@primitivehub/mcp-server 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +47 -27
- package/README.md +43 -5
- package/dist/tools/verify-before-load.d.ts.map +1 -1
- package/dist/tools/verify-before-load.js +14 -2
- package/dist/tools/verify-before-load.js.map +1 -1
- package/dist/tools/verify-bundle.d.ts.map +1 -1
- package/dist/tools/verify-bundle.js +17 -2
- package/dist/tools/verify-bundle.js.map +1 -1
- package/package.json +16 -15
package/CHANGELOG.md
CHANGED
|
@@ -6,7 +6,41 @@ Version tracks Trust Contract spec version (for `verify_bundle`) and
|
|
|
6
6
|
Context CI Top 10 version (for `scan_text` / `audit_workspace`);
|
|
7
7
|
`0.1.x` of this package is conformant to both v0.1.
|
|
8
8
|
|
|
9
|
-
## [
|
|
9
|
+
## [0.1.2] — 2026-10-05
|
|
10
|
+
|
|
11
|
+
**Security (Critical) — forged Trust Bundle, reported 2026-09-30.** Fail
|
|
12
|
+
closed on unauthenticated bundles. Depends on `@primitivehub/phub@^0.1.2`
|
|
13
|
+
and `@primitivehub/verify@^0.1.1`.
|
|
14
|
+
|
|
15
|
+
### Security
|
|
16
|
+
- `verify_bundle` → `isError:true` + `authenticated:false` +
|
|
17
|
+
`trust:"INSPECTED_NOT_AUTHENTICATED"` for any bundle that isn't
|
|
18
|
+
cryptographically authenticated (every bundle, in v0.1).
|
|
19
|
+
- `verify_before_load` → a supplied, unauthenticated bundle now **BLOCKS**
|
|
20
|
+
(`BUNDLE_UNAUTHENTICATED`); it can never make a load `safe`.
|
|
21
|
+
- Supersedes `@primitivehub/mcp-server@0.1.0`, **deprecated**.
|
|
22
|
+
|
|
23
|
+
## [0.1.1] — 2026-10-04
|
|
24
|
+
|
|
25
|
+
Tracks `@primitivehub/phub@0.1.1`. No tool code changed — `verify_before_load`
|
|
26
|
+
shipped in 0.1.0 and remains a pure transport (ADR-0031).
|
|
27
|
+
|
|
28
|
+
### Changed
|
|
29
|
+
- **`verify_before_load` now reports a `tier` on every reason** — `block`
|
|
30
|
+
(tamper / drift / live scanner finding / demanded-but-absent
|
|
31
|
+
attestation) vs `posture` (unsealed). Inherited automatically from
|
|
32
|
+
`verifyBeforeLoad` in `@primitivehub/phub`; agents can branch on the
|
|
33
|
+
low-FP signal, not just the `safe` boolean. Requires
|
|
34
|
+
`@primitivehub/phub@^0.1.1`.
|
|
35
|
+
- **README** now documents the shipped `verify_before_load` tool (it was
|
|
36
|
+
still marked "planned") and fixes its ADR-0029 link.
|
|
37
|
+
|
|
38
|
+
## [0.1.0] — 2026-07-21
|
|
39
|
+
|
|
40
|
+
The v0.1 launch release — a pure transport layer over `@primitivehub/verify`
|
|
41
|
+
and `@primitivehub/phub` (ADR-0031). Five tools; published to npm at launch
|
|
42
|
+
([ADR-0045](../../docs/decisions/0045-product-first-public-launch-and-distribution-repo.md),
|
|
43
|
+
product-first).
|
|
10
44
|
|
|
11
45
|
### Added (PR 5.7.5 — MCP runtime gate, ADR-0029)
|
|
12
46
|
- **`verify_before_load`** tool — the composite runtime gate. Combines
|
|
@@ -24,15 +58,7 @@ Context CI Top 10 version (for `scan_text` / `audit_workspace`);
|
|
|
24
58
|
`verifyBeforeLoad`) per ADR-0031 § 2 rule #1. The MCP wrapper is
|
|
25
59
|
pure transport.
|
|
26
60
|
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
**Not yet published to npm.** Per
|
|
30
|
-
[ADR-0022](../../docs/decisions/0022-publishing-deferred-to-launch.md)
|
|
31
|
-
publishing is gated to the project launch event. The server is fully
|
|
32
|
-
functional inside the monorepo today; `npx @primitivehub/mcp-server`
|
|
33
|
-
is a launch-day capability.
