@muhaven/mcp 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +66 -2
- package/README.md +125 -125
- package/bin/muhaven-broker.cjs +11 -11
- package/bin/muhaven-mcp.cjs +11 -11
- package/manifest.json +98 -98
- package/package.json +104 -104
package/CHANGELOG.md
CHANGED
|
@@ -7,7 +7,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
-
## [0.1.
|
|
10
|
+
## [0.1.2] — 2026-05-11
|
|
11
|
+
|
|
12
|
+
Re-roll of the `0.1.1` workflow-validation cut. `0.1.1` never reached npm:
|
|
13
|
+
the tag pointed at the version-bump commit but the workflow at that SHA
|
|
14
|
+
lacked two fixes that landed on `agenticwave` after the tag was first cut.
|
|
15
|
+
Bumping to `0.1.2` lets the tag reference the latest `agenticwave` HEAD
|
|
16
|
+
which contains both fixes; subsequent releases follow the normal flow.
|
|
17
|
+
|
|
18
|
+
### Fixed
|
|
19
|
+
|
|
20
|
+
- **NODE_AUTH_TOKEN was overriding the OIDC trusted-publisher exchange in
|
|
21
|
+
`.github/workflows/mcp-publish.yml`** (commit `e373e36`). The
|
|
22
|
+
`actions/setup-node@v4` `registry-url` parameter writes an `.npmrc`
|
|
23
|
+
with `_authToken=${NODE_AUTH_TOKEN}` placeholder; the GitHub Actions
|
|
24
|
+
runner's inherited env had `NODE_AUTH_TOKEN` populated (visible in the
|
|
25
|
+
failing workflow logs as `XXXXX-XXXXX-XXXXX-XXXXX`), so npm tried
|
|
26
|
+
token-based publish first and 404'd because that token has no
|
|
27
|
+
permission on `@muhaven/mcp`. Fix: explicit `env: NODE_AUTH_TOKEN: ''`
|
|
28
|
+
on the publish step forces the `--provenance`-driven OIDC exchange as
|
|
29
|
+
the sole auth method.
|
|
30
|
+
|
|
31
|
+
- **OIDC claims diagnostic step added pre-publish** (commit `e373e36`).
|
|
32
|
+
Prints `github.repository_owner` / `github.repository` /
|
|
33
|
+
`github.workflow_ref` / `github.event_name` / `github.ref` so that any
|
|
34
|
+
future Trusted Publisher binding mismatch can be diff'd
|
|
35
|
+
character-by-character against the npm-side configuration. Surfaced
|
|
36
|
+
the case-sensitivity gotcha around `repository_owner` that `0.1.1`'s
|
|
37
|
+
three failed attempts triggered.
|
|
38
|
+
|
|
39
|
+
### Distribution
|
|
40
|
+
|
|
41
|
+
- Identical bundle bytes to the `0.1.1` artifact except for the embedded
|
|
42
|
+
`0.1.2` version strings in `package.json` + `manifest.json`. No code
|
|
43
|
+
changes to the MCP server or broker daemon. Same `dist/` shape, same
|
|
44
|
+
16 files in the tarball, same `bin/` entry-points.
|
|
45
|
+
|
|
46
|
+
## [0.1.1] — 2026-05-11
|
|
47
|
+
|
|
48
|
+
Workflow-validation cut. `0.1.0` shipped via a one-time manual `npm publish
|
|
49
|
+
--no-provenance` because npm Trusted Publisher could not be configured against
|
|
50
|
+
a non-existent package; this release exercises the `mcp-publish.yml` workflow
|
|
51
|
+
end-to-end on the muhaven.app hosts so subsequent releases carry full Sigstore
|
|
52
|
+
provenance attestations and `npm view dist.signatures` populates.
|
|
53
|
+
|
|
54
|
+
### Fixed
|
|
55
|
+
|
|
56
|
+
- Re-runs the publish path through `.github/workflows/mcp-publish.yml`
|
|
57
|
+
(Workstream D) on the now-configured Trusted Publisher binding for
|
|
58
|
+
`@muhaven/mcp`. Validates the full OIDC → cosign sign → `npm publish
|
|
59
|
+
--provenance` → post-publish shasum verify chain that `0.1.0` skipped.
|
|
60
|
+
- No code change relative to `0.1.0`. Bundle bytes identical except for the
|
|
61
|
+
embedded `0.1.1` version string in `package.json` + `manifest.json`. The
|
|
62
|
+
`0.1.0` "Provenance" badge gap (visible on the npmjs.com sidebar) closes
|
|
63
|
+
with this release.
|
|
64
|
+
|
|
65
|
+
### Distribution
|
|
66
|
+
|
|
67
|
+
- First release where `npm view @muhaven/mcp@0.1.1 dist.signatures` returns a
|
|
68
|
+
populated array, `dist.attestations.url` resolves to a GitHub-hosted
|
|
69
|
+
attestation, and the npmjs.com sidebar shows the "Provenance" badge linked
|
|
70
|
+
to the workflow run.
|
|
71
|
+
|
|
72
|
+
|
|
11
73
|
|
|
12
74
|
First publishable cut. All publish-readiness security must-fixes (H-1 / H-2 /
|
|
13
75
|
H-3 from `MCP_PUBLISH_READINESS.md` §2) and package-hygiene work landed on
|
|
@@ -119,5 +181,7 @@ Workstream H)
|
|
|
119
181
|
muhaven-mcp-0.1.0.tgz
|
|
120
182
|
```
|
|
121
183
|
|
|
122
|
-
[Unreleased]: https://github.com/hasToDev/muhaven/compare/mcp-v0.1.
|
|
184
|
+
[Unreleased]: https://github.com/hasToDev/muhaven/compare/mcp-v0.1.2...HEAD
|
|
185
|
+
[0.1.2]: https://github.com/hasToDev/muhaven/releases/tag/mcp-v0.1.2
|
|
186
|
+
[0.1.1]: https://github.com/hasToDev/muhaven/releases/tag/mcp-v0.1.1
|
|
123
187
|
[0.1.0]: https://github.com/hasToDev/muhaven/releases/tag/mcp-v0.1.0
|
package/README.md
CHANGED
|
@@ -1,125 +1,125 @@
|
|
|
1
|
-
# `@muhaven/mcp` — MCP server for MuHaven RWA portfolios
|
|
2
|
-
|
|
3
|
-
Confidential RWA portfolio management on Fhenix CoFHE, exposed as a Model
|
|
4
|
-
Context Protocol server installable in Claude Desktop / Cursor / Claude Code.
|
|
5
|
-
|
|
6
|
-
## What it does
|
|
7
|
-
|
|
8
|
-
22 tools across five groups (P3 + P7 + P11):
|
|
9
|
-
|
|
10
|
-
| Group | Tools | Description |
|
|
11
|
-
|---|---|---|
|
|
12
|
-
| `muhaven.read.*` | `portfolio` · `yields` · `distribution` · `tokens` · `audit` · `protection_coverage` · `kyc_attestation` | Read your encrypted-balance portfolio, yield history, audit log, and P11 governance/KYC state |
|
|
13
|
-
| `muhaven.position.*` | `buy` · `sell` · `claim` · `rebalance` | **Propose** trades — returns unsigned UserOps + broker signature; never auto-submits |
|
|
14
|
-
| `muhaven.policy.*` | `set_tier` · `pause` · `audit_export` · `session_key_status` | Manage the tiered-autonomy state machine |
|
|
15
|
-
| `muhaven.issuer.*` | `distribute_yield` · `kyc_add` · `kyc_remove` · `unpause_token` · `audit_query` | Issuer-side: distribute yield, manage KYC whitelist, NAV-set+unpause, query own audit trail |
|
|
16
|
-
| `muhaven.governance.*` | `propose` · `cast_vote` | P11 encrypted-governance ceremony (cast-vote frontend runner deferred to Wave 5) |
|
|
17
|
-
|
|
18
|
-
`MUHAVEN_READ_ONLY=true` exposes only the 7 `muhaven.read.*` tools.
