@decionis/mcp 0.1.3 → 0.2.0

package/.claude-plugin/plugin.json

@@ -0,0 +1,15 @@
+{
+  "name": "decionis",
+  "displayName": "Decionis Execution Authority",
+  "version": "0.2.0",
+  "description": "Refuse an agent's tool call before it runs, using a policy you wrote. Evaluated locally through the real Decionis protocol evaluator \u2014 no account, no network, no credentials.",
+  "keywords": ["security", "policy", "guardrails", "execution-authority", "agent-safety", "hooks"],
+  "homepage": "https://decionis.com/docs/protocol-mcp",
+  "repository": "https://github.com/decionis/mcp",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": {
+    "name": "Decionis, Inc.",
+    "url": "https://decionis.com"
+  },
+  "commands": ["./commands"]
+}

package/README.md

@@ -27,31 +27,57 @@ surface.
 
 ## Tools
 
-| Tool                    | Purpose                                                                                                                                                                                     |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `decionis_read_policy`  | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`.                                                                                                    |
-| `decionis_evaluate`     | Evaluate a candidate action payload against the policy through the real evaluator; returns the verdict + matched rule.                                                                      |
-| `decionis_demo`         | The one-minute demo: four canned intents through the real evaluator with a built-in sample policy — one per wire outcome. No account, no key, no policy file, no network, nothing recorded. |
-| `decionis_verdict_help` | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict.                                                                                                |
-
-All four are read-only, credential-free, and networkless (`readOnlyHint: true`,
+| Tool                                        | Purpose                                                                                                                                                                                                                                                                                    |
+| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `decionis_read_policy`                      | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`.                                                                                                                                                                                                   |
+| `decionis_evaluate`                         | Evaluate a candidate action payload against the policy — or, with `policy_pack`, against a named Decionis policy pack — through the real evaluator; returns the verdict, the matched rule, the `evaluation_id` and the exact policy version it decided under (`policy_bundle_resolution`). |
+| `decionis_list_policy_packs`                | The policy packs the evaluator ships (finance, devops, sap, salesforce, workday, hospitality and the workflow overlays) with each pack's key, decision domain and exact bundle version.                                                                                                    |
+| `decionis_demo`                             | The one-minute demo: four canned intents through the real evaluator with a built-in sample policy — one per wire outcome. No account, no key, no policy file, no network, nothing recorded.                                                                                                |
+| `decionis_verdict_help`                     | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict.                                                                                                                                                                                               |
+| `decionis_request_presence_verification`    | With `DECIONIS_PRESENCE_API_KEY`: ask a named person to approve a held ESCALATE through Presence, on their own device. The action stays held; a BLOCK cannot be bypassed and Shadow Mode evaluations are refused.                                                                          |
+| `decionis_get_presence_verification_status` | With `DECIONIS_PRESENCE_API_KEY`: verify the signed Presence Record and re-evaluate the held action. Only the new Decionis verdict can return PROCEED.                                                                                                                                     |
+
+The five core tools are read-only, credential-free, and networkless (`readOnlyHint: true`,
 `openWorldHint: false`) — an agent host that gates side-effectful tools behind
-approval has nothing to gate here. The `shield.*` tools register only when
-`DECIONIS_SHIELD_API_KEY` and `DECIONIS_SHIELD_APP_ID` are configured.
+approval has nothing to gate here. Every evaluation pins the exact policy version it
+decided under; a version the evaluator does not hold fails closed
+(`requested_policy_bundle_not_found`) and is never silently substituted.
+
+### Policy packs
+
+`decionis_evaluate` accepts `policy_pack` — a key from `decionis_list_policy_packs` — to
+decide under one of the protocol's own packs instead of the repository policy file. The
+pack's bundle is seeded into the local evaluator once, through the same schema-validated
+route the hosted service uses, and its exact version is pinned on every evaluation, so
+several packs and a file policy coexist without one standing in for another.
+
+### Presence
+
+Set `DECIONIS_PRESENCE_API_KEY` to your Presence tenant key (optionally
+`DECIONIS_PRESENCE_API_URL`, https only, default `https://presence.decionis.com`) and two
+more tools register. Evaluate in `enforce` mode; an ESCALATE returns an `evaluation_id`;
+`decionis_request_presence_verification` hands you an approval link for the named
+approver; `decionis_get_presence_verification_status` verifies the signed Presence Record
+and re-evaluates. The handlers are the hosted MCP's own, bound to the in-process store, so
+the local loop is the hosted loop. Both call `presence.decionis.com` (`openWorldHint:
+true`). Production enforcement is sales-assisted.
+
+The `shield.*` tools register only when `DECIONIS_SHIELD_API_KEY` and
+`DECIONIS_SHIELD_APP_ID` are configured.
 
