@strixgov/mcp-proxy 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,93 @@
+# Changelog
+
+All notable changes to `@strixgov/mcp-proxy` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0]
+
+Initial release. The Strix MCP Proxy — a standalone process that
+wraps any upstream MCP server with governance, with **zero changes**
+to the upstream's tool implementations.
+
+This is the **distribution wedge** for governed agent tool execution
+per [`docs/strategy/mcp-mode-ladder-v1.md`](https://github.com/Strixgov/strix/tree/main/docs/strategy/mcp-mode-ladder-v1.md):
+fastest path to "Strix governs every MCP call on this machine,"
+designed so Mode 3 (Capability-Enforced) is the v0.2.0 upgrade path
+rather than a v1.0 rewrite.
+
+### Added
+- `COMMERCIAL.md` — plain-English summary of the ELv2 boundary,
+  designed for both the developer evaluating the proxy (30-second
+  decision tree) and the legal / procurement team reviewing it
+  (10-row scenarios table with ✅ / 💰 / ⚠️ outcomes). Mirrors the
+  posture of `@strixgov/mcp-adapter`'s COMMERCIAL.md with
+  proxy-specific deployment scenarios (multi-tenant gateway, MSP,
+  on-prem appliance). Ships in the npm tarball via the `files`
+  allowlist.
+- `strix-mcp-proxy` CLI — spawn over stdio in place of any upstream
+  MCP server; configure via flags or a JSON config file. Compatible
+  with Claude Desktop, mcp-cli, IDE integrations, and any other
+  MCP-aware client that spawns its servers as child processes.
+- `startProxy(opts)` programmatic API in `src/index.mjs` for
+  embedding the proxy in a host process or test harness.
+- `loadConfig(filePath)` + `resolveCapabilities(spec)` config-loader
+  helpers — validated config-file shape, ~`/` expansion in
+  `storagePath`, dynamic import of companion-pack capability arrays.
+- Companion-pack-aware classification — accepts any
+  `@strixgov/capabilities-mcp-common/*` import path via the
+  `capabilities` config field. Heuristic fallback for unknown tools.
+- Local-mode (in-memory + JSONL) signed Ed25519 receipts; opt-in
+  connected mode (sync to `strixgov.com`) via `STRIX_API_KEY` +
+  `STRIX_TENANT_ID` per the mcp-adapter contract.
+- Approval gate plumbing — wired to `@strixgov/tool-gateway`'s
+  approver interface; consumers supply their own
+  Slack / webhook / web UI / terminal approver.
+- Actor context forwarding — clients that put
+  `_meta.strix_actor_id` / `_meta.strix_actor_role` on a callTool
+  request get those fields bound into the receipt.
+- Test mode (`transport: { kind: "test", ... }`) — caller supplies
+  an `InMemoryTransport` pair so the full proxy pipeline can be
+  exercised in-process without spawning subprocesses. Used by the
+  end-to-end test suite.
+
+### Verification
+- 25 tests pass under `node --test` (+1 skipped: the network-gated
+  tarball install smoke; opt in with `STRIX_RUN_TARBALL_INSTALL=1`):
+  - `test/proxy-end-to-end.test.mjs` — full pipeline with linked
+    InMemoryTransport pairs; ALLOW round-trip, DENY blocks the
+    upstream + still emits signed receipt, companion-pack canonical
+    receipt ids, actor-context forwarding, audit-event lifecycle,
+    riskOverrides batch gating, startProxy validation errors.
+  - `test/config.test.mjs` — config-file loader validation, ~/
+    expansion, companion-pack dynamic import resolution.
+  - `test/cli.test.mjs` — `--help`, `--version`, missing-arg errors,
+    missing-file errors.
+- Companion-pack lookup uses `cap.name` indexing (the P0 #2 fix
+  shipped on `claude/strix-mcp-wrapping-IDXOy`) so server-prefixed
+  tool names (`notion-fetch`, `slack_send_message`) match the pack
+  rather than falling through to the MEDIUM EXECUTE heuristic.
+
+### Mode coverage
+- **Mode 1 (Observed)** — every call produces a signed receipt.
+- **Mode 2 (Approval-Gated)** — HIGH / CRITICAL or rule-targeted
+  calls held at the action boundary; approver identity bound to
+  the receipt; non-retroactive.
