@scopebond/mcp 0.2.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Avouro LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,61 @@
+# @scopebond/mcp
+
+The Scopebond **MCP proxy** — one policy for every Model Context Protocol tool
+call, in front of the servers an agent uses. It sits in-path between an MCP client
+and an upstream server, checks each `tools/call` against your policy before it is
+forwarded, and records a signed **PEP-authorized receipt**. A denied call is never
+forwarded.
+
+- **Label:** in-path · prevents. The proxy decides the caller's request (no agent
+  signature), so its receipts are `pep_authorized` — the identity is the
+  configured principal, and the receipt attests that the proxy authorized the
+  call, never that an agent signed it.
+
+## Use it
+
+Point your MCP client at `scopebond-mcp` and give it the real server after `--`:
+
+```
+scopebond-mcp --server filesystem --policy scopebond.policy.json --key scopebond-agent.key \
+  -- npx -y @modelcontextprotocol/server-filesystem /path/to/workspace
+```
+
+`tools/call` is checked; everything else (`initialize`, `tools/list`, …) passes
+through. A denial returns a JSON-RPC error to the client and is never sent
+upstream. Set `--receipts log.jsonl` to keep the signed receipts locally.
+
+**Ceiling.** The proxy governs **tool invocations** (`tools/call`). It does not
+gate resource reads (`resources/read`) or prompt fetches (`prompts/get`), which
+pass through — so a server that exposes data as resources rather than tools is not
+covered by a tool policy. Govern such data at the server, or front only servers
+whose sensitive operations are tools.
+
+## Policy
+
+Bound MCP calls with the Action Taxonomy's `mcp.tool.call` type — "read-only
+filesystem tools only":
+
+```json
+{
+  "vocabulary_version": "1.0", "policy_id": "mcp", "version": 1,
+  "clauses": [
+    { "id": "fs", "type": "action_allowlist", "mode": "enforce",
+      "action_types": ["mcp.tool.call"],
+      "param_bounds": { "server": { "enum": ["filesystem"] }, "tool": { "pattern": "^(?!delete_|write_).+" } } }
+  ]
+}
+```
+
+## Library
+
+The proxy core is exported and transport-agnostic:
+
+```js
+import { createMcpProxy, mapMcpToolCall } from "@scopebond/mcp";
+```
+
+`createMcpProxy({ policy, principal, server, attesterKeyPem, upstream })` returns
+`{ handle(message) }`; inject `upstream` to test the decision path without a real
+server.
+
+Experimental alpha; controlled test use only.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+// scopebond-mcp — a stdio Model Context Protocol proxy. It sits between an MCP
+// client and an upstream server: the client speaks MCP to this process, and this
+// process speaks MCP to the upstream command (everything after `--`). Every
+// tools/call is checked against policy before it is forwarded; a denial returns a
+// JSON-RPC error and is never sent upstream.
+//
+//   scopebond-mcp init --server <id>          scaffold a key + starter policy
+//   scopebond-mcp --server <id> [--policy p.json] [--key k.pem] [--principal sub] \
+//       [--receipts log.jsonl] -- <upstream-command...>
+//
+// Env: SCOPEBOND_MCP_POLICY, SCOPEBOND_MCP_KEY, SCOPEBOND_MCP_SERVER,
+//      SCOPEBOND_MCP_PRINCIPAL, SCOPEBOND_MCP_RECEIPTS.
+// MCP stdio is newline-delimited JSON-RPC. Fail closed: any setup error exits 1.
+import { readFileSync, appendFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { createMcpProxy } from "./proxy.js";
+import { scaffold } from "./init.js";
+import { connectCloud, loadMcpConnection, connectionFileFor, openExporter } from "./cloud.js";
+function arg(name, fallback) {
+    const i = process.argv.indexOf(name);
+    return i >= 0 ? process.argv[i + 1] : fallback;
+}
+function die(message) { process.stderr.write(`scopebond-mcp: ${message}\n`); process.exit(1); }
+// `init`: scaffold a key + a starter policy for one server, then exit.
+if (process.argv[2] === "init") {
+    const server = arg("--server", process.env.SCOPEBOND_MCP_SERVER);
+    if (!server)
+        die("usage: scopebond-mcp init --server <upstream-server-id>");
+    const { keyFile, policyFile } = scaffold(server, { force: process.argv.includes("--force") });
+    console.log(`Scopebond MCP proxy enrolled for server "${server}":`);
+    console.log(`  key      ${keyFile}`);
+    console.log(`  policy   ${policyFile} (starter — edit the tool bounds)`);
+    console.log("");
+    console.log("Point your MCP client at the proxy:");
+    console.log(`  scopebond-mcp --server ${server} -- <your real MCP server command>`);
+    process.exit(0);
+}
+// `connect`: enroll the proxy's key with a workspace and store a scoped credential.
