vcon-server 0.4.0

Stores vCons encrypted at rest, on local disk or in an S3 bucket (as objects or Parquet files), and returns them to authorized readers.
Documentation

vcon-server

A server that stores vCons, the IETF conversation-record format, encrypted at rest, and returns them to authorized readers. It serves an HTTP API over TLS and keeps each tenant's vCons under that tenant's own keys. A deleted or replaced version is kept, hidden, until its tenant's retention period has passed since it was stored, and then erased, unless a legal hold keeps it. Every request is recorded in an audit log.

Status: 0.4.0 released, not yet for production. What works today is on what is built.

This crate is the vcon-server program. Its library exists so the tests can drive the same code the binary runs; it is not a stable API.

Install

From crates.io, with Rust 1.99 or later:

cargo install vcon-server --locked
vcon-server --version

The build compiles SQLCipher, the OpenSSL it uses, and AWS-LC, so the host needs a C compiler with the C library headers, make and perl. On Debian or Ubuntu:

sudo apt-get install gcc libc6-dev make perl

Release archives for Linux on x86_64 and aarch64, with checksums, an SBOM and signed build provenance, are on the releases page.

Run it

The server needs a master key (a file of 32 random bytes), a TLS certificate and its key, and one TOML configuration file:

listen = "0.0.0.0:8443"
data_dir = "/var/lib/vcon-server"
master_key = "/etc/vcon-server/master.key"

[tls]
cert = "/etc/vcon-server/cert.pem"
key = "/etc/vcon-server/key.pem"

vcon-server serve --config /etc/vcon-server/vcon-server.toml

It locks all its memory at start and refuses to start if it cannot. The getting started guide covers each step, the systemd unit, and making the first tenant and its keys.

For AI agents

The server serves MCP at /mcp on its TLS listener, and through vcon-server mcp for an agent that starts its servers as commands. Each tool does the work of one HTTP route, with the same API keys, scopes and audit records. The MCP page lists every tool with its parameters and an example.

Objects in an S3 bucket

The server can keep each version's sealed object in an S3-compatible bucket (RustFS, MinIO or AWS S3) instead of the data directory, and can pack those objects into Parquet files in the same bucket. Keep vCons in an S3 bucket sets up the bucket, and keep vCons as Parquet files in a bucket turns on Parquet storage. vcon-server export parquet writes a copy of a tenant's vCons as Parquet files; see export to Parquet.

Links

License

Licensed under either of the Apache License, Version 2.0 or the MIT License, at your option.