|
|
19
|
-
|
|
20
|
-
## Architecture (one paragraph)
|
|
21
|
-
|
|
22
|
-
The MCP server runs as an MCPB STDIO subprocess of the host LLM (Claude
|
|
23
|
-
Desktop, Cursor, Claude Code). It speaks HTTPS to the MuHaven backend at
|
|
24
|
-
`https://api.muhaven.app` and IPC to a long-running sibling daemon
|
|
25
|
-
called `muhaven-broker`. The broker holds two secrets — your ZeroDev
|
|
26
|
-
session-key private half (for signing UserOps) and your scoped JWT (for
|
|
27
|
-
authenticating to the backend) — both in your OS keychain. The broker
|
|
28
|
-
NEVER speaks TCP and NEVER reaches out to the network. It exposes one
|
|
29
|
-
signing primitive over a Unix socket (POSIX) or named pipe (Windows).
|
|
30
|
-
This split — network-facing MCP server / signing-only broker — is the
|
|
31
|
-
**lethal-trifecta** mitigation: an attacker who compromises the LLM
|
|
32
|
-
process cannot exfiltrate your key without also compromising a separate
|
|
33
|
-
process running under your user.
|
|
34
|
-
|
|
35
|
-
The `muhaven-broker login` ceremony uses the OAuth 2.0 Device
|
|
36
|
-
Authorization Grant (RFC 8628) — same shape as `gh auth login --web`,
|
|
37
|
-
`wrangler login`, `gcloud auth login`. You never paste a JWT.
|
|
38
|
-
|
|
39
|
-
## Install (development)
|
|
40
|
-
|
|
41
|
-
```bash
|
|
42
|
-
# In the muhaven monorepo, from repo root
|
|
43
|
-
pnpm install
|
|
44
|
-
pnpm --filter @muhaven/mcp build
|
|
45
|
-
```
|
|
46
|
-
|
|
47
|
-
The `bin/` shims will be invokable as `muhaven-mcp` and `muhaven-broker`
|
|
48
|
-
once the package is linked.
|
|
49
|
-
|
|
50
|
-
## Setup (end-user, post-MCPB-publish)
|
|
51
|
-
|
|
52
|
-
1. **Install the MCPB package** in your host (Claude Desktop / Cursor / Claude Code).
|
|
53
|
-
2. **Provision a session key.** This is the private half the broker holds for signing UserOps. The dashboard-side mint UI is a Wave 5 deliverable — until then, generate one yourself:
|
|
54
|
-
```bash
|
|
55
|
-
node -e "console.log('0x' + require('crypto').randomBytes(32).toString('hex'))"
|
|
56
|
-
```
|
|
57
|
-
The corresponding kernel session key install on-chain runs through the dashboard `/agent/policy/transition` flow (one-time per tier). For read-only smokes you can skip the install — the broker only needs the private half to start.
|
|
58
|
-
3. **Start the broker daemon.** Set `MUHAVEN_BROKER_SESSION_KEY=0x…` and run:
|
|
59
|
-
```bash
|
|
60
|
-
muhaven-broker
|
|
61
|
-
```
|
|
62
|
-
Recipes for systemd / launchd / Windows Service in `docs/runbook.md` (TODO).
|
|
63
|
-
4. **Authenticate via device-code flow:**
|
|
64
|
-
```bash
|
|
65
|
-
muhaven-broker login
|
|
66
|
-
```
|
|
67
|
-
The broker prints a URL like `https://muhaven.app/link?code=ABCD-1234` and (when not run with `--no-launch-browser`) opens it. Sign in with your passkey on the dashboard, verify the device fingerprint shown on the `/link` page, click **Authorize**. The CLI exits with success when the JWT lands in your keystore.
|
|
68
|
-
5. **Use any MCP tool** from your host LLM. First call may take a moment as the broker fetches the JWT from the keystore.
|
|
69
|
-
|
|
70
|
-
> **Windows / WSL2 / devcontainer / SSH-remote operators:** export `MUHAVEN_KEYRING=file` to skip the OS-keychain probe and use the file-backed keystore at `~/.muhaven/jwt` (mode 0600, parent dir mode 0700). The keychain backend depends on `@napi-rs/keyring` which needs platform-specific build prerequisites; the file fallback works everywhere.
|
|
71
|
-
|
|
72
|
-
## Hardening invariants (`THREAT_MODEL_P0.md` aligned)
|
|
73
|
-
|
|
74
|
-
- **Transport is STDIO + Unix-socket only.** The MCP server's `StdioServerTransport` is the only transport mounted; the broker's IPC is a Unix socket on POSIX (parent dir mode `0700`, socket file mode `0600`) or a per-user named pipe on Windows. **Never bind TCP.**
|
|
75
|
-
- **`mcp-remote` is banned.** CVE-2025-6514 disclosed an arbitrary-command-execution path through that proxy. Do not use it; do not set `MUHAVEN_BACKEND_URL` to anything that wraps it.
|
|
76
|
-
- **`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`** is recommended in your shell rc when running Claude Code locally — it prevents inherited env vars from leaking into the MCP subprocess. The MCP package's `MUHAVEN_*` env vars are read at boot, but adopting the scrub habit limits collateral exposure.
|
|
77
|
-
- **Tool descriptions are pinned** at build time in `tool-hashes.json`. The server exits with code 70 (`EX_CONFIG`) on startup if the live descriptors don't match the pinned hashes — defends against tool-description-poisoning patches per the mcp-context-protector pattern (post-MCPoison, March 2026).
|
|
78
|
-
- **Position tools never auto-submit.** They return an unsigned UserOp envelope plus a broker signature. The host LLM is expected to present this to the user for explicit confirmation before bundler submission. The MCP server does not speak to any bundler.
|
|
79
|
-
|
|
80
|
-
## Environment variables
|
|
81
|
-
|
|
82
|
-
| Var | Required | Default | Purpose |
|
|
83
|
-
|---|---|---|---|
|
|
84
|
-
| `MUHAVEN_BACKEND_URL` | no | `https://api.muhaven.app` | Backend host. Use staging URL for development. |
|
|
85
|
-
| `MUHAVEN_DASHBOARD_URL` | no | `https://muhaven.app` | Dashboard origin used for the `/link` URL. |
|
|
86
|
-
| `MUHAVEN_BROKER_ENDPOINT` | no | `~/.muhaven/broker.sock` (POSIX) / `\\.\pipe\muhaven-broker-<user>` (Windows) | IPC path. Set if running multiple isolated brokers. |
|
|
87
|
-
| `MUHAVEN_BROKER_SESSION_KEY` | **yes** (broker) | — | 0x-prefixed 32-byte hex; the session-key private half. |
|
|
88
|
-
| `MUHAVEN_READ_ONLY` | no | `false` | When `true`, only `muhaven.read.*` tools are registered. |
|
|
89
|
-
| `MUHAVEN_KEYRING` | no | auto | Set to `file` to force the file-backed keystore (required on WSL2 / devcontainer / SSH-remote). |
|
|
90
|
-
| `MUHAVEN_REQUEST_TIMEOUT_MS` | no | `15000` | Backend HTTP timeout. |
|
|
91
|
-
| `MUHAVEN_BROKER_TIMEOUT_MS` | no | `5000` | Broker IPC timeout. |
|
|
92
|
-
| `MUHAVEN_JWT_CACHE_TTL_SEC` | no | `30` | In-process JWT cache TTL. |
|
|
93
|
-
| `MUHAVEN_BROKER_MAX_BYTES` | no | `65536` | Per-request payload cap on the broker IPC. |
|
|
94
|
-
|
|
95
|
-
The MCPB `manifest.json` declares the user-facing subset (`backend_url`, `dashboard_url`, `broker_endpoint`, `read_only`); the host's secret manager handles the values.
