SaravananJaichandar

World Model MCP — Security skill for Claude Code

Security community

world-model-mcp is a signed audit memory server for AI coding agents, delivered as an MCP tool.

How to install World Model MCP

This entry records only its repository, not the path inside it, so there is no exact command to give. Open SaravananJaichandar/world-model-mcp and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What World Model MCP does

world-model-mcp is a signed audit memory server for AI coding agents, delivered as an MCP tool. Every event Ed25519-signed and Merkle-chained; offline-verifiable against pinned public keys. Hosted platform with hybrid post-quantum signing at etch.systems.

Alternatives in Security

Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
Pocketpaw — Your AI agent in 30 seconds 775 ★

README

World Model MCP

**Persistent memory + optional signed audit for AI coding agents.**

world-model-mcp is persistent memory plus a post-quantum-signed, offline-verifiable audit trail for AI coding agents (FIPS 205 hybrid Ed25519 + SLH-DSA), MIT-licensed and fully local.

`world-model-mcp` ships a local SQLite knowledge graph your agent queries every turn: hallucinations become verifiable, corrections stick across sessions, and regressions get caught before they land. Flip on the audit chain and every event is signed with FIPS 205 hybrid Ed25519 + SLH-DSA, verifiable offline forever. MIT-licensed, runs entirely local, works with 10+ AI coding agents including Claude Code, Cursor, Codex, Continue, Cline, Windsurf, GitHub Copilot Chat, pi, OpenClaw, and Hermes Agent.

**Latest: v0.16.3.** Metadata refresh. No code changes. The PyPI summary and keyword set now name both artifacts that ship in this wheel: the MCP world-model memory server for coding agents, and the `etch-verify` offline audit-chain verifier CLI. Both were already installed by every prior release; the metadata is now honest about that so a searcher looking for an offline audit-chain verifier can find the package. v0.16.2 shipped CI hardening plus the `world-model demo` live notary beat introduced in v0.16.0 (three sample decisions signed into a real hybrid-signed epoch, verified VALID, mutated one byte to prove tamper detection fires live, then restored). Full version history in [CHANGELOG.md](CHANGELOG.md).

Try it in 10 seconds

pip install -U world-model-mcp && world-model demo

You will see three sample decisions signed into a tamper-evident epoch, then the demo mutates one byte and re-verifies to prove the tamper is detected instantly (INVALID), then restores and re-verifies (VALID again). Offline, no account, no network. A `world-model-demo-receipt.json` lands in your current directory and a shareable `etch.systems/verify#…` URL is printed for anyone to check the same receipt in