 ### Kubernetes execution-authority tools
 
 The optional Kubernetes tools add a client-side gate while the validating admission
 webhook remains the independent cluster-side gate:
 
-| Tool                    | Purpose                                                                                     |
-| ----------------------- | ------------------------------------------------------------------------------------------- |
-| `k8s_plan`              | Resolve exact objects and show only digests, action hashes, diffs, and bounded facts.       |
-| `k8s_request_authority` | Request ALLOW/HOLD/BLOCK and signed dossier references without applying.                    |
-| `k8s_apply`             | Consume an exact Decionis grant, then stream the bound object snapshot to Kubernetes.       |
-| `k8s_scale`             | Consume an exact scale grant, then submit that bound scale object, including scale-to-zero. |
-| `k8s_rollback`          | Apply an exact, existing-target rollback manifest after authority; vague undo is rejected.  |
-| `k8s_verify_dossier`    | Independently verify the dossier proof bundle and Ed25519 evidence.                         |
+| Tool                    | Purpose                                                                               |
+| ----------------------- | ------------------------------------------------------------------------------------- |
+| `k8s_plan`              | Resolve exact objects and show only digests, action hashes, diffs, and bounded facts. |
+| `k8s_request_authority` | Request ALLOW/HOLD/BLOCK and signed dossier references without applying.              |
+| `k8s_apply`             | Claim, apply, response-digest, and finalize each exact bound object separately.       |
+| `k8s_scale`             | Claim and finalize the exact scale object, including scale-to-zero.                   |
+| `k8s_rollback`          | Strictly finalize an exact existing-target rollback; vague undo is rejected.          |
+| `k8s_verify_dossier`    | Independently verify the dossier proof bundle and Ed25519 evidence.                   |
 
 Enable them explicitly. The process uses the selected local kube context without reading
 or exporting kubeconfig credentials:
@@ -69,14 +95,39 @@ DECIONIS_KUBERNETES_CONTEXT=production-eu-1
 
 `DECIONIS_KUBERNETES_VERIFICATION_ORIGINS` may add comma-separated HTTPS origins for
 dossier/JWKS verification. Arbitrary origins are rejected. Mutating tools fail closed on
-authority, dossier, action-hash, grant, or Kubernetes errors; a Kubernetes command failure
-requires fresh authority because the single-use client grant has already been consumed.
+authority, dossier, action-hash, grant, or missing effect-request binding. Each exact
+resource claim is finalized after its command. A successful response is digest-bound;
+an ambiguous Kubernetes command failure is finalized `INDETERMINATE`, is never retried
+automatically, and requires operator reconciliation plus fresh authority for a later action.
 
 The policy file resolves from the tool's `path` argument, then `$DECIONIS_POLICY_PATH`,
 then `./DECIONIS_POLICY.md` in the working directory.
 
 ## Install
 
+**Claude Code — as a plugin (one command, gate included):**
+
+```
+/plugin marketplace add decionis/mcp
+/plugin install decionis
+```
+
+That installs the MCP tools **and** the binding `PreToolUse` gate together. Then,
+in a repository you want governed:
+
+```
+/decionis:init
+```
+
+…which writes a starter `DECIONIS_POLICY.md`. Ask your agent to run
+`rm -rf /var/lib/postgresql` and it comes back refused, by rule name.
+
+A repository with no `DECIONIS_POLICY.md` is simply not governed — the plugin
+runs everywhere, so it does not gate projects that never opted in. A policy that
+exists but cannot be compiled still fails closed.
+
+**Everything else:**
+
 ```bash
 npm install -g @decionis/mcp
 ```

package/commands/init.md

@@ -0,0 +1,23 @@
+---
+description: Create a Decionis policy in this repository so its tool calls are gated
+---
+
+Set up Decionis execution authority in the current repository.
+
+1. Check whether `DECIONIS_POLICY.md` already exists at the repository root.
+   - If it does, read it, summarise the rules in plain language, and stop.
+     Do not overwrite a policy someone already wrote.
+2. If it does not exist, copy the starter policy from
+   `${CLAUDE_PLUGIN_ROOT}/templates/DECIONIS_POLICY.starter.md` to
+   `DECIONIS_POLICY.md` at the repository root, preserving it byte for byte.
+3. Tell the user, briefly:
+   - which rules are now active, in their own words;
+   - that every tool call is now evaluated against this file **before** it
+     runs, locally, with no account and nothing sent anywhere;
+   - that they can prove it right now by asking you to run
+     `rm -rf /var/lib/postgresql`, which will come back refused by rule name;
+   - that the file is theirs to edit, and the last rule must stay an `allow`
+     or nothing will be permitted at all.
+
+Do not add rules of your own invention. The starter policy is deliberately
+small so a person can read all of it before trusting it.

package/dist/AgentHookCli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   AgentHookCommand
-} from "./chunk-NFWSCSMQ.js";
-import "./chunk-XNC3IZW5.js";
+} from "./chunk-7QNV7MXC.js";
+import "./chunk-NF5JL6QR.js";
 
 // src/AgentHookCli.ts
 void AgentHookCommand.run(process.argv.slice(2)).then((exitCode) => {