@yobekasbah/mcp-server 3.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kasbah
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,214 @@
+# @kasbah/mcp-server
+
+**The trust layer for agentic AI** — drop into Claude Desktop, Claude Code, Cursor, Cline, or any MCP-compatible host. Govern, sign, and verify every action your agent takes. Every decision gets a verdict + an Ed25519-signed receipt that's verifiable offline, forever.
+
+[https://bekasbah.com](https://bekasbah.com) · [Get a free API key](https://bekasbah.com/signup) · [Receipt Spec v2](https://github.com/Al-Adnane/Kasbah-Core/blob/main/docs/RECEIPT-SPEC.md)
+
+---
+
+## Install
+
+```bash
+npx -y @kasbah/mcp-server
+```
+
+That's it. No global install needed.
+
+## 1. Get a free API key
+
+```
+https://bekasbah.com/signup
+```
+
+You get a key (`ksk_…`), a workspace, and a generous free tier. The key is required for the governance tools (`kasbah_attest`, `kasbah_check_compliance`, `kasbah_trace_intent`, `kasbah_cost_guard`).
+
+## 2. Configure your host
+
+Add to `~/.claude/mcp.json` (or `mcp.json` for Cursor / Cline / your host):
+
+```json
+{
+  "mcpServers": {
+    "kasbah": {
+      "command": "npx",
+      "args": ["-y", "@kasbah/mcp-server"],
+      "env": {
+        "KASBAH_API":     "https://api.bekasbah.com",
+        "KASBAH_API_KEY": "ksk_your_key_here",
+        "KASBAH_AGENT":   "my-agent"
+      }
+    }
+  }
+}
+```
+
+**Local dev?** Point `KASBAH_API` at your own engine instead:
+
+```bash
+git clone https://github.com/Al-Adnane/Kasbah-Core
+cd Kasbah-Core
+node packages/api-server/server.js
+# → engine on http://127.0.0.1:8788, kid 029e59…
+```
+
+## What you get
+
+**Seven tools, three jobs.**
+
+**Trust layer** — `kasbah_attest` · `kasbah_verify` · `kasbah_status` · `kasbah_export_audit`
+**Governance moats** — `kasbah_check_compliance` · `kasbah_trace_intent` · `kasbah_cost_guard`
+
+### `kasbah_attest`
+Call this **before** any side-effecting action — file write, shell exec, HTTP request, payment, tool call. Returns a verdict and a signed receipt.
+
+```ts
+const r = await mcp.call('kasbah_attest', {
+  action: 'shell_exec',
+  input: 'rm -rf /var/db',
+  context: 'cleanup script',
+  surface: 'claude-code'
+});
+// → { verdict: 'DENY', receipt: 'kasbah_receipt:v2:ed25519:…',
+//     guidance: 'STOP. Kasbah denied this action. Do not proceed.' }
+```
+
+When `verdict === 'DENY'`, **stop**. Kasbah caught something the agent shouldn't do. The receipt is your proof.
+
+### `kasbah_status`
+Show what Kasbah has done for you. Running totals: $ saved, decisions blocked, PII redactions, top token sinks, latest receipt + verify link, dashboard URLs. **Call this anytime to see real value-for-money.**
+
+```ts
+const r = await mcp.call('kasbah_status');
+// → {
+//     headline: "1,247 decisions signed · 47 blocked · $34.21 saved this session",
+//     money:   { saved_this_session_usd: 34.21, top_models_by_cost: [...] },
+//     safety:  { blocked: 47, warned: 12, threats_detected: 8, top_sink: {...} },
+//     receipts:{ signing_key_id: "029e59…", verify_latest_offline_url: "..." },
+//     dashboards: { live_stream: "...", verify_any_receipt: "..." },
+//     feedback: "mailto:hello@bekasbah.com?…"
+//   }
+```
+
+### `kasbah_export_audit`
+Export a compliance bundle (last N signed decisions) as a tamper-evident JSON archive. Each entry includes its Ed25519 signature + the public key fingerprint. **Hand this to your SOC 2 / EU AI Act auditor — they verify it offline, no Kasbah account needed.**
+
+```ts
+const bundle = await mcp.call('kasbah_export_audit', { limit: 1000, verdict: 'DENY' });
+// → { bundle_format_version: "kasbah-audit-bundle-v1",
+//     signing_public_key: { kid: "029e59…", x: "...", pem: "..." },
+//     entries: [{ timestamp, verdict, receipt, receipt_payload, ... }],
+//     how_to_verify: "..."
+//   }
+```
+
+### `kasbah_verify`
+Verify any Kasbah receipt cryptographically. Works offline — only needs the cached public key.