+if (process.argv[2] === "connect") {
+    const url = process.argv[3];
+    const bundleFile = process.argv[4];
+    const keyPath = arg("--key", process.env.SCOPEBOND_MCP_KEY ?? "scopebond-agent.key");
+    if (!url || !bundleFile)
+        die("usage: scopebond-mcp connect <workspace-url> <enrollment-bundle.json> [--key k.pem]");
+    let bundle;
+    try {
+        bundle = JSON.parse(readFileSync(bundleFile, "utf8"));
+    }
+    catch (e) {
+        die(`could not read the enrollment bundle ${bundleFile}: ${e.message}`);
+    }
+    connectCloud(keyPath, url, bundle).then((c) => {
+        console.log(`Connected to ${c.url} (org ${c.organization_id} · env ${c.environment_id})`);
+        console.log(`  credential stored in ${connectionFileFor(keyPath)} — a secret, do not commit`);
+        console.log("Run the proxy as usual; every governed tool call is now mirrored to your workspace.");
+        process.exit(0);
+    }).catch((e) => die(`connect failed: ${e.message}`));
+}
+else {
+    const dashDash = process.argv.indexOf("--");
+    if (dashDash < 0 || dashDash === process.argv.length - 1)
+        die("provide the upstream command after `--`");
+    const upstreamCmd = process.argv.slice(dashDash + 1);
+    const server = arg("--server", process.env.SCOPEBOND_MCP_SERVER);
+    const policyPath = arg("--policy", process.env.SCOPEBOND_MCP_POLICY ?? "scopebond.policy.json");
+    const keyPath = arg("--key", process.env.SCOPEBOND_MCP_KEY ?? "scopebond-agent.key");
+    const principal = arg("--principal", process.env.SCOPEBOND_MCP_PRINCIPAL ?? "mcp-client");
+    const receiptsPath = arg("--receipts", process.env.SCOPEBOND_MCP_RECEIPTS);
+    if (!server)
+        die("--server (the upstream server id) is required");
+    let policy;
+    let attesterKeyPem;
+    try {
+        policy = JSON.parse(readFileSync(policyPath, "utf8"));
+    }
+    catch (e) {
+        die(`could not read policy ${policyPath}: ${e.message}`);
+    }
+    try {
+        attesterKeyPem = readFileSync(keyPath, "utf8");
+    }
+    catch (e) {
+        die(`could not read signing key ${keyPath}: ${e.message}`);
+    }
+    // When connected to a workspace, mirror the PEP-authorized receipts to the portal
+    // through a durable outbox. The proxy is long-running, so the exporter's own timer
+    // delivers; a final flush runs on shutdown.
+    const connection = loadMcpConnection(keyPath);
+    let exporter;
+    if (connection) {
+        try {
+            exporter = openExporter(keyPath, connection);
+        }
+        catch (e) {
+            die(`durable Cloud outbox could not open: ${e.message}`);
+        }
+    }
+    // Spawn the upstream server and correlate its responses by id.
+    const child = spawn(upstreamCmd[0], upstreamCmd.slice(1), { stdio: ["pipe", "pipe", "inherit"] });
+    child.on("error", (e) => die(`could not start the upstream server: ${e.message}`));
+    const shutdown = (code) => {
+        if (!exporter)
+            process.exit(code);
+        void exporter.flush().finally(() => { exporter.stop(); process.exit(code); });
+    };
+    child.on("exit", (code) => shutdown(code ?? 0));
+    process.on("SIGINT", () => shutdown(0));
+    process.on("SIGTERM", () => shutdown(0));
+    const pending = new Map();
+    const key = (id) => JSON.stringify(id ?? null);
+    createInterface({ input: child.stdout }).on("line", (line) => {
+        if (!line.trim())
+            return;
+        let msg;
+        try {
+            msg = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        const waiter = msg.id !== undefined ? pending.get(key(msg.id)) : undefined;
+        if (waiter) {
+            pending.delete(key(msg.id));
+            waiter(msg);
+            return;
+        }
+        process.stdout.write(line + "\n"); // upstream-initiated notification → pass to the client
+    });
+    const upstream = {
+        call(message) {
+            return new Promise((resolve) => {
+                if (message.id === undefined || message.id === null) { // notification: fire and forget
+                    child.stdin.write(JSON.stringify(message) + "\n");
+                    resolve({ jsonrpc: "2.0", result: null });
+                    return;
+                }
+                pending.set(key(message.id), resolve);
+                child.stdin.write(JSON.stringify(message) + "\n");
+            });
+        },
+    };
+    const proxy = createMcpProxy({
+        policy, principal: { subject: `client:${principal}`, issuer: "scopebond:mcp-proxy" }, server: server,
+        attesterKeyPem, upstream,
+        onReceipt: (r) => {
+            if (receiptsPath) {
+                try {
+                    appendFileSync(receiptsPath, JSON.stringify(r) + "\n");
+                }
+                catch { /* best effort */ }
+            }
+            exporter?.enqueue(r); // mirror to the workspace when connected
+        },
+    });
+    createInterface({ input: process.stdin }).on("line", async (line) => {
+        if (!line.trim())
+            return;
+        let msg;
+        try {
+            msg = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        try {
+            const response = await proxy.handle(msg);
+            if (msg.id !== undefined && msg.id !== null)
+                process.stdout.write(JSON.stringify(response) + "\n");
+        }
+        catch (e) {
+            // Fail closed: a proxy error becomes a JSON-RPC error, never a silent forward.
