@primitivehub/mcp-server 0.1.0 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +46 -27
- package/README.md +53 -7
- package/dist/tools/verify-before-load.d.ts +14 -5
- package/dist/tools/verify-before-load.d.ts.map +1 -1
- package/dist/tools/verify-before-load.js +28 -7
- package/dist/tools/verify-before-load.js.map +1 -1
- package/dist/tools/verify-bundle.d.ts.map +1 -1
- package/dist/tools/verify-bundle.js +17 -2
- package/dist/tools/verify-bundle.js.map +1 -1
- package/package.json +16 -15
package/CHANGELOG.md
CHANGED
|
@@ -6,7 +6,40 @@ Version tracks Trust Contract spec version (for `verify_bundle`) and
|
|
|
6
6
|
Context CI Top 10 version (for `scan_text` / `audit_workspace`);
|
|
7
7
|
`0.1.x` of this package is conformant to both v0.1.
|
|
8
8
|
|
|
9
|
-
## [
|
|
9
|
+
## [0.1.3] — 2026-10-16
|
|
10
|
+
|
|
11
|
+
**Security hardening (external assessment PH-SEC-003).** Requires
|
|
12
|
+
`@primitivehub/phub@^0.1.3` + `@primitivehub/verify@^0.1.2`.
|
|
13
|
+
|
|
14
|
+
### Changed
|
|
15
|
+
- **Honest scope for `verify_before_load` (PH-SEC-003):** documented as an
|
|
16
|
+
**opt-in verification API** — registering the MCP server does NOT
|
|
17
|
+
interpose on agent file reads; real enforcement needs the host to mediate
|
|
18
|
+
reads. Removed the "every agent MUST consult before reading" over-claim.
|
|
19
|
+
- Inherits verify's fail-closed `valid` + the `inspected` field; the
|
|
20
|
+
`scan_text` doc now states all ten detectors (CCI-001…010) run.
|
|
21
|
+
|
|
22
|
+
## [0.1.1] — 2026-10-04
|
|
23
|
+
|
|
24
|
+
Tracks `@primitivehub/phub@0.1.1`. No tool code changed — `verify_before_load`
|
|
25
|
+
shipped in 0.1.0 and remains a pure transport (ADR-0031).
|
|
26
|
+
|
|
27
|
+
### Changed
|
|
28
|
+
- **`verify_before_load` now reports a `tier` on every reason** — `block`
|
|
29
|
+
(tamper / drift / live scanner finding / demanded-but-absent
|
|
30
|
+
attestation) vs `posture` (unsealed). Inherited automatically from
|
|
31
|
+
`verifyBeforeLoad` in `@primitivehub/phub`; agents can branch on the
|
|
32
|
+
low-FP signal, not just the `safe` boolean. Requires
|
|
33
|
+
`@primitivehub/phub@^0.1.1`.
|
|
34
|
+
- **README** now documents the shipped `verify_before_load` tool (it was
|
|
35
|
+
still marked "planned") and fixes its ADR-0029 link.
|
|
36
|
+
|
|
37
|
+
## [0.1.0] — 2026-07-21
|
|
38
|
+
|
|
39
|
+
The v0.1 launch release — a pure transport layer over `@primitivehub/verify`
|
|
40
|
+
and `@primitivehub/phub` (ADR-0031). Five tools; published to npm at launch
|
|
41
|
+
([ADR-0045](../../docs/decisions/0045-product-first-public-launch-and-distribution-repo.md),
|
|
42
|
+
product-first).
|
|
10
43
|
|
|
11
44
|
### Added (PR 5.7.5 — MCP runtime gate, ADR-0029)
|
|
12
45
|
- **`verify_before_load`** tool — the composite runtime gate. Combines
|
|
@@ -24,15 +57,7 @@ Context CI Top 10 version (for `scan_text` / `audit_workspace`);
|
|
|
24
57
|
`verifyBeforeLoad`) per ADR-0031 § 2 rule #1. The MCP wrapper is
|
|
25
58
|
pure transport.
