DEV Community

Manuel Felipe Arias Pineda
Manuel Felipe Arias Pineda

Posted on

mcp-colombia Soulprint: Building the First Verified MCP Service

#security #ai #opensource #webdev

mcp-colombia is now the first verified MCP service

Integrating Soulprint means every call to mcp-colombia-hub is tracked for behavior — and misbehaving bots get reputation penalties.

What changed in v1.2.0

1. Service identity

The server generates its own Soulprint DID at startup (score=80 — creator privilege). This qualifies it to issue attestations on the P2P network.

const serviceKp = getServiceKeypair();
// did:key:z6Mk... score=80
Enter fullscreen mode Exit fullscreen mode

2. Behavior tracking on every tool

All 8 tools are now wrapped:

server.tool(
  'ml_buscar_productos',
  'Search MercadoLibre...',
  { ... },
  withTracking('ml_buscar_productos', async (args) => {
    return { content: [{ type: 'text', text: JSON.stringify(await searchProducts(args)) }] };
  })
);
Enter fullscreen mode Exit fullscreen mode

Spam (>5 req/60s):

→ issues -1 attestation: 'spam-detected'
→ Bot reputation: 10 → 9 → ... → 0
Enter fullscreen mode Exit fullscreen mode

Normal usage (3+ tools, 3+ completions):

→ issues +1 attestation: 'normal-usage-pattern'
→ Bot reputation: 10 → 11 → ... → 20
Enter fullscreen mode Exit fullscreen mode

3. Premium endpoint: trabajo_aplicar

Requires Soulprint score >= 95.

server.tool('trabajo_aplicar', 'PREMIUM...', schema,
  async (args, extra) => {
    const check = requireSoulprint(extra?.capabilities, 95, 'trabajo_aplicar');
    if (!check.ok) return check.mcpError; // 403 with explanation

    const { ctx } = check;
    // ctx.score >= 95 guaranteed
    // ctx.did = unique nullifier, no PII
    return createVerifiedApplication(args, ctx);
  }
);
Enter fullscreen mode Exit fullscreen mode

The application response includes:

{
  "applicant": {
    "did": "did:key:z6Mk...",
    "score": 98,
    "verified": true
  },
  "trust_guarantees": {
    "human_verified": true,
    "no_spam_history": true,
    "zkp": true
  }
}
Enter fullscreen mode Exit fullscreen mode

Test results: 37/37 

[A] Unit:        16 tests — service identity, tracker, middleware
[B] Integration: 12 tests — 3 bot scenarios, country support
[C] Pen tests:    9 tests — token forgery, Sybil, fake attestations
Enter fullscreen mode Exit fullscreen mode

Install 

npx -y mcp-colombia-hub
Enter fullscreen mode Exit fullscreen mode

For premium endpoints:

npx soulprint verify-me --selfie me.jpg --document cedula.jpg
export SOULPRINT_TOKEN=$(cat ~/.soulprint/token.spt)
Enter fullscreen mode Exit fullscreen mode

GitHub: https://github.com/manuelariasfz/mcp-colombia
Soulprint: https://github.com/manuelariasfz/soulprint
npm: https://www.npmjs.com/package/mcp-colombia-hub

Top comments (0)