+            if (msg.id !== undefined && msg.id !== null) {
+                process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id: msg.id, error: { code: -32000, message: `scopebond-mcp failed closed: ${e.message}` } }) + "\n");
+            }
+        }
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,oFAAoF;AACpF,wDAAwD;AACxD,EAAE;AACF,sEAAsE;AACtE,wDAAwD;AACxD,iFAAiF;AAEjF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9F,SAAS,GAAG,CAAC,IAAY,EAAE,QAAiB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AACD,SAAS,GAAG,CAAC,OAAe,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9G,uEAAuE;AACvE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,yDAAyD,CAAC,CAAC;IAC5E,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,IAAI,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,mCAAmC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,oCAAoC,CAAC,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,qBAAqB,CAAE,CAAC;IACtF,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,qFAAqF,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,wCAAwC,UAAU,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IACjG,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,eAAe,UAAU,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,0BAA0B,iBAAiB,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,mBAAoB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;KAAM,CAAC;IAER,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACzG,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,uBAAuB,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,YAAY,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAElE,IAAI,MAAe,CAAC;IACpB,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,yBAAyB,UAAU,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAC3J,IAAI,CAAC;QAAC,cAAc,GAAG,YAAY,CAAC,OAAiB,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,8BAA8B,OAAO,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAEtJ,kFAAkF;IAClF,mFAAmF;IACnF,4CAA4C;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAiB,CAAC,CAAC;IACxD,IAAI,QAAmC,CAAC;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,QAAQ,GAAG,YAAY,CAAC,OAAiB,EAAE,UAAU,CAAC,CAAC;QAAC,CAAC;QAC/D,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,wCAAyC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACpF,CAAC;IAED,+DAA+D;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAClG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,QAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC/D,MAAM,GAAG,GAAG,CAAC,EAAW,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IAExD,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,IAAI,GAAmB,CAAC;QACxB,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,uDAAuD;IAC5F,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAgB;QAC5B,IAAI,CAAC,OAAO;YACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,gCAAgC;oBACrF,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;oBAClD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBACtC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,MAAM,KAAK,GAAG,cAAc,CAAC;QAC3B,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,SAAS,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,MAAM,EAAE,MAAgB;QAC9G,cAAc,EAAE,QAAQ;QACxB,SAAS,EAAE,CAAC,CAAgB,EAAE,EAAE;YAC9B,IAAI,YAAY,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;YACjH,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC;QACjE,CAAC;KACF,CAAC,CAAC;IAEH,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,IAAI,GAAmB,CAAC;QACxB,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,+EAA+E;YAC/E,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gCAAiC,CAAW,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACxK,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACH,CAAC","sourcesContent":["#!/usr/bin/env node\n// scopebond-mcp — a stdio Model Context Protocol proxy. It sits between an MCP\n// client and an upstream server: the client speaks MCP to this process, and this\n// process speaks MCP to the upstream command (everything after `--`). Every\n// tools/call is checked against policy before it is forwarded; a denial returns a\n// JSON-RPC error and is never sent upstream.\n//\n//   scopebond-mcp init --server <id>          scaffold a key + starter policy\n//   scopebond-mcp --server <id> [--policy p.json] [--key k.pem] [--principal sub] \\\n//       [--receipts log.jsonl] -- <upstream-command...>\n//\n// Env: SCOPEBOND_MCP_POLICY, SCOPEBOND_MCP_KEY, SCOPEBOND_MCP_SERVER,\n//      SCOPEBOND_MCP_PRINCIPAL, SCOPEBOND_MCP_RECEIPTS.\n// MCP stdio is newline-delimited JSON-RPC. Fail closed: any setup error exits 1.\n\nimport { readFileSync, appendFileSync } from \"node:fs\";\nimport { spawn } from \"node:child_process\";\nimport { createInterface } from \"node:readline\";\nimport type { SignedReceipt, CloudExporter } from \"@scopebond/gateway\";\nimport { createMcpProxy } from \"./proxy.js\";\nimport type { JsonRpcMessage, McpUpstream } from \"./proxy.js\";\nimport { scaffold } from \"./init.js\";\nimport { connectCloud, loadMcpConnection, connectionFileFor, openExporter } from \"./cloud.js\";\n\nfunction arg(name: string, fallback?: string): string | undefined {\n  const i = process.argv.indexOf(name);\n  return i >= 0 ? process.argv[i + 1] : fallback;\n}\nfunction die(message: string): never { process.stderr.write(`scopebond-mcp: ${message}\\n`); process.exit(1); }\n\n// `init`: scaffold a key + a starter policy for one server, then exit.\nif (process.argv[2] === \"init\") {\n  const server = arg(\"--server\", process.env.SCOPEBOND_MCP_SERVER);\n  if (!server) die(\"usage: scopebond-mcp init --server <upstream-server-id>\");\n  const { keyFile, policyFile } = scaffold(server as string, { force: process.argv.includes(\"--force\") });\n  console.log(`Scopebond MCP proxy enrolled for server \"${server}\":`);\n  console.log(`  key      ${keyFile}`);\n  console.log(`  policy   ${policyFile} (starter — edit the tool bounds)`);\n  console.log(\"\");\n  console.log(\"Point your MCP client at the proxy:\");\n  console.log(`  scopebond-mcp --server ${server} -- <your real MCP server command>`);\n  process.exit(0);\n}\n\n// `connect`: enroll the proxy's key with a workspace and store a scoped credential.\nif (process.argv[2] === \"connect\") {\n  const url = process.argv[3];\n  const bundleFile = process.argv[4];\n  const keyPath = arg(\"--key\", process.env.SCOPEBOND_MCP_KEY ?? \"scopebond-agent.key\")!;\n  if (!url || !bundleFile) die(\"usage: scopebond-mcp connect <workspace-url> <enrollment-bundle.json> [--key k.pem]\");\n  let bundle;\n  try { bundle = JSON.parse(readFileSync(bundleFile, \"utf8\")); }\n  catch (e) { die(`could not read the enrollment bundle ${bundleFile}: ${(e as Error).message}`); }\n  connectCloud(keyPath, url, bundle).then((c) => {\n    console.log(`Connected to ${c.url} (org ${c.organization_id} · env ${c.environment_id})`);\n    console.log(`  credential stored in ${connectionFileFor(keyPath)} — a secret, do not commit`);\n    console.log(\"Run the proxy as usual; every governed tool call is now mirrored to your workspace.