|
|
26
59
|
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
**Not yet published to npm.** Per
|
|
30
|
-
[ADR-0022](../../docs/decisions/0022-publishing-deferred-to-launch.md)
|
|
31
|
-
publishing is gated to the project launch event. The server is fully
|
|
32
|
-
functional inside the monorepo today; `npx @primitivehub/mcp-server`
|
|
33
|
-
is a launch-day capability.
|
|
34
|
-
|
|
35
|
-
### Added — initial Gate G-D release
|
|
60
|
+
### Added — initial Gate G-D release (2026-06-02)
|
|
36
61
|
|
|
37
62
|
Per [ADR-0031](../../docs/decisions/0031-mcp-server-as-transport.md)
|
|
38
63
|
the v0.1 server is a pure transport layer over existing primitives.
|
|
@@ -42,9 +67,9 @@ Zero custom trust logic; every tool delegates.
|
|
|
42
67
|
Accepts a Trust Bundle as a JSON string OR a pre-parsed object.
|
|
43
68
|
Levels: `structural` / `policy` / `full` (steps 3-6 stubbed per
|
|
44
69
|
verify v0.1).
|
|
45
|
-
- **`scan_text`** — runs the
|
|
46
|
-
arbitrary text. Wraps phub's `runScan`. Honors
|
|
47
|
-
`--strict` / `--allow-fail` / `--detector`.
|
|
70
|
+
- **`scan_text`** — runs the full Context CI Top 10 detector roster
|
|
71
|
+
(CCI-001…010) over arbitrary text. Wraps phub's `runScan`. Honors
|
|
72
|
+
`--policy` / `--strict` / `--allow-fail` / `--detector`.
|
|
48
73
|
- **`audit_workspace`** — active-surface tool. Walks + classifies +
|
|
49
74
|
scans every agent-context artifact under a root path. Wraps phub's
|
|
50
75
|
`runAudit`. Output includes per-artifact verdicts + project
|
|
@@ -58,33 +83,27 @@ Zero custom trust logic; every tool delegates.
|
|
|
58
83
|
- **Programmatic API** — `buildServer()`, `runStdio()`, individual
|
|
59
84
|
tool callables for in-process / SSE / HTTP transports.
|
|
60
85
|
- **Worked examples** (`examples/`) — Claude Code, Cursor, Aider
|
|
61
|
-
config snippets verified to register the server with
|
|
86
|
+
config snippets verified to register the server with its five
|
|
62
87
|
visible tools.
|
|
63
88
|
|
|
64
89
|
### Runtime deps
|
|
65
90
|
|
|
66
91
|
- `@modelcontextprotocol/sdk` `^1.0.0` — the official MCP SDK; not
|
|
67
92
|
hand-rolled (justified in ADR-0031 § "Alternatives").
|
|
68
|
-
- `@primitivehub/verify` `^0.1.0
|
|
69
|
-
- `@primitivehub/phub` `^0.1.0
|
|
93
|
+
- `@primitivehub/verify` `^0.1.0`.
|
|
94
|
+
- `@primitivehub/phub` `^0.1.0`.
|
|
70
95
|
|
|
71
96
|
### Tests
|
|
72
97
|
- `test/tools.test.ts` — 16 cases, in-process tool wrappers.
|
|
73
98
|
- `test/server.test.ts` — 6 cases, JSON-RPC via `InMemoryTransport`.
|
|
74
|
-
-
|
|
99
|
+
- `test/verify-before-load.test.ts` — 10 cases, the composite runtime gate.
|
|
100
|
+
- 32/32 passing.