|
|
34
|
-
|
|
35
|
-
### Added — initial Gate G-D release
|
|
61
|
+
### Added — initial Gate G-D release (2026-06-02)
|
|
36
62
|
|
|
37
63
|
Per [ADR-0031](../../docs/decisions/0031-mcp-server-as-transport.md)
|
|
38
64
|
the v0.1 server is a pure transport layer over existing primitives.
|
|
@@ -42,9 +68,9 @@ Zero custom trust logic; every tool delegates.
|
|
|
42
68
|
Accepts a Trust Bundle as a JSON string OR a pre-parsed object.
|
|
43
69
|
Levels: `structural` / `policy` / `full` (steps 3-6 stubbed per
|
|
44
70
|
verify v0.1).
|
|
45
|
-
- **`scan_text`** — runs the
|
|
46
|
-
arbitrary text. Wraps phub's `runScan`. Honors
|
|
47
|
-
`--strict` / `--allow-fail` / `--detector`.
|
|
71
|
+
- **`scan_text`** — runs the full Context CI Top 10 detector roster
|
|
72
|
+
(CCI-001…010) over arbitrary text. Wraps phub's `runScan`. Honors
|
|
73
|
+
`--policy` / `--strict` / `--allow-fail` / `--detector`.
|
|
48
74
|
- **`audit_workspace`** — active-surface tool. Walks + classifies +
|
|
49
75
|
scans every agent-context artifact under a root path. Wraps phub's
|
|
50
76
|
`runAudit`. Output includes per-artifact verdicts + project
|
|
@@ -58,33 +84,27 @@ Zero custom trust logic; every tool delegates.
|
|
|
58
84
|
- **Programmatic API** — `buildServer()`, `runStdio()`, individual
|
|
59
85
|
tool callables for in-process / SSE / HTTP transports.
|
|
60
86
|
- **Worked examples** (`examples/`) — Claude Code, Cursor, Aider
|
|
61
|
-
config snippets verified to register the server with
|
|
87
|
+
config snippets verified to register the server with its five
|
|
62
88
|
visible tools.
|
|
63
89
|
|
|
64
90
|
### Runtime deps
|
|
65
91
|
|
|
66
92
|
- `@modelcontextprotocol/sdk` `^1.0.0` — the official MCP SDK; not
|
|
67
93
|
hand-rolled (justified in ADR-0031 § "Alternatives").
|
|
68
|
-
- `@primitivehub/verify` `^0.1.0
|
|
69
|
-
- `@primitivehub/phub` `^0.1.0
|
|
94
|
+
- `@primitivehub/verify` `^0.1.0`.
|
|
95
|
+
- `@primitivehub/phub` `^0.1.0`.
|
|
70
96
|
|
|
71
97
|
### Tests
|
|
72
98
|
- `test/tools.test.ts` — 16 cases, in-process tool wrappers.
|
|
73
99
|
- `test/server.test.ts` — 6 cases, JSON-RPC via `InMemoryTransport`.
|
|
74
|
-
-
|
|
100
|
+
- `test/verify-before-load.test.ts` — 10 cases, the composite runtime gate.
|
|
101
|
+
- 32/32 passing.
|
|
75
102
|
|
|
76
103
|
### Forward-looking (next PRs, not in this release)
|
|
77
104
|
|
|
78
|
-
- **MCP runtime gate** (planned [ADR-0029](../../docs/decisions/0026-phub-lock-format-and-drift-detection.md))
|
|
79
|
-
— `verify_before_load` composite tool that combines `check_lock`
|
|
80
|
-
+ `verify_bundle` and is consulted by agents at primitive-read
|
|
81
|
-
time. Refuses-by-default for unattested content.
|
|
82
105
|
- **SSE / HTTP transports** — for browser-based agents that can't
|
|
83
106
|
spawn stdio child processes.
|
|
84
|
-
- **Tool surface additions as
|
|
85
|
-
inherits verify v0.2 (signature/cert/Rekor)
|
|
86
|
-
`audit_workspace` inherit new detector classes via phub's
|
|
87
|
-
detector registry.
|
|
107
|
+
- **Tool surface additions as verify matures** — `verify_bundle`
|
|
108
|
+
inherits verify v0.2 (signature / cert / Rekor) when those steps land.
