Back to docs
Agent Integration

MCP Setup

Add RecourseOS to your agent tool list. One config block, then your agent can call recourse.evaluate before any destructive action.

Quick Start

Add RecourseOS to your agent's MCP config:

{
  "mcpServers": {
    "recourseos": {
      "command": "npx",
      "args": ["-y", "recourse-cli@latest", "mcp", "serve"]
    }
  }
}

Then tell the agent to check before destructive commands:

Use RecourseOS to check before running: rm -rf /tmp/test

Agent Setup Guides

Shell Wrapper

Wrap dangerous shell commands so they automatically check RecourseOS before executing. Add to your shell profile:

eval "$(recourse wrap)"

Or with npx:

eval "$(npx -y recourse-cli@latest wrap)"

Available Tools

ToolPurpose
recourse_evaluate_terraformEvaluate Terraform plan JSON before apply
recourse_evaluate_shellEvaluate a shell command before execution
recourse_evaluate_mcp_callEvaluate another MCP tool call before invoking it
recourse_evaluate_with_evidenceRe-evaluate with verification evidence
recourse_supported_resourcesList deterministic resource handler coverage

Attestation

Every evaluation response includes a cryptographic attestation (Ed25519 signature). Always enabled.

Verify attestations:

  • recourse verify attestation.json — CLI verification
  • GET /.well-known/recourse-keys.json — public key registry
  • GET /.well-known/attestations/{id}.json — individual attestations

Agent Behavior

Agents should treat RecourseOS as a pre-action consequence check:

  • allowSafe to proceed
  • warnProceed with caution, inform user
  • escalateStop and ask user for explicit approval
  • blockDo not proceed without human review