|
|
75
101
|
|
|
76
102
|
### Forward-looking (next PRs, not in this release)
|
|
77
103
|
|
|
78
|
-
- **MCP runtime gate** (planned [ADR-0029](../../docs/decisions/0026-phub-lock-format-and-drift-detection.md))
|
|
79
|
-
— `verify_before_load` composite tool that combines `check_lock`
|
|
80
|
-
+ `verify_bundle` and is consulted by agents at primitive-read
|
|
81
|
-
time. Refuses-by-default for unattested content.
|
|
82
104
|
- **SSE / HTTP transports** — for browser-based agents that can't
|
|
83
105
|
spawn stdio child processes.
|
|
84
|
-
- **Tool surface additions as
|
|
85
|
-
inherits verify v0.2 (signature/cert/Rekor)
|
|
86
|
-
`audit_workspace` inherit new detector classes via phub's
|
|
87
|
-
detector registry.
|
|
106
|
+
- **Tool surface additions as verify matures** — `verify_bundle`
|
|
107
|
+
inherits verify v0.2 (signature / cert / Rekor) when those steps land.
|
|
88
108
|
|
|
89
|
-
[
|
|
90
|
-
[0.1.0]: https://github.com/PrimitiveHub-AI/context-ci/releases/tag/mcp-server-v0.1.0
|
|
109
|
+
[0.1.0]: https://github.com/DevXYZx/primitivehub/releases/tag/mcp-server-v0.1.0
|
package/README.md
CHANGED
|
@@ -12,6 +12,9 @@ Gate G-D acceptance + [ADR-0031](../../docs/decisions/0031-mcp-server-as-transpo
|
|
|
12
12
|
|
|
13
13
|
Lets an AI agent ask, mid-task:
|
|
14
14
|
|
|
15
|
+
- **"Is this file safe to load right now?" → `verify_before_load`** —
|
|
16
|
+
the inline Context Firewall; the composite gate the agent calls before
|
|
17
|
+
reading any agent-context artifact
|
|
15
18
|
- "Is this Trust Bundle valid?" → `verify_bundle`
|
|
16
19
|
- "Does this text trip Context CI Top 10?" → `scan_text`
|
|
17
20
|
- "What context primitives are in this workspace, and which are
|
|
@@ -86,7 +89,7 @@ mcp-servers:
|
|
|
86
89
|
args: ["@primitivehub/mcp-server"]
|
|
87
90
|
```
|
|
88
91
|
|
|
89
|
-
See [`examples/`](./examples/) for
|
|
92
|
+
See [`examples/`](./examples/) for complete host configurations.
|
|
90
93
|
|
|
91
94
|
## Tools
|
|
92
95
|
|
|
@@ -107,8 +110,8 @@ stubbed in v0.1 (see verify README).
|
|
|
107
110
|
|
|
108
111
|
### `scan_text`
|
|
109
112
|
|
|
110
|
-
Run the
|
|
111
|
-
`runScan`.
|
|
113
|
+
Run the full Context CI Top 10 detector roster (CCI-001…010) against
|
|
114
|
+
text. Wraps phub's `runScan`.
|
|
112
115
|
|
|
113
116
|
**Arguments:**
|
|
114
117
|
|
|
@@ -154,6 +157,46 @@ and reports drift (added / modified / removed / reclassified).
|
|
|
154
157
|
| `max_files` | number | no | `10000` |
|
|
155
158
|
| `max_depth` | number | no | `16` |
|
|
156
159
|
|
|
160
|
+
### `verify_before_load`
|
|
161
|
+
|
|
162
|
+
**The inline Context Firewall.** Call this BEFORE loading any
|
|
163
|
+
agent-context primitive — it refuses-by-default per
|
|
164
|
+
[ADR-0029](../../docs/decisions/0029-mcp-runtime-gate.md). The composite
|
|
165
|
+
of `check_lock` + `scan_text` + (optional) `verify_bundle`, folded into
|
|
166
|
+
one verdict: `{ safe, reasons[], checks }`, with `isError: true`
|
|
167
|
+
whenever `safe` is false. Each reason carries a `tier` — `block`
|
|
168
|
+
(tamper / drift / live scanner finding / demanded-but-absent
|
|
169
|
+
attestation) or `posture` (simply unsealed) — so an agent can branch on
|
|
170
|
+
the low-FP signal, not just the boolean. Same engine as the `phub
|
|
171
|
+
verify-before-load` CLI command and the `phub-scan` action's `mode:
|
|
172
|
+
gate`.
