@primitivehub/mcp-server 0.1.0

package/dist/tools/verify-before-load.js

@@ -0,0 +1,167 @@
+/**
+ * MCP tool: `verify_before_load`
+ *
+ * The composite runtime gate. Per ADR-0029, every agent runtime that
+ * loads agent-context primitives MUST consult this tool before reading
+ * the content. Refuses-by-default for:
+ *   - missing lock (operator hasn't sealed anything)
+ *   - lock spec-version mismatch (Top 10 ratcheted; re-seal required)
+ *   - drift (working tree differs from lock)
+ *   - unattested artifacts (with requireAttestation set)
+ *   - scanner findings (T1/T2/T5 at v0.1)
+ *   - invalid Trust Bundle (when one is provided)
+ *
+ * Pure transport per ADR-0031 § 2 rule #1. Combines two existing
+ * primitives:
+ *   - `verifyBeforeLoad` from @primitivehub/phub  (workspace + lock + scan)
+ *   - `verifyBundle` from @primitivehub/verify    (cryptographic bundle)
+ *
+ * If a future ADR changes any check semantics, it changes in phub /
+ * verify; this file inherits the new behavior with zero edits.
+ */
+import { verifyBundle } from "@primitivehub/verify";
+import { verifyBeforeLoad } from "@primitivehub/phub";
+export const VERIFY_BEFORE_LOAD_TOOL = {
+    name: "verify_before_load",
+    description: "Composite runtime gate. Call this BEFORE loading any agent-context primitive — refuses-by-default for drift, unattested artifacts, scanner findings, or invalid Trust Bundles. Returns {safe, reasons[], checks}. The composite of check_lock + scan_text + (optional) verify_bundle.",
+    inputSchema: {
+        type: "object",
+        additionalProperties: false,
+        required: ["path"],
+        properties: {
+            path: {
+                type: "string",
+                description: "The artifact path to gate (relative to workspace_root, or absolute). The agent's 'I'm about to read this file' anchor.",
+            },
+            workspace_root: {
+                type: "string",
+                description: "Workspace root. Defaults to the server's cwd.",
+            },
+            policy_path: {
+                type: "string",
+                description: "Path to .primitivehub/policy.yaml. Auto-discover if absent.",
+            },
+            lock_path: {
+                type: "string",
+                description: "Explicit lock path. Auto-discover if absent.",
+            },
+            require_attestation: {
+                type: "boolean",
+                description: "If true, an 'unattested' lock entry counts as unsafe. Use when consuming registry primitives that should carry rekor:* or registry:* attestations. Default false (matches v0.1 lock semantics).",
+            },
+            bundle: {
+                description: "Optional Trust Bundle (JSON string OR parsed object). When provided, verify_bundle runs at the requested level and contributes its failures to the unsafe reasons.",
+                oneOf: [{ type: "string" }, { type: "object" }],
+            },
+            level: {
+                type: "string",
+                enum: ["structural", "policy", "full"],
+                description: "Bundle verification depth. Only meaningful when 'bundle' is provided. Default 'policy'.",
+            },
+        },
+    },
+};
+export async function callVerifyBeforeLoad(rawArgs) {
+    const args = (rawArgs ?? {});
+    if (typeof args.path !== "string" || args.path.length === 0) {
+        return errorResponse("path argument is required (non-empty string)");
+    }
+    // Run the workspace/lock/scan gate first.
+    let phubResult;
+    try {
+        const opts = {
+            workspaceRoot: args.workspace_root ?? process.cwd(),
+            path: args.path,
+        };
+        if (args.policy_path !== undefined)
+            opts.policyPath = args.policy_path;
+        if (args.lock_path !== undefined)
+            opts.lockPath = args.lock_path;
+        if (args.require_attestation !== undefined)
+            opts.requireAttestation = args.require_attestation;
+        phubResult = verifyBeforeLoad(opts);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return errorResponse(`workspace gate failed: ${msg}`);
+    }
+    let safe = phubResult.safe;
+    const reasons = [...phubResult.reasons];
+    let bundleCheck = null;
+    // Optional bundle verification.
+    if (args.bundle !== undefined) {
+        let parsedBundle;
+        if (typeof args.bundle === "string") {
+            try {
+                parsedBundle = JSON.parse(args.bundle);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                reasons.push({
+                    code: "BUNDLE_PARSE_ERROR",
+                    message: `bundle string is not valid JSON: ${msg}`,
+                });
+                safe = false;
+                bundleCheck = { provided: true, parsed: false };
+            }
+        }
+        else if (typeof args.bundle === "object" && args.bundle !== null) {
+            parsedBundle = args.bundle;
+        }
+        else {
+            reasons.push({
+                code: "BUNDLE_PARSE_ERROR",
+                message: "bundle must be a JSON string or parsed object",
+            });
+            safe = false;
+            bundleCheck = { provided: true, parsed: false };
+        }
+        if (parsedBundle !== undefined) {
+            const verifyResult = await verifyBundle(parsedBundle, { level: args.level ?? "policy" });
+            bundleCheck = {
+                provided: true,
+                parsed: true,
+                valid: verifyResult.valid,
+                level: verifyResult.level,
+                failureCodes: verifyResult.failures.map((f) => f.code),
+                deferredSteps: verifyResult.deferredSteps,
+            };
+            if (!verifyResult.valid) {
+                safe = false;
+                for (const f of verifyResult.failures) {
+                    reasons.push({
+                        code: `BUNDLE_${f.code}`,
+                        message: f.message + (f.path ? ` (at ${f.path})` : ""),
+                    });
+                }
+            }
+        }
+    }
+    else {
+        bundleCheck = { provided: false };
+    }
+    const payload = {
+        safe,
+        reasons,
+        checks: {
+            ...phubResult.checks,
+            bundle: bundleCheck,
+        },
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+        isError: !safe,
+    };
+}
+function errorResponse(message) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({ safe: false, reasons: [{ code: "USAGE_ERROR", message }], checks: null }, null, 2),
+            },
+        ],
+        isError: true,
+    };
+}
+//# sourceMappingURL=verify-before-load.js.map

