@atlasauth/pca-mcp 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,37 +1,59 @@
 # @atlasauth/pca-mcp
 
-Model Context Protocol adapter for Proof-Carrying Authority: wrap an MCP tool handler so every call emits a PCActn (and attaches the proof) before the handler runs.
+Model Context Protocol adapter for Proof-Carrying Authority (PCA). `withPCA` wraps an MCP tool handler so every call first builds a signed PCActn (failing fast if the agent's own grant does not permit it), hands you the proof to forward to the resource server, and then runs the original handler.
 
 ## Install
 
 ```sh
-npm i @atlasauth/pca-mcp
-# peer dependency, install alongside:
-npm i @modelcontextprotocol/sdk
+npm i @atlasauth/pca-mcp @atlasauth/pca
+npm i @modelcontextprotocol/sdk   # optional peer dependency (^1)
 ```
 
-`@modelcontextprotocol/sdk` (^1) is an optional peer dependency.
-
 ## Usage
 
 ```ts
+import { agent, generateKeyPair } from '@atlasauth/pca';
 import { withPCA } from '@atlasauth/pca-mcp';
 
+const pcaAgent = agent({
+  principal: generateKeyPair(),
+  goal: 'process refunds',
+  permissions: { stripe: ['refund'] },
+  limits: { refund: '$500/day' },
+  aud: 'ins_acme',
+});
+
 server.tool(
   'refund',
   schema,
   withPCA(
-    agent,                                       // core @atlasauth/pca Agent
+    pcaAgent,
     {
       verb: 'stripe.refund',
       resource: (args) => `ch_${args.chargeId}`,
-      onProof: (pca) => { /* forward pca.encoded to the resource server */ },
+      onProof: (pca, args) => {
+        // forward pca.headers (PCA-Action) to the resource server with your request
+      },
     },
     async (args) => ({ content: [{ type: 'text', text: await doRefund(args) }] }),
   ),
 );
 ```
 
-The wrapped handler keeps the MCP handler shape. On a local fast-fail it returns an MCP error result (`isError: true`) rather than throwing. It builds + attaches a PCActn; it does not authorize on its own — the resource server's verifier decides.
+The wrapped handler keeps the MCP handler shape `(args, extra?) => result`. When the local dry-run denies the action it returns an MCP error result (`isError: true`) instead of throwing, so the model can see the refusal.
+
+## API
+
+- `withPCA(agent, spec, handler)` - spec is `{ verb, resource, aud?, failFast?, onProof? }`.
+- `guardToolResult(pca, result)` - adds the encoded PCActn to a tool result's `_meta['x-pca-action']`, keeping existing content.
+- Re-exports `bridgeToolCall`, `pcaHeaders`, and the `PcaCall` type from `@atlasauth/pca`.
+
+To make the server that receives these calls an OAuth resource server, see `@atlasauth/pca-mcp-rs`.
+
+## Status
+
+This package does not authorize anything. It attaches a proof-carrying action; the resource server's verifier (see `@atlasauth/pca`) decides. The MCP SDK is matched structurally and never imported. PCA cryptography has not been independently audited.
+
+## License
 
-Part of Proof-Carrying Authority — see `@atlasauth/pca`.
+MIT - see LICENSE

package/package.json

@@ -1,7 +1,26 @@
 {
   "name": "@atlasauth/pca-mcp",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Model Context Protocol adapter for Proof-Carrying Authority: wrap an MCP tool handler so every call emits a PCActn (and attaches the proof) before the handler runs.",
+  "keywords": [
+    "mcp",
+    "model context protocol",
+    "tool calling",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-mcp"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,7 +31,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/pca": "0.1.0"
+    "@atlasauth/pca": "0.2.0"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1"
@@ -28,8 +47,12 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },