Developer Docs

cMAP MCP Server

A Model Context Protocol server for verified data provenance. Every tool call is authenticated as a real user via OAuth 2.1; every stamp is a signed receipt in Supabase.

Server URL

https://cosmictruth.lovable.app/mcp

Get an API key →Manage subscription →

Connect your AI client

The server speaks MCP over Streamable HTTP with OAuth 2.1 discovery. Every listed client handles the OAuth handshake for you — sign in with the same email you used to subscribe.

Claude Desktop

Settings → Connectors → Add connector → Remote MCP.

Name: cMAP
URL:  https://cosmictruth.lovable.app/mcp

ChatGPT (Codex)

Settings → Connectors → Custom connector.

Name: cMAP
Transport: HTTP
URL: https://cosmictruth.lovable.app/mcp

Cursor

~/.cursor/mcp.json (or workspace .cursor/mcp.json):

{
  "mcpServers": {
    "cmap": {
      "url": "https://cosmictruth.lovable.app/mcp"
    }
  }
}

VS Code (Copilot Chat)

.vscode/mcp.json in your workspace:

{
  "servers": {
    "cmap": {
      "type": "http",
      "url": "https://cosmictruth.lovable.app/mcp"
    }
  }
}

Tool reference

provenance_recordStarter · Pro

Record a SHA-256 hash as a signed provenance stamp on the caller's account. Fast, no external calls.

{ "sha256": "…64 hex chars…", "label": "optional label" }

provenance_ots_stampStarter · Pro

Submit a SHA-256 to public OpenTimestamps calendars for Bitcoin anchoring, then persist calendar receipts.

{ "sha256": "…64 hex chars…", "label": "optional label" }

list_nodesStarter · Pro

Enumerate cMAP sovereign nodes with signed-status coupling state.

{}

list_bladesStarter · Pro

Enumerate OMNI-SAM AXIS blade registry entries.

{}

centralization_inventoryStarter · Pro

Report centralization dependencies detected in the current build.

{}

Pro webhooks

On the Pro tier, every stamp fans out to your registered endpoints. Configure them in Account → Webhooks. Delivery headers:

POST <your endpoint>
Content-Type: application/json
User-Agent: cMAP-Provenance-Webhook/1.0
X-CMAP-Event: stamp.recorded
X-CMAP-Timestamp: <unix seconds>
X-CMAP-Signature: <hex hmac_sha256(secret, body)>
X-CMAP-Signature-V1: t=<ts>,v1=<hex hmac_sha256(secret, ts + "." + body)>

{
  "event": "stamp.recorded",
  "delivered_at": "2026-07-20T00:00:00.000Z",
  "stamp": {
    "id": "…uuid…",
    "sha256": "…64 hex chars…",
    "label": "…",
    "kind": "record" | "ots",
    "status": "recorded" | "submitted" | "failed",
    "created_at": "…iso…"
  }
}

Verify by recomputing HMAC-SHA256(secret, raw_body) and comparing to X-CMAP-Signature in constant time. Reject anything older than 5 minutes.

Get an API key

There's no separate API key — OAuth handshake with your subscribed account is the key. Subscribe, then connect any client above.

See plans →

← back to cMAP