GoodRoom.verify is a passkey-based human approval service designed to add a hardware-backed biometric checkpoint to high-risk AI agent actions. It integrates with agent runtimes via the Model Context Protocol (MCP), allowing autonomous agents to pause before executing irreversible operations such as production migrations, financial transactions, or sensitive data access. The service is currently in private beta and positions itself as an MCP-native security layer for enterprise and developer workflows. The approval workflow begins when an agent attempts a sensitive MCP tool call. An MCP gateway submits only an action summary and a SHA-256 hash to GoodRoom.verify; no prompt context or agent conversation is transmitted. The operator then receives a 120-second, single-use challenge that must be approved using a passkey, such as Touch ID, Face ID, Windows Hello, or a hardware security key. Once approved, the agent receives a short-lived, single-use cryptographic proof bound to the exact action, enabling execution without exposing biometric credentials to the agent. A core design principle is zero-trust security. GoodRoom.verify does not retain prompts or agent context, and the passkeys are locked to the goodroom.in domain, ensuring physical presence is required for approval. Each approval produces cryptographic evidence for audits, making the entire process explicit, scoped, and auditable. The service is built to gate irreversible actions while keeping autonomous agents fast and flexible in low-risk scenarios. GoodRoom.verify is aimed at teams deploying AI agents in production environments where safety and compliance are critical. It supports popular agent runtimes such as [PERSON_NAME] Code and Cursor, and encourages integration through its MCP server. The project is open source on GitHub, though the hosted service manages the approval challenges and passkey enrollment.
Solves
GoodRoom.verify solves the problem of AI agents executing irreversible actions without human oversight by requiring a hardware-backed passkey approval before high-risk MCP tool calls. It provides a secure, short-lived, and auditable human-in-the-loop checkpoint that prevents unauthorized or accidental production changes, financial operations, and sensitive data access.