+- **Mode 3 (Capability-Enforced)** — explicitly deferred to v0.2.0.
+  The design seam (`buildUpstreamIface()` in `src/proxy.mjs`) is the
+  single place where `execution_authorization_v1` token mint +
+  transport will attach. The cryptographic primitive is already
+  shipped at `@strixgov/mcp-token-validator`.
+
+### License
+- Source-available under [Elastic License 2.0](./LICENSE) — per the
+  packaging spec at `docs/strategy/mcp-adapter-packaging-v1.md`,
+  every commercial-tier package in the Strix bundle ships under
+  ELv2; the trust primitives stay MIT.
+- **NOTE for first publish:** verify the bundled `LICENSE` text
+  against the canonical Elastic License 2.0 at
+  https://www.elastic.co/licensing/elastic-license before tagging
+  `mcp-proxy-v0.1.0`. The bundled text is the agent's best
+  reproduction of the canonical license and should be reviewed by
+  legal counsel before going live.

package/COMMERCIAL.md

@@ -0,0 +1,159 @@
+# Commercial use of `@strixgov/mcp-proxy`
+
+`@strixgov/mcp-proxy` is distributed under the
+[Elastic License 2.0](./LICENSE) — **source-available**, free for
+internal use, with one operational restriction.
+
+This document is the plain-English summary of the license boundary
+and the path to a commercial license when you need one. It is not
+legal advice; the canonical terms live in [`LICENSE`](./LICENSE).
+
+The same licensing posture applies to
+[`@strixgov/mcp-adapter`](https://www.npmjs.com/package/@strixgov/mcp-adapter).
+The trust primitives the proxy depends on
+([`@strixgov/verifier`](https://www.npmjs.com/package/@strixgov/verifier),
+[`@strixgov/tool-gateway`](https://www.npmjs.com/package/@strixgov/tool-gateway),
+[`@strixgov/mcp-token-validator`](https://www.npmjs.com/package/@strixgov/mcp-token-validator),
+the `@strixgov/capabilities-*` packs) are MIT-licensed separately and
+have no commercial restrictions.
+
+---
+
+## Quick answer — 30 seconds (for the developer evaluating the proxy)
+
+Walk down this tree. Stop at the first **yes**.
+
+1. **Are you running `strix-mcp-proxy` on your laptop, in CI, or in a
+   private staging environment?**
+   → **Free.** No license needed.
+
+2. **Are you running it in production in front of MCP servers that
+   *your own* agents talk to?** (e.g. your Claude Desktop config now
+   points at the proxy instead of the upstream Notion / GitHub /
+   Filesystem MCP server)
+   → **Free.** Internal production is the headline ELv2 grant.
+
+3. **Are you running one proxy instance per customer, on infrastructure
+   you own, where each customer's agents go through their own
+   proxy?**
+   → **Free if each instance governs only that customer's agents.**
+   This is "distributing the software in your own product" — see
+   row 6 in the scenarios table.
+
+4. **Are you running one proxy instance that fronts MCP traffic for
+   multiple third-party customers (multi-tenant gateway-as-a-service)?**
+   → **Commercial license required.** Email
+   [`sales@strixgov.com`](mailto:sales@strixgov.com).
+
+5. **Are you offering the proxy itself as a hosted product (e.g.
+   "GovernanceCloud — point your MCP client at us")?**
+   → **Commercial license required.** Same email.
+
+6. **Are you unsure which side of the line you're on?**
+   → Email [`sales@strixgov.com`](mailto:sales@strixgov.com) — most
+   "unsure" cases turn out to be free.
+
+---
+
+## Scenarios table — for legal / procurement review
+
+The cases that come up most often for a network-positioned proxy.
+Cite the row number when emailing for confirmation.