|
|
88
109
|
|
|
89
|
-
[
|
|
90
|
-
[0.1.0]: https://github.com/PrimitiveHub-AI/context-ci/releases/tag/mcp-server-v0.1.0
|
|
110
|
+
[0.1.0]: https://github.com/DevXYZx/primitivehub/releases/tag/mcp-server-v0.1.0
|
package/README.md
CHANGED
|
@@ -12,6 +12,9 @@ Gate G-D acceptance + [ADR-0031](../../docs/decisions/0031-mcp-server-as-transpo
|
|
|
12
12
|
|
|
13
13
|
Lets an AI agent ask, mid-task:
|
|
14
14
|
|
|
15
|
+
- **"Is this file safe to load right now?" → `verify_before_load`** —
|
|
16
|
+
the inline Context Firewall; the composite gate the agent calls before
|
|
17
|
+
reading any agent-context artifact
|
|
15
18
|
- "Is this Trust Bundle valid?" → `verify_bundle`
|
|
16
19
|
- "Does this text trip Context CI Top 10?" → `scan_text`
|
|
17
20
|
- "What context primitives are in this workspace, and which are
|
|
@@ -86,7 +89,7 @@ mcp-servers:
|
|
|
86
89
|
args: ["@primitivehub/mcp-server"]
|
|
87
90
|
```
|
|
88
91
|
|
|
89
|
-
See [`examples/`](./examples/) for
|
|
92
|
+
See [`examples/`](./examples/) for complete host configurations.
|
|
90
93
|
|
|
91
94
|
## Tools
|
|
92
95
|
|
|
@@ -154,6 +157,38 @@ and reports drift (added / modified / removed / reclassified).
|
|
|
154
157
|
| `max_files` | number | no | `10000` |
|
|
155
158
|
| `max_depth` | number | no | `16` |
|
|
156
159
|
|
|
160
|
+
### `verify_before_load`
|
|
161
|
+
|
|
162
|
+
**The inline Context Firewall.** Call this BEFORE loading any
|
|
163
|
+
agent-context primitive — it refuses-by-default per
|
|
164
|
+
[ADR-0029](../../docs/decisions/0029-mcp-runtime-gate.md). The composite
|
|
165
|
+
of `check_lock` + `scan_text` + (optional) `verify_bundle`, folded into
|
|
166
|
+
one verdict: `{ safe, reasons[], checks }`, with `isError: true`
|
|
167
|
+
whenever `safe` is false. Each reason carries a `tier` — `block`
|
|
168
|
+
(tamper / drift / live scanner finding / demanded-but-absent
|
|
169
|
+
attestation) or `posture` (simply unsealed) — so an agent can branch on
|
|
170
|
+
the low-FP signal, not just the boolean. Same engine as the `phub
|
|
171
|
+
verify-before-load` CLI command and the `phub-scan` action's `mode:
|
|
172
|
+
gate`.
|
|
173
|
+
|
|
174
|
+
**Arguments:**
|
|
175
|
+
|
|
176
|
+
| Field | Type | Required | Default |
|
|
177
|
+
|---|---|---|---|
|
|
178
|
+
| `path` | string | **yes** | — |
|
|
179
|
+
| `workspace_root` | string | no | `process.cwd()` |
|
|
180
|
+
| `policy_path` | string | no | auto-discover |
|
|
181
|
+
| `lock_path` | string | no | auto-discover |
|
|
182
|
+
| `require_attestation` | boolean | no | `false` |
|
|
183
|
+
| `bundle` | string \| object | no | — |
|
|
184
|
+
| `level` | `structural` \| `policy` \| `full` | no | `policy` |
|
|
185
|
+
|
|
186
|
+
Reason codes are stable across patch releases — agents branch on
|
|
187
|
+
`code`: `LOCK_MISSING`, `LOCK_SPEC_VERSION_MISMATCH`, `PATH_NOT_FOUND`,
|
|
188
|
+
`PATH_UNCLASSIFIED`, `PATH_NOT_IN_LOCK`, `PATH_DIGEST_MISMATCH`,
|
|
189
|
+
`PATH_UNATTESTED`, `PATH_FLAGGED_BY_SCANNER` (plus `BUNDLE_*` when a
|
|
190
|
+
Trust Bundle is supplied).