|
|
173
|
+
|
|
174
|
+
> **Scope — opt-in, not enforced (PH-SEC-003).** Registering this MCP
|
|
175
|
+
> server exposes `verify_before_load` as a tool an agent *can* call; it
|
|
176
|
+
> does **not** interpose on the agent's file reads. A host or loader can
|
|
177
|
+
> still read content without invoking the gate. Treat this as an **opt-in
|
|
178
|
+
> verification API**: real "no untrusted bytes reach the model"
|
|
179
|
+
> enforcement requires the host to route reads through the gate. Our docs
|
|
180
|
+
> describe the *capability*, not a guarantee the host enforces it.
|
|
181
|
+
|
|
182
|
+
**Arguments:**
|
|
183
|
+
|
|
184
|
+
| Field | Type | Required | Default |
|
|
185
|
+
|---|---|---|---|
|
|
186
|
+
| `path` | string | **yes** | — |
|
|
187
|
+
| `workspace_root` | string | no | `process.cwd()` |
|
|
188
|
+
| `policy_path` | string | no | auto-discover |
|
|
189
|
+
| `lock_path` | string | no | auto-discover |
|
|
190
|
+
| `require_attestation` | boolean | no | `false` |
|
|
191
|
+
| `bundle` | string \| object | no | — |
|
|
192
|
+
| `level` | `structural` \| `policy` \| `full` | no | `policy` |
|
|
193
|
+
|
|
194
|
+
Reason codes are stable across patch releases — agents branch on
|
|
195
|
+
`code`: `LOCK_MISSING`, `LOCK_SPEC_VERSION_MISMATCH`, `PATH_NOT_FOUND`,
|
|
196
|
+
`PATH_UNCLASSIFIED`, `PATH_NOT_IN_LOCK`, `PATH_DIGEST_MISMATCH`,
|
|
197
|
+
`PATH_UNATTESTED`, `PATH_FLAGGED_BY_SCANNER` (plus `BUNDLE_*` when a
|
|
198
|
+
Trust Bundle is supplied).
|
|
199
|
+
|
|
157
200
|
## Design discipline
|
|
158
201
|
|
|
159
202
|
Per [ADR-0031](../../docs/decisions/0031-mcp-server-as-transport.md)
|
|
@@ -170,10 +213,13 @@ this package is a transport layer with three load-bearing rules:
|
|
|
170
213
|
does not cache, queue, or remember invocations. The agent's
|
|
171
214
|
conversation is the only state that matters.
|
|
172
215
|
|
|
173
|
-
The MCP runtime gate `verify_before_load`
|
|
174
|
-
is a
|
|
175
|
-
|
|
176
|
-
|
|
216
|
+
The MCP runtime gate `verify_before_load`
|
|
217
|
+
([ADR-0029](../../docs/decisions/0029-mcp-runtime-gate.md)) is a
|
|
218
|
+
composite of `check_lock` + `scan_text` + (optional) `verify_bundle`
|
|
219
|
+
applied at the agent's read time. It ships in this package (see the
|
|
220
|
+
tool section above) and holds the same transport discipline: zero
|
|
221
|
+
custom trust logic — the verdict is `verifyBeforeLoad` from
|
|
222
|
+
`@primitivehub/phub` plus `verifyBundle` from `@primitivehub/verify`.