\");\n    process.exit(0);\n  }).catch((e) => die(`connect failed: ${(e as Error).message}`));\n} else {\n\nconst dashDash = process.argv.indexOf(\"--\");\nif (dashDash < 0 || dashDash === process.argv.length - 1) die(\"provide the upstream command after `--`\");\nconst upstreamCmd = process.argv.slice(dashDash + 1);\n\nconst server = arg(\"--server\", process.env.SCOPEBOND_MCP_SERVER);\nconst policyPath = arg(\"--policy\", process.env.SCOPEBOND_MCP_POLICY ?? \"scopebond.policy.json\");\nconst keyPath = arg(\"--key\", process.env.SCOPEBOND_MCP_KEY ?? \"scopebond-agent.key\");\nconst principal = arg(\"--principal\", process.env.SCOPEBOND_MCP_PRINCIPAL ?? \"mcp-client\");\nconst receiptsPath = arg(\"--receipts\", process.env.SCOPEBOND_MCP_RECEIPTS);\nif (!server) die(\"--server (the upstream server id) is required\");\n\nlet policy: unknown;\nlet attesterKeyPem: string;\ntry { policy = JSON.parse(readFileSync(policyPath as string, \"utf8\")); } catch (e) { die(`could not read policy ${policyPath}: ${(e as Error).message}`); }\ntry { attesterKeyPem = readFileSync(keyPath as string, \"utf8\"); } catch (e) { die(`could not read signing key ${keyPath}: ${(e as Error).message}`); }\n\n// When connected to a workspace, mirror the PEP-authorized receipts to the portal\n// through a durable outbox. The proxy is long-running, so the exporter's own timer\n// delivers; a final flush runs on shutdown.\nconst connection = loadMcpConnection(keyPath as string);\nlet exporter: CloudExporter | undefined;\nif (connection) {\n  try { exporter = openExporter(keyPath as string, connection); }\n  catch (e) { die(`durable Cloud outbox could not open: ${(e as Error).message}`); }\n}\n\n// Spawn the upstream server and correlate its responses by id.\nconst child = spawn(upstreamCmd[0], upstreamCmd.slice(1), { stdio: [\"pipe\", \"pipe\", \"inherit\"] });\nchild.on(\"error\", (e) => die(`could not start the upstream server: ${e.message}`));\nconst shutdown = (code: number) => {\n  if (!exporter) process.exit(code);\n  void exporter.flush().finally(() => { exporter!.stop(); process.exit(code); });\n};\nchild.on(\"exit\", (code) => shutdown(code ?? 0));\nprocess.on(\"SIGINT\", () => shutdown(0));\nprocess.on(\"SIGTERM\", () => shutdown(0));\n\nconst pending = new Map<string, (m: JsonRpcMessage) => void>();\nconst key = (id: unknown) => JSON.stringify(id ?? null);\n\ncreateInterface({ input: child.stdout }).on(\"line\", (line) => {\n  if (!line.trim()) return;\n  let msg: JsonRpcMessage;\n  try { msg = JSON.parse(line); } catch { return; }\n  const waiter = msg.id !== undefined ? pending.get(key(msg.id)) : undefined;\n  if (waiter) { pending.delete(key(msg.id)); waiter(msg); return; }\n  process.stdout.write(line + \"\\n\"); // upstream-initiated notification → pass to the client\n});\n\nconst upstream: McpUpstream = {\n  call(message) {\n    return new Promise((resolve) => {\n      if (message.id === undefined || message.id === null) { // notification: fire and forget\n        child.stdin.write(JSON.stringify(message) + \"\\n\");\n        resolve({ jsonrpc: \"2.0\", result: null });\n        return;\n      }\n      pending.set(key(message.id), resolve);\n      child.stdin.write(JSON.stringify(message) + \"\\n\");\n    });\n  },\n};\n\nconst proxy = createMcpProxy({\n  policy, principal: { subject: `client:${principal}`, issuer: \"scopebond:mcp-proxy\" }, server: server as string,\n  attesterKeyPem, upstream,\n  onReceipt: (r: SignedReceipt) => {\n    if (receiptsPath) { try { appendFileSync(receiptsPath, JSON.stringify(r) + \"\\n\"); } catch { /* best effort */ } }\n    exporter?.enqueue(r); // mirror to the workspace when connected\n  },\n});\n\ncreateInterface({ input: process.stdin }).on(\"line\", async (line) => {\n  if (!line.trim()) return;\n  let msg: JsonRpcMessage;\n  try { msg = JSON.parse(line); } catch { return; }\n  try {\n    const response = await proxy.handle(msg);\n    if (msg.id !== undefined && msg.id !== null) process.stdout.write(JSON.stringify(response) + \"\\n\");\n  } catch (e) {\n    // Fail closed: a proxy error becomes a JSON-RPC error, never a silent forward.\n    if (msg.id !== undefined && msg.id !== null) {\n      process.stdout.write(JSON.stringify({ jsonrpc: \"2.0\", id: msg.id, error: { code: -32000, message: `scopebond-mcp failed closed: ${(e as Error).message}` } }) + \"\\n\");\n    }\n  }\n});\n}\n"]}

package/dist/cloud.d.ts

@@ -0,0 +1,13 @@
+import { type CloudEnrollmentBundle, type CloudEnrollmentResult, type CloudExporter } from "@scopebond/gateway";
+export interface McpConnection extends CloudEnrollmentResult {
+    url: string;
+}
+export declare const connectionFileFor: (keyPath: string) => string;
+export declare function loadMcpConnection(keyPath: string): McpConnection | null;
+/** Enroll the proxy's signing key (its attester) with a workspace via the one-use
+ *  handoff, then persist the scoped machine credential next to the key. */
+export declare function connectCloud(keyPath: string, url: string, bundle: CloudEnrollmentBundle, fetchImpl?: typeof fetch): Promise<McpConnection>;
+/** A durable exporter for a connection; enqueue each receipt and it flushes on the
+ *  proxy's lifetime (timer) plus an explicit flush on shutdown. */
+export declare function openExporter(keyPath: string, connection: McpConnection, fetchImpl?: typeof fetch): CloudExporter;
+//# sourceMappingURL=cloud.d.ts.map

package/dist/cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../src/cloud.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,KAAK,aAAa,EAC3E,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IAC1D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,KAAG,MAAiC,CAAC;AAEtF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAQvE;AAED;2EAC2E;AAC3E,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,GACpF,OAAO,CAAC,aAAa,CAAC,CAMxB;AAED;mEACmE;AACnE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,aAAa,CAGhH"}

package/dist/cloud.js

@@ -0,0 +1,37 @@
+// scopebond-mcp → Scopebond Cloud: enroll the proxy's signing key with a workspace
+// and export the PEP-authorized receipts it emits, so governed MCP tool calls show
+// in the hosted portal. Reuses the gateway's enrollment and durable exporter (D40).