|
|
191
|
+
|
|
157
192
|
## Design discipline
|
|
158
193
|
|
|
159
194
|
Per [ADR-0031](../../docs/decisions/0031-mcp-server-as-transport.md)
|
|
@@ -170,10 +205,13 @@ this package is a transport layer with three load-bearing rules:
|
|
|
170
205
|
does not cache, queue, or remember invocations. The agent's
|
|
171
206
|
conversation is the only state that matters.
|
|
172
207
|
|
|
173
|
-
The MCP runtime gate `verify_before_load`
|
|
174
|
-
is a
|
|
175
|
-
|
|
176
|
-
|
|
208
|
+
The MCP runtime gate `verify_before_load`
|
|
209
|
+
([ADR-0029](../../docs/decisions/0029-mcp-runtime-gate.md)) is a
|
|
210
|
+
composite of `check_lock` + `scan_text` + (optional) `verify_bundle`
|
|
211
|
+
applied at the agent's read time. It ships in this package (see the
|
|
212
|
+
tool section above) and holds the same transport discipline: zero
|
|
213
|
+
custom trust logic — the verdict is `verifyBeforeLoad` from
|
|
214
|
+
`@primitivehub/phub` plus `verifyBundle` from `@primitivehub/verify`.
|
|
177
215
|
|
|
178
216
|
## Programmatic embedding
|
|
179
217
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-before-load.d.ts","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;
|
|
1
|
+
{"version":3,"file":"verify-before-load.d.ts","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAWH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C1B,CAAA;AAYV,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsGtE"}
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
* verify; this file inherits the new behavior with zero edits.
|
|
21
21
|
*/
|
|
22
22
|
import { verifyBundle } from "@primitivehub/verify";
|
|
23
|
-
import { verifyBeforeLoad } from "@primitivehub/phub";
|
|
23
|
+
import { verifyBeforeLoad, isBundleAuthenticated, unauthenticatedBundleMessage, UNAUTHENTICATED_BUNDLE_CODE, } from "@primitivehub/phub";
|
|
24
24
|
export const VERIFY_BEFORE_LOAD_TOOL = {
|
|
25
25
|
name: "verify_before_load",
|
|
26
26
|
description: "Composite runtime gate. Call this BEFORE loading any agent-context primitive — refuses-by-default for drift, unattested artifacts, scanner findings, or invalid Trust Bundles. Returns {safe, reasons[], checks}. The composite of check_lock + scan_text + (optional) verify_bundle.",
|
|
@@ -118,16 +118,28 @@ export async function callVerifyBeforeLoad(rawArgs) {
|
|
|
118
118
|
}
|
|
119
119
|
if (parsedBundle !== undefined) {
|
|
120
120
|
const verifyResult = await verifyBundle(parsedBundle, { level: args.level ?? "policy" });
|
|
121
|
+
// SECURITY (forged-bundle report, 2026-09-30): a supplied bundle is
|
|
122
|
+
// part of the load-time trust decision. `valid` at structural/policy
|
|
123
|
+
// authenticates nothing and is forgeable, so gate on real
|
|
124
|
+
// authentication and fail closed — an unauthenticated bundle BLOCKS.
|
|
125
|
+
const authenticated = isBundleAuthenticated(verifyResult);
|
|
121
126
|
bundleCheck = {
|
|
122
127
|
provided: true,
|
|
123
128
|
parsed: true,
|
|
124
129
|
valid: verifyResult.valid,
|
|
130
|
+
authenticated,
|
|
125
131
|
level: verifyResult.level,
|
|
126
132
|
failureCodes: verifyResult.failures.map((f) => f.code),
|
|
127
133
|
deferredSteps: verifyResult.deferredSteps,
|
|
128
134
|
};
|
|
129
|
-
if (!
