MCP server

Authentication

Authentication to the Equilibrium MCP server depends on which instance you’re pointed at: a future public read-only instance, or a self-hosted one running against your own generator runs and cache.

Public instance

The public instance is planned to require no API key. It would serve validate_claim and lookup_source against the same claimcheck and source registry everyone else uses, and generate_synthetic_sample against the published generator catalog — nothing account-specific to authenticate to.

Self-hosted instance

A self-hosted server authenticates requests with an API key passed via the EQUILIBRIUM_API_KEY environment variable. The key scopes access to your own generator run history, your own cache, and — if configured — private calibration targets that aren’t part of the public catalog.

export EQUILIBRIUM_API_KEY="eqk_live_..."
equilibrium mcp serve --port 8420

Once the server is running, point your MCP host’s server configuration at http://localhost:8420 (or wherever you’ve exposed it). The server reads EQUILIBRIUM_API_KEY from the environment at startup; it is not passed per-request by the calling model, so the key never appears in a tool call payload. To rotate a key, issue a new one and restart the server — there is no live key-rotation endpoint.

If EQUILIBRIUM_API_KEY is unset, a self-hosted server starts in the same read-only mode planned for the public instance: it will serve validate_claim and lookup_source, but generate_synthetic_sample runs will not be recorded against any account, and private calibration targets won’t be visible.