+// The proxy is long-running, so the exporter's own flush timer delivers; a durable
+// outbox next to the key survives restarts.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { completeCloudEnrollment, createCloudExporter, } from "@scopebond/gateway";
+import { SqliteCloudOutbox, loadOrCreateAttester } from "@scopebond/gateway/node";
+export const connectionFileFor = (keyPath) => keyPath + ".cloud.json";
+export function loadMcpConnection(keyPath) {
+    const path = connectionFileFor(keyPath);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof parsed.url === "string" && typeof parsed.credential === "string")
+            return parsed;
+    }
+    catch { /* fall through */ }
+    return null;
+}
+/** Enroll the proxy's signing key (its attester) with a workspace via the one-use
+ *  handoff, then persist the scoped machine credential next to the key. */
+export async function connectCloud(keyPath, url, bundle, fetchImpl) {
+    const { attester } = loadOrCreateAttester({ file: keyPath });
+    const result = await completeCloudEnrollment({ url, bundle, attester, fetch: fetchImpl });
+    const connection = { url, ...result };
+    writeFileSync(connectionFileFor(keyPath), JSON.stringify(connection, null, 2) + "\n", { mode: 0o600 });
+    return connection;
+}
+/** A durable exporter for a connection; enqueue each receipt and it flushes on the
+ *  proxy's lifetime (timer) plus an explicit flush on shutdown. */
+export function openExporter(keyPath, connection, fetchImpl) {
+    const outbox = new SqliteCloudOutbox(keyPath + ".cloud-outbox.db");
+    return createCloudExporter({ url: connection.url, credential: connection.credential, outbox, fetch: fetchImpl });
+}
+//# sourceMappingURL=cloud.js.map

package/dist/cloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.js","sourceRoot":"","sources":["../src/cloud.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,mFAAmF;AACnF,4CAA4C;AAE5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EACL,uBAAuB,EAAE,mBAAmB,GAE7C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAMlF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,GAAG,aAAa,CAAC;AAEtF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2B,CAAC;QAChF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,MAAuB,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EAAE,GAAW,EAAE,MAA6B,EAAE,SAAwB;IAErF,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAkB,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IACrD,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAAyB,EAAE,SAAwB;IAC/F,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,GAAG,kBAAkB,CAAC,CAAC;IACnE,OAAO,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AACnH,CAAC","sourcesContent":["// scopebond-mcp → Scopebond Cloud: enroll the proxy's signing key with a workspace\n// and export the PEP-authorized receipts it emits, so governed MCP tool calls show\n// in the hosted portal. Reuses the gateway's enrollment and durable exporter (D40).\n// The proxy is long-running, so the exporter's own flush timer delivers; a durable\n// outbox next to the key survives restarts.\n\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport {\n  completeCloudEnrollment, createCloudExporter,\n  type CloudEnrollmentBundle, type CloudEnrollmentResult, type CloudExporter,\n} from \"@scopebond/gateway\";\nimport { SqliteCloudOutbox, loadOrCreateAttester } from \"@scopebond/gateway/node\";\n\nexport interface McpConnection extends CloudEnrollmentResult {\n  url: string;\n}\n\nexport const connectionFileFor = (keyPath: string): string => keyPath + \".cloud.json\";\n\nexport function loadMcpConnection(keyPath: string): McpConnection | null {\n  const path = connectionFileFor(keyPath);\n  if (!existsSync(path)) return null;\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf8\")) as Partial<McpConnection>;\n    if (typeof parsed.url === \"string\" && typeof parsed.credential === \"string\") return parsed as McpConnection;\n  } catch { /* fall through */ }\n  return null;\n}\n\n/** Enroll the proxy's signing key (its attester) with a workspace via the one-use\n *  handoff, then persist the scoped machine credential next to the key. */\nexport async function connectCloud(\n  keyPath: string, url: string, bundle: CloudEnrollmentBundle, fetchImpl?: typeof fetch,\n): Promise<McpConnection> {\n  const { attester } = loadOrCreateAttester({ file: keyPath });\n  const result = await completeCloudEnrollment({ url, bundle, attester, fetch: fetchImpl });\n  const connection: McpConnection = { url, ...result };\n  writeFileSync(connectionFileFor(keyPath), JSON.stringify(connection, null, 2) + \"\\n\", { mode: 0o600 });\n  return connection;\n}\n\n/** A durable exporter for a connection; enqueue each receipt and it flushes on the\n *  proxy's lifetime (timer) plus an explicit flush on shutdown. */\nexport function openExporter(keyPath: string, connection: McpConnection, fetchImpl?: typeof fetch): CloudExporter {\n  const outbox = new SqliteCloudOutbox(keyPath + \".cloud-outbox.db\");\n  return createCloudExporter({ url: connection.url, credential: connection.credential, outbox, fetch: fetchImpl });\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { createMcpProxy, mapMcpToolCall } from "./proxy.js";
+export type { McpProxy, McpProxyConfig, McpUpstream, JsonRpcMessage } from "./proxy.js";
+export { starterMcpPolicy } from "./init.js";
+export { connectCloud, loadMcpConnection, openExporter, connectionFileFor } from "./cloud.js";
+export type { McpConnection } from "./cloud.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC9F,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// @scopebond/mcp — the Model Context Protocol proxy connector. The library
+// surface is the deterministic mapper and the transport-agnostic proxy core; the
+// `scopebond-mcp` binary provides the stdio transport to a real upstream server.
