctions screening.

• Canada - federal + cross-border FMCSA on every lookup; provincial depth varies by

province. Canadian broker verification is available over MCP (`cab_id`); Canadian

carrier intake is a REST write, not an MCP tool.

Security

• Air-gapped verification - trust decisions are grounded in out-of-band authoritative

data, not in the agent's persuadable context.

• Typed output is structured evidence; third-party free-text fields are data to

reason over, never commands to execute.

• OAuth 2.1 + PKCE with scoped, server-enforced role gating and per-key rate limits.
• EIN excluded from the agent door; inputs sanitized; payloads capped.
• Audit log of every verification call (which tool, which account, when, outcome).

Report a vulnerability: `SECURITY.md`.

License

The contents of this repository - schemas, configs, and documentation - are released under

the MIT License so you can freely build against, redistribute, and adapt the

interface. The Cipher & Row verification server, scoring model, and engine are not open

source; see `NOTICE`.

Setup + live examples: ·

Partnerships / review keys: partnerships@cipherandrow.com

Keywords: MCP freight verification · LLM-ready freight data · AI agent carrier vetting ·

FMCSA carrier lookup API · broker verification · double-brokering fraud detection ·

chameleon carrier · freight trust score · Model Context Protocol logistics · autonomous

dispatch agent.