KISC arch init
This commit is contained in:
@@ -0,0 +1,247 @@
|
||||
# VeriTrust MCPF Credential Submission
|
||||
|
||||
## Overview
|
||||
|
||||
KISC already has a VeriTrust organization profile. This submission requests a **MCPServerCredential** for the new `did:web:llm.kis.gov.lv` identity.
|
||||
|
||||
---
|
||||
|
||||
## Existing KISC Profile in VeriTrust
|
||||
|
||||
**Holder DID:** `did:key:z6Mkuwv1z6y2yorbBf4LEkNzJCg16ERVfWE3bJEPKXtQm7a9`
|
||||
**Public Alias:** `did:web:veritrust.vc:portal:company:df0684bd-b54a-4684-b3d6-93a3b1c4bcb9`
|
||||
**Status:** Verified
|
||||
|
||||
---
|
||||
|
||||
## New Identity for MCP Server
|
||||
|
||||
**DID:** `did:web:llm.kis.gov.lv`
|
||||
**Public Key (multibase):** `z6MkjWGNnJsdyvutfbsytFJhkwDwyHkMkfWVL8X1fS1yBm2w`
|
||||
**Service Endpoint:** `https://llm.kis.gov.lv/mcp`
|
||||
**Manifest:** `https://llm.kis.gov.lv/.well-known/mcp/manifest.json`
|
||||
|
||||
---
|
||||
|
||||
## Submission Process
|
||||
|
||||
### Step 1: Verify Local Deployment
|
||||
|
||||
Before submitting to VeriTrust, ensure:
|
||||
|
||||
```bash
|
||||
# All .well-known endpoints accessible
|
||||
curl https://llm.kis.gov.lv/.well-known/did.json
|
||||
curl https://llm.kis.gov.lv/.well-known/mcp-trust-registry.json
|
||||
curl https://llm.kis.gov.lv/.well-known/mcp/manifest.json
|
||||
|
||||
# MCP server operational
|
||||
curl https://llm.kis.gov.lv/mcp-health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Step 2: Submit Credential Request
|
||||
|
||||
**Method 1: Via VeriTrust Portal (Recommended)**
|
||||
|
||||
1. Log into VeriTrust portal: https://veritrust.vc/portal
|
||||
2. Navigate to your KISC organization profile
|
||||
3. Click "Request Credential" → "MCP Server Credential"
|
||||
4. Fill in form with data from `mcp-server-request.json`
|
||||
5. Upload or paste:
|
||||
- DID: `did:web:llm.kis.gov.lv`
|
||||
- Public key (multibase): `z6MkjWGNnJsdyvutfbsytFJhkwDwyHkMkfWVL8X1fS1yBm2w`
|
||||
- Endpoint: `https://llm.kis.gov.lv/mcp`
|
||||
- Manifest URL: `https://llm.kis.gov.lv/.well-known/mcp/manifest.json`
|
||||
6. Submit for review
|
||||
|
||||
**Method 2: Via API (If Available)**
|
||||
|
||||
```bash
|
||||
# POST to VeriTrust credential issuance API
|
||||
curl -X POST https://veritrust.vc/api/v1/credentials/issue \
|
||||
-H "Authorization: Bearer $VERITRUST_API_KEY" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d @mcp-server-request.json
|
||||
```
|
||||
|
||||
**Method 3: Email Submission**
|
||||
|
||||
Send `mcp-server-request.json` to: credentials@veritrust.vc
|
||||
|
||||
Include:
|
||||
- Subject: "KISC MCP Server Credential Request - did:web:llm.kis.gov.lv"
|
||||