+export { createMcpProxy, mapMcpToolCall } from "./proxy.js";
+export { starterMcpPolicy } from "./init.js";
+export { connectCloud, loadMcpConnection, openExporter, connectionFileFor } from "./cloud.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AAEjF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC","sourcesContent":["// @scopebond/mcp — the Model Context Protocol proxy connector. The library\n// surface is the deterministic mapper and the transport-agnostic proxy core; the\n// `scopebond-mcp` binary provides the stdio transport to a real upstream server.\n\nexport { createMcpProxy, mapMcpToolCall } from \"./proxy.js\";\nexport type { McpProxy, McpProxyConfig, McpUpstream, JsonRpcMessage } from \"./proxy.js\";\nexport { starterMcpPolicy } from \"./init.js\";\nexport { connectCloud, loadMcpConnection, openExporter, connectionFileFor } from \"./cloud.js\";\nexport type { McpConnection } from \"./cloud.js\";\n"]}

package/dist/init.d.ts

@@ -0,0 +1,10 @@
+/** A starter MCP policy: allow read-ish tools on the server, deny destructive
+ *  ones by name. Every threshold is the operator's to edit. */
+export declare function starterMcpPolicy(server: string): Record<string, unknown>;
+export declare function scaffold(server: string, opts?: {
+    force?: boolean;
+}): {
+    keyFile: string;
+    policyFile: string;
+};
+//# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASxE;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAQhH"}

package/dist/init.js

@@ -0,0 +1,26 @@
+// `scopebond-mcp init` — scaffold the local enrollment for the proxy: a signing
+// key and a starter policy for one upstream server. Keys and receipts stay local.
+import { writeFileSync, existsSync } from "node:fs";
+import { loadOrCreateAttester } from "@scopebond/gateway/node";
+/** A starter MCP policy: allow read-ish tools on the server, deny destructive
+ *  ones by name. Every threshold is the operator's to edit. */
+export function starterMcpPolicy(server) {
+    return {
+        vocabulary_version: "1.0", policy_id: "mcp", version: 1,
+        clauses: [{
+                id: "tools", type: "action_allowlist", mode: "enforce", action_types: ["mcp.tool.call"],
+                param_bounds: { server: { enum: [server] }, tool: { pattern: "^(?!delete_|write_|remove_|drop_|rm_).+" } },
+                description: `Allow non-destructive tools on ${server}; deny delete/write/remove/drop/rm tools.`,
+            }],
+    };
+}
+export function scaffold(server, opts = {}) {
+    const keyFile = "scopebond-agent.key";
+    const policyFile = "scopebond.policy.json";
+    loadOrCreateAttester({ file: keyFile }); // reused if present
+    if (!existsSync(policyFile) || opts.force) {
+        writeFileSync(policyFile, JSON.stringify(starterMcpPolicy(server), null, 2) + "\n");
+    }
+    return { keyFile, policyFile };
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kFAAkF;AAElF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;+DAC+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO;QACL,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACvD,OAAO,EAAE,CAAC;gBACR,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC;gBACvF,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,EAAE;gBAC1G,WAAW,EAAE,kCAAkC,MAAM,2CAA2C;aACjG,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,OAA4B,EAAE;IACrE,MAAM,OAAO,GAAG,qBAAqB,CAAC;IACtC,MAAM,UAAU,GAAG,uBAAuB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,oBAAoB;IAC7D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC","sourcesContent":["// `scopebond-mcp init` — scaffold the local enrollment for the proxy: a signing\n// key and a starter policy for one upstream server. Keys and receipts stay local.\n\nimport { writeFileSync, existsSync } from \"node:fs\";\nimport { loadOrCreateAttester } from \"@scopebond/gateway/node\";\n\n/** A starter MCP policy: allow read-ish tools on the server, deny destructive\n *  ones by name. Every threshold is the operator's to edit. */\nexport function starterMcpPolicy(server: string): Record<string, unknown> {\n  return {\n    vocabulary_version: \"1.0\", policy_id: \"mcp\", version: 1,\n    clauses: [{\n      id: \"tools\", type: \"action_allowlist\", mode: \"enforce\", action_types: [\"mcp.tool.call\"],\n      param_bounds: { server: { enum: [server] }, tool: { pattern: \"^(?!delete_|write_|remove_|drop_|rm_).+\" } },\n      description: `Allow non-destructive tools on ${server}; deny delete/write/remove/drop/rm tools.`,\n    }],\n  };\n}\n\nexport function scaffold(server: string, opts: { force?: boolean } = {}): { keyFile: string; policyFile: string } {\n  const keyFile = \"scopebond-agent.key\";\n  const policyFile = \"scopebond.policy.json\";\n  loadOrCreateAttester({ file: keyFile }); // reused if present\n  if (!existsSync(policyFile) || opts.force) {\n    writeFileSync(policyFile, JSON.stringify(starterMcpPolicy(server), null, 2) + \"\\n\");\n  }\n  return { keyFile, policyFile };\n}\n"]}

package/dist/proxy.d.ts

@@ -0,0 +1,43 @@
+import type { SignedReceipt } from "@scopebond/gateway";
+export interface JsonRpcMessage {
+    jsonrpc?: string;
+    id?: string | number | null;
+    method?: string;
+    params?: Record<string, unknown>;
+    result?: unknown;
+    error?: unknown;
+}
+/** Map an MCP `tools/call` to a normalized `mcp.tool.call` action. Arguments are
+ * digested, never stored. */
