Overview

zkMCP is a pre-execution authorization gateway. It does not replace MCP, the agent framework, or the upstream tool server. It inserts a deterministic security boundary between an agent's requested action and the code that performs that action.

The core path has four systems with deliberately different responsibilities:

Click to zoom

Component responsibilities

The separation is intentional. The AI model remains probabilistic; the boundary that decides whether a sensitive side effect may happen is deterministic.

The invariant

For a protected tool, the gateway follows one invariant:

No successful authorization receipt, no upstream execution.

A request can therefore end in one of two states:

Click to zoom

What is deterministic

The model can generate arbitrary prose and reasoning, but zkMCP reduces the requested side effect into a small authorization envelope:

interface MidnightAuthorizationRequest {
  agent: string;
  tool: string;
  resource?: string;
  amount?: bigint;
  approved?: boolean;
}

The Compact circuit then reasons only about those deterministic facts and the private policy committed at deployment.

This is why zkMCP does not attempt to prove LLM inference. The useful security statement is smaller:

The concrete action that was about to execute satisfied the committed authorization policy.

Read next