reeve 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1c59f8e6c82441798415dbe8c2a0f53820615dfe8fcce4d96294ccc46d355208
+  data.tar.gz: 670b19c4de2bc2fab5c16b4fbb7c958b3ea64cede00615f219032ef27161626f
+SHA512:
+  metadata.gz: 148721a9d10024026ff713a59ddf0fdf6cb1c32691f4c78c79961337a654f08c8f08b3445ba8a4630c00ce563553352c59194cc7355f00eae50942cf0f61cae0
+  data.tar.gz: 6b2b69206f97d2ca3278a3ccb37ba63a4ab74447a39de01f6e0c5ebe1c53aff5958a4c2389fafa0d55ae192bdd4035ed1df9d224e8fa49c7c4e52064bcdbe887

data/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## [0.0.1] - 2026-08-11
+
+- Placeholder release reserving the gem name. No functionality.

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Victor Velazquez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,63 @@
+# Reeve
+
+**Authentication says who's at the door. Reeve decides what they can touch, and remembers
+what they touched.**
+
+A Ruby gem that makes it safe for a Rails application to expose MCP tools to AI agents:
+declarative per-record authorization, an append-only audit ledger, and a testing kit that
+proves both hold.
+
+> **Status: 0.0.1 is a placeholder release reserving the gem name. There is no working
+> code yet.** Development is in progress — don't install this expecting it to do anything.
+
+*A reeve is an official who acts with delegated authority on behalf of someone else — the
+root of "sheriff" (shire-reeve). That delegation is exactly what this gem governs: an agent
+acting for a human, allowed to reach only what that human may reach.*
+
+*Developed under the working name `mcp-guardrails`.*
+
+## The problem
+
+The Ruby MCP server stack — the official [`mcp`](https://github.com/modelcontextprotocol/ruby-sdk)
+gem, [fast-mcp](https://github.com/yjacquin/fast-mcp), and
+[ActionMCP](https://github.com/seuros/actionmcp) — is healthy and consolidating. All three
+authenticate the *connection*. None of them scope what an authenticated agent may **see per
+person**, none produce a compliance-grade audit trail, and none ship a way to prove either
+in CI.
+
+That's the gap Reeve fills. It's an extension layer, not a competitor — it rides all three.
+
+## The shape of it
+
+```ruby
+class InvoiceSearchTool < FastMcp::Tool
+  guard_with InvoicePolicy          # the only line you add
+
+  def call(query:)
+    Invoice.where("number LIKE ?", "%#{query}%")
+  end
+end
+```
+
+Three things then hold:
+
+1. **Deny by default.** The tool returns only invoices the acting principal may see. No
+   principal, no guard, or a policy error means no records — never a silent pass.
+2. **Every call leaves a trace.** One append-only ledger row per invocation, allowed or
+   denied, naming the agent, the principal, the arguments, what came back, and the rule
+   that decided.
+3. **Provable in CI.** `expect(tool).to deny_access_for(stranger)` in RSpec,
+   `assert_denies_access_for` in Minitest, or the checks called directly from a rake task.
+
+## Planned for v1
+
+- Per-record authorization bridging Pundit or plain policy objects
+- Append-only audit ledger with a query interface and an install generator
+- Testing kit: framework-neutral checks with RSpec, Minitest, and plain-Ruby front-ends
+- fast-mcp adapter, plus a plain interface for everyone else
+
+Ruby 3.0+, Rails 7.0+. No runtime dependencies.
+
+## License
+
+MIT. See [LICENSE.txt](LICENSE.txt).

data/lib/reeve/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Reeve
+  VERSION = "0.0.1"
+end

data/lib/reeve.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative "reeve/version"
+
+# Reeve — per-record authorization and an append-only audit ledger for the MCP tools
+# a Rails application exposes to AI agents.
+#
+# 0.0.1 is a placeholder release reserving the gem name. It has no functionality yet.
+# See https://github.com/vicmaster/reeve for progress.
+module Reeve
+  class Error < StandardError; end
+end

metadata

@@ -0,0 +1,59 @@
+--- !ruby/object:Gem::Specification
+name: reeve
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Victor Velazquez
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-08-11 00:00:00.000000000 Z
+dependencies: []
+description: |
+  Reeve makes it safe for a Rails application to expose MCP (Model Context Protocol)
+  tools to AI agents. Authentication says who is at the door; Reeve decides what they
+  may touch and remembers what they touched: declarative per-record authorization
+  scoped to the human the agent acts for, an append-only audit ledger of every call,
+  and a testing kit that turns both guarantees into CI assertions. Works alongside
+  fast-mcp, ActionMCP, and the official mcp gem. Developed under the working name
+  mcp-guardrails.
+email:
+- velazquezgaspar16@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/reeve.rb
+- lib/reeve/version.rb
+homepage: https://github.com/vicmaster/reeve
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/vicmaster/reeve
+  source_code_uri: https://github.com/vicmaster/reeve
+  changelog_uri: https://github.com/vicmaster/reeve/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/vicmaster/reeve/issues
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Per-record authorization and audit guardrails for Rails MCP tools
+test_files: []