@decionis/mcp 0.1.2 → 0.1.4

package/.claude-plugin/plugin.json

@@ -0,0 +1,15 @@
+{
+  "name": "decionis",
+  "displayName": "Decionis Execution Authority",
+  "version": "0.1.4",
+  "description": "Refuse an agent's tool call before it runs, using a policy you wrote. Evaluated locally through the real Decionis protocol evaluator \u2014 no account, no network, no credentials.",
+  "keywords": ["security", "policy", "guardrails", "execution-authority", "agent-safety", "hooks"],
+  "homepage": "https://decionis.com/docs/protocol-mcp",
+  "repository": "https://github.com/decionis/mcp",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": {
+    "name": "Decionis, Inc.",
+    "url": "https://decionis.com"
+  },
+  "commands": ["./commands"]
+}

package/README.md

@@ -27,17 +27,79 @@ surface.
 
 ## Tools
 
-| Tool                    | Purpose                                                                                                                |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| `decionis_read_policy`  | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`.                               |
-| `decionis_evaluate`     | Evaluate a candidate action payload against the policy through the real evaluator; returns the verdict + matched rule. |
-| `decionis_verdict_help` | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict.                           |
+| Tool                    | Purpose                                                                                                                                                                                     |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `decionis_read_policy`  | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`.                                                                                                    |
+| `decionis_evaluate`     | Evaluate a candidate action payload against the policy through the real evaluator; returns the verdict + matched rule.                                                                      |
+| `decionis_demo`         | The one-minute demo: four canned intents through the real evaluator with a built-in sample policy — one per wire outcome. No account, no key, no policy file, no network, nothing recorded. |
+| `decionis_verdict_help` | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict.                                                                                                |
+
+All four are read-only, credential-free, and networkless (`readOnlyHint: true`,
+`openWorldHint: false`) — an agent host that gates side-effectful tools behind
+approval has nothing to gate here. The `shield.*` tools register only when
+`DECIONIS_SHIELD_API_KEY` and `DECIONIS_SHIELD_APP_ID` are configured.
+
+### Kubernetes execution-authority tools
+
+The optional Kubernetes tools add a client-side gate while the validating admission
+webhook remains the independent cluster-side gate:
+
+| Tool                    | Purpose                                                                                     |
+| ----------------------- | ------------------------------------------------------------------------------------------- |
+| `k8s_plan`              | Resolve exact objects and show only digests, action hashes, diffs, and bounded facts.       |
+| `k8s_request_authority` | Request ALLOW/HOLD/BLOCK and signed dossier references without applying.                    |
+| `k8s_apply`             | Consume an exact Decionis grant, then stream the bound object snapshot to Kubernetes.       |
+| `k8s_scale`             | Consume an exact scale grant, then submit that bound scale object, including scale-to-zero. |
+| `k8s_rollback`          | Apply an exact, existing-target rollback manifest after authority; vague undo is rejected.  |
+| `k8s_verify_dossier`    | Independently verify the dossier proof bundle and Ed25519 evidence.                         |
+
+Enable them explicitly. The process uses the selected local kube context without reading
+or exporting kubeconfig credentials:
+
+```bash
+DECIONIS_KUBERNETES_TOOLS_ENABLED=true
+DECIONIS_AUTHORITY_BASE_URL=https://api.decionis.example
+DECIONIS_API_KEY=<org-scoped-key>
+DECIONIS_ORG_ID=<org-uuid>
+DECIONIS_KUBERNETES_CLUSTER_ID=production-eu-1
+DECIONIS_KUBERNETES_ACTOR=operator@example.com
+DECIONIS_KUBERNETES_POLICY_VERSION=kubernetes-production-v1
+DECIONIS_KUBERNETES_CONTEXT=production-eu-1
+```
+
+`DECIONIS_KUBERNETES_VERIFICATION_ORIGINS` may add comma-separated HTTPS origins for
+dossier/JWKS verification. Arbitrary origins are rejected. Mutating tools fail closed on
+authority, dossier, action-hash, grant, or Kubernetes errors; a Kubernetes command failure
+requires fresh authority because the single-use client grant has already been consumed.
 
 The policy file resolves from the tool's `path` argument, then `$DECIONIS_POLICY_PATH`,
 then `./DECIONIS_POLICY.md` in the working directory.
 
 ## Install
 
+**Claude Code — as a plugin (one command, gate included):**
+
+```
+/plugin marketplace add decionis/mcp
+/plugin install decionis
+```
+
+That installs the MCP tools **and** the binding `PreToolUse` gate together. Then,
+in a repository you want governed:
+
+```
+/decionis:init
+```
+
+…which writes a starter `DECIONIS_POLICY.md`. Ask your agent to run
+`rm -rf /var/lib/postgresql` and it comes back refused, by rule name.
+
+A repository with no `DECIONIS_POLICY.md` is simply not governed — the plugin
+runs everywhere, so it does not gate projects that never opted in. A policy that
+exists but cannot be compiled still fails closed.
+
+**Everything else:**
+
 ```bash
 npm install -g @decionis/mcp
 ```

package/commands/init.md

@@ -0,0 +1,23 @@
+---
+description: Create a Decionis policy in this repository so its tool calls are gated
+---
+
+Set up Decionis execution authority in the current repository.
+
+1. Check whether `DECIONIS_POLICY.md` already exists at the repository root.
+   - If it does, read it, summarise the rules in plain language, and stop.
+     Do not overwrite a policy someone already wrote.
+2. If it does not exist, copy the starter policy from
+   `${CLAUDE_PLUGIN_ROOT}/templates/DECIONIS_POLICY.starter.md` to
+   `DECIONIS_POLICY.md` at the repository root, preserving it byte for byte.
+3. Tell the user, briefly:
+   - which rules are now active, in their own words;
+   - that every tool call is now evaluated against this file **before** it
+     runs, locally, with no account and nothing sent anywhere;
+   - that they can prove it right now by asking you to run
+     `rm -rf /var/lib/postgresql`, which will come back refused by rule name;
+   - that the file is theirs to edit, and the last rule must stay an `allow`
+     or nothing will be permitted at all.
+
+Do not add rules of your own invention. The starter policy is deliberately
+small so a person can read all of it before trusting it.

package/dist/AgentHookCli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   AgentHookCommand
-} from "./chunk-2C62WFX2.js";
-import "./chunk-KY5AVRL6.js";
+} from "./chunk-MJVKY7PZ.js";
+import "./chunk-YVRIRS6H.js";
 
 // src/AgentHookCli.ts
 void AgentHookCommand.run(process.argv.slice(2)).then((exitCode) => {