+
+| # | Scenario | Outcome | Why |
+|---|----------|---------|-----|
+| 1 | Internal use — your engineers run `strix-mcp-proxy` locally in front of Claude Desktop's MCP servers | ✅ **Free** | Pure internal use; matches the headline ELv2 grant. |
+| 2 | One proxy per environment (dev/stage/prod), all governing the same company's agents | ✅ **Free** | Same as row 1; the count of instances doesn't matter, the question is whether each instance serves your own agents. |
+| 3 | You wrap the proxy in your own SaaS product (the proxy is invisible to your end users; they never call it, you operate it for the agents *your product* runs) | ✅ **Free** | The proxy is an internal dependency of your product. ELv2's "hosted service" restriction is about whether you expose the proxy's *governance features* to third parties. |
+| 4 | Multi-tenant proxy — one instance fronting MCP traffic for several of *your customers'* agents, where each customer can configure their own policy through the proxy | 💰 **License required** | Hosting the proxy's features for third parties. This is exactly what ELv2 reserves. |
+| 5 | MSP runs one proxy per managed customer, each on the customer's own infrastructure, billed per managed instance | ⚠️ **Email us** | Likely fine if each instance is operationally isolated to a single customer and you're billing for the management service, not for the proxy itself. Quick clarification saves both sides time. |
+| 6 | On-premise enterprise product — you ship a software appliance that includes the proxy; each customer installs it on their own infrastructure and operates it themselves | ✅ **Free** | You're distributing, not hosting. Each customer is operating it internally for themselves. |
+| 7 | You fork the proxy, rebrand it as "AgentGuard Proxy," and sell it as a hosted product | 💰 **License required** | Rebranding doesn't change the license question; hosting third-party governance is the restricted activity. |
+| 8 | Open-source project (non-commercial) ships the proxy as part of its agent toolchain documentation | ✅ **Free** | Internal use by maintainers; redistribution under ELv2 is permitted. |
+| 9 | You operate the proxy AND sync receipts to `strixgov.com` for centralized evidence retention | ⚠️ **Email us** | Proxy use itself is free per row 1; the hosted Strix platform has separate commercial terms. The hosted side is what you'd be buying. |
+| 10 | Federal / regulated buyer requires FAR/DFARS, FedRAMP-adjacent posture, SOC 2, custom MSA | 💰 **License required (Enterprise tier)** | Commercial terms on top of ELv2; same email path — mention "federal." |
+
+### Reading the outcomes
+
+- **✅ Free** — use under ELv2 without contacting us. Standard
+  contribution and redistribution rules apply (see the contribution
+  note below).
+- **💰 License required** — email
+  [`sales@strixgov.com`](mailto:sales@strixgov.com) before deploying.
+  Tier proposal returned within one business day; standard MSA
+  available for review.
+- **⚠️ Email us** — on the boundary or involves a separate Strix
+  product. Quick clarification saves both sides time later.
+
+### What ELv2 actually restricts (one paragraph)
+
+The Elastic License 2.0 grants you the right to read, modify, run, and
+redistribute the software with three limitations: you can't (a) provide
+the software's features to third parties as a hosted or managed
+service, (b) circumvent the license-key functionality, or (c) remove
+or obscure the licensing or attribution notices. Limitation (a) is the
+only one that meaningfully affects this package — (b) doesn't apply
+because there are no license keys, and (c) is just "keep the LICENSE
+file." See the
+[canonical Elastic License 2.0 text](https://www.elastic.co/licensing/elastic-license)
+for the exact wording.
+
+---
+
+## When you need a commercial license
+
+Buy a commercial license if you need any of the following:
+
+1. **Offer the proxy as a hosted or managed governance service to
+   third parties.** Multi-tenant gateway-as-a-service is the
+   archetype. Internal use is fine; B2B service offerings are not.
+2. **Connected Mode at strixgov.com.** Centralized approvals,
+   evidence retention beyond your local disk (EU AI Act 2-year
+   requirement), multi-tenant policy management, SIEM forwarding,
+   compliance evidence packs. None of those are part of the ELv2
+   grant — they're the Strix hosted platform.
+3. **Enterprise features** the standard proxy doesn't ship:
+   SAML/OIDC SSO for approvers, RBAC on approval roles, KMS-backed
+   signing keys (AWS KMS / GCP Cloud KMS), dedicated support, custom
+   MSA, SOC 2 / FedRAMP / regulatory attestations.
+
+If you're not sure which category you're in, email
+[`sales@strixgov.com`](mailto:sales@strixgov.com).
