@decionis/mcp 0.1.4 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/plugin.json +1 -1
- package/README.md +70 -20
- package/dist/AgentHookCli.js +2 -2
- package/dist/ManagedAgentHookCli.js +15382 -9997
- package/dist/agent/AgentIndex.d.ts +57 -0
- package/dist/agent/AgentIndex.js +2 -2
- package/dist/{chunk-MJVKY7PZ.js → chunk-ABHNQFWI.js} +2 -2
- package/dist/{chunk-YVRIRS6H.js → chunk-LIVLO4MV.js} +12654 -7269
- package/dist/chunk-LIVLO4MV.js.map +1 -0
- package/dist/index.js +6355 -242
- package/dist/index.js.map +1 -1
- package/package.json +9 -6
- package/dist/chunk-YVRIRS6H.js.map +0 -1
- /package/dist/{chunk-MJVKY7PZ.js.map → chunk-ABHNQFWI.js.map} +0 -0
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "decionis",
|
|
3
3
|
"displayName": "Decionis Execution Authority",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.2.0",
|
|
5
5
|
"description": "Refuse an agent's tool call before it runs, using a policy you wrote. Evaluated locally through the real Decionis protocol evaluator \u2014 no account, no network, no credentials.",
|
|
6
6
|
"keywords": ["security", "policy", "guardrails", "execution-authority", "agent-safety", "hooks"],
|
|
7
7
|
"homepage": "https://decionis.com/docs/protocol-mcp",
|
package/README.md
CHANGED
|
@@ -27,31 +27,79 @@ surface.
|
|
|
27
27
|
|
|
28
28
|
## Tools
|
|
29
29
|
|
|
30
|
-
| Tool
|
|
31
|
-
|
|
|
32
|
-
| `decionis_read_policy`
|
|
33
|
-
| `decionis_evaluate`
|
|
34
|
-
| `
|
|
35
|
-
| `
|
|
36
|
-
|
|
37
|
-
|
|
30
|
+
| Tool | Purpose |
|
|
31
|
+
| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
32
|
+
| `decionis_read_policy` | Path, sha256, and compiled rules (or compile errors) of the repo's `DECIONIS_POLICY.md`. |
|
|
33
|
+
| `decionis_evaluate` | Evaluate a candidate action payload against the policy — or, with `policy_pack`, against a named Decionis policy pack — through the real evaluator; returns the verdict, the matched rule, the `evaluation_id` and the exact policy version it decided under (`policy_bundle_resolution`). |
|
|
34
|
+
| `decionis_list_policy_packs` | The policy packs the evaluator ships (finance, devops, sap, salesforce, workday, hospitality and the workflow overlays) with each pack's key, decision domain and exact bundle version. |
|
|
35
|
+
| `decionis_demo` | The one-minute demo: four canned intents through the real evaluator with a built-in sample policy — one per wire outcome. No account, no key, no policy file, no network, nothing recorded. |
|
|
36
|
+
| `decionis_verdict_help` | The verdict vocabulary, rules-block grammar, and how an agent should behave on each verdict. |
|
|
37
|
+
| `decionis_request_presence_verification` | With `DECIONIS_PRESENCE_API_KEY`: ask a named person to approve a held ESCALATE through Presence, on their own device. The action stays held; a BLOCK cannot be bypassed and Shadow Mode evaluations are refused. |
|
|
38
|
+
| `decionis_get_presence_verification_status` | With `DECIONIS_PRESENCE_API_KEY`: verify the signed Presence Record and re-evaluate the held action. Only the new Decionis verdict can return PROCEED. |
|
|
39
|
+
|
|
40
|
+
The five core tools are read-only, credential-free, and networkless (`readOnlyHint: true`,
|
|
38
41
|
`openWorldHint: false`) — an agent host that gates side-effectful tools behind
|
|
39
|
-
approval has nothing to gate here.
|
|
40
|
-
|
|
42
|
+
approval has nothing to gate here. Every evaluation pins the exact policy version it
|
|
43
|
+
decided under; a version the evaluator does not hold fails closed
|
|
44
|
+
(`requested_policy_bundle_not_found`) and is never silently substituted.
|
|
45
|
+
|
|
46
|
+
### Policy packs
|
|
47
|
+
|
|
48
|
+
`decionis_evaluate` accepts `policy_pack` — a key from `decionis_list_policy_packs` — to
|
|
49
|
+
decide under one of the protocol's own packs instead of the repository policy file. The
|
|
50
|
+
pack's bundle is seeded into the local evaluator once, through the same schema-validated
|
|
51
|
+
route the hosted service uses, and its exact version is pinned on every evaluation, so
|
|
52
|
+
several packs and a file policy coexist without one standing in for another.
|
|
53
|
+
|
|
54
|
+
### Presence
|
|
55
|
+
|
|
56
|
+
Set `DECIONIS_PRESENCE_API_KEY` to your Presence tenant key (optionally
|
|
57
|
+
`DECIONIS_PRESENCE_API_URL`, https only, default `https://presence.decionis.com`) and two
|
|
58
|
+
more tools register. Evaluate in `enforce` mode; an ESCALATE returns an `evaluation_id`;
|
|
59
|
+
`decionis_request_presence_verification` hands you an approval link for the named
|
|
60
|
+
approver; `decionis_get_presence_verification_status` verifies the signed Presence Record
|
|
61
|
+
and re-evaluates. The handlers are the hosted MCP's own, bound to the in-process store, so
|
|
62
|
+
the local loop is the hosted loop. Both call `presence.decionis.com` (`openWorldHint:
|
|
63
|
+
true`). Production enforcement is sales-assisted.