|
|
96
|
-
|
|
97
|
-
## CLI subcommands (`muhaven-broker`)
|
|
98
|
-
|
|
99
|
-
| Command | Effect |
|
|
100
|
-
|---|---|
|
|
101
|
-
| (none) | Run the daemon (production mode). |
|
|
102
|
-
| `muhaven-broker login [--no-launch-browser]` | Run the device-code ceremony; on success store the JWT in the keystore. |
|
|
103
|
-
| `muhaven-broker logout` | Clear the JWT from the keystore. |
|
|
104
|
-
| `muhaven-broker doctor` | Print environment + keystore + reachability report. |
|
|
105
|
-
|
|
106
|
-
## Threat model in 30 seconds
|
|
107
|
-
|
|
108
|
-
Per `development/DEV_WAVE_4/THREAT_MODEL_P0.md`:
|
|
109
|
-
|
|
110
|
-
| Risk | Control |
|
|
111
|
-
|---|---|
|
|
112
|
-
| **R-1** Prompt injection escalating into a tx | Position tools return *unsigned* UserOps; host MUST present to user for explicit passkey confirmation. |
|
|
113
|
-
| **R-2** Hallucinated tool call | Strict-enum tool registry + `additionalProperties: false` Zod schemas. |
|
|
114
|
-
| **R-3** Replay of confirmation tokens | Single-use server-side nonced tokens via existing P1 confirm-token-service. |
|
|
115
|
-
| **R-6** ZeroDev session-key escape | Session key lives in broker keystore (OS keychain) — never in the LLM-process env. |
|
|
116
|
-
| **R-7** MCP env-block exfiltration | MCPB `sensitive: true` for secrets → OS keychain; broker isolation; no plaintext disk. |
|
|
117
|
-
| **R-8** FHE ACL bypass | Backend enforces every read; MCP server never decrypts FHE handles. |
|
|
118
|
-
|
|
119
|
-
## License
|
|
120
|
-
|
|
121
|
-
MIT
|
|
122
|
-
|
|
123
|
-
## Status: `0.1.0` — first publish-ready cut
|
|
124
|
-
|
|
125
|
-
Wave 4 Phase P3 deliverable per `development/DEV_WAVE_4/PROGRESS.md`. Workstreams A–D of the npm-publish ceremony (security must-fixes, `package.json` hygiene, `LICENSE` + `CHANGELOG`, GitHub Actions workflows) are landed on `agenticwave`; the actual `npm publish` is operator-driven via the tag-push of `mcp-v0.1.0` against the `npm-publish` GitHub Environment (2-reviewer gate · OIDC trusted-publishing · Sigstore provenance). See `development/DEV_WAVE_4/MCP_PUBLISH_READINESS.md` §6 for the operator runbook.
|
|
1
|
+
# `@muhaven/mcp` — MCP server for MuHaven RWA portfolios
|
|
2
|
+
|
|
3
|
+
Confidential RWA portfolio management on Fhenix CoFHE, exposed as a Model
|
|
4
|
+
Context Protocol server installable in Claude Desktop / Cursor / Claude Code.
|
|
5
|
+
|
|
6
|
+
## What it does
|
|
7
|
+
|
|
8
|
+
22 tools across five groups (P3 + P7 + P11):
|
|
9
|
+
|
|
10
|
+
| Group | Tools | Description |
|
|
11
|
+
|---|---|---|
|
|
12
|
+
| `muhaven.read.*` | `portfolio` · `yields` · `distribution` · `tokens` · `audit` · `protection_coverage` · `kyc_attestation` | Read your encrypted-balance portfolio, yield history, audit log, and P11 governance/KYC state |
|
|
13
|
+
| `muhaven.position.*` | `buy` · `sell` · `claim` · `rebalance` | **Propose** trades — returns unsigned UserOps + broker signature; never auto-submits |
|
|
14
|
+
| `muhaven.policy.*` | `set_tier` · `pause` · `audit_export` · `session_key_status` | Manage the tiered-autonomy state machine |
|
|
15
|
+
| `muhaven.issuer.*` | `distribute_yield` · `kyc_add` · `kyc_remove` · `unpause_token` · `audit_query` | Issuer-side: distribute yield, manage KYC whitelist, NAV-set+unpause, query own audit trail |
|
|
16
|
+
| `muhaven.governance.*` | `propose` · `cast_vote` | P11 encrypted-governance ceremony (cast-vote frontend runner deferred to Wave 5) |
|
|
17
|
+
|
|
18
|
+
`MUHAVEN_READ_ONLY=true` exposes only the 7 `muhaven.read.*` tools.
|
|
19
|
+
|
|
20
|
+
## Architecture (one paragraph)
|
|
21
|
+
|
|
22
|
+
The MCP server runs as an MCPB STDIO subprocess of the host LLM (Claude
|
|
23
|
+
Desktop, Cursor, Claude Code). It speaks HTTPS to the MuHaven backend at
|
|
24
|
+
`https://api.muhaven.app` and IPC to a long-running sibling daemon
|
|
25
|
+
called `muhaven-broker`. The broker holds two secrets — your ZeroDev
|
|
26
|
+
session-key private half (for signing UserOps) and your scoped JWT (for
|
|
27
|
+
authenticating to the backend) — both in your OS keychain. The broker
|
|
28
|
+
NEVER speaks TCP and NEVER reaches out to the network. It exposes one
|
|
29
|
+
signing primitive over a Unix socket (POSIX) or named pipe (Windows).
|
|
30
|
+
This split — network-facing MCP server / signing-only broker — is the
|
|
31
|
+
**lethal-trifecta** mitigation: an attacker who compromises the LLM
|
|
32
|
+
process cannot exfiltrate your key without also compromising a separate
|
|
33
|
+
process running under your user.
|
|
34
|
+
|
|
35
|
+
The `muhaven-broker login` ceremony uses the OAuth 2.0 Device
|
|
36
|
+
Authorization Grant (RFC 8628) — same shape as `gh auth login --web`,
|
|
37
|
+
`wrangler login`, `gcloud auth login`. You never paste a JWT.
|
|
38
|
+
|
|
39
|
+
## Install (development)
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
# In the muhaven monorepo, from repo root
|
|
43
|
+
pnpm install
|
|
44
|
+
pnpm --filter @muhaven/mcp build
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
The `bin/` shims will be invokable as `muhaven-mcp` and `muhaven-broker`
|
|
48
|
+
once the package is linked.
|
|
49
|
+
|
|
50
|
+
## Setup (end-user, post-MCPB-publish)
|
|
51
|
+
|
|
52
|
+
1. **Install the MCPB package** in your host (Claude Desktop / Cursor / Claude Code).
|
|
53
|
+
2. **Provision a session key.** This is the private half the broker holds for signing UserOps. The dashboard-side mint UI is a Wave 5 deliverable — until then, generate one yourself:
|
|
54
|
+
```bash
|
|
55
|
+
node -e "console.log('0x' + require('crypto').randomBytes(32).toString('hex'))"
|
|
56
|
+
```
|
|
57
|
+
The corresponding kernel session key install on-chain runs through the dashboard `/agent/policy/transition` flow (one-time per tier). For read-only smokes you can skip the install — the broker only needs the private half to start.
|
|
58
|
+
3. **Start the broker daemon.** Set `MUHAVEN_BROKER_SESSION_KEY=0x…` and run:
|
|
59
|
+
```bash
|
|
60
|
+
muhaven-broker
|
|
61
|
+
```
|
|
62
|
+
Recipes for systemd / launchd / Windows Service in `docs/runbook.md` (TODO).