|
|
177
223
|
|
|
178
224
|
## Programmatic embedding
|
|
179
225
|
|
|
@@ -1,15 +1,24 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* MCP tool: `verify_before_load`
|
|
3
3
|
*
|
|
4
|
-
* The composite runtime gate
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* The composite runtime gate — an OPT-IN verification API. An agent (or a
|
|
5
|
+
* host integration) SHOULD call this BEFORE loading any agent-context
|
|
6
|
+
* primitive.
|
|
7
|
+
*
|
|
8
|
+
* IMPORTANT (PH-SEC-003 — honest scope): calling this is ADVISORY, not
|
|
9
|
+
* enforced. Registering the MCP server does NOT interpose on the agent's
|
|
10
|
+
* file reads — nothing prevents a loader from reading content without
|
|
11
|
+
* calling the gate. Real enforcement requires the HOST to mediate reads
|
|
12
|
+
* through this check; until then this is an opt-in check, not a
|
|
13
|
+
* compulsory read-interceptor.
|
|
14
|
+
*
|
|
15
|
+
* Refuses-by-default for:
|
|
7
16
|
* - missing lock (operator hasn't sealed anything)
|
|
8
17
|
* - lock spec-version mismatch (Top 10 ratcheted; re-seal required)
|
|
9
18
|
* - drift (working tree differs from lock)
|
|
10
19
|
* - unattested artifacts (with requireAttestation set)
|
|
11
|
-
* - scanner findings (
|
|
12
|
-
* - invalid Trust Bundle (when one is provided)
|
|
20
|
+
* - scanner findings (all ten Context CI Top 10 detectors, CCI-001…010)
|
|
21
|
+
* - an unauthenticated or invalid Trust Bundle (when one is provided)
|
|
13
22
|
*
|
|
14
23
|
* Pure transport per ADR-0031 § 2 rule #1. Combines two existing
|
|
15
24
|
* primitives:
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-before-load.d.ts","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"verify-before-load.d.ts","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C1B,CAAA;AAYV,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsGtE"}
|
|
@@ -1,15 +1,24 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* MCP tool: `verify_before_load`
|
|
3
3
|
*
|
|
4
|
-
* The composite runtime gate
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* The composite runtime gate — an OPT-IN verification API. An agent (or a
|
|
5
|
+
* host integration) SHOULD call this BEFORE loading any agent-context
|
|
6
|
+
* primitive.
|
|
7
|
+
*
|
|
8
|
+
* IMPORTANT (PH-SEC-003 — honest scope): calling this is ADVISORY, not
|
|
9
|
+
* enforced. Registering the MCP server does NOT interpose on the agent's
|
|
10
|
+
* file reads — nothing prevents a loader from reading content without
|
|
11
|
+
* calling the gate. Real enforcement requires the HOST to mediate reads
|
|
12
|
+
* through this check; until then this is an opt-in check, not a
|
|
13
|
+
* compulsory read-interceptor.
|
|
14
|
+
*
|
|
15
|
+
* Refuses-by-default for:
|
|
7
16
|
* - missing lock (operator hasn't sealed anything)
|
|
8
17
|
* - lock spec-version mismatch (Top 10 ratcheted; re-seal required)
|
|
9
18
|
* - drift (working tree differs from lock)
|
|
10
19
|
* - unattested artifacts (with requireAttestation set)
|
|
11
|
-
* - scanner findings (
|
|
12
|
-
* - invalid Trust Bundle (when one is provided)
|
|
20
|
+
* - scanner findings (all ten Context CI Top 10 detectors, CCI-001…010)
|
|
21
|
+
* - an unauthenticated or invalid Trust Bundle (when one is provided)
|
|
13
22
|
*
|
|
14
23
|
* Pure transport per ADR-0031 § 2 rule #1. Combines two existing
|
|
15
24
|
* primitives:
|
|
@@ -20,7 +29,7 @@
|
|
|
20
29
|
* verify; this file inherits the new behavior with zero edits.