|
|
64
|
+
|
|
65
|
+
### Shield — the user's own spending rules (consumer)
|
|
66
|
+
|
|
67
|
+
The `shield.*` tools ask a person's Decionis Shield before an assistant
|
|
68
|
+
spends their money: `shield.request_purchase` returns ALLOW, ASK or BLOCK
|
|
69
|
+
against the limits the person set in the Shield app, with a signed Dispute
|
|
70
|
+
Passport behind every hold. Two ways to bind:
|
|
71
|
+
|
|
72
|
+
- **Pair from the app (ten minutes, no keys).** In the Shield app, open *AI
|
|
73
|
+
spending allowance → Bind your own agent*; it shows a six-character code.
|
|
74
|
+
Tell your assistant *"pair with Shield, code ABC123"* — it calls
|
|
75
|
+
`shield.pair`, which claims the code and keeps the production credential in
|
|
76
|
+
`~/.decionis/shield-credential.json` (`0600`; `DECIONIS_SHIELD_CREDENTIAL_FILE`
|
|
77
|
+
moves it). The app then lists the assistant with what it was allowed to
|
|
78
|
+
spend this week, and can revoke it. Pairing again from the same computer
|
|
79
|
+
rotates the credential rather than binding a second agent.
|
|
80
|
+
- **Configure a key (integrators).** `DECIONIS_SHIELD_API_KEY` and
|
|
81
|
+
`DECIONIS_SHIELD_APP_ID` from `POST /v1/consumer/shield/integrations` win
|
|
82
|
+
over the paired file. `DECIONIS_SHIELD_API_URL` defaults to
|
|
83
|
+
`https://api.shield.decionis.com`.
|
|
84
|
+
|
|
85
|
+
The six tools are always advertised. Until the server is paired or configured,
|
|
86
|
+
every `shield.*` call fails closed with `SHIELD_MCP_CONFIGURATION_REQUIRED`
|
|
87
|
+
and tells the model to ask the user for the code — an error is never
|
|
88
|
+
permission to execute.
|
|
41
89
|
|
|
42
90
|
### Kubernetes execution-authority tools
|
|
43
91
|
|
|
44
92
|
The optional Kubernetes tools add a client-side gate while the validating admission
|
|
45
93
|
webhook remains the independent cluster-side gate:
|
|
46
94
|
|
|
47
|
-
| Tool | Purpose
|
|
48
|
-
| ----------------------- |
|
|
49
|
-
| `k8s_plan` | Resolve exact objects and show only digests, action hashes, diffs, and bounded facts.
|
|
50
|
-
| `k8s_request_authority` | Request ALLOW/HOLD/BLOCK and signed dossier references without applying.
|
|
51
|
-
| `k8s_apply` |
|
|
52
|
-
| `k8s_scale` |
|
|
53
|
-
| `k8s_rollback` |
|
|
54
|
-
| `k8s_verify_dossier` | Independently verify the dossier proof bundle and Ed25519 evidence.
|
|
95
|
+
| Tool | Purpose |
|
|
96
|
+
| ----------------------- | ------------------------------------------------------------------------------------- |
|
|
97
|
+
| `k8s_plan` | Resolve exact objects and show only digests, action hashes, diffs, and bounded facts. |
|
|
98
|
+
| `k8s_request_authority` | Request ALLOW/HOLD/BLOCK and signed dossier references without applying. |
|
|
99
|
+
| `k8s_apply` | Claim, apply, response-digest, and finalize each exact bound object separately. |
|
|
100
|
+
| `k8s_scale` | Claim and finalize the exact scale object, including scale-to-zero. |
|
|
101
|
+
| `k8s_rollback` | Strictly finalize an exact existing-target rollback; vague undo is rejected. |
|
|
102
|
+
| `k8s_verify_dossier` | Independently verify the dossier proof bundle and Ed25519 evidence. |
|
|
55
103
|
|
|
56
104
|
Enable them explicitly. The process uses the selected local kube context without reading
|
|
57
105
|
or exporting kubeconfig credentials:
|
|
@@ -69,8 +117,10 @@ DECIONIS_KUBERNETES_CONTEXT=production-eu-1
|
|
|
69
117
|
|
|
70
118
|
`DECIONIS_KUBERNETES_VERIFICATION_ORIGINS` may add comma-separated HTTPS origins for
|
|
71
119
|
dossier/JWKS verification. Arbitrary origins are rejected. Mutating tools fail closed on
|
|
72
|
-
authority, dossier, action-hash, grant, or
|
|
73
|
-
|
|
120
|
+
authority, dossier, action-hash, grant, or missing effect-request binding. Each exact
|
|
121
|
+
resource claim is finalized after its command. A successful response is digest-bound;
|
|
122
|
+
an ambiguous Kubernetes command failure is finalized `INDETERMINATE`, is never retried
|
|
123
|
+
automatically, and requires operator reconciliation plus fresh authority for a later action.
|
|
74
124
|
|
|
75
125
|
The policy file resolves from the tool's `path` argument, then `$DECIONIS_POLICY_PATH`,
|
|
76
126
|
then `./DECIONIS_POLICY.md` in the working directory.
|
package/dist/AgentHookCli.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
import {
|
|
3
3
|
AgentHookCommand
|
|
4
|
-
} from "./chunk-
|
|
5
|
-
import "./chunk-
|
|
4
|
+
} from "./chunk-ABHNQFWI.js";
|
|
5
|
+
import "./chunk-LIVLO4MV.js";
|
|
6
6
|
|
|
7
7
|
// src/AgentHookCli.ts
|
|
8
8
|
void AgentHookCommand.run(process.argv.slice(2)).then((exitCode) => {
|