package/dist/tools/verify-before-load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-before-load.js","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,gBAAgB,EAA+B,MAAM,oBAAoB,CAAA;AAElF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,uRAAuR;IACzR,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wHAAwH;aAC3H;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,+CAA+C;aAC7D;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,6DAA6D;aAC3E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,8CAA8C;aAC5D;YACD,mBAAmB,EAAE;gBACnB,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,iMAAiM;aACpM;YACD,MAAM,EAAE;gBACN,WAAW,EACT,oKAAoK;gBACtK,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAChD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACtC,WAAW,EACT,yFAAyF;aAC5F;SACF;KACF;CACO,CAAA;AAiBV,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAY,CAAA;IAEvC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,8CAA8C,CAAC,CAAA;IACtE,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAkC,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAA2C;YACnD,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAA;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAA;QACtE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAA;QAChE,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QAC9F,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO,aAAa,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;IAC1B,MAAM,OAAO,GAA6C,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACjF,IAAI,WAAW,GAAkB,IAAI,CAAA;IAErC,gCAAgC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,YAAqB,CAAA;QACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,oCAAoC,GAAG,EAAE;iBACnD,CAAC,CAAA;gBACF,IAAI,GAAG,KAAK,CAAA;gBACZ,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YACjD,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAA;YACF,IAAI,GAAG,KAAK,CAAA;YACZ,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QACjD,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAA;YACxF,WAAW,GAAG;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtD,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAA;YACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,GAAG,KAAK,CAAA;gBACZ,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;oBACtC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,OAAO;QACP,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,MAAM,EAAE,WAAW;SACpB;KACF,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,IAAI;KACf,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IAIpC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAC1E,IAAI,EACJ,CAAC,CACF;aACF;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}