|
|
135
|
+
if (!authenticated) {
|
|
130
136
|
safe = false;
|
|
137
|
+
reasons.push({
|
|
138
|
+
code: UNAUTHENTICATED_BUNDLE_CODE,
|
|
139
|
+
message: unauthenticatedBundleMessage(verifyResult),
|
|
140
|
+
});
|
|
141
|
+
}
|
|
142
|
+
if (!verifyResult.valid) {
|
|
131
143
|
for (const f of verifyResult.failures) {
|
|
132
144
|
reasons.push({
|
|
133
145
|
code: `BUNDLE_${f.code}`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-before-load.js","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAC3E,OAAO,
|
|
1
|
+
{"version":3,"file":"verify-before-load.js","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,GAE5B,MAAM,oBAAoB,CAAA;AAE3B,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,uRAAuR;IACzR,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wHAAwH;aAC3H;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,+CAA+C;aAC7D;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,6DAA6D;aAC3E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,8CAA8C;aAC5D;YACD,mBAAmB,EAAE;gBACnB,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,iMAAiM;aACpM;YACD,MAAM,EAAE;gBACN,WAAW,EACT,oKAAoK;gBACtK,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAChD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACtC,WAAW,EACT,yFAAyF;aAC5F;SACF;KACF;CACO,CAAA;AAiBV,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAY,CAAA;IAEvC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,8CAA8C,CAAC,CAAA;IACtE,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAkC,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAA2C;YACnD,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAA;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAA;QACtE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAA;QAChE,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QAC9F,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO,aAAa,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;IAC1B,MAAM,OAAO,GAA6C,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACjF,IAAI,WAAW,GAAkB,IAAI,CAAA;IAErC,gCAAgC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,YAAqB,CAAA;QACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,oCAAoC,GAAG,EAAE;iBACnD,CAAC,CAAA;gBACF,IAAI,GAAG,KAAK,CAAA;gBACZ,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YACjD,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAA;YACF,IAAI,GAAG,KAAK,CAAA;YACZ,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QACjD,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAA;YACxF,oEAAoE;YACpE,qEAAqE;YACrE,0DAA0D;YAC1D,qEAAqE;YACrE,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAA;YACzD,WAAW,GAAG;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,aAAa;gBACb,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtD,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAA;YACD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,GAAG,KAAK,CAAA;gBACZ,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;iBACpD,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;oBACtC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,OAAO;QACP,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,MAAM,EAAE,WAAW;SACpB;KACF,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,IAAI;KACf,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IAIpC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAC1E,IAAI,EACJ,CAAC,CACF;aACF;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-bundle.d.ts","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"verify-bundle.d.ts","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BrB,CAAA;AASV,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,qEAAqE;AACrE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDlE"}
|
|
@@ -10,6 +10,7 @@
|
|
|
10
10
|
* the new behavior for free.
|
|
11
11
|
*/
|
|
12
12
|
import { verifyBundle } from "@primitivehub/verify";
|
|
13
|
+
import { isBundleAuthenticated, unauthenticatedBundleMessage } from "@primitivehub/phub";
|
|
13
14
|
export const VERIFY_BUNDLE_TOOL = {
|
|
14
15
|
name: "verify_bundle",
|
|
15
16
|
description: "Verify a PrimitiveHub Trust Bundle against the v0.1 wire format. Runs schema validation, content-digest verification, and Context CI policy evaluation. Steps 3-6 (signature/cert/Rekor) are stubbed in v0.1 — pass level: 'full' to see DEFERRED failures. All verification runs locally; no network calls.",
|
|
@@ -65,14 +66,28 @@ export async function callVerifyBundle(rawArgs) {
|
|
|
65
66
|
allowFailFor: args.allow_fail_for ?? [],
|
|
66
67
|
},
|
|
67
68
|
});
|
|
69
|
+
// SECURITY (forged-bundle report, 2026-09-30): `valid` at the
|
|
70
|
+
// structural/policy levels authenticates NOTHING — an agent must not
|
|
71
|
+
// treat it as a trust verdict. Surface a separate `authenticated`
|
|
72
|
+
// flag and fail closed (isError) unless the bundle was actually
|
|
73
|
+
// cryptographically verified. See @primitivehub/phub isBundleAuthenticated.
|
|
74
|
+
const authenticated = isBundleAuthenticated(result);
|
|
75
|
+
const payload = {
|
|
76
|
+
...result,
|
|
77
|
+
authenticated,
|
|
78
|
+
trust: authenticated
|
|
79
|
+
? "AUTHENTICATED"
|
|
80
|
+
: "INSPECTED_NOT_AUTHENTICATED",
|
|
81
|
+
securityNote: authenticated ? undefined : unauthenticatedBundleMessage(result),
|
|
82
|
+
};
|
|
68
83
|
return {
|
|
69
84
|
content: [
|
|
70
85
|
{
|
|
71
86
|
type: "text",
|
|
72
|
-
text: JSON.stringify(
|
|
87
|
+
text: JSON.stringify(payload, null, 2),
|
|
73
88
|
},
|
|
74
89
|
],
|
|
75
|
-
isError: !