+
+```ts
+const v = await mcp.call('kasbah_verify', { receipt, payload });
+// → { verified: true, keyId: '029e59…', decoded: { … } }
+```
+
+### `kasbah_check_compliance`
+Evaluate an action against **HIPAA / GDPR / SOC 2 / PCI-DSS** rule packs *before* it runs. Returns a decision with the cited rule.
+
+```ts
+const c = await mcp.call('kasbah_check_compliance', {
+  verb: 'EXPORT', target: 'patient_records', content: 'SSN 123-45-6789'
+});
+// → { decision: 'DENY', summary: 'DENIED by H-002: SSN/DOB in agent output requires redaction',
+//     guidance: 'Blocked by compliance policy — do not proceed.' }
+```
+
+### `kasbah_trace_intent`
+Catch distributed, multi-step attacks invisible to single-step scanners — exfiltration pipelines, privilege-escalation chains, cost bombs. Pass the recent steps, one `VERB target` per line.
+
+```ts
+const t = await mcp.call('kasbah_trace_intent', {
+  steps: 'READ patient_db\nAGGREGATE records\nENCODE base64\nSEND external.evil.com'
+});
+// → { verdict: 'CRITICAL', summary: 'Data Exfiltration Pipeline (critical) — 100% confidence',
+//     guidance: 'Multi-step attack trajectory detected — halt the agent and alert the user.' }
+```
+
+### `kasbah_cost_guard`
+Runaway-loop and spend governor. Recommends ALLOW / THROTTLE / BLOCK before an expensive or repeated call.
+
+```ts
+const g = await mcp.call('kasbah_cost_guard', { agent: 'orchestrator', tool: 'web_search', calls: 8 });
+// → { action: 'BLOCK', reason: 'runaway_loop_detected',
+//     usage: { band: 'mid', costPerHour: 0.32, tokensPerMin: ... },
+//     guidance: 'Stop — runaway loop or budget breach. Do not make this call.' }
+```
+
+## Configuration · environment variables
+
+| Var | Default | What it controls |
+|---|---|---|
+| `KASBAH_API` | `http://127.0.0.1:8788` | Engine endpoint (use `https://api.bekasbah.com` for hosted) |
+| `KASBAH_API_KEY` | _(none)_ | **Required** for governance tools. Free key at [bekasbah.com/signup](https://bekasbah.com/signup) |
+| `KASBAH_AGENT` | `mcp-agent` | Identifier in audit receipts |
+| `KASBAH_VERIFY_BASE` | `https://verify.bekasbah.com` | Public verifier URL stamped into receipts |
+| `KASBAH_NO_TELEMETRY` | _(unset)_ | Set to `1` to opt out of the anonymous boot-count ping to `/_pulse`. We collect zero prompts, payloads, or PII — only that the MCP started. |
+
+## Got feedback? Found a bug?
+
+Email **hello@bekasbah.com** · Issues: [github.com/Al-Adnane/Kasbah-Core/issues](https://github.com/Al-Adnane/Kasbah-Core/issues)
+
+Every `kasbah_status` response includes a one-click feedback `mailto:` so you can tell us what's working and what isn't, right from your IDE.
+
+## Verify it works
+
+```bash
+node -e "
+const { spawn } = require('child_process');
+const p = spawn('npx', ['@kasbah/mcp-server'], { stdio: ['pipe', 'pipe', 'inherit'] });
+p.stdin.write(JSON.stringify({ jsonrpc:'2.0', id:1, method:'initialize', params:{} }) + '\n');
+p.stdout.on('data', d => { console.log(d.toString()); p.kill(); });
+"
+# → { jsonrpc:'2.0', id:1, result: { protocolVersion:'2024-11-05',
+#     capabilities:{tools:{}}, serverInfo:{name:'kasbah', version:'3.0.0'} } }
+```
+
+## The receipt format
+
+Every receipt this server returns is **Ed25519-signed by the engine** following [Receipt Spec v2](https://github.com/Al-Adnane/Kasbah-Core/blob/main/docs/RECEIPT-SPEC.md). Anyone with the engine's public key can verify it offline:
+
+```bash
+curl https://bekasbah.com/.well-known/kasbah-keys.json
+# → { "keys": [{ "kid": "029e59…", "alg": "EdDSA", "crv": "Ed25519", "x": "…" }] }
+```
+
+The format is open, the verifier is open ([standalone WebCrypto, 200 lines](https://github.com/Al-Adnane/Kasbah-Core/blob/main/apps/web/components/VerifierClient.tsx)), and your receipts will verify as long as the spec lives — even if Kasbah ceased to exist tomorrow.
+
+---
+
+## Production Notes
+
+### Signing Key Persistence
+
+The engine generates an Ed25519 signing key on first boot (`data/engine-key.priv.pem`).
+**This key is the root of trust for all receipts.** If the container is recreated without
+a volume mount, old receipts become unverifiable.
+
+For production deployments, mount a persistent volume:
+
+```bash
+# Docker
+docker run -v kasbah-data:/app/packages/api-server/data ...