|
|
21
30
|
*/
|
|
22
31
|
import { verifyBundle } from "@primitivehub/verify";
|
|
23
|
-
import { verifyBeforeLoad } from "@primitivehub/phub";
|
|
32
|
+
import { verifyBeforeLoad, isBundleAuthenticated, unauthenticatedBundleMessage, UNAUTHENTICATED_BUNDLE_CODE, } from "@primitivehub/phub";
|
|
24
33
|
export const VERIFY_BEFORE_LOAD_TOOL = {
|
|
25
34
|
name: "verify_before_load",
|
|
26
35
|
description: "Composite runtime gate. Call this BEFORE loading any agent-context primitive — refuses-by-default for drift, unattested artifacts, scanner findings, or invalid Trust Bundles. Returns {safe, reasons[], checks}. The composite of check_lock + scan_text + (optional) verify_bundle.",
|
|
@@ -118,16 +127,28 @@ export async function callVerifyBeforeLoad(rawArgs) {
|
|
|
118
127
|
}
|
|
119
128
|
if (parsedBundle !== undefined) {
|
|
120
129
|
const verifyResult = await verifyBundle(parsedBundle, { level: args.level ?? "policy" });
|
|
130
|
+
// SECURITY (forged-bundle report, 2026-09-30): a supplied bundle is
|
|
131
|
+
// part of the load-time trust decision. `valid` at structural/policy
|
|
132
|
+
// authenticates nothing and is forgeable, so gate on real
|
|
133
|
+
// authentication and fail closed — an unauthenticated bundle BLOCKS.
|
|
134
|
+
const authenticated = isBundleAuthenticated(verifyResult);
|
|
121
135
|
bundleCheck = {
|
|
122
136
|
provided: true,
|
|
123
137
|
parsed: true,
|
|
124
138
|
valid: verifyResult.valid,
|
|
139
|
+
authenticated,
|
|
125
140
|
level: verifyResult.level,
|
|
126
141
|
failureCodes: verifyResult.failures.map((f) => f.code),
|
|
127
142
|
deferredSteps: verifyResult.deferredSteps,
|
|
128
143
|
};
|
|
129
|
-
if (!
|
|
144
|
+
if (!authenticated) {
|
|
130
145
|
safe = false;
|
|
146
|
+
reasons.push({
|
|
147
|
+
code: UNAUTHENTICATED_BUNDLE_CODE,
|
|
148
|
+
message: unauthenticatedBundleMessage(verifyResult),
|
|
149
|
+
});
|
|
150
|
+
}
|
|
151
|
+
if (!verifyResult.valid) {
|
|
131
152
|
for (const f of verifyResult.failures) {
|
|
132
153
|
reasons.push({
|
|
133
154
|
code: `BUNDLE_${f.code}`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-before-load.js","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"verify-before-load.js","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,GAE5B,MAAM,oBAAoB,CAAA;AAE3B,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,uRAAuR;IACzR,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wHAAwH;aAC3H;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,+CAA+C;aAC7D;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,6DAA6D;aAC3E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,8CAA8C;aAC5D;YACD,mBAAmB,EAAE;gBACnB,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,iMAAiM;aACpM;YACD,MAAM,EAAE;gBACN,WAAW,EACT,oKAAoK;gBACtK,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAChD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACtC,WAAW,EACT,yFAAyF;aAC5F;SACF;KACF;CACO,CAAA;AAiBV,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAY,CAAA;IAEvC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,8CAA8C,CAAC,CAAA;IACtE,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAkC,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAA2C;YACnD,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAA;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAA;QACtE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAA;QAChE,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QAC9F,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO,aAAa,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;IAC1B,MAAM,OAAO,GAA6C,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACjF,IAAI,WAAW,GAAkB,IAAI,CAAA;IAErC,gCAAgC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,YAAqB,CAAA;QACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,oCAAoC,GAAG,EAAE;iBACnD,CAAC,CAAA;gBACF,IAAI,GAAG,KAAK,CAAA;gBACZ,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YACjD,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAA;YACF,IAAI,GAAG,KAAK,CAAA;YACZ,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QACjD,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAA;YACxF,oEAAoE;YACpE,qEAAqE;YACrE,0DAA0D;YAC1D,qEAAqE;YACrE,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAA;YACzD,WAAW,GAAG;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,aAAa;gBACb,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtD,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAA;YACD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,GAAG,KAAK,CAAA;gBACZ,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC;iBACpD,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;oBACtC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,OAAO;QACP,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,MAAM,EAAE,WAAW;SACpB;KACF,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,IAAI;KACf,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IAIpC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAC1E,IAAI,EACJ,CAAC,CACF;aACF;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-bundle.d.ts","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"verify-bundle.d.ts","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BrB,CAAA;AASV,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,qEAAqE;AACrE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDlE"}
|
|
@@ -10,6 +10,7 @@
|
|
|
10
10
|
* the new behavior for free.
