@decionis/mcp 0.1.2 → 0.1.3

package/README.md

@@ -27,11 +27,50 @@ surface.
 
 ## Tools
 
-| Tool                    | Purpose                                                                                                                |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| `decionis_read_policy`  | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`.                               |
-| `decionis_evaluate`     | Evaluate a candidate action payload against the policy through the real evaluator; returns the verdict + matched rule. |
-| `decionis_verdict_help` | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict.                           |
+| Tool                    | Purpose                                                                                                                                                                                     |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `decionis_read_policy`  | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`.                                                                                                    |
+| `decionis_evaluate`     | Evaluate a candidate action payload against the policy through the real evaluator; returns the verdict + matched rule.                                                                      |
+| `decionis_demo`         | The one-minute demo: four canned intents through the real evaluator with a built-in sample policy — one per wire outcome. No account, no key, no policy file, no network, nothing recorded. |
+| `decionis_verdict_help` | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict.                                                                                                |
+
+All four are read-only, credential-free, and networkless (`readOnlyHint: true`,
+`openWorldHint: false`) — an agent host that gates side-effectful tools behind
+approval has nothing to gate here. The `shield.*` tools register only when
+`DECIONIS_SHIELD_API_KEY` and `DECIONIS_SHIELD_APP_ID` are configured.
+
+### Kubernetes execution-authority tools
+
+The optional Kubernetes tools add a client-side gate while the validating admission
+webhook remains the independent cluster-side gate:
+
+| Tool                    | Purpose                                                                                     |
+| ----------------------- | ------------------------------------------------------------------------------------------- |
+| `k8s_plan`              | Resolve exact objects and show only digests, action hashes, diffs, and bounded facts.       |
+| `k8s_request_authority` | Request ALLOW/HOLD/BLOCK and signed dossier references without applying.                    |
+| `k8s_apply`             | Consume an exact Decionis grant, then stream the bound object snapshot to Kubernetes.       |
+| `k8s_scale`             | Consume an exact scale grant, then submit that bound scale object, including scale-to-zero. |
+| `k8s_rollback`          | Apply an exact, existing-target rollback manifest after authority; vague undo is rejected.  |
+| `k8s_verify_dossier`    | Independently verify the dossier proof bundle and Ed25519 evidence.                         |
+
+Enable them explicitly. The process uses the selected local kube context without reading
+or exporting kubeconfig credentials:
+
+```bash
+DECIONIS_KUBERNETES_TOOLS_ENABLED=true
+DECIONIS_AUTHORITY_BASE_URL=https://api.decionis.example
+DECIONIS_API_KEY=<org-scoped-key>
+DECIONIS_ORG_ID=<org-uuid>
+DECIONIS_KUBERNETES_CLUSTER_ID=production-eu-1
+DECIONIS_KUBERNETES_ACTOR=operator@example.com
+DECIONIS_KUBERNETES_POLICY_VERSION=kubernetes-production-v1
+DECIONIS_KUBERNETES_CONTEXT=production-eu-1
+```
+
+`DECIONIS_KUBERNETES_VERIFICATION_ORIGINS` may add comma-separated HTTPS origins for
+dossier/JWKS verification. Arbitrary origins are rejected. Mutating tools fail closed on
+authority, dossier, action-hash, grant, or Kubernetes errors; a Kubernetes command failure
+requires fresh authority because the single-use client grant has already been consumed.
 
 The policy file resolves from the tool's `path` argument, then `$DECIONIS_POLICY_PATH`,
 then `./DECIONIS_POLICY.md` in the working directory.

package/dist/AgentHookCli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   AgentHookCommand
-} from "./chunk-2C62WFX2.js";
-import "./chunk-KY5AVRL6.js";
+} from "./chunk-NFWSCSMQ.js";
+import "./chunk-XNC3IZW5.js";
 
 // src/AgentHookCli.ts
 void AgentHookCommand.run(process.argv.slice(2)).then((exitCode) => {