|
|
63
|
+
4. **Authenticate via device-code flow:**
|
|
64
|
+
```bash
|
|
65
|
+
muhaven-broker login
|
|
66
|
+
```
|
|
67
|
+
The broker prints a URL like `https://muhaven.app/link?code=ABCD-1234` and (when not run with `--no-launch-browser`) opens it. Sign in with your passkey on the dashboard, verify the device fingerprint shown on the `/link` page, click **Authorize**. The CLI exits with success when the JWT lands in your keystore.
|
|
68
|
+
5. **Use any MCP tool** from your host LLM. First call may take a moment as the broker fetches the JWT from the keystore.
|
|
69
|
+
|
|
70
|
+
> **Windows / WSL2 / devcontainer / SSH-remote operators:** export `MUHAVEN_KEYRING=file` to skip the OS-keychain probe and use the file-backed keystore at `~/.muhaven/jwt` (mode 0600, parent dir mode 0700). The keychain backend depends on `@napi-rs/keyring` which needs platform-specific build prerequisites; the file fallback works everywhere.
|
|
71
|
+
|
|
72
|
+
## Hardening invariants (`THREAT_MODEL_P0.md` aligned)
|
|
73
|
+
|
|
74
|
+
- **Transport is STDIO + Unix-socket only.** The MCP server's `StdioServerTransport` is the only transport mounted; the broker's IPC is a Unix socket on POSIX (parent dir mode `0700`, socket file mode `0600`) or a per-user named pipe on Windows. **Never bind TCP.**
|
|
75
|
+
- **`mcp-remote` is banned.** CVE-2025-6514 disclosed an arbitrary-command-execution path through that proxy. Do not use it; do not set `MUHAVEN_BACKEND_URL` to anything that wraps it.
|
|
76
|
+
- **`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`** is recommended in your shell rc when running Claude Code locally — it prevents inherited env vars from leaking into the MCP subprocess. The MCP package's `MUHAVEN_*` env vars are read at boot, but adopting the scrub habit limits collateral exposure.
|
|
77
|
+
- **Tool descriptions are pinned** at build time in `tool-hashes.json`. The server exits with code 70 (`EX_CONFIG`) on startup if the live descriptors don't match the pinned hashes — defends against tool-description-poisoning patches per the mcp-context-protector pattern (post-MCPoison, March 2026).
|
|
78
|
+
- **Position tools never auto-submit.** They return an unsigned UserOp envelope plus a broker signature. The host LLM is expected to present this to the user for explicit confirmation before bundler submission. The MCP server does not speak to any bundler.
|
|
79
|
+
|
|
80
|
+
## Environment variables
|
|
81
|
+
|
|
82
|
+
| Var | Required | Default | Purpose |
|
|
83
|
+
|---|---|---|---|
|
|
84
|
+
| `MUHAVEN_BACKEND_URL` | no | `https://api.muhaven.app` | Backend host. Use staging URL for development. |
|
|
85
|
+
| `MUHAVEN_DASHBOARD_URL` | no | `https://muhaven.app` | Dashboard origin used for the `/link` URL. |
|
|
86
|
+
| `MUHAVEN_BROKER_ENDPOINT` | no | `~/.muhaven/broker.sock` (POSIX) / `\\.\pipe\muhaven-broker-<user>` (Windows) | IPC path. Set if running multiple isolated brokers. |
|
|
87
|
+
| `MUHAVEN_BROKER_SESSION_KEY` | **yes** (broker) | — | 0x-prefixed 32-byte hex; the session-key private half. |
|
|
88
|
+
| `MUHAVEN_READ_ONLY` | no | `false` | When `true`, only `muhaven.read.*` tools are registered. |
|
|
89
|
+
| `MUHAVEN_KEYRING` | no | auto | Set to `file` to force the file-backed keystore (required on WSL2 / devcontainer / SSH-remote). |
|
|
90
|
+
| `MUHAVEN_REQUEST_TIMEOUT_MS` | no | `15000` | Backend HTTP timeout. |
|
|
91
|
+
| `MUHAVEN_BROKER_TIMEOUT_MS` | no | `5000` | Broker IPC timeout. |
|
|
92
|
+
| `MUHAVEN_JWT_CACHE_TTL_SEC` | no | `30` | In-process JWT cache TTL. |
|
|
93
|
+
| `MUHAVEN_BROKER_MAX_BYTES` | no | `65536` | Per-request payload cap on the broker IPC. |
|
|
94
|
+
|
|
95
|
+
The MCPB `manifest.json` declares the user-facing subset (`backend_url`, `dashboard_url`, `broker_endpoint`, `read_only`); the host's secret manager handles the values.
|
|
96
|
+
|
|
97
|
+
## CLI subcommands (`muhaven-broker`)
|
|
98
|
+
|
|
99
|
+
| Command | Effect |
|
|
100
|
+
|---|---|
|
|
101
|
+
| (none) | Run the daemon (production mode). |
|
|
102
|
+
| `muhaven-broker login [--no-launch-browser]` | Run the device-code ceremony; on success store the JWT in the keystore. |
|
|
103
|
+
| `muhaven-broker logout` | Clear the JWT from the keystore. |
|
|
104
|
+
| `muhaven-broker doctor` | Print environment + keystore + reachability report. |
|
|
105
|
+
|
|
106
|
+
## Threat model in 30 seconds
|
|
107
|
+
|
|
108
|
+
Per `development/DEV_WAVE_4/THREAT_MODEL_P0.md`:
|
|
109
|
+
|
|
110
|
+
| Risk | Control |
|
|
111
|
+
|---|---|
|
|
112
|
+
| **R-1** Prompt injection escalating into a tx | Position tools return *unsigned* UserOps; host MUST present to user for explicit passkey confirmation. |
|
|
113
|
+
| **R-2** Hallucinated tool call | Strict-enum tool registry + `additionalProperties: false` Zod schemas. |
|
|
114
|
+
| **R-3** Replay of confirmation tokens | Single-use server-side nonced tokens via existing P1 confirm-token-service. |
|
|
115
|
+
| **R-6** ZeroDev session-key escape | Session key lives in broker keystore (OS keychain) — never in the LLM-process env. |
|
|
116
|
+
| **R-7** MCP env-block exfiltration | MCPB `sensitive: true` for secrets → OS keychain; broker isolation; no plaintext disk. |
|
|
117
|
+
| **R-8** FHE ACL bypass | Backend enforces every read; MCP server never decrypts FHE handles. |
|
|
118
|
+
|
|
119
|
+
## License
|
|
120
|
+
|
|
121
|
+
MIT
|
|
122
|
+
|
|
123
|
+
## Status: `0.1.0` — first publish-ready cut
|
|
124
|
+
|
|
125
|
+
Wave 4 Phase P3 deliverable per `development/DEV_WAVE_4/PROGRESS.md`. Workstreams A–D of the npm-publish ceremony (security must-fixes, `package.json` hygiene, `LICENSE` + `CHANGELOG`, GitHub Actions workflows) are landed on `agenticwave`; the actual `npm publish` is operator-driven via the tag-push of `mcp-v0.1.0` against the `npm-publish` GitHub Environment (2-reviewer gate · OIDC trusted-publishing · Sigstore provenance). See `development/DEV_WAVE_4/MCP_PUBLISH_READINESS.md` §6 for the operator runbook.