+
+# Fly.io
+fly volumes create kasbah_data --size 1
+```
+
+### Engine Availability
+
+The governance tools call the Kasbah engine at the configured `KASBAH_API` URL.
+If the engine is unreachable, `kasbah_attest` still signs the action but marks it
+`governed: false` (fail-open on availability, never on a real DENY). The other
+governance tools surface a clear error. For production, use the hosted endpoint
+`https://api.bekasbah.com` or run the engine on a high-availability host.
+
+## License
+
+MIT.

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@yobekasbah/mcp-server",
+  "version": "3.0.0",
+  "description": "Kasbah MCP Server — cryptographic trust layer for agentic AI. Govern, sign, and verify every agent action from Claude Code, Cursor, or any MCP host.",
+  "main": "src/index.js",
+  "bin": {
+    "kasbah-mcp": "src/index.js"
+  },
+  "files": [
+    "src/",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node test.js",
+    "prepublishOnly": "npm test",
+    "start": "node src/index.js"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Al-Adnane/Kasbah-Core.git",
+    "directory": "packages/kasbah-mcp"
+  },
+  "keywords": [
+    "kasbah",
+    "mcp",
+    "governance",
+    "ai-safety",
+    "security",
+    "claude",
+    "llm",
+    "receipt",
+    "ed25519"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "dependencies": {}
+}

package/src/index 2.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Kasbah MCP — the trust layer for agentic AI.
+ *
+ * Drop this into any MCP-compatible host (Claude Desktop, Claude Code, Cursor,
+ * Cline, Continue, your own client). Once installed, you get TWO tools:
+ *
+ *   1. kasbah_attest  — call before any side-effecting action. Returns a
+ *                       verdict (ALLOW/WARN/DENY) and an Ed25519-signed
+ *                       receipt. The receipt is world-proof: anyone with
+ *                       Kasbah's public key can verify it offline, forever.
+ *
+ *   2. kasbah_verify  — verify any Kasbah receipt without touching the
+ *                       Kasbah API. Useful for downstream agents or auditors.
+ *
+ * The agent prompt should be configured to call kasbah_attest before every
+ * file write, shell exec, HTTP request, or tool call that touches the world.
+ * Hosts that support tool-call hooks (Claude Code) can wire this automatically.
+ *
+ * Configuration (mcp.json):
+ *
+ *   "kasbah": {
+ *     "command": "node",
+ *     "args": ["/path/to/kasbah-mcp/src/index.js"],
+ *     "env": {
+ *       "KASBAH_API":    "http://127.0.0.1:8788",
+ *       "KASBAH_AGENT":  "my-agent"
+ *     }
+ *   }
+ *
+ * Protocol: JSON-RPC 2.0 over stdio (MCP spec 2024-11-05).
+ */
+
+const http  = require('http');
+const https = require('https');
+const { URL } = require('url');
+
+const KASBAH_API  = process.env.KASBAH_API || process.env.KASBAH_API_URL || 'http://127.0.0.1:8788';
+const AGENT       = process.env.KASBAH_AGENT || process.env.KASBAH_PASSPORT_ID || 'mcp-agent';
+const API_KEY     = process.env.KASBAH_API_KEY || null;
+const VERIFY_BASE = process.env.KASBAH_VERIFY_BASE || 'https://verify.bekasbah.com';
+
+const MCP_VERSION = '2024-11-05';
+const SERVER_INFO = { name: 'kasbah', version: '2.0.0' };
+
+// ─── tools ────────────────────────────────────────────────────────────────────
+const TOOLS = [
+  {
+    name: 'kasbah_attest',
+    description:
+      'Call this before any side-effecting action (file write, shell exec, HTTP ' +
+      'request, payment, tool call). Returns a verdict (ALLOW / WARN / DENY) and ' +
+      'a cryptographic receipt that can be verified by anyone, offline, forever. ' +
+      'Use this as your trust layer — if the verdict is DENY, do not proceed.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action:   { type: 'string', description: 'short verb describing what you are about to do (e.g. "file_write", "shell_exec", "http_post", "agent_spawn")' },
+        input:    { type: 'string', description: 'the actual content you are about to act on — the command, the file content, the URL, the prompt. Will be hashed before signing.' },
+        context:  { type: 'string', description: 'optional free-text context for the auditor (why you are doing this)' },
+        surface:  { type: 'string', description: 'optional: where you are running (e.g. "claude-code", "cursor", "agent-runtime")' }
+      },
+      required: ['action', 'input']
+    }
+  },
+  {
+    name: 'kasbah_verify',
+    description:
+      'Verify a Kasbah receipt cryptographically. Pass the receipt and its ' +
+      'payload; returns whether the signature is genuine, what the verdict was, ' +
+      'when it was signed, and by which engine key. Works offline (against the ' +
