Getting started

Published 4.2.0. Registry releases exist for every artifact; conformance claims remain same-program evidence, not independent interoperability testing. The packages were released on 3 September 2026 from signed tag v4.2.0 at the commit recorded in the publication state. Install from the registry, or build that commit from a VCP-SDK checkout with the source command under each registry command.

What VCP is

The Value Context Protocol (VCP) sends the what and keeps the why. It carries values, constraints, and current state between compatible services and agents as short, readable context they can act on without learning the private reasons behind it. The specification covers identity, constitutional semantics, signed bundle transport, adaptation context, and optional extensions.

VCP supplies protocol types and verification machinery. Applications remain responsible for consent, minimization, storage, model-provider integration, policy design, human oversight, and operational security.

Version boundary

Package and protocol versions are numbered separately, so a new SDK release does not mean a new protocol version. Negotiate candidate features with each peer before sending them, and state which protocol baseline each integration supports.

Python quick start

1. Install

# From PyPI
python3 -m venv .venv
. .venv/bin/activate
python -m pip install value-context-protocol==4.2.0

# Or from the root of a VCP-SDK checkout at the published commit (tag v4.2.0, c5035e9)
python -m pip install ./python

2. Parse identity and semantics

from vcp import CSM1Code, Token

identity = Token.parse("family.safe.guide@1.2.0")
profile = CSM1Code.parse("N5+F+E")

assert identity.canonical == "family.safe.guide"
assert profile.encode() == "N5+E+F"

A UVC token (the VCP/I identity token), such as family.safe.guide@1.2.0, names a constitution by domain, approach, and role, and can carry a version and namespace. A CSM-1 code compactly states a persona, an adherence level, and scopes, with an optional namespace or version. Encoding sorts the scopes alphabetically, which is why N5+F+E comes back as N5+E+F.

3. Encode adaptation context

from vcp.adaptation import (
    PersonalState,
    PersonalStateDimension,
    SituationalDimension,
    VCPContext,
)

context = VCPContext(
    situational={
        SituationalDimension.TIME: ["🌅"],
        SituationalDimension.SPACE: ["🏡"],
        SituationalDimension.COMPANY: ["👶"],
    },
    personal={
        PersonalStateDimension.ENERGY_LEVEL:
            PersonalState("fatigued", 4),
    },
)

wire = context.encode()
roundtrip = VCPContext.decode(wire)
assert roundtrip == context

The example uses three of the nine baseline situational dimensions: time, space, and company. VEP-0004 adds four more for a 13-dimension model, which remains a v3.2 candidate feature. The encoding is compact but plaintext, so treat encoded personal state as sensitive data.

4. Verify a signed bundle before injection

from vcp import Orchestrator, VerificationResult

result = Orchestrator(trust_config).verify(bundle)
if result is not VerificationResult.VALID:
    raise PermissionError("Rejected VCP bundle: " + result.name)

# Only the verified branch may format or inject bundle content.

Injection here means placing the bundle's constitution text into the model's context, which is why only verified content may reach it.

trust_config and bundle are application-owned inputs. The SDK repository's examples/python/05_full_pipeline.py shows the complete runnable flow with test keys, trust anchors, bundle construction, verification, and formatting.

TypeScript WebMCP quick start

1. Install

# From npm
npm install @creedspace/vcp-sdk@4.2.0

# Or from the root of a VCP-SDK checkout at the published commit (tag v4.2.0, c5035e9)
npm install ./webmcp

2. Register browser tools

import { registerVCPTools } from '@creedspace/vcp-sdk';

const registration = await registerVCPTools({
  chatEndpoint: '/api/chat',
  enableChat: false,
});

console.log(registration.registered);
registration.cleanup();

The package feature-detects document.modelContext, is safe during server rendering, and does not inject a remote polyfill. Applications that need a polyfill must bundle and pin it themselves.

This site also has its own TypeScript modules under $lib/vcp. Some of them drive the demo pages; others (context, audit, privacy, adaptation-rules, constitution, constitution-codes, nl-parser, transition-detection, scheduling, learning, multi-agent, safety) are reference code that no page imports. None of them is an npm package API.

Rust quick start

1. Install

# From crates.io, inside your own Cargo project
cargo add vcp-core@4.2.0

# Or from the root of a VCP-SDK checkout at the published commit (tag v4.2.0, c5035e9)
cargo build --manifest-path ./rust/Cargo.toml -p vcp-core

2. Parse

use vcp_core::{Csm1Code, VcpToken};

fn main() {
    let identity = VcpToken::parse(
        "family.safe.guide@1.2.0"
    ).expect("valid identity");
    let profile = Csm1Code::parse("N5+F+E")
        .expect("valid CSM-1");

    assert_eq!(identity.role(), "guide");
    assert_eq!(profile.encode(), "N5+E+F");
}

vcp-core also contains the trust, transport verification, context, hooks, composition, and revocation modules. Two further crates are published at 4.2.0: vcp-cli (cargo install vcp-cli@4.2.0) for the command line and vcp-wasm for WebAssembly.

Privacy checklist

• Collect only context required for the declared purpose
• Bind consent to platform, purpose, fields, and expiry
• Keep sensitive personal state ephemeral unless continuity is explicitly enabled
• Filter context at each stakeholder boundary
• Apply decay and reject implausible future timestamps
• Redact logs and define retention and deletion behavior
• Test that candidate extensions are never sent silently to a peer that does not support them

Next steps

• Core concepts: protocol architecture and context tiers
• CSM-1 specification: CSM-1 codes such as N5+E+F, and the multi-line CSM-1 token
• API reference: maintained package surfaces and security boundaries
• VCP playground: build and inspect a CSM-1 token in your browser