|
package/bin/muhaven-broker.cjs
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
/* eslint-disable */
|
|
3
|
-
const { runCli } = require('../dist/broker.cjs');
|
|
4
|
-
|
|
5
|
-
runCli(process.argv.slice(2)).then(
|
|
6
|
-
(code) => process.exit(code ?? 0),
|
|
7
|
-
(err) => {
|
|
8
|
-
process.stderr.write(`fatal: ${err && err.stack ? err.stack : String(err)}\n`);
|
|
9
|
-
process.exit(1);
|
|
10
|
-
},
|
|
11
|
-
);
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
/* eslint-disable */
|
|
3
|
+
const { runCli } = require('../dist/broker.cjs');
|
|
4
|
+
|
|
5
|
+
runCli(process.argv.slice(2)).then(
|
|
6
|
+
(code) => process.exit(code ?? 0),
|
|
7
|
+
(err) => {
|
|
8
|
+
process.stderr.write(`fatal: ${err && err.stack ? err.stack : String(err)}\n`);
|
|
9
|
+
process.exit(1);
|
|
10
|
+
},
|
|
11
|
+
);
|
package/bin/muhaven-mcp.cjs
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
/* eslint-disable */
|
|
3
|
-
const { runMcpStdioCli } = require('../dist/index.cjs');
|
|
4
|
-
|
|
5
|
-
runMcpStdioCli().then(
|
|
6
|
-
() => process.exit(0),
|
|
7
|
-
(err) => {
|
|
8
|
-
process.stderr.write(`fatal: ${err && err.stack ? err.stack : String(err)}\n`);
|
|
9
|
-
process.exit(1);
|
|
10
|
-
},
|
|
11
|
-
);
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
/* eslint-disable */
|
|
3
|
+
const { runMcpStdioCli } = require('../dist/index.cjs');
|
|
4
|
+
|
|
5
|
+
runMcpStdioCli().then(
|
|
6
|
+
() => process.exit(0),
|
|
7
|
+
(err) => {
|
|
8
|
+
process.stderr.write(`fatal: ${err && err.stack ? err.stack : String(err)}\n`);
|
|
9
|
+
process.exit(1);
|
|
10
|
+
},
|
|
11
|
+
);
|
package/manifest.json
CHANGED
|
@@ -1,98 +1,98 @@
|
|
|
1
|
-
{
|
|
2
|
-
"$comment": "MCPB v0.2 manifest for @muhaven/mcp. Per ADR-3 the JWT is acquired via the device-code ceremony and stored in the broker's keystore — it is NOT a user_config entry. Sensitive items declared here are limited to the broker session-key + IPC endpoint overrides.",
|
|
3
|
-
"manifest_version": "0.2",
|
|
4
|
-
"name": "muhaven-mcp",
|
|
5
|
-
"display_name": "MuHaven (RWA portfolio)",
|
|
6
|
-
"version": "0.1.
|
|
7
|
-
"description": "Confidential RWA portfolio management on Fhenix CoFHE. Read your encrypted balances, propose yield claims and policy changes — all signing happens in a sibling broker daemon, the LLM never sees your private key.",
|
|
8
|
-
"long_description": "MuHaven MCP exposes 22 tools across read.* / position.* / policy.* / issuer.* / governance.* groups for managing real-world asset (RWA) tokens with FHE-encrypted balances. Authentication uses a one-time device-code ceremony (run `muhaven-broker login`); subsequent tool calls fetch the JWT from the broker over a Unix socket. Position / governance tools return unsigned UserOps + broker signatures — they NEVER auto-submit to a bundler. The companion `muhaven-broker` daemon must be running before tools can be invoked. See README for setup.",
|
|
9
|
-
"author": {
|
|
10
|
-
"name": "MuHaven",
|
|
11
|
-
"email": "hello@muhaven.app",
|
|
12
|
-
"url": "https://muhaven.app"
|
|
13
|
-
},
|
|
14
|
-
"homepage": "https://muhaven.app",
|
|
15
|
-
"documentation": "https://github.com/hasToDev/muhaven/blob/master/packages/mcp/README.md",
|
|
16
|
-
"support": "https://github.com/hasToDev/muhaven/issues",
|
|
17
|
-
"license": "MIT",
|
|
18
|
-
"keywords": ["fhe", "fhenix", "rwa", "claude", "mcp", "muhaven"],
|
|
19
|
-
"compatibility": {
|
|
20
|
-
"platforms": ["darwin", "win32", "linux"],
|
|
21
|
-
"runtimes": {
|
|
22
|
-
"node": ">=20.0.0"
|
|
23
|
-
}
|
|
24
|
-
},
|
|
25
|
-
"server": {
|
|
26
|
-
"type": "node",
|
|
27
|
-
"entry_point": "dist/index.cjs",
|
|
28
|
-
"mcp_config": {
|
|
29
|
-
"command": "node",
|
|
30
|
-
"args": ["${__dirname}/dist/index.cjs"],
|
|
31
|
-
"env": {
|
|
32
|
-
"MUHAVEN_BACKEND_URL": "${user_config.backend_url}",
|
|
33
|
-
"MUHAVEN_DASHBOARD_URL": "${user_config.dashboard_url}",
|
|
34
|
-
"MUHAVEN_BROKER_ENDPOINT": "${user_config.broker_endpoint}",
|
|
35
|
-
"MUHAVEN_READ_ONLY": "${user_config.read_only}"
|
|
36
|
-
}
|
|
37
|
-
}
|
|
38
|
-
},
|
|
39
|
-
"tools": [
|
|
40
|
-
{ "name": "muhaven.read.portfolio", "description": "Encrypted-balance portfolio summary; aggregates only.", "sensitive": false },
|
|
41
|
-
{ "name": "muhaven.read.yields", "description": "Per-token yield history (cleartext aggregates).", "sensitive": false },
|
|
42
|
-
{ "name": "muhaven.read.distribution", "description": "Distribution status for a (token, epoch).", "sensitive": false },
|
|
43
|
-
{ "name": "muhaven.read.tokens", "description": "RWA tokens the user holds.", "sensitive": false },
|
|
44
|
-
{ "name": "muhaven.read.audit", "description": "User's tiered-autonomy audit log.", "sensitive": false },
|
|
45
|
-
{ "name": "muhaven.position.buy", "description": "Propose a Subscription buy. Returns unsigned UserOp.", "sensitive": true },
|
|
46
|
-
{ "name": "muhaven.position.sell", "description": "Propose a redemption-queue sell. Returns unsigned UserOp.", "sensitive": true },
|
|
47
|
-
{ "name": "muhaven.position.claim", "description": "Propose a yield claim. Returns unsigned UserOp.", "sensitive": true },
|
|
48
|
-
{ "name": "muhaven.position.rebalance", "description": "Propose a multi-leg atomic rebalance.", "sensitive": true },
|
|
49
|
-
{ "name": "muhaven.policy.set_tier", "description": "Request / commit a tiered-autonomy transition.", "sensitive": true },
|
|
50
|
-
{ "name": "muhaven.policy.pause", "description": "Activate /pause kill-switch.", "sensitive": true },
|
|
51
|
-
{ "name": "muhaven.policy.audit_export", "description": "Drain the audit log to JSON.", "sensitive": false },
|
|
52
|
-
{ "name": "muhaven.policy.session_key_status", "description": "Inspect ZeroDev session-key state.", "sensitive": false },
|
|
53
|
-
{ "name": "muhaven.issuer.distribute_yield", "description": "Propose a yield distribution. Issuer-only.", "sensitive": true },