+export declare function mapMcpToolCall(server: string, params: Record<string, unknown> | undefined): {
+    action_type: string;
+    params: Record<string, unknown>;
+};
+/** A pre-authenticated forwarder to the upstream MCP server. Tests inject it; the
+ * CLI implements it over stdio. */
+export interface McpUpstream {
+    call(message: JsonRpcMessage): Promise<JsonRpcMessage>;
+}
+export interface McpProxyConfig {
+    policy: unknown;
+    /** The validated caller identity recorded on every receipt. */
+    principal: {
+        subject: string;
+        issuer: string;
+    };
+    /** The upstream server id, used as the action's `server` parameter. */
+    server: string;
+    /** PEM of the key that signs the PEP receipts (the enrolled proxy key). */
+    attesterKeyPem: string;
+    upstream: McpUpstream;
+    now?: () => string;
+    /** Sink for each emitted receipt (e.g. a local log / exporter). */
+    onReceipt?: (receipt: SignedReceipt) => void | Promise<void>;
+}
+export interface McpProxy {
+    handle(message: JsonRpcMessage): Promise<JsonRpcMessage>;
+}
+/** Build a proxy handler. Every `tools/call` is decided against policy; anything
+ * else is passed through to the upstream unchanged. */
+export declare function createMcpProxy(config: McpProxyConfig): McpProxy;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,oBAAoB,CAAC;AAIlE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAID;6BAC6B;AAC7B,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAKpJ;AAED;mCACmC;AACnC,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,WAAW,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1D;AAED;uDACuD;AACvD,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAgC/D"}

package/dist/proxy.js

@@ -0,0 +1,51 @@
+// The MCP proxy core: sit in front of an upstream MCP server, check each
+// `tools/call` against policy before forwarding it, and emit a signed
+// PEP-authorized receipt. A denied call is never forwarded. Deterministic and
+// transport-agnostic — the upstream is injected, so the decision path is
+// conformance-tested directly; the `scopebond-mcp` CLI provides the real stdio
+// transport. The proxy decides the caller's request (no agent signature), so its
+// receipts are pep_authorized (§15) — the identity is the configured principal.
+import { violates } from "@scopebond/verify";
+import { buildPepReceipt, attesterFromPrivateKeyPem } from "@scopebond/gateway";
+import { canonical } from "@scopebond/policy-schema/canonical";
+import { createHash } from "node:crypto";
+const digest = (value) => "sha256:" + createHash("sha256").update(canonical(value)).digest("hex");
+/** Map an MCP `tools/call` to a normalized `mcp.tool.call` action. Arguments are
+ * digested, never stored. */
+export function mapMcpToolCall(server, params) {
+    return {
+        action_type: "mcp.tool.call",
+        params: { server, tool: String(params?.name ?? ""), args_digest: digest(params?.arguments ?? {}) },
+    };
+}
+/** Build a proxy handler. Every `tools/call` is decided against policy; anything
+ * else is passed through to the upstream unchanged. */
+export function createMcpProxy(config) {
+    const attester = attesterFromPrivateKeyPem(config.attesterKeyPem);
+    return {
+        async handle(message) {
+            if (message?.method !== "tools/call")
+                return config.upstream.call(message);
+            const intent = mapMcpToolCall(config.server, message.params);
+            const claimed = {
+                intent,
+                executed: true,
+                timestamp: config.now?.() ?? new Date().toISOString(),
+                intent_hash: digest(intent).slice(7),
+            };
+            const verdict = violates(config.policy, [], claimed, {});
+            const decision = verdict.violated ? "deny" : "allow";
+            const receipt = await buildPepReceipt({ intent, policy: config.policy, principal: config.principal, realtimeResult: decision, now: config.now }, attester);
+            await config.onReceipt?.(receipt);
+            if (decision === "deny") {
+                return {
+                    jsonrpc: "2.0",
+                    id: message.id ?? null,
+                    error: { code: -32000, message: `Scopebond policy denied ${intent.params.tool}: ${verdict.explanation || "out of policy"}` },
+                };
+            }
+            return config.upstream.call(message);
+        },
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sEAAsE;AACtE,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAEhF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE5H;6BAC6B;AAC7B,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAA2C;IACxF,OAAO;QACL,WAAW,EAAE,eAAe;QAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE;KACnG,CAAC;AACJ,CAAC;AA0BD;uDACuD;AACvD,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,QAAQ,GAAa,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5E,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAuB;YAClC,IAAI,OAAO,EAAE,MAAM,KAAK,YAAY;gBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE3E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG;gBACd,MAAM;gBACN,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;aACrC,CAAC;YACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAe,EAAE,EAAE,EAAE,OAAgB,EAAE,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAErD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAe,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAClH,QAAQ,CACT,CAAC;YACF,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;YAElC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,2BAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,IAAI,eAAe,EAAE,EAAE;iBAC7H,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["// The