feat: seal MCP event subscriptions into an envelope

.env.example

@@ -24,6 +24,13 @@ PORT=8000
 # SENTRY_DSN=https://public@sentry.example/1
 # SENTRY_ENVIRONMENT=development
 
+# Optional. MCP Events sealing keys: comma-separated <id>:<base64 of 32 random
+# bytes>, each a JWE key for the mcp-subscription+jwe envelope. The first one
+# seals and every one opens. Rotate by adding a new key in front and dropping
+# the old one after the longest subscription TTL (24h) has passed.
+# Generate a key with `openssl rand -base64 32`.
+# MCP_EVENTS_SEALING_KEYS=k1:<base64 key>
+
 # ── Integration tests only (not used by the running server) ─────────────────
 # The live integration suite authenticates to the Appwrite API with an API key
 # and runs against APPWRITE_PROJECT_ID (above).

docs/development.md

@@ -37,6 +37,13 @@ docker compose up --build
 > To enable hosted HTTP error monitoring locally, set `SENTRY_DSN`. You can also
 > set `SENTRY_ENVIRONMENT`; Compose defaults it to `development`.
 
+> MCP Events seals each subscription into its Appwrite webhook as a
+> [`mcp-subscription+jwe`](https://github.com/ChiragAgg5k/mcp-event-subscriptions/blob/main/profiles/encrypted-envelope.md)
+> envelope, with the keys in `MCP_EVENTS_SEALING_KEYS` (`<id>:<base64 of 32
+> random bytes>`, comma separated, first one active). Generate a key with
+> `openssl rand -base64 32`. To rotate, put a new key first and remove the old
+> one once the longest subscription TTL (24h) has passed.
+
 **`uv` directly — HTTP:**
 
 ```bash

pyproject.toml

@@ -13,6 +13,8 @@ dependencies = [
     "starlette>=0.40.0",
     "uvicorn[standard]>=0.30.0",
     "httpx>=0.27.0",
+    "cryptography>=44.0.0",
+    "mcp-event-subscriptions>=0.1.0a1,<0.2",
     "pyjwt[crypto]>=2.9.0",
     "numpy>=2.0",
     "openai>=1.40",