|
|
54
|
-
{ "name": "muhaven.issuer.kyc_add", "description": "Propose adding an investor to the ERC-3643 whitelist. Issuer-only.", "sensitive": true },
|
|
55
|
-
{ "name": "muhaven.issuer.kyc_remove", "description": "Propose removing an investor from the ERC-3643 whitelist. Issuer-only.", "sensitive": true },
|
|
56
|
-
{ "name": "muhaven.issuer.unpause_token", "description": "Propose set-NAV-and-unpause for a freshly-deployed token. Issuer-only.", "sensitive": true },
|
|
57
|
-
{ "name": "muhaven.issuer.audit_query", "description": "Read your own tiered-autonomy audit log (issuer-self).", "sensitive": false },
|
|
58
|
-
{ "name": "muhaven.read.protection_coverage", "description": "Read the on-chain DefaultProtection coverage state for a token (P11).", "sensitive": false },
|
|
59
|
-
{ "name": "muhaven.read.kyc_attestation", "description": "Read the KYC attestation registry status for an investor (P11).", "sensitive": false },
|
|
60
|
-
{ "name": "muhaven.governance.propose", "description": "Propose an EncryptedGovernance vote. Returns unsigned UserOp (P11).", "sensitive": true },
|
|
61
|
-
{ "name": "muhaven.governance.cast_vote", "description": "Cast an encrypted vote on an open proposal. Returns unsigned UserOp (P11; runner deferred to Wave 5).", "sensitive": true }
|
|
62
|
-
],
|
|
63
|
-
"user_config": [
|
|
64
|
-
{
|
|
65
|
-
"key": "backend_url",
|
|
66
|
-
"type": "string",
|
|
67
|
-
"title": "MuHaven backend URL",
|
|
68
|
-
"description": "Backend host. Default: https://api.muhaven.app (production). Use https://api-stage.muhaven.app for staging.",
|
|
69
|
-
"default": "https://api.muhaven.app",
|
|
70
|
-
"sensitive": false
|
|
71
|
-
},
|
|
72
|
-
{
|
|
73
|
-
"key": "dashboard_url",
|
|
74
|
-
"type": "string",
|
|
75
|
-
"title": "MuHaven dashboard URL",
|
|
76
|
-
"description": "Dashboard origin used by the device-code authorization page (/link). Default: https://muhaven.app. Hardcoded for phishing resistance — do not change unless you know what you are doing.",
|
|
77
|
-
"default": "https://muhaven.app",
|
|
78
|
-
"sensitive": false
|
|
79
|
-
},
|
|
80
|
-
{
|
|
81
|
-
"key": "broker_endpoint",
|
|
82
|
-
"type": "string",
|
|
83
|
-
"title": "muhaven-broker IPC endpoint",
|
|
84
|
-
"description": "Path to the broker's Unix socket (POSIX) or named pipe (Windows). Leave blank to use the per-user default.",
|
|
85
|
-
"default": "",
|
|
86
|
-
"sensitive": false
|
|
87
|
-
},
|
|
88
|
-
{
|
|
89
|
-
"key": "read_only",
|
|
90
|
-
"type": "boolean",
|
|
91
|
-
"title": "Read-only mode",
|
|
92
|
-
"description": "When enabled, only the muhaven.read.* toolset is exposed; position.* and policy.* tools are not registered.",
|
|
93
|
-
"default": false,
|
|
94
|
-
"sensitive": false
|
|
95
|
-
}
|
|
96
|
-
],
|
|
97
|
-
"$comment_setup": "First-run instructions: (1) install this package via your MCPB host (Claude Desktop / Cursor / Claude Code). (2) Start the broker daemon: `muhaven-broker` (running in the background; see README for systemd / launchd / Windows-Service recipes). (3) Authenticate: `muhaven-broker login` — opens browser to https://muhaven.app/link?code=XXXX-XXXX, complete passkey ceremony. (4) Use any tool in this MCP package."
|
|
98
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"$comment": "MCPB v0.2 manifest for @muhaven/mcp. Per ADR-3 the JWT is acquired via the device-code ceremony and stored in the broker's keystore — it is NOT a user_config entry. Sensitive items declared here are limited to the broker session-key + IPC endpoint overrides.",
|
|
3
|
+
"manifest_version": "0.2",
|
|
4
|
+
"name": "muhaven-mcp",
|
|
5
|
+
"display_name": "MuHaven (RWA portfolio)",
|
|
6
|
+
"version": "0.1.2",
|
|
7
|
+
"description": "Confidential RWA portfolio management on Fhenix CoFHE. Read your encrypted balances, propose yield claims and policy changes — all signing happens in a sibling broker daemon, the LLM never sees your private key.",
|
|
8
|
+
"long_description": "MuHaven MCP exposes 22 tools across read.* / position.* / policy.* / issuer.* / governance.* groups for managing real-world asset (RWA) tokens with FHE-encrypted balances. Authentication uses a one-time device-code ceremony (run `muhaven-broker login`); subsequent tool calls fetch the JWT from the broker over a Unix socket. Position / governance tools return unsigned UserOps + broker signatures — they NEVER auto-submit to a bundler. The companion `muhaven-broker` daemon must be running before tools can be invoked. See README for setup.",
|
|
9
|
+
"author": {
|
|
10
|
+
"name": "MuHaven",
|
|
11
|
+
"email": "hello@muhaven.app",
|
|
12
|
+
"url": "https://muhaven.app"
|
|
13
|
+
},
|
|
14
|
+
"homepage": "https://muhaven.app",
|
|
15
|
+
"documentation": "https://github.com/hasToDev/muhaven/blob/master/packages/mcp/README.md",
|
|
16
|
+
"support": "https://github.com/hasToDev/muhaven/issues",
|
|
17
|
+
"license": "MIT",
|
|
18
|
+
"keywords": ["fhe", "fhenix", "rwa", "claude", "mcp", "muhaven"],
|
|
19
|
+
"compatibility": {
|
|
20
|
+
"platforms": ["darwin", "win32", "linux"],
|
|
21
|
+
"runtimes": {
|
|
22
|
+
"node": ">=20.0.0"
|
|
23
|
+
}
|
|
24
|
+
},
|
|
25
|
+
"server": {
|
|
26
|
+
"type": "node",
|
|
27
|
+
"entry_point": "dist/index.cjs",
|
|
28
|
+
"mcp_config": {
|
|
29
|
+
"command": "node",
|
|
30
|
+
"args": ["${__dirname}/dist/index.cjs"],
|
|
31
|
+
"env": {
|
|
32
|
+
"MUHAVEN_BACKEND_URL": "${user_config.backend_url}",
|
|
33
|
+
"MUHAVEN_DASHBOARD_URL": "${user_config.dashboard_url}",
|
|
34
|
+
"MUHAVEN_BROKER_ENDPOINT": "${user_config.broker_endpoint}",
|
|
35
|
+
"MUHAVEN_READ_ONLY": "${user_config.read_only}"
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
},
|
|
39
|
+
"tools": [
|
|
40
|
+
{ "name": "muhaven.read.portfolio", "description": "Encrypted-balance portfolio summary; aggregates only.", "sensitive": false },
