Run SignerSet

Start with a quick single-account demo, or move directly to the production multi-account setup.

Quick demo: one account

For getting to a demo the fastest, have claude code/codex/cursor guide you through the single-user process in setup-macos.md:

Open the macOS Demo Guide

Recommended setup: separate accounts

For a meaningful security boundary, use three user accounts:

1.Proposer account — runs the agent that proposes actions.
2.Maintainer account — runs the agent that reviews and approves actions.
3.Credential account — runs the Credential Adapter and holds the protected service credentials. For now, must be http-accessible to the proposer account (e.g.- localhost).

The proposer and maintainer should not be able to read each other’s signing keys. Neither agent account should be able to read the credential account.

Do not give OpenClaw, Hermes, Codex, Claude Code, or another general-purpose agent access to credentials on the credential account.

Create the accounts

Create the proposer, maintainer, and credential accounts (on separate machines, virtual machines, containers, or operating-system user accounts).

Separate machines provide the strongest boundary, but separate user accounts are an accessible place to start.

Prepare each agent account

Install an agent harness (proposer and maintainer only)

Set up the account normally with the preferred agent environment, such as:

OpenClaw
Hermes
Codex
Claude Code
Another MCP-compatible or agentic harness

Start with no direct permissions or credentials for the protected application. The agent should reach governed operations only through the MPAS integration below.

Clone the source repositories (all accounts)

Clone:

The MPAS repository
The MPAS Applications repository

Continue setup in each account using agent with file system access

Use the editable prompt below in the proposer and maintainer accounts.

Credential account

Find the mpas repository on this machine and read examples/demo/guides/credential-adapter.md inside it. Follow the guide to set up this account as the Credential Adapter operator. Complete every step in order: create the ~/.mpas directory tree, generate the adapter key, source the application plugin and adapter-config template from mpas-applications, fill in the deployment config with the signer DIDs collected from the proposer and maintainer accounts, store the upstream credential, validate the config, and start the daemon. Do not proceed to the next step until the daemon health check passes.

Maintainer account

Find the mpas repository on this machine and read examples/demo/guides/maintainer.md inside it. Follow the guide to set up this account as a Maintainer. Complete every step in order: create the ~/.mpas directory tree, generate your Ed25519 signing key, copy the printed did:jwk string and send it to the Credential Adapter operator, wait for the operator to confirm your DID is registered, create the signer server config, and register the signer server as an MCP server in this agent harness. Do not add any proposer bridge to this account. Verify by listing your available MCP tools and polling for pending approvals.

Proposer account

Find the mpas repository on this machine and read examples/demo/guides/proposer.md inside it. Follow the guide to set up this account as a Proposer. Complete every step in order: create the ~/.mpas directory tree, generate your Ed25519 signing key, copy the printed did:jwk string and send it to the Credential Adapter operator, wait for the operator to confirm your DID is registered and the daemon is running, find and clone the bridge for your application from mpas-applications, create the bridge config pointing at the adapter and coordination service, build the bridge, and register it as an MCP server in this agent harness. If the agents run on different machines, or if human approvers need to approve from another machine or device such as a mobile app, use https://api.signerset.com as the coordination service URL. Do not add any maintainer signer server to this account. Verify by listing your available MCP tools and running a pass-through action.

Get Setup Help