Getting Started

Source-only candidate. No registry release is currently claimed. Run the commands below from a VCP-SDK checkout whose immutable commit is recorded in the coordinated candidate manifest.

What VCP Is

The Value Context Protocol (VCP) defines interoperable identity, constitutional semantics, signed bundle transport, adaptation context, and optional extensions for systems that carry values and context between compatible services.

VCP supplies protocol types and verification machinery. Applications remain responsible for consent, minimisation, storage, model-provider integration, policy design, human oversight, and operational security.

Version Boundary

A package version does not declare a new protocol version. Negotiate pre-release features and publish the supported baseline with every integration.

Python Quick Start

1. Install

# From the root of an immutable VCP-SDK checkout
python3 -m venv .venv
. .venv/bin/activate
python -m pip install ./python

2. Parse Identity and Semantics

from vcp import CSM1Code, Token

identity = Token.parse("family.safe.guide@1.2.0")
profile = CSM1Code.parse("N5+F+E")

assert identity.canonical == "family.safe.guide"
assert profile.encode() == "N5+E+F"

Identity tokens answer who or what is addressed. CSM-1 codes compactly express a persona, adherence level, scopes, and optional namespace or version.

3. Encode Adaptation Context

from vcp.adaptation import (
    PersonalState,
    PersonalStateDimension,
    SituationalDimension,
    VCPContext,
)

context = VCPContext(
    situational={
        SituationalDimension.TIME: ["🌅"],
        SituationalDimension.SPACE: ["🏡"],
        SituationalDimension.COMPANY: ["👶"],
    },
    personal={
        PersonalStateDimension.ENERGY_LEVEL:
            PersonalState("fatigued", 4),
    },
)

wire = context.encode()
roundtrip = VCPContext.decode(wire)
assert roundtrip == context

The extended 13-dimension situational model is a v3.2 candidate feature. Personal context may be sensitive even when compactly encoded.

4. Verify a Signed Bundle Before Injection

from vcp import Orchestrator, VerificationResult

result = Orchestrator(trust_config).verify(bundle)
if result is not VerificationResult.VALID:
    raise PermissionError("Rejected VCP bundle: " + result.name)

# Only the verified branch may format or inject bundle content.

trust_config and bundle are application-owned inputs. The SDK repository's examples/python/05_full_pipeline.py shows the complete runnable flow with test keys, trust anchors, bundle construction, verification, and formatting.

TypeScript WebMCP Quick Start

1. Install

# From the root of an immutable VCP-SDK checkout
npm install ./webmcp

2. Register Browser Tools

import { registerVCPTools } from '@creed-space/vcp-sdk';

const registration = await registerVCPTools({
  chatEndpoint: '/api/chat',
  enableChat: false,
});

console.log(registration.registered);
registration.cleanup();

The package feature-detects document.modelContext, is safe during server rendering, and does not inject a remote polyfill. Applications that need a polyfill must bundle and pin it themselves.

The Demo Site also contains internal TypeScript modules under $lib/vcp. Those modules power this application and are not an npm package API.

Rust Quick Start

1. Install

# From the root of an immutable VCP-SDK checkout
cargo build --manifest-path ./rust/Cargo.toml -p vcp-core

2. Parse

use vcp_core::{Csm1Code, VcpToken};

fn main() {
    let identity = VcpToken::parse(
        "family.safe.guide@1.2.0"
    ).expect("valid identity");
    let profile = Csm1Code::parse("N5+F+E")
        .expect("valid CSM-1");

    assert_eq!(identity.role(), "guide");
    assert_eq!(profile.encode(), "N5+E+F");
}

The Rust workspace also provides trust, transport verification, context, hooks, composition, revocation, command-line, and WebAssembly crates. Choose only the surfaces your application needs.

Privacy Checklist

• Collect only context required for the declared purpose
• Bind consent to platform, purpose, fields, and expiry
• Keep sensitive personal state ephemeral unless continuity is explicitly enabled
• Filter context at each stakeholder boundary
• Apply decay and reject implausible future timestamps
• Redact logs and define retention and deletion behavior
• Test that unsupported peers do not receive candidate extensions silently

Next Steps

• Core Concepts: protocol architecture and context layers
• CSM-1 Specification: compact constitutional semantics
• API Reference: maintained package surfaces and security boundaries
• Token Playground: interactive Demo-local context encoding