MCP proxy core: sit in front of an upstream MCP server, check each\n// `tools/call` against policy before forwarding it, and emit a signed\n// PEP-authorized receipt. A denied call is never forwarded. Deterministic and\n// transport-agnostic — the upstream is injected, so the decision path is\n// conformance-tested directly; the `scopebond-mcp` CLI provides the real stdio\n// transport. The proxy decides the caller's request (no agent signature), so its\n// receipts are pep_authorized (§15) — the identity is the configured principal.\n\nimport { violates } from \"@scopebond/verify\";\nimport { buildPepReceipt, attesterFromPrivateKeyPem } from \"@scopebond/gateway\";\nimport type { SignedReceipt, Attester } from \"@scopebond/gateway\";\nimport { canonical } from \"@scopebond/policy-schema/canonical\";\nimport { createHash } from \"node:crypto\";\n\nexport interface JsonRpcMessage {\n  jsonrpc?: string;\n  id?: string | number | null;\n  method?: string;\n  params?: Record<string, unknown>;\n  result?: unknown;\n  error?: unknown;\n}\n\nconst digest = (value: unknown): string => \"sha256:\" + createHash(\"sha256\").update(canonical(value as never)).digest(\"hex\");\n\n/** Map an MCP `tools/call` to a normalized `mcp.tool.call` action. Arguments are\n * digested, never stored. */\nexport function mapMcpToolCall(server: string, params: Record<string, unknown> | undefined): { action_type: string; params: Record<string, unknown> } {\n  return {\n    action_type: \"mcp.tool.call\",\n    params: { server, tool: String(params?.name ?? \"\"), args_digest: digest(params?.arguments ?? {}) },\n  };\n}\n\n/** A pre-authenticated forwarder to the upstream MCP server. Tests inject it; the\n * CLI implements it over stdio. */\nexport interface McpUpstream {\n  call(message: JsonRpcMessage): Promise<JsonRpcMessage>;\n}\n\nexport interface McpProxyConfig {\n  policy: unknown;\n  /** The validated caller identity recorded on every receipt. */\n  principal: { subject: string; issuer: string };\n  /** The upstream server id, used as the action's `server` parameter. */\n  server: string;\n  /** PEM of the key that signs the PEP receipts (the enrolled proxy key). */\n  attesterKeyPem: string;\n  upstream: McpUpstream;\n  now?: () => string;\n  /** Sink for each emitted receipt (e.g. a local log / exporter). */\n  onReceipt?: (receipt: SignedReceipt) => void | Promise<void>;\n}\n\nexport interface McpProxy {\n  handle(message: JsonRpcMessage): Promise<JsonRpcMessage>;\n}\n\n/** Build a proxy handler. Every `tools/call` is decided against policy; anything\n * else is passed through to the upstream unchanged. */\nexport function createMcpProxy(config: McpProxyConfig): McpProxy {\n  const attester: Attester = attesterFromPrivateKeyPem(config.attesterKeyPem);\n  return {\n    async handle(message: JsonRpcMessage): Promise<JsonRpcMessage> {\n      if (message?.method !== \"tools/call\") return config.upstream.call(message);\n\n      const intent = mapMcpToolCall(config.server, message.params);\n      const claimed = {\n        intent,\n        executed: true,\n        timestamp: config.now?.() ?? new Date().toISOString(),\n        intent_hash: digest(intent).slice(7),\n      };\n      const verdict = violates(config.policy as never, [], claimed as never, {});\n      const decision = verdict.violated ? \"deny\" : \"allow\";\n\n      const receipt = await buildPepReceipt(\n        { intent, policy: config.policy as never, principal: config.principal, realtimeResult: decision, now: config.now },\n        attester,\n      );\n      await config.onReceipt?.(receipt);\n\n      if (decision === \"deny\") {\n        return {\n          jsonrpc: \"2.0\",\n          id: message.id ?? null,\n          error: { code: -32000, message: `Scopebond policy denied ${intent.params.tool}: ${verdict.explanation || \"out of policy\"}` },\n        };\n      }\n      return config.upstream.call(message);\n    },\n  };\n}\n"]}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@scopebond/mcp",
+  "version": "0.2.0",
+  "description": "Scopebond MCP proxy — one policy for every Model Context Protocol tool call, in front of the servers an agent uses. In-path enforcement with a signed PEP-authorized receipt.",
+  "license": "Apache-2.0",
+  "author": "Avouro LLC",
+  "homepage": "https://github.com/avouro-com/scopebond/tree/main/packages/mcp#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/avouro-com/scopebond.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/avouro-com/scopebond/issues"
+  },
+  "keywords": [
+    "scopebond",
+    "mcp",
+    "model-context-protocol",
+    "ai-agents",
+    "policy",
+    "proxy"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "scopebond-mcp": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@scopebond/policy-schema": "^0.3.0",
+    "@scopebond/verify": "^0.2.0",
+    "@scopebond/gateway": "^0.5.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.json && node --test test/*.test.mjs"
+  }
+}