+
+---
+
+## How to get a commercial license
+
+Email [`sales@strixgov.com`](mailto:sales@strixgov.com) with:
+
+- Your company name + primary contact
+- A one-paragraph description of how you intend to deploy the proxy
+- Approximate scale (number of tenants, expected receipt volume per
+  month, target compliance regimes — SOC 2 / EU AI Act / HIPAA /
+  FedRAMP)
+- Whether you need any of the Enterprise features listed above
+
+Federal procurement: same email, mention federal scope and we'll route
+appropriately.
+
+---
+
+## What about contribution?
+
+Contributions are welcome under ELv2. By submitting a pull request you
+agree your contribution is licensed under the same terms as the rest
+of the package — same approach as Elasticsearch, Kibana, Sentry, and
+other ELv2 projects.
+
+---
+
+## Where to read the actual terms
+
+- [`LICENSE`](./LICENSE) — the verbatim Elastic License 2.0 text.
+- [`@strixgov/mcp-adapter/COMMERCIAL.md`](https://github.com/Strixgov/strix/tree/main/packages/strixgov-mcp-adapter/COMMERCIAL.md)
+  — the sibling document for the adapter library; same posture, mostly
+  the same scenarios.
+- [https://www.elastic.co/licensing/elastic-license](https://www.elastic.co/licensing/elastic-license)
+  — the canonical Elastic 2.0 source. The bundled `LICENSE` should
+  match this verbatim; if you spot a discrepancy, the canonical source
+  wins — file an issue.

package/LICENSE

@@ -0,0 +1,91 @@
+Elastic License 2.0
+
+Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+Limitations
+
+You may not provide the software to others as a hosted or managed service,
+where the service provides users with access to any substantial set of the
+features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf
+of your company.
+
+Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license
+no later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your
+licenses to terminate automatically and permanently.
+
+No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.
+
+Definitions
+
+The "licensor" is the entity offering these terms, and the "software" is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+"you" refers to the individual or entity agreeing to these terms.
+
+"your company" is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+"control" means ownership of substantially all the assets of an entity, or
+the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+"your licenses" are all the licenses granted to you for the software under
+these terms.
+
+"use" means anything you do with the software requiring one of your licenses.
+
+"trademark" means trademarks, service marks, and similar rights.

package/README.md

@@ -0,0 +1,234 @@
+# @strixgov/mcp-proxy
+
+**The distribution wedge for governed agent tool execution. Point your MCP client at the proxy instead of the underlying server — every `callTool` becomes intercepted, evaluated against policy, and emits a signed Ed25519 receipt. Designed so Mode 3 enforcement is the v0.2.0 upgrade path, not a rewrite.**
+
+```sh
+npm install -g @strixgov/mcp-proxy
+strix-mcp-proxy --config ./proxy-config.json
+```
+
+Compared to `@strixgov/mcp-adapter`, which is a library you integrate into
+your own MCP server code: the proxy is a **standalone process** you run in
+front of any existing MCP server, with **zero changes** to your tool
+implementations. It's the "change your MCP endpoint" path — the lowest-friction
+way to put Strix governance in front of an agent in production.
+
+## What it does
+
+```
+MCP Client ──stdio──▶ [strix-mcp-proxy] ──stdio──▶ Upstream MCP Server (Notion, GitHub, Filesystem, …)
+                            ▲
+                            │
+                    governMCPServer:
+                    classify → policy → approval → receipt
+```
+
+For every incoming `callTool`:
+
+1. **Classify** the tool via the configured companion pack (heuristic fallback for unknown).
+2. **Evaluate** policy — `ALLOW` / `DENY` / `APPROVAL_REQUIRED`.
+3. **Hold** for an approver when policy demands it.
+4. **Execute** via the upstream MCP server (only on `ALLOW`).
+5. **Sign** an Ed25519 receipt — allowed or denied — verifiable against the public JWKS by `@strixgov/verifier`.
+
+Tool implementations are untouched. The MCP client (Claude Desktop, mcp-cli,
+IDE integration, your own code) doesn't need to know Strix exists — it just
+spawns this proxy in place of the upstream server.