- Body: Reference existing KISC profile (did:key:z6Mkuwv1z6y2yorbBf4LEkNzJCg16ERVfWE3bJEPKXtQm7a9)
|
||||
- Attach: mcp-server-request.json
|
||||
|
||||
---
|
||||
|
||||
### Step 3: Verification by VeriTrust
|
||||
|
||||
VeriTrust will verify:
|
||||
|
||||
1. ✅ KISC organization profile exists and is verified
|
||||
2. ✅ `llm.kis.gov.lv` domain is controlled by KISC
|
||||
3. ✅ DID document accessible at `https://llm.kis.gov.lv/.well-known/did.json`
|
||||
4. ✅ MCP manifest valid at `https://llm.kis.gov.lv/.well-known/mcp/manifest.json`
|
||||
5. ✅ Public key matches DID document
|
||||
6. ✅ Compliance claims are accurate (GDPR, NIS2)
|
||||
|
||||
**Timeline:** 1-5 business days (typically 1-2 days for verified organizations)
|
||||
|
||||
---
|
||||
|
||||
### Step 4: Receive Credential
|
||||
|
||||
VeriTrust will provide:
|
||||
|
||||
```json
|
||||
{
|
||||
"@context": [
|
||||
"https://www.w3.org/2018/credentials/v1",
|
||||
"https://mcpf.dev/credentials/v1"
|
||||
],
|
||||
"id": "https://veritrust.vc/credentials/[UUID]",
|
||||
"type": ["VerifiableCredential", "MCPServerCredential"],
|
||||
"issuer": {
|
||||
"id": "did:web:veritrust.vc",
|
||||
"name": "VeriTrust"
|
||||
},
|
||||
"issuanceDate": "2026-01-30T10:00:00Z",
|
||||
"expirationDate": "2027-01-30T10:00:00Z",
|
||||
"credentialSubject": {
|
||||
"id": "did:web:llm.kis.gov.lv#mcp-server",
|
||||
...
|
||||
},
|
||||
"credentialStatus": {
|
||||
"id": "https://veritrust.vc/status/2026#94567",
|
||||
"type": "StatusList2021Entry",
|
||||
...
|
||||
},
|
||||
"proof": {
|
||||
"type": "Ed25519Signature2020",
|
||||
"created": "2026-01-30T10:00:00Z",
|
||||
"verificationMethod": "did:web:veritrust.vc#key-1",
|
||||
"proofPurpose": "assertionMethod",
|
||||
"proofValue": "z5vgK8B..." // VeriTrust's cryptographic signature
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Step 5: Install Credential
|
||||
|
||||
Use the provided `install-credential.sh` script:
|
||||
|
||||
```bash
|
||||
# On llm.kis.gov.lv server
|
||||
cd /opt/kisc-llm/poc/deploy
|
||||
|
||||
# Save VeriTrust credential to temporary file
|
||||
cat > /tmp/veritrust-credential.json << 'EOF'
|
||||
{
|
||||
... (paste VeriTrust-provided credential JSON) ...
|
||||
}
|
||||
EOF
|
||||
|
||||
# Run install script
|
||||
./veritrust/install-credential.sh /tmp/veritrust-credential.json
|
||||
|
||||
# Verify installation
|
||||
curl https://llm.kis.gov.lv/.well-known/credentials/mcp-server.json | jq
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Step 6: Register in MCPF Registry
|
||||
|
||||
VeriTrust will automatically register the MCP server in their MCPF registry at `https://mcp.veritrust.vc`.