package/dist/tools/verify-bundle.d.ts

@@ -0,0 +1,56 @@
+/**
+ * MCP tool: `verify_bundle`
+ *
+ * Thin wrapper around `@primitivehub/verify`'s `verifyBundle`.
+ * Zero custom trust logic — every behavioral question is delegated
+ * to the verify reference implementation (ADR-0020).
+ *
+ * Tool input/output schemas mirror the verify library's public types.
+ * When verify v0.2 unstubs cryptographic steps 3-6, this tool gets
+ * the new behavior for free.
+ */
+export declare const VERIFY_BUNDLE_TOOL: {
+    readonly name: "verify_bundle";
+    readonly description: "Verify a PrimitiveHub Trust Bundle against the v0.1 wire format. Runs schema validation, content-digest verification, and Context CI policy evaluation. Steps 3-6 (signature/cert/Rekor) are stubbed in v0.1 — pass level: 'full' to see DEFERRED failures. All verification runs locally; no network calls.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["bundle"];
+        readonly properties: {
+            readonly bundle: {
+                readonly description: "The Trust Bundle as a JSON string OR a pre-parsed JSON object. Strings are JSON.parse'd before verification.";
+                readonly oneOf: readonly [{
+                    readonly type: "string";
+                }, {
+                    readonly type: "object";
+                }];
+            };
+            readonly level: {
+                readonly type: "string";
+                readonly enum: readonly ["structural", "policy", "full"];
+                readonly description: "Verification depth. 'structural' = schema + digest (steps 1+2). 'policy' (default) = + Context CI policy (steps 1+2+7). 'full' = + signature/cert/Rekor (steps 1-7; steps 3-6 stubbed in v0.1).";
+            };
+            readonly strict: {
+                readonly type: "boolean";
+                readonly description: "Treat predicate WARN verdicts as FAIL during policy evaluation.";
+            };
+            readonly allow_fail_for: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Detector names, CCI IDs, or threat categories that are permitted to FAIL without rejecting the bundle.";
+            };
+        };
+    };
+};
+export interface VerifyBundleResultText {
+    type: "text";
+    text: string;
+}
+/** Call shape for the MCP server's CallToolRequestSchema handler. */
+export declare function callVerifyBundle(rawArgs: unknown): Promise<{
+    content: VerifyBundleResultText[];
+    isError: boolean;
+}>;
+//# sourceMappingURL=verify-bundle.d.ts.map

package/dist/tools/verify-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-bundle.d.ts","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BrB,CAAA;AASV,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,qEAAqE;AACrE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkClE"}