+
+## 5-line integration (Claude Desktop)
+
+```jsonc
+// ~/Library/Application Support/Claude/claude_desktop_config.json
+{
+  "mcpServers": {
+    "notion": {
+      "command": "strix-mcp-proxy",
+      "args": ["--config", "/Users/you/strix-proxy/notion.json"]
+    }
+  }
+}
+```
+
+The config file at `notion.json` points the proxy at the real Notion MCP
+server and sets your policy. See [`examples/notion-proxy-config.json`](./examples/notion-proxy-config.json)
+for a complete example.
+
+## Config file shape
+
+```jsonc
+{
+  "serverId": "notion",                         // namespace for capability ids
+  "upstream": {
+    "command": "npx",
+    "args": ["-y", "@notionhq/notion-mcp-server"]
+  },
+  "capabilities": "@strixgov/capabilities-mcp-common/notion",  // import path
+  "policy": {
+    "rules": {
+      "mcp.notion.create_database": "DENY"      // per-capability override
+    },
+    "riskOverrides": {
+      "LOW": "ALLOW",
+      "MEDIUM": "APPROVAL_REQUIRED",
+      "HIGH": "APPROVAL_REQUIRED",
+      "CRITICAL": "DENY"
+    },
+    "default": "DENY"
+  },
+  "approval": { "enabled": false },
+  "storagePath": "~/.strix-mcp-proxy/notion"    // optional; JSONL receipts on disk
+}
+```
+
+`capabilities` can be either:
+- a bare import path (`@strixgov/capabilities-mcp-common/notion`,
+  `@strixgov/capabilities-mcp-common/github`, etc.) — resolved at startup
+- an inline array of `McpCapability` objects (caller-managed classification)
+
+## CLI flags (no config file needed for simple cases)
+
+```sh
+strix-mcp-proxy \
+  --upstream-command npx \
+  --upstream-arg "-y" --upstream-arg "@notionhq/notion-mcp-server" \
+  --server-id notion \
+  --capabilities @strixgov/capabilities-mcp-common/notion \
+  --policy-default DENY \
+  --risk-low ALLOW \
+  --risk-medium APPROVAL_REQUIRED \
+  --risk-critical DENY \
+  --storage-path ~/.strix-mcp-proxy/notion
+```
+
+Run `strix-mcp-proxy --help` for the full flag list.
+
+## What ships with the proxy
+
+| Feature | v0.1.0 | v0.2.0 (planned) |
+|---|---|---|
+| MCP stdio transport (consumer side) | ✓ | — |
+| MCP stdio transport (upstream side) | ✓ | — |
+| MCP HTTP transport (either side) | — | ✓ |
+| Companion-pack classification | ✓ | — |
+| Heuristic fallback for unknown tools | ✓ | — |
+| Fail-closed default policy | ✓ | — |
+| Per-capability rules + risk overrides | ✓ | — |
+| Approval gate (any approver implementation) | ✓ | — |
+| Local-mode signed receipts (in-memory or JSONL) | ✓ | — |
+| Connected mode (sync receipts to `strixgov.com`) | ✓ | — |
+| Mode 1 (Observed) | ✓ | — |
+| Mode 2 (Approval-Gated) | ✓ | — |
+| **Mode 3 (Capability-Enforced) — `execution_authorization_v1` token mint + transport** | — | ✓ |
+| **Posture B reference impl (HTTP outbound enforcement)** | — | ✓ |
+
+See [`docs/strategy/mcp-mode-ladder-v1.md`](https://github.com/Strixgov/strix/tree/main/docs/strategy/mcp-mode-ladder-v1.md)
+for the framing of Mode 1 / 2 / 3 and the exact public claim available
+at each enforcement strength.
+
+## The upgrade path to Mode 3
+
+Mode 3 — Capability-Enforced — is the upgrade, not a rewrite. The
+v0.1.0 proxy already routes every outbound call through a single
+`buildUpstreamIface()` seam in `src/proxy.mjs`. In v0.2.0 a new option
+(`mode: "enforced"`) will wrap that seam with the
+`execution_authorization_v1` token mint + transport step per
+[`docs/architecture/mcp-mode-3-enforcement-v1.md`](https://github.com/Strixgov/strix/tree/main/docs/architecture/mcp-mode-3-enforcement-v1.md).