|
||||
|
||||
Verify registration:
|
||||
|
||||
```bash
|
||||
# Search by country
|
||||
curl "https://mcp.veritrust.vc/mcp/search?country=LV"
|
||||
|
||||
# Get specific server
|
||||
curl "https://mcp.veritrust.vc/mcp/servers/did:web:llm.kis.gov.lv"
|
||||
```
|
||||
|
||||
Expected response:
|
||||
```json
|
||||
{
|
||||
"did": "did:web:llm.kis.gov.lv",
|
||||
"endpoint": "https://llm.kis.gov.lv/mcp",
|
||||
"manifest": "https://llm.kis.gov.lv/.well-known/mcp/manifest.json",
|
||||
"credentials": [
|
||||
"https://llm.kis.gov.lv/.well-known/credentials/mcp-server.json"
|
||||
],
|
||||
"metadata": {
|
||||
"organization": "Kultūras informācijas sistēmu centrs",
|
||||
"country": "LV",
|
||||
"tags": ["architecture", "government", "latvia", "culture"],
|
||||
"status": "active"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### VeriTrust cannot verify domain ownership
|
||||
|
||||
**Solution:** Add DNS TXT record:
|
||||
|
||||
```
|
||||
_veritrust.llm.kis.gov.lv TXT "did=did:web:llm.kis.gov.lv"
|
||||
```
|
||||
|
||||
### VeriTrust cannot fetch DID document
|
||||
|
||||
**Solution:** Verify HTTPS and CORS:
|
||||
|
||||
```bash
|
||||
curl -I https://llm.kis.gov.lv/.well-known/did.json
|
||||
# Should show:
|
||||
# HTTP/2 200
|
||||
# access-control-allow-origin: *
|
||||
# content-type: application/json
|
||||
```
|
||||
|
||||
### Credential issuance delayed
|
||||
|
||||
**Solution:** Contact VeriTrust support with:
|
||||
- Organization: KISC
|
||||
- Existing DID: did:key:z6Mkuwv1z6y2yorbBf4LEkNzJCg16ERVfWE3bJEPKXtQm7a9
|
||||
- New DID: did:web:llm.kis.gov.lv
|
||||
- Request ID: (if provided)
|
||||
|
||||
---
|
||||
|
||||
## Contact
|
||||
|
||||
**VeriTrust Support:**
|
||||
- Website: https://veritrust.vc
|
||||
- Email: support@veritrust.vc (or credentials@veritrust.vc)
|
||||
- Portal: https://veritrust.vc/portal
|
||||
|
||||
**KISC Contact:**
|
||||
- Rihards (VeriTrust relationship)
|
||||
- KISC IT operations team
|
||||
|
||||
---
|
||||
|
||||
## Credential Renewal
|
||||
|
||||
**Expiration:** 1 year from issuance
|
||||
**Renewal Process:** 30 days before expiration, VeriTrust will notify KISC via email
|
||||
**Action Required:** Confirm renewal (usually automatic for verified organizations)
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0
|
||||
**Last Updated:** 2026-01-30
|
||||
**Status:** Ready for Submission
|
||||
@@ -0,0 +1,206 @@
|
||||
#!/usr/bin/env bash
|
||||
###############################################################################
|
||||
# KISC MCPF - Install VeriTrust-Issued Credential
|
||||
#
|
||||
# Installs the VeriTrust-signed MCP Server Credential and validates it
|
||||
#
|
||||
# Usage: ./install-credential.sh <credential-file.json>
|
||||
###############################################################################
|
||||
set -euo pipefail
|
||||
|
||||
CREDENTIAL_FILE="${1:-}"
|
||||
DEPLOY_DIR="/opt/kisc-llm/poc/deploy"
|
||||
TARGET="$DEPLOY_DIR/.well-known/credentials/mcp-server.json"
|
||||
|
||||
# Colors
|
||||
GREEN='\033[0;32m'
|
||||
RED='\033[0;31m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
|
||||
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
||||
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||
|
||||
# =============================================================================
|
||||
# Validation
|
||||
# =============================================================================
|
||||
|
||||
if [[ -z "$CREDENTIAL_FILE" ]]; then
|
||||
log_error "Usage: $0 <credential-file.json>"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 /tmp/veritrust-credential.json"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$CREDENTIAL_FILE" ]]; then
|
||||
log_error "File not found: $CREDENTIAL_FILE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -d "$DEPLOY_DIR" ]]; then
|
||||
log_error "Deploy directory not found: $DEPLOY_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "============================================"
|
||||
echo "Install VeriTrust Credential"
|
||||
echo "============================================"
|
||||
echo "Source: $CREDENTIAL_FILE"
|
||||
echo "Target: $TARGET"
|
||||
echo ""
|
||||
|
||||
# =============================================================================
|
||||
# Validate Credential Format
|
||||
# =============================================================================
|
||||
|
||||
log_info "Step 1: Validating credential format..."