|
|
41
|
+
{ "name": "muhaven.read.yields", "description": "Per-token yield history (cleartext aggregates).", "sensitive": false },
|
|
42
|
+
{ "name": "muhaven.read.distribution", "description": "Distribution status for a (token, epoch).", "sensitive": false },
|
|
43
|
+
{ "name": "muhaven.read.tokens", "description": "RWA tokens the user holds.", "sensitive": false },
|
|
44
|
+
{ "name": "muhaven.read.audit", "description": "User's tiered-autonomy audit log.", "sensitive": false },
|
|
45
|
+
{ "name": "muhaven.position.buy", "description": "Propose a Subscription buy. Returns unsigned UserOp.", "sensitive": true },
|
|
46
|
+
{ "name": "muhaven.position.sell", "description": "Propose a redemption-queue sell. Returns unsigned UserOp.", "sensitive": true },
|
|
47
|
+
{ "name": "muhaven.position.claim", "description": "Propose a yield claim. Returns unsigned UserOp.", "sensitive": true },
|
|
48
|
+
{ "name": "muhaven.position.rebalance", "description": "Propose a multi-leg atomic rebalance.", "sensitive": true },
|
|
49
|
+
{ "name": "muhaven.policy.set_tier", "description": "Request / commit a tiered-autonomy transition.", "sensitive": true },
|
|
50
|
+
{ "name": "muhaven.policy.pause", "description": "Activate /pause kill-switch.", "sensitive": true },
|
|
51
|
+
{ "name": "muhaven.policy.audit_export", "description": "Drain the audit log to JSON.", "sensitive": false },
|
|
52
|
+
{ "name": "muhaven.policy.session_key_status", "description": "Inspect ZeroDev session-key state.", "sensitive": false },
|
|
53
|
+
{ "name": "muhaven.issuer.distribute_yield", "description": "Propose a yield distribution. Issuer-only.", "sensitive": true },
|
|
54
|
+
{ "name": "muhaven.issuer.kyc_add", "description": "Propose adding an investor to the ERC-3643 whitelist. Issuer-only.", "sensitive": true },
|
|
55
|
+
{ "name": "muhaven.issuer.kyc_remove", "description": "Propose removing an investor from the ERC-3643 whitelist. Issuer-only.", "sensitive": true },
|
|
56
|
+
{ "name": "muhaven.issuer.unpause_token", "description": "Propose set-NAV-and-unpause for a freshly-deployed token. Issuer-only.", "sensitive": true },
|
|
57
|
+
{ "name": "muhaven.issuer.audit_query", "description": "Read your own tiered-autonomy audit log (issuer-self).", "sensitive": false },
|
|
58
|
+
{ "name": "muhaven.read.protection_coverage", "description": "Read the on-chain DefaultProtection coverage state for a token (P11).", "sensitive": false },
|
|
59
|
+
{ "name": "muhaven.read.kyc_attestation", "description": "Read the KYC attestation registry status for an investor (P11).", "sensitive": false },
|
|
60
|
+
{ "name": "muhaven.governance.propose", "description": "Propose an EncryptedGovernance vote. Returns unsigned UserOp (P11).", "sensitive": true },
|
|
61
|
+
{ "name": "muhaven.governance.cast_vote", "description": "Cast an encrypted vote on an open proposal. Returns unsigned UserOp (P11; runner deferred to Wave 5).", "sensitive": true }
|
|
62
|
+
],
|
|
63
|
+
"user_config": [
|
|
64
|
+
{
|
|
65
|
+
"key": "backend_url",
|
|
66
|
+
"type": "string",
|
|
67
|
+
"title": "MuHaven backend URL",
|
|
68
|
+
"description": "Backend host. Default: https://api.muhaven.app (production). Use https://api-stage.muhaven.app for staging.",
|
|
69
|
+
"default": "https://api.muhaven.app",
|
|
70
|
+
"sensitive": false
|
|
71
|
+
},
|
|
72
|
+
{
|
|
73
|
+
"key": "dashboard_url",
|
|
74
|
+
"type": "string",
|
|
75
|
+
"title": "MuHaven dashboard URL",
|
|
76
|
+
"description": "Dashboard origin used by the device-code authorization page (/link). Default: https://muhaven.app. Hardcoded for phishing resistance — do not change unless you know what you are doing.",
|
|
77
|
+
"default": "https://muhaven.app",
|
|
78
|
+
"sensitive": false
|
|
79
|
+
},
|
|
80
|
+
{
|
|
81
|
+
"key": "broker_endpoint",
|
|
82
|
+
"type": "string",
|
|
83
|
+
"title": "muhaven-broker IPC endpoint",
|
|
84
|
+
"description": "Path to the broker's Unix socket (POSIX) or named pipe (Windows). Leave blank to use the per-user default.",
|
|
85
|
+
"default": "",
|
|
86
|
+
"sensitive": false
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"key": "read_only",
|
|
90
|
+
"type": "boolean",
|
|
91
|
+
"title": "Read-only mode",
|
|
92
|
+
"description": "When enabled, only the muhaven.read.* toolset is exposed; position.* and policy.* tools are not registered.",
|
|
93
|
+
"default": false,
|
|
94
|
+
"sensitive": false
|
|
95
|
+
}
|
|
96
|
+
],
|
|
97
|
+
"$comment_setup": "First-run instructions: (1) install this package via your MCPB host (Claude Desktop / Cursor / Claude Code). (2) Start the broker daemon: `muhaven-broker` (running in the background; see README for systemd / launchd / Windows-Service recipes). (3) Authenticate: `muhaven-broker login` — opens browser to https://muhaven.app/link?code=XXXX-XXXX, complete passkey ceremony. (4) Use any tool in this MCP package."
|
|
98
|
+
}
|
package/package.json
CHANGED
|
@@ -1,104 +1,104 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@muhaven/mcp",
|
|
3
|
-
"version": "0.1.
|
|
4
|
-
"description": "MuHaven MCP server — read/position/policy toolsets bridging Claude Desktop / Cursor / Claude Code to the MuHaven backend, with a sibling muhaven-broker daemon holding the session-key private half over a local IPC socket",
|
|
5
|
-
"type": "module",
|
|
6
|
-
"repository": {
|
|
7
|
-
"type": "git",
|
|
8
|
-
"url": "git+https://github.com/hasToDev/muhaven.git",
|
|
9
|
-
"directory": "packages/mcp"
|
|
10
|
-
},
|
|
11
|
-
"bugs": {
|
|
12
|
-
"url": "https://github.com/hasToDev/muhaven/issues"
|
|
13
|
-
},
|
|
14
|
-
"homepage": "https://github.com/hasToDev/muhaven/tree/master/packages/mcp",
|
|
15
|
-
"publishConfig": {
|
|
16
|
-
"access": "public",
|
|
17
|
-
"registry": "https://registry.npmjs.org/",
|
|
18
|
-
"provenance": true
|
|
19
|
-
},