+
+Operators turn on Mode 3 by adding `"mode": "enforced"` to the config
+file. Upstream MCP servers that opt in to validation (via
+[`@strixgov/mcp-token-validator`](https://www.npmjs.com/package/@strixgov/mcp-token-validator))
+refuse to act on sensitive tools unless the token is present.
+
+The cryptographic primitive is already shipped — see
+[`@strixgov/mcp-token-validator`](https://www.npmjs.com/package/@strixgov/mcp-token-validator).
+v0.1.0 of the proxy does not mint these tokens yet; what it does is
+make sure the *seam* exists so v0.2.0 plugs in cleanly.
+
+## Listening to receipts
+
+```js
+import { startProxy } from "@strixgov/mcp-proxy";
+
+const handle = await startProxy({
+  upstream: { command: "npx", args: ["-y", "@notionhq/notion-mcp-server"] },
+  serverId: "notion",
+  capabilities: notionCapabilities,
+  policy: { default: "DENY", riskOverrides: { LOW: "ALLOW" } },
+  onReceipt: (r) => {
+    console.log(r.decision, r.capabilityId, r.signature);
+  },
+});
+```
+
+Every receipt is byte-compatible with [`@strixgov/verifier`](https://www.npmjs.com/package/@strixgov/verifier):
+
+```sh
+npx @strixgov/verifier chain ~/.strix-mcp-proxy/notion/receipts.jsonl
+```
+
+The verifier has zero Strix runtime dependency. Strix is not on the
+trust path of receipt verification.
+
+## What this proxy is NOT
+
+- **Not an MCP server you call directly.** It's a *wrap* of an
+  existing MCP server. You need an upstream.
+- **Not a replacement for `@strixgov/mcp-adapter`.** The adapter is
+  the library; the proxy is the standalone process. They share the
+  same governance core (`@strixgov/tool-gateway`) and produce
+  byte-identical receipts.
+- **Not Mode 3 today.** v0.1.0 ships Mode 1 + Mode 2. Mode 3
+  enforcement is the v0.2.0 upgrade path, designed for, but not
+  implemented in, this release.
+
+## Security posture
+
+See [`SECURITY.md`](./SECURITY.md) for the security-team-facing
+posture, including:
+
+- **Credential boundary** — three deployment positions (proxy holds /
+  proxy passes through / proxy never sees the credential) with the
+  audit-posture trade-off of each.
+- **What the proxy stores** — only signed receipts (with
+  `invocationHash`, NOT raw args), the gateway signing key, and
+  policy config. Never auth credentials. Never raw tool args.
+- **Process model** — what happens on crash / mid-approval / disk
+  full. Fail-closed at every boundary; the proxy will not start
+  without a loadable signing key.
+- **Multi-tenant boundary** — single-tenant by design in v0.1.0;
+  run one proxy process per tenant for isolation.
+- **What the proxy does NOT govern** — out-of-wrapper traffic, the
+  agent's internal state, the upstream's own argument handling
+  (SQL/command injection inside the upstream is the upstream's
+  responsibility).
+
+Report security issues via GitHub Security Advisory on
+`github.com/Strixgov/strix`. The companion operator runbook at
+[`docs/runbooks/operate-mcp-proxy.md`](https://github.com/Tarshann/strix-platform/tree/main/docs/runbooks/operate-mcp-proxy.md)
+covers daily operations, receipt-log rotation, and upgrade
+discipline.
+
+## License
+
+Source-available under the [Elastic License 2.0](./LICENSE).
+
+You may use, modify, and self-host the proxy internally — including
+in production — provided you do not offer it as a hosted or managed
+service to third parties.
+
+If you run the proxy in a commercial product or want hosted approvals,
+connected mode, retention, or compliance evidence packs, email
+`sales@strixgov.com`.
+
+The trust primitives the proxy depends on
+([`@strixgov/verifier`](https://www.npmjs.com/package/@strixgov/verifier),
+[`@strixgov/tool-gateway`](https://www.npmjs.com/package/@strixgov/tool-gateway),
+[`@strixgov/mcp-token-validator`](https://www.npmjs.com/package/@strixgov/mcp-token-validator))
+remain MIT-licensed. Strix is not on the trust path of receipt
+verification or token validation — that property is unchanged by
+this license boundary.
+
+## Requirements
+
+- Node.js ≥ 18
+- An upstream MCP server (stdio transport)