|
|
11
11
|
*/
|
|
12
12
|
import { verifyBundle } from "@primitivehub/verify";
|
|
13
|
+
import { isBundleAuthenticated, unauthenticatedBundleMessage } from "@primitivehub/phub";
|
|
13
14
|
export const VERIFY_BUNDLE_TOOL = {
|
|
14
15
|
name: "verify_bundle",
|
|
15
16
|
description: "Verify a PrimitiveHub Trust Bundle against the v0.1 wire format. Runs schema validation, content-digest verification, and Context CI policy evaluation. Steps 3-6 (signature/cert/Rekor) are stubbed in v0.1 — pass level: 'full' to see DEFERRED failures. All verification runs locally; no network calls.",
|
|
@@ -65,14 +66,28 @@ export async function callVerifyBundle(rawArgs) {
|
|
|
65
66
|
allowFailFor: args.allow_fail_for ?? [],
|
|
66
67
|
},
|
|
67
68
|
});
|
|
69
|
+
// SECURITY (forged-bundle report, 2026-09-30): `valid` at the
|
|
70
|
+
// structural/policy levels authenticates NOTHING — an agent must not
|
|
71
|
+
// treat it as a trust verdict. Surface a separate `authenticated`
|
|
72
|
+
// flag and fail closed (isError) unless the bundle was actually
|
|
73
|
+
// cryptographically verified. See @primitivehub/phub isBundleAuthenticated.
|
|
74
|
+
const authenticated = isBundleAuthenticated(result);
|
|
75
|
+
const payload = {
|
|
76
|
+
...result,
|
|
77
|
+
authenticated,
|
|
78
|
+
trust: authenticated
|
|
79
|
+
? "AUTHENTICATED"
|
|
80
|
+
: "INSPECTED_NOT_AUTHENTICATED",
|
|
81
|
+
securityNote: authenticated ? undefined : unauthenticatedBundleMessage(result),
|
|
82
|
+
};
|
|
68
83
|
return {
|
|
69
84
|
content: [
|
|
70
85
|
{
|
|
71
86
|
type: "text",
|
|
72
|
-
text: JSON.stringify(
|
|
87
|
+
text: JSON.stringify(payload, null, 2),
|
|
73
88
|
},
|
|
74
89
|
],
|
|
75
|
-
isError: !