|
|
20
|
-
"sideEffects": false,
|
|
21
|
-
"main": "./dist/index.cjs",
|
|
22
|
-
"module": "./dist/index.js",
|
|
23
|
-
"types": "./dist/index.d.ts",
|
|
24
|
-
"exports": {
|
|
25
|
-
".": {
|
|
26
|
-
"import": {
|
|
27
|
-
"types": "./dist/index.d.ts",
|
|
28
|
-
"default": "./dist/index.js"
|
|
29
|
-
},
|
|
30
|
-
"require": {
|
|
31
|
-
"types": "./dist/index.d.cts",
|
|
32
|
-
"default": "./dist/index.cjs"
|
|
33
|
-
}
|
|
34
|
-
},
|
|
35
|
-
"./broker": {
|
|
36
|
-
"import": {
|
|
37
|
-
"types": "./dist/broker.d.ts",
|
|
38
|
-
"default": "./dist/broker.js"
|
|
39
|
-
},
|
|
40
|
-
"require": {
|
|
41
|
-
"types": "./dist/broker.d.cts",
|
|
42
|
-
"default": "./dist/broker.cjs"
|
|
43
|
-
}
|
|
44
|
-
},
|
|
45
|
-
"./package.json": "./package.json"
|
|
46
|
-
},
|
|
47
|
-
"bin": {
|
|
48
|
-
"muhaven-mcp": "./bin/muhaven-mcp.cjs",
|
|
49
|
-
"muhaven-broker": "./bin/muhaven-broker.cjs"
|
|
50
|
-
},
|
|
51
|
-
"files": [
|
|
52
|
-
"dist",
|
|
53
|
-
"bin",
|
|
54
|
-
"manifest.json",
|
|
55
|
-
"tool-hashes.json",
|
|
56
|
-
"README.md",
|
|
57
|
-
"CHANGELOG.md",
|
|
58
|
-
"LICENSE"
|
|
59
|
-
],
|
|
60
|
-
"scripts": {
|
|
61
|
-
"build": "tsup",
|
|
62
|
-
"dev": "MUHAVEN_DEV_BUILD=1 tsup --watch",
|
|
63
|
-
"clean": "rimraf dist",
|
|
64
|
-
"typecheck": "tsc --noEmit",
|
|
65
|
-
"test": "vitest run",
|
|
66
|
-
"test:watch": "vitest",
|
|
67
|
-
"verify-tool-hashes": "tsx scripts/verify-tool-hashes.ts",
|
|
68
|
-
"prepublishOnly": "pnpm clean && pnpm build && pnpm typecheck && pnpm test && pnpm verify-tool-hashes -- --check"
|
|
69
|
-
},
|
|
70
|
-
"dependencies": {
|
|
71
|
-
"@modelcontextprotocol/sdk": "^1.0.4",
|
|
72
|
-
"viem": "^2.47.0",
|
|
73
|
-
"zod": "^3.24.0"
|
|
74
|
-
},
|
|
75
|
-
"optionalDependencies": {
|
|
76
|
-
"@napi-rs/keyring": "^1.1.0"
|
|
77
|
-
},
|
|
78
|
-
"devDependencies": {
|
|
79
|
-
"@types/node": "^22.0.0",
|
|
80
|
-
"rimraf": "^5.0.0",
|
|
81
|
-
"tsup": "^8.5.1",
|
|
82
|
-
"tsx": "^4.21.0",
|
|
83
|
-
"typescript": "^5.7.0",
|
|
84
|
-
"vitest": "^3.0.0"
|
|
85
|
-
},
|
|
86
|
-
"engines": {
|
|
87
|
-
"node": ">=20.0.0",
|
|
88
|
-
"pnpm": ">=9.0.0"
|
|
89
|
-
},
|
|
90
|
-
"keywords": [
|
|
91
|
-
"mcp",
|
|
92
|
-
"model-context-protocol",
|
|
93
|
-
"mcpb",
|
|
94
|
-
"fhe",
|
|
95
|
-
"fhenix",
|
|
96
|
-
"muhaven",
|
|
97
|
-
"rwa",
|
|
98
|
-
"claude",
|
|
99
|
-
"agentic",
|
|
100
|
-
"web3",
|
|
101
|
-
"erc-3643"
|
|
102
|
-
],
|
|
103
|
-
"license": "MIT"
|
|
104
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@muhaven/mcp",
|
|
3
|
+
"version": "0.1.2",
|
|
4
|
+
"description": "MuHaven MCP server — read/position/policy toolsets bridging Claude Desktop / Cursor / Claude Code to the MuHaven backend, with a sibling muhaven-broker daemon holding the session-key private half over a local IPC socket",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"repository": {
|
|
7
|
+
"type": "git",
|
|
8
|
+
"url": "git+https://github.com/hasToDev/muhaven.git",
|
|
9
|
+
"directory": "packages/mcp"
|
|
10
|
+
},
|
|
11
|
+
"bugs": {
|
|
12
|
+
"url": "https://github.com/hasToDev/muhaven/issues"
|
|
13
|
+
},
|
|
14
|
+
"homepage": "https://github.com/hasToDev/muhaven/tree/master/packages/mcp",
|
|
15
|
+
"publishConfig": {
|
|
16
|
+
"access": "public",
|
|
17
|
+
"registry": "https://registry.npmjs.org/",
|
|
18
|
+
"provenance": true
|
|
19
|
+
},
|
|
20
|
+
"sideEffects": false,
|
|
21
|
+
"main": "./dist/index.cjs",
|
|
22
|
+
"module": "./dist/index.js",
|
|
23
|
+
"types": "./dist/index.d.ts",
|
|
24
|
+
"exports": {
|
|
25
|
+
".": {
|
|
26
|
+
"import": {
|
|
27
|
+
"types": "./dist/index.d.ts",
|
|
28
|
+
"default": "./dist/index.js"
|
|
29
|
+
},
|
|
30
|
+
"require": {
|
|
31
|
+
"types": "./dist/index.d.cts",
|
|
32
|
+
"default": "./dist/index.cjs"
|
|
33
|
+
}
|
|
34
|
+
},
|
|
35
|
+
"./broker": {
|
|
36
|
+
"import": {
|
|
37
|
+
"types": "./dist/broker.d.ts",
|
|
38
|
+
"default": "./dist/broker.js"
|
|
39
|
+
},
|
|
40
|
+
"require": {
|
|
41
|
+
"types": "./dist/broker.d.cts",
|
|
42
|
+
"default": "./dist/broker.cjs"
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"./package.json": "./package.json"
|
|
46
|
+
},
|
|
47
|
+
"bin": {
|
|
48
|
+
"muhaven-mcp": "./bin/muhaven-mcp.cjs",
|
|
49
|
+
"muhaven-broker": "./bin/muhaven-broker.cjs"
|
|
50
|
+
},
|
|
51
|
+
"files": [
|
|
52
|
+
"dist",
|
|
53
|
+
"bin",
|
|
54
|
+
"manifest.json",
|
|
55
|
+
"tool-hashes.json",
|
|
56
|
+
"README.md",
|
|
57
|
+
"CHANGELOG.md",
|
|
58
|
+
"LICENSE"
|
|
59
|
+
],
|
|
60
|
+
"scripts": {
|
|
61
|
+
"build": "tsup",
|
|
62
|
+
"dev": "MUHAVEN_DEV_BUILD=1 tsup --watch",
|
|
63
|
+
"clean": "rimraf dist",
|
|
64
|
+
"typecheck": "tsc --noEmit",
|
|
65
|
+
"test": "vitest run",
|
|
66
|
+
"test:watch": "vitest",
|
|
67
|
+
"verify-tool-hashes": "tsx scripts/verify-tool-hashes.ts",
|
|
68
|
+
"prepublishOnly": "pnpm clean && pnpm build && pnpm typecheck && pnpm test && pnpm verify-tool-hashes -- --check"
|
|
69
|
+
},
|
|
70
|
+
"dependencies": {
|
|
71
|
+
"@modelcontextprotocol/sdk": "^1.0.4",
|
|
72
|
+
"viem": "^2.47.0",
|
|
73
|
+
"zod": "^3.24.0"
|
|
74
|
+
},
|
|
75
|
+
"optionalDependencies": {
|
|
76
|
+
"@napi-rs/keyring": "^1.1.0"
|
|
77
|
+
},
|
|
78
|
+
"devDependencies": {
|
|
79
|
+
"@types/node": "^22.0.0",
|
|
80
|
+
"rimraf": "^5.0.0",
|
|
81
|
+
"tsup": "^8.5.1",
|
|
82
|
+
"tsx": "^4.21.0",
|
|
83
|
+
"typescript": "^5.7.0",
|
|
84
|
+
"vitest": "^3.0.0"
|
|
85
|
+
},
|
|
86
|
+
"engines": {
|
|
87
|
+
"node": ">=20.0.0",
|
|
88
|
+
"pnpm": ">=9.0.0"
|
|
89
|
+
},
|
|
90
|
+
"keywords": [
|
|
91
|
+
"mcp",
|
|
92
|
+
"model-context-protocol",
|
|
93
|
+
"mcpb",
|
|
94
|
+
"fhe",
|
|
95
|
+
"fhenix",
|
|
96
|
+
"muhaven",
|
|
97
|
+
"rwa",
|
|
98
|
+
"claude",
|
|
99
|
+
"agentic",
|
|
100
|
+
"web3",
|
|
101
|
+
"erc-3643"
|
|
102
|
+
],
|
|
103
|
+
"license": "MIT"
|
|
104
|
+
}
|