Is that MCP request actually from your AI agent

Is that MCP request actually from your AI agent? Last week we open-sourced Signet — cryptographic signing for every AI agent tool call. Someone asked a good question: the agent signs, but does the server verify? Fair point. v0.1 was one-sided. The agent signed every request, but the server didn't check. Like mailing a signed contract that nobody verifies on the other end. Better than nothing, but the trust chain is broken. This week we closed the loop. From one-sided to bilateral v0.1 Agent sign