package/dist/tools/verify-bundle.js

@@ -0,0 +1,84 @@
+/**
+ * MCP tool: `verify_bundle`
+ *
+ * Thin wrapper around `@primitivehub/verify`'s `verifyBundle`.
+ * Zero custom trust logic — every behavioral question is delegated
+ * to the verify reference implementation (ADR-0020).
+ *
+ * Tool input/output schemas mirror the verify library's public types.
+ * When verify v0.2 unstubs cryptographic steps 3-6, this tool gets
+ * the new behavior for free.
+ */
+import { verifyBundle } from "@primitivehub/verify";
+export const VERIFY_BUNDLE_TOOL = {
+    name: "verify_bundle",
+    description: "Verify a PrimitiveHub Trust Bundle against the v0.1 wire format. Runs schema validation, content-digest verification, and Context CI policy evaluation. Steps 3-6 (signature/cert/Rekor) are stubbed in v0.1 — pass level: 'full' to see DEFERRED failures. All verification runs locally; no network calls.",
+    inputSchema: {
+        type: "object",
+        additionalProperties: false,
+        required: ["bundle"],
+        properties: {
+            bundle: {
+                description: "The Trust Bundle as a JSON string OR a pre-parsed JSON object. Strings are JSON.parse'd before verification.",
+                oneOf: [{ type: "string" }, { type: "object" }],
+            },
+            level: {
+                type: "string",
+                enum: ["structural", "policy", "full"],
+                description: "Verification depth. 'structural' = schema + digest (steps 1+2). 'policy' (default) = + Context CI policy (steps 1+2+7). 'full' = + signature/cert/Rekor (steps 1-7; steps 3-6 stubbed in v0.1).",
+            },
+            strict: {
+                type: "boolean",
+                description: "Treat predicate WARN verdicts as FAIL during policy evaluation.",
+            },
+            allow_fail_for: {
+                type: "array",
+                items: { type: "string" },
+                description: "Detector names, CCI IDs, or threat categories that are permitted to FAIL without rejecting the bundle.",
+            },
+        },
+    },
+};
+/** Call shape for the MCP server's CallToolRequestSchema handler. */
+export async function callVerifyBundle(rawArgs) {
+    const args = (rawArgs ?? {});
+    let parsedBundle;
+    if (typeof args.bundle === "string") {
+        try {
+            parsedBundle = JSON.parse(args.bundle);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return errorResponse(`bundle string is not valid JSON: ${msg}`);
+        }
+    }
+    else if (typeof args.bundle === "object" && args.bundle !== null) {
+        parsedBundle = args.bundle;
+    }
+    else {
+        return errorResponse("bundle argument is required (string or object)");
+    }
+    const result = await verifyBundle(parsedBundle, {
+        level: args.level ?? "policy",
+        policy: {
+            strict: args.strict ?? false,
+            allowFailFor: args.allow_fail_for ?? [],
+        },
+    });
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(result, null, 2),
+            },
+        ],
+        isError: !result.valid,
+    };
+}
+function errorResponse(message) {
+    return {
+        content: [{ type: "text", text: JSON.stringify({ valid: false, error: message }, null, 2) }],
+        isError: true,
+    };
+}
+//# sourceMappingURL=verify-bundle.js.map

package/dist/tools/verify-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-bundle.js","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAA0B,MAAM,sBAAsB,CAAA;AAE3E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,8SAA8S;IAChT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,WAAW,EAAE,8GAA8G;gBAC3H,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAChD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACtC,WAAW,EACT,iMAAiM;aACpM;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,iEAAiE;aAC/E;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,wGAAwG;aAC3G;SACF;KACF;CACO,CAAA;AAcV,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAA;IAEhD,IAAI,YAAqB,CAAA;IACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5D,OAAO,aAAa,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACnE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,OAAO,aAAa,CAAC,gDAAgD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ;QAC7B,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,YAAY,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;SACxC;KACF,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aACtC;SACF;QACD,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK;KACvB,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@primitivehub/mcp-server",
+  "version": "0.1.0",
+  "description": "MCP server exposing PrimitiveHub verification + scanning to AI agents (Claude, Cursor, Aider, …). Pure transport over @primitivehub/verify + @primitivehub/phub — zero custom trust logic.",
+  "license": "MIT",
+  "author": "PrimitiveHub AI / CyberOrca Labs",
+  "homepage": "https://primitivehub.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PrimitiveHub-AI/context-ci.git",
+    "directory": "packages/mcp-server"
+  },
+  "bugs": {
+    "url": "https://github.com/PrimitiveHub-AI/context-ci/issues"
+  },
+  "type": "module",
+  "bin": {
+    "primitivehub-mcp": "./bin/primitivehub-mcp.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@primitivehub/verify": "^0.1.0",
+    "@primitivehub/phub": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "5.7.3",
+    "vitest": "^2.1.0"
+  },
+  "keywords": [
+    "primitivehub",
+    "mcp",
+    "model-context-protocol",
+    "ai-agent",
+    "context-ci",
+    "trust-bundle",
+    "verifier",
+    "supply-chain-security",
+    "claude",
+    "cursor"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}