|
||||
|
||||
# Check if valid JSON
|
||||
if ! jq empty "$CREDENTIAL_FILE" 2>/dev/null; then
|
||||
log_error "Invalid JSON in credential file"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check required fields
|
||||
REQUIRED_FIELDS=(
|
||||
"@context"
|
||||
"type"
|
||||
"issuer.id"
|
||||
"credentialSubject.id"
|
||||
"proof.type"
|
||||
"proof.proofValue"
|
||||
)
|
||||
|
||||
for field in "${REQUIRED_FIELDS[@]}"; do
|
||||
if ! jq -e ".$field" "$CREDENTIAL_FILE" >/dev/null 2>&1; then
|
||||
log_error "Missing required field: $field"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
# Verify issuer is VeriTrust
|
||||
ISSUER=$(jq -r '.issuer.id' "$CREDENTIAL_FILE")
|
||||
if [[ "$ISSUER" != "did:web:veritrust.vc" ]]; then
|
||||
log_error "Invalid issuer: $ISSUER (expected: did:web:veritrust.vc)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify subject is KISC MCP server
|
||||
SUBJECT=$(jq -r '.credentialSubject.id' "$CREDENTIAL_FILE")
|
||||
if [[ "$SUBJECT" != "did:web:llm.kis.gov.lv#mcp-server" ]]; then
|
||||
log_warn "Subject mismatch: $SUBJECT (expected: did:web:llm.kis.gov.lv#mcp-server)"
|
||||
fi
|
||||
|
||||
# Check expiration
|
||||
EXPIRATION=$(jq -r '.expirationDate' "$CREDENTIAL_FILE")
|
||||
log_info "Credential expires: $EXPIRATION"
|
||||
|
||||
log_info "✅ Credential format valid"
|
||||
echo ""
|
||||
|
||||
# =============================================================================
|
||||
# Backup Existing Credential
|
||||
# =============================================================================
|
||||
|
||||
log_info "Step 2: Backing up existing credential..."
|
||||
|
||||
if [[ -f "$TARGET" ]]; then
|
||||
BACKUP="$TARGET.backup-$(date +%Y%m%d-%H%M%S)"
|
||||
cp "$TARGET" "$BACKUP"
|
||||
log_info "Backup created: $BACKUP"
|
||||
else
|
||||
log_warn "No existing credential to backup"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# =============================================================================
|
||||
# Install New Credential
|
||||
# =============================================================================
|
||||
|
||||
log_info "Step 3: Installing new credential..."
|
||||
|
||||
# Copy credential to target location
|
||||
cp "$CREDENTIAL_FILE" "$TARGET"
|
||||
|
||||
# Set permissions (world-readable)
|
||||
chmod 644 "$TARGET"
|
||||
|
||||
log_info "✅ Credential installed: $TARGET"
|
||||
echo ""
|
||||
|
||||
# =============================================================================
|
||||
# Reload nginx
|
||||
# =============================================================================
|
||||
|
||||
log_info "Step 4: Reloading nginx..."
|
||||
|
||||
if docker ps --format '{{.Names}}' | grep -q "kisc-nginx"; then
|
||||
docker exec kisc-nginx nginx -s reload
|
||||
log_info "✅ nginx reloaded"
|
||||
else
|
||||
log_warn "nginx container not found, skipping reload"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# =============================================================================
|
||||
# Verify Installation
|
||||
# =============================================================================
|
||||
|
||||
log_info "Step 5: Verifying installation..."