|
|
90
|
+
isError: !authenticated,
|
|
76
91
|
};
|
|
77
92
|
}
|
|
78
93
|
function errorResponse(message) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-bundle.js","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"verify-bundle.js","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AAExF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,8SAA8S;IAChT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,WAAW,EAAE,8GAA8G;gBAC3H,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAChD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACtC,WAAW,EACT,iMAAiM;aACpM;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,iEAAiE;aAC/E;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,wGAAwG;aAC3G;SACF;KACF;CACO,CAAA;AAcV,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAA;IAEhD,IAAI,YAAqB,CAAA;IACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5D,OAAO,aAAa,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACnE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,OAAO,aAAa,CAAC,gDAAgD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ;QAC7B,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,YAAY,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;SACxC;KACF,CAAC,CAAA;IAEF,8DAA8D;IAC9D,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,4EAA4E;IAC5E,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG;QACd,GAAG,MAAM;QACT,aAAa;QACb,KAAK,EAAE,aAAa;YAClB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,6BAA6B;QACjC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC;KAC/E,CAAA;IAED,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aACvC;SACF;QACD,OAAO,EAAE,CAAC,aAAa;KACxB,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,21 +1,21 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@primitivehub/mcp-server",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.3",
|
|
4
4
|
"description": "MCP server exposing PrimitiveHub verification + scanning to AI agents (Claude, Cursor, Aider, …). Pure transport over @primitivehub/verify + @primitivehub/phub — zero custom trust logic.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "PrimitiveHub AI / CyberOrca Labs",
|
|
7
7
|
"homepage": "https://primitivehub.ai",
|
|
8
8
|
"repository": {
|
|
9
9
|
"type": "git",
|
|
10
|
-
"url": "git+https://github.com/
|
|
10
|
+
"url": "git+https://github.com/DevXYZx/primitivehub.git",
|
|
11
11
|
"directory": "packages/mcp-server"
|
|
12
12
|
},
|
|
13
13
|
"bugs": {
|
|
14
|
-
"url": "https://github.com/
|
|
14
|
+
"url": "https://github.com/DevXYZx/primitivehub/issues"
|
|
15
15
|
},
|
|
16
16
|
"type": "module",
|
|
17
17
|
"bin": {
|
|
18
|
-
"primitivehub-mcp": "
|
|
18
|
+
"primitivehub-mcp": "bin/primitivehub-mcp.js"
|
|
19
19
|
},
|
|
20
20
|
"main": "./dist/index.js",
|
|
21
21
|
"types": "./dist/index.d.ts",
|
|
@@ -35,15 +35,22 @@
|
|
|
35
35
|
],
|
|
36
36
|
"publishConfig": {
|
|
37
37
|
"access": "public",
|
|
38
|
-
"provenance":
|
|
38
|
+
"provenance": false
|
|
39
|
+
},
|
|
40
|
+
"scripts": {
|
|
41
|
+
"build": "tsc",
|
|
42
|
+
"test": "vitest run",
|
|
43
|
+
"test:watch": "vitest",
|
|
44
|
+
"typecheck": "tsc --noEmit",
|
|
45
|
+
"prepublishOnly": "pnpm typecheck && pnpm test && pnpm build"
|
|
39
46
|
},
|
|
40
47
|
"engines": {
|
|
41
48
|
"node": ">=20"
|
|
42
49
|
},
|
|
43
50
|
"dependencies": {
|
|
44
51
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
45
|
-
"@primitivehub/verify": "^0.1.
|
|
46
|
-
"@primitivehub/phub": "^0.1.
|
|
52
|
+
"@primitivehub/verify": "^0.1.2",
|
|
53
|
+
"@primitivehub/phub": "^0.1.3"
|
|
47
54
|
},
|
|
48
55
|
"devDependencies": {
|
|
49
56
|
"@types/node": "^22",
|
|
@@ -61,11 +68,5 @@
|
|
|
61
68
|
"supply-chain-security",
|
|
62
69
|
"claude",
|
|
63
70
|
"cursor"
|
|
64
|
-
]
|
|
65
|
-
|
|
66
|
-
"build": "tsc",
|
|
67
|
-
"test": "vitest run",
|
|
68
|
-
"test:watch": "vitest",
|
|
69
|
-
"typecheck": "tsc --noEmit"
|
|
70
|
-
}
|
|
71
|
-
}
|
|
71
|
+
]
|
|
72
|
+
}
|