@treeship/mcp 0.1.0

package/dist/attest.d.ts

@@ -0,0 +1,2 @@
+import type { AttestParams } from './types.js';
+export declare function attestAction(params: AttestParams): Promise<string | undefined>;

package/dist/attest.js

@@ -0,0 +1,33 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+export async function attestAction(params) {
+    const args = [
+        'attest', 'action',
+        '--actor', params.actor,
+        '--action', params.action,
+        '--format', 'json',
+    ];
+    if (params.parentId) {
+        args.push('--parent', params.parentId);
+    }
+    const cleanMeta = {};
+    for (const [k, v] of Object.entries(params.meta ?? {})) {
+        if (v !== undefined && v !== null)
+            cleanMeta[k] = v;
+    }
+    if (Object.keys(cleanMeta).length > 0) {
+        args.push('--meta', JSON.stringify(cleanMeta));
+    }
+    try {
+        const { stdout } = await exec('treeship', args, { timeout: 5000 });
+        const result = JSON.parse(stdout);
+        return result.id || result.artifact_id;
+    }
+    catch {
+        if (process.env.TREESHIP_DEBUG === '1') {
+            process.stderr.write(`[treeship] attestAction failed: ${params.action}\n`);
+        }
+        return undefined;
+    }
+}

package/dist/client.d.ts

@@ -0,0 +1,12 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import type { CallToolRequest, CallToolResultSchema, CompatibilityCallToolResultSchema, Implementation } from '@modelcontextprotocol/sdk/types.js';
+import type { RequestOptions } from '@modelcontextprotocol/sdk/shared/protocol.js';
+import type { ClientOptions } from '@modelcontextprotocol/sdk/client/index.js';
+export declare class TreeshipMCPClient extends Client {
+    private _actor;
+    private _disabled;
+    constructor(clientInfo: Implementation, options?: ClientOptions);
+    callTool(params: CallToolRequest['params'], resultSchema?: typeof CallToolResultSchema | typeof CompatibilityCallToolResultSchema, options?: RequestOptions): Promise<any>;
+    private _attestIntent;
+    private _attestReceipt;
+}

package/dist/client.js

@@ -0,0 +1,72 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { attestAction } from './attest.js';
+import { hashPayload } from './utils.js';
+export class TreeshipMCPClient extends Client {
+    _actor;
+    _disabled;
+    constructor(clientInfo, options) {
+        super(clientInfo, options);
+        this._actor = process.env.TREESHIP_ACTOR ?? `agent://mcp-${clientInfo?.name ?? 'unknown'}`;
+        this._disabled = process.env.TREESHIP_DISABLE === '1';
+    }
+    async callTool(params, resultSchema, options) {
+        if (this._disabled) {
+            return super.callTool(params, resultSchema, options);
+        }
+        // Attest INTENT before the call (awaited -- proof of what was about to happen)
+        const intentId = await this._attestIntent(params).catch(() => undefined);
+        const startMs = Date.now();
+        let result;
+        let error;
+        try {
+            result = await super.callTool(params, resultSchema, options);
+        }
+        catch (e) {
+            error = e;
+            throw e;
+        }
+        finally {
+            const elapsedMs = Date.now() - startMs;
+            // Attest RECEIPT after the call (fire-and-forget -- never blocks response)
+            this._attestReceipt(params, result, intentId, elapsedMs, error).catch(() => { });
+        }
+        // Attach treeship metadata to result
+        if (intentId && result) {
+            result._treeship = {
+                intent: intentId,
+                tool: params.name,
+                actor: this._actor,
+            };
+        }
+        return result;
+    }
+    async _attestIntent(params) {
+        return attestAction({
+            actor: this._actor,
+            action: `mcp.tool.${params.name}.intent`,
+            meta: {
+                tool: params.name,
+                server: 'mcp',
+                args_digest: hashPayload(JSON.stringify(params.arguments ?? {})),
+                approval_nonce: process.env.TREESHIP_APPROVAL_NONCE || undefined,
+            },
+        });
+    }
+    async _attestReceipt(params, result, intentId, elapsedMs, error) {
+        await attestAction({
+            actor: this._actor,
+            action: `mcp.tool.${params.name}.receipt`,
+            parentId: intentId,
+            meta: {
+                tool: params.name,
+                elapsed_ms: elapsedMs,
+                exit_code: error ? 1 : 0,
+                is_error: result?.isError ?? !!error,
+                output_digest: result
+                    ? hashPayload(JSON.stringify(result.content ?? result))
+                    : undefined,
+                error_message: error?.message,
+            },
+        }).catch(() => { });
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from '@modelcontextprotocol/sdk/client/index.js';
+export { TreeshipMCPClient as Client } from './client.js';
+export type { ToolReceipt, AttestParams } from './types.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+// Re-export EVERYTHING from @modelcontextprotocol/sdk/client unchanged
+// so existing imports still work after switching to @treeship/mcp
+export * from '@modelcontextprotocol/sdk/client/index.js';
+// Override Client with our wrapped version
+export { TreeshipMCPClient as Client } from './client.js';

package/dist/types.d.ts

@@ -0,0 +1,12 @@
+export interface ToolReceipt {
+    intent?: string;
+    receipt?: string;
+    tool: string;
+    actor: string;
+}
+export interface AttestParams {
+    actor: string;
+    action: string;
+    parentId?: string;
+    meta?: Record<string, unknown>;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/utils.d.ts

@@ -0,0 +1 @@
+export declare function hashPayload(content: string): string;

package/dist/utils.js

@@ -0,0 +1,4 @@
+import { createHash } from 'node:crypto';
+export function hashPayload(content) {
+    return 'sha256:' + createHash('sha256').update(content).digest('hex');
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@treeship/mcp",
+  "version": "0.1.0",
+  "description": "Drop-in Treeship attestation for MCP tool calls",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/zerkerlabs/treeship",
+    "directory": "bridges/mcp"
+  },
+  "homepage": "https://treeship.dev",
+  "keywords": ["treeship", "mcp", "attestation", "agents", "tool-calls"],
+  "files": ["dist"],
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run"
+  }
+}