Module 3: Your First VCP Integration

3.1 — Choose the Right Surface

VCP-SDK 4.2.0 exposes three deliberately different surfaces:

Version boundary: 4.2.0 is the source-only SDK candidate. No registry release is currently claimed. VCP v3.1 is the published protocol baseline. The source candidate also contains explicitly identified v3.2 experimental adaptation features.

3.2 — Installation

Run these commands from an immutable VCP-SDK checkout recorded in the coordinated candidate manifest.

Python (Python 3.10 or newer):

python -m pip install ./python

TypeScript WebMCP integration:

npm install ./webmcp

Rust:

cargo build --manifest-path ./rust/Cargo.toml -p vcp-core

Pin the exact source commit in deployed applications. After registry publication, use only a version whose receipt and digest appear in the coordinated release manifest.

3.3 — Parse and Canonicalise in Python

from vcp import CSM1Code, Token

identity = Token.parse("family.safe.guide@1.2.0")
profile = CSM1Code.parse("N5+F+E")

print(identity.full)       # family.safe.guide@1.2.0
print(identity.canonical)  # family.safe.guide
print(profile.encode())    # N5+E+F (canonical scope order)

Both parsers reject malformed input. Treat parse failure as a validation failure, rather than silently accepting a string as trusted VCP data.

3.4 — Encode Adaptation Context in Python

The adaptation layer can encode situational and personal state into a compact wire representation:

from vcp.adaptation import ContextEncoder

context = ContextEncoder().encode(
    time="morning",
    space="home",
    company="children",
)

wire = context.encode()
print(wire)  # ⏰🌅|📍🏡|👥👶

The 13-dimension v3.2 adaptation model remains a candidate feature. Negotiate it explicitly when interoperability with a v3.1-only peer matters.

3.5 — Register Browser Tools in TypeScript

The TypeScript package registers VCP capabilities with document.modelContext when the browser supports WebMCP:

import { registerVCPTools } from '@creed-space/vcp-sdk';

const registration = await registerVCPTools({
  chatEndpoint: '/api/chat',
  enableChat: false,
});

console.log(registration.registered);

// Call this when the component or page is destroyed.
registration.cleanup();

The call is safe during server rendering and returns an empty registration in unsupported browsers. Your application owns any optional polyfill and must bundle and pin it locally.

3.6 — Parse in Rust

use vcp_core::{Csm1Code, VcpToken};

fn main() {
    let identity = VcpToken::parse(
        "family.safe.guide@1.2.0"
    ).expect("valid identity");
    let profile = Csm1Code::parse("N5+F+E")
        .expect("valid CSM-1 code");

    assert_eq!(identity.domain(), "family");
    assert_eq!(profile.encode(), "N5+E+F");
}

3.7 — Verification Is a Separate Gate

Parsing proves that data has the expected syntax. It does not prove issuer trust, signature validity, attestation validity, freshness, scope, revocation status, or content integrity. Signed bundles must pass the SDK orchestrator before their content is injected into a model.

The VCP-SDK repository includes a complete examples/python/05_full_pipeline.py example covering key generation, trust anchors, bundle verification, and guarded injection.