|
|
90
|
+
isError: !authenticated,
|
|
76
91
|
};
|
|
77
92
|
}
|
|
78
93
|
function errorResponse(message) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-bundle.js","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"verify-bundle.js","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AAExF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,8SAA8S;IAChT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,WAAW,EAAE,8GAA8G;gBAC3H,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAChD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACtC,WAAW,EACT,iMAAiM;aACpM;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,iEAAiE;aAC/E;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,wGAAwG;aAC3G;SACF;KACF;CACO,CAAA;AAcV,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAA;IAEhD,IAAI,YAAqB,CAAA;IACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5D,OAAO,aAAa,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACnE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,OAAO,aAAa,CAAC,gDAAgD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ;QAC7B,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,YAAY,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;SACxC;KACF,CAAC,CAAA;IAEF,8DAA8D;IAC9D,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,4EAA4E;IAC5E,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG;QACd,GAAG,MAAM;QACT,aAAa;QACb,KAAK,EAAE,aAAa;YAClB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,6BAA6B;QACjC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC;KAC/E,CAAA;IAED,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aACvC;SACF;QACD,OAAO,EAAE,CAAC,aAAa;KACxB,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,21 +1,21 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@primitivehub/mcp-server",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"description": "MCP server exposing PrimitiveHub verification + scanning to AI agents (Claude, Cursor, Aider, …). Pure transport over @primitivehub/verify + @primitivehub/phub — zero custom trust logic.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "PrimitiveHub AI / CyberOrca Labs",
|
|
7
7
|
"homepage": "https://primitivehub.ai",
|
|
8
8
|
"repository": {
|
|
9
9
|
"type": "git",
|
|
10
|
-
"url": "git+https://github.com/
|
|
10
|
+
"url": "git+https://github.com/DevXYZx/primitivehub.git",
|
|
11
11
|
"directory": "packages/mcp-server"
|
|
12
12
|
},
|
|
13
13
|
"bugs": {
|
|
14
|
-
"url": "https://github.com/
|
|
14
|
+
"url": "https://github.com/DevXYZx/primitivehub/issues"
|
|
15
15
|
},
|
|
16
16
|
"type": "module",
|
|
17
17
|
"bin": {
|
|
18
|
-
"primitivehub-mcp": "
|
|
18
|
+
"primitivehub-mcp": "bin/primitivehub-mcp.js"
|
|
19
19
|
},
|
|
20
20
|
"main": "./dist/index.js",
|
|
21
21
|
"types": "./dist/index.d.ts",
|
|
@@ -35,15 +35,22 @@
|
|
|
35
35
|
],
|
|
36
36
|
"publishConfig": {
|
|
37
37
|
"access": "public",
|
|
38
|
-
"provenance":
|
|
38
|
+
"provenance": false
|
|
39
|
+
},
|
|
40
|
+
"scripts": {
|
|
41
|
+
"build": "tsc",
|
|
42
|
+
"test": "vitest run",
|
|
43
|
+
"test:watch": "vitest",
|
|
44
|
+
"typecheck": "tsc --noEmit",
|
|
45
|
+
"prepublishOnly": "pnpm typecheck && pnpm test && pnpm build"
|
|
39
46
|
},
|
|
40
47
|
"engines": {
|
|
41
48
|
"node": ">=20"
|
|
42
49
|
},
|
|
43
50
|
"dependencies": {
|
|
44
51
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
45
|
-
"@primitivehub/verify": "^0.1.
|
|
46
|
-
"@primitivehub/phub": "^0.1.
|
|
52
|
+
"@primitivehub/verify": "^0.1.1",
|
|
53
|
+
"@primitivehub/phub": "^0.1.2"
|
|
47
54
|
},
|
|
48
55
|
"devDependencies": {
|
|
49
56
|
"@types/node": "^22",
|
|
@@ -61,11 +68,5 @@
|
|
|
61
68
|
"supply-chain-security",
|
|
62
69
|
"claude",
|
|
63
70
|
"cursor"
|
|
64
|
-
]
|
|
65
|
-
|
|
66
|
-
"build": "tsc",
|
|
67
|
-
"test": "vitest run",
|
|
68
|
-
"test:watch": "vitest",
|
|
69
|
-
"typecheck": "tsc --noEmit"
|
|
70
|
-
}
|
|
71
|
-
}
|
|
71
|
+
]
|
|
72
|
+
}
|