|
||||
|
||||
# Test endpoint
|
||||
RESPONSE=$(curl -sS -k https://localhost/.well-known/credentials/mcp-server.json 2>/dev/null || echo "")
|
||||
|
||||
if [[ -z "$RESPONSE" ]]; then
|
||||
log_error "Endpoint not accessible"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
|
||||
log_error "Endpoint returned invalid JSON"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check proof value matches
|
||||
INSTALLED_PROOF=$(echo "$RESPONSE" | jq -r '.proof.proofValue')
|
||||
SOURCE_PROOF=$(jq -r '.proof.proofValue' "$CREDENTIAL_FILE")
|
||||
|
||||
if [[ "$INSTALLED_PROOF" != "$SOURCE_PROOF" ]]; then
|
||||
log_error "Proof value mismatch! Installation may be corrupted."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log_info "✅ Installation verified"
|
||||
echo ""
|
||||
|
||||
# =============================================================================
|
||||
# Success Summary
|
||||
# =============================================================================
|
||||
|
||||
echo "============================================"
|
||||
echo "Installation Complete"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
echo "Credential Details:"
|
||||
echo " Issuer: $(jq -r '.issuer.name' "$TARGET")"
|
||||
echo " Subject: $(jq -r '.credentialSubject.id' "$TARGET")"
|
||||
echo " Issued: $(jq -r '.issuanceDate' "$TARGET")"
|
||||
echo " Expires: $(jq -r '.expirationDate' "$TARGET")"
|
||||
echo " Status URL: $(jq -r '.credentialStatus.statusListCredential' "$TARGET")"
|
||||
echo ""
|
||||
echo "Endpoint:"
|
||||
echo " https://llm.kis.gov.lv/.well-known/credentials/mcp-server.json"
|
||||
echo ""
|
||||
echo "Next Steps:"
|
||||
echo " 1. Test external access:"
|
||||
echo " curl https://llm.kis.gov.lv/.well-known/credentials/mcp-server.json | jq"
|
||||
echo ""
|
||||
echo " 2. Verify in MCPF Registry:"
|
||||
echo " curl https://mcp.veritrust.vc/mcp/servers/did:web:llm.kis.gov.lv"
|
||||
echo ""
|
||||
echo " 3. Test with AI agent (Claude Desktop, ChatGPT, etc.)"
|
||||
echo ""
|
||||
@@ -0,0 +1,66 @@
|
||||
{
|
||||
"credentialType": "MCPServerCredential",
|
||||
"subject": {
|
||||
"did": "did:web:llm.kis.gov.lv",
|
||||
"type": "MCPServer",
|
||||
"endpoint": "https://llm.kis.gov.lv/mcp",
|
||||
"manifest": "https://llm.kis.gov.lv/.well-known/mcp/manifest.json"
|
||||
},
|
||||
"controller": {
|
||||
"id": "org.kisc",
|
||||
"name": "Kultūras informācijas sistēmu centrs",
|
||||
"registrationNumber": "KISC-REG-NUMBER",
|
||||
"country": "LV",
|
||||
"website": "https://kis.gov.lv",
|
||||
"existingDID": "did:key:z6Mkuwv1z6y2yorbBf4LEkNzJCg16ERVfWE3bJEPKXtQm7a9"
|
||||
},
|
||||
"owner": {
|
||||
"id": "org.km",
|
||||
"name": "Kultūras ministrija",
|
||||
"country": "LV",
|
||||
"website": "https://km.gov.lv"
|
||||
},
|
||||
"capabilities": [
|
||||
{
|
||||
"name": "search",
|
||||
"description": "Search YAML registers and Markdown documentation",
|
||||
"riskLevel": "low"
|
||||
},
|
||||
{
|
||||
"name": "get_entity",
|
||||
"description": "Retrieve entity by canonical ID",
|
||||
"riskLevel": "low"
|
||||
}
|
||||
],
|
||||
"governance": {
|
||||
"assuranceLevel": "substantial",
|
||||
"compliance": [
|
||||
"GDPR",
|
||||
"NIS2",
|
||||
"Latvian-Data-Protection-Act"
|
||||
],
|
||||
"dataClassification": "public",
|
||||
"certifications": [],
|
||||
"auditTrail": true
|
||||
},
|
||||
"publicKey": {
|
||||
"type": "Ed25519VerificationKey2020",
|
||||
"multibase": "z6MkjWGNnJsdyvutfbsytFJhkwDwyHkMkfWVL8X1fS1yBm2w",
|
||||
"jwk": {
|
||||
"kty": "OKP",
|
||||
"crv": "Ed25519",
|
||||
"x": "Sw-NGiVKSYj0zsrL7ceP6EMV673IuL2bYzHEypuojvA"
|
||||
}
|
||||
},
|
||||
"validityPeriod": {
|
||||
"notBefore": "2026-01-30T00:00:00Z",
|
||||
"notAfter": "2027-01-30T00:00:00Z"
|
||||
},
|
||||
"metadata": {
|
||||
"purpose": "MCPF Trust Framework integration for KISC MCP Server",
|
||||
"environment": "production",
|
||||
"poc": "POC-AI-LLM-1",
|
||||
"technicalContact": "support@kis.gov.lv",
|
||||
"requestDate": "2026-01-30"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user