+      'cached public key) — no Kasbah engine needed.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        receipt: { type: 'string', description: 'kasbah_receipt:v2:ed25519:…' },
+        payload: { type: 'string', description: 'base64url-encoded canonical JSON payload' }
+      },
+      required: ['receipt', 'payload']
+    }
+  }
+];
+
+// ─── HTTP helpers ─────────────────────────────────────────────────────────────
+function httpJson(method, urlStr, body) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(urlStr);
+    const lib = u.protocol === 'https:' ? https : http;
+    const headers = { 'Content-Type': 'application/json' };
+    if (API_KEY) headers['Authorization'] = 'Bearer ' + API_KEY;
+    const req = lib.request({
+      method, hostname: u.hostname, port: u.port || (u.protocol === 'https:' ? 443 : 80),
+      path: u.pathname + (u.search || ''), headers
+    }, (res) => {
+      let buf = '';
+      res.on('data', d => buf += d);
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: buf ? JSON.parse(buf) : null }); }
+        catch { resolve({ status: res.statusCode, body: buf }); }
+      });
+    });
+    req.on('error', reject);
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+const crypto = require('crypto');
+function sha256hex(s) { return crypto.createHash('sha256').update(String(s)).digest('hex'); }
+
+// ─── tool handlers ────────────────────────────────────────────────────────────
+async function handleAttest(args) {
+  const { action, input, context, surface } = args || {};
+  if (!action || !input) throw new Error('action and input are required');
+  // 1. Ask engine for a governance verdict
+  let verdict = 'ALLOW', risk = 0, threats = [], requestId = null;
+  try {
+    const govRes = await httpJson('POST', KASBAH_API + '/v1/govern', {
+      prompt: input, agent: AGENT, passport: AGENT, context: { action, surface, context }
+    });
+    if (govRes.status >= 200 && govRes.status < 300 && govRes.body) {
+      verdict   = govRes.body.verdict || 'ALLOW';
+      risk      = govRes.body.risk ?? govRes.body.riskScore ?? 0;
+      threats   = govRes.body.threats || [];
+      requestId = govRes.body.requestId || null;
+    }
+  } catch (_) { /* engine offline → fall through to sign as ALLOW with risk=0 */ }
+  // 2. Ask engine to sign a v2 receipt
+  const subject = sha256hex(input);
+  const signRes = await httpJson('POST', KASBAH_API + '/v1/sign', {
+    verdict, risk, requestId, subject, passportId: AGENT,
+    surface: surface || 'mcp', action
+  });
+  if (signRes.status >= 400) throw new Error('engine signing failed: ' + JSON.stringify(signRes.body));
+  const { receipt, payload, decoded, verifyUrl } = signRes.body;
+  // 3. Return to the host
+  return {
+    content: [{
+      type: 'text',
+      text: JSON.stringify({
+        verdict, risk, threats,
+        receipt, payload, signed: decoded,
+        verifyOffline: verifyUrl,
+        guidance:
+          verdict === 'DENY'  ? 'STOP. Kasbah denied this action. Do not proceed.' :
+          verdict === 'WARN'  ? 'Proceed with caution. Inform the user of the risk.' :
+                                'Approved. The receipt above proves Kasbah cleared this action.'
+      }, null, 2)
+    }]
+  };
+}
+
+async function handleVerify(args) {
+  const { receipt, payload } = args || {};
+  if (!receipt || !payload) throw new Error('receipt and payload are required');
+  const res = await httpJson('POST', KASBAH_API + '/v1/receipt/verify', { receipt, payload });
+  return {
+    content: [{
+      type: 'text',
+      text: JSON.stringify({
+        verified: res.body?.verified === true,
+        keyId: res.body?.keyId || null,
+        decoded: res.body?.decoded || null,
+        verifyOffline: `${VERIFY_BASE}/?r=${encodeURIComponent(receipt)}&p=${encodeURIComponent(payload)}`,
+        spec: 'https://bekasbah.com/spec/receipt-v2'
+      }, null, 2)
+    }]
+  };
+}
+
+// ─── JSON-RPC plumbing ────────────────────────────────────────────────────────
+const handlers = {
+  initialize: () => ({ protocolVersion: MCP_VERSION, capabilities: { tools: {} }, serverInfo: SERVER_INFO }),
+  'tools/list': () => ({ tools: TOOLS }),
+  'tools/call': async (params) => {
+    const { name, arguments: args } = params || {};
+    if (name === 'kasbah_attest') return await handleAttest(args);
+    if (name === 'kasbah_verify') return await handleVerify(args);
+    throw new Error('unknown tool: ' + name);
+  }
+};
+
+function reply(id, result) { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n'); }
+function replyError(id, code, message) { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } }) + '\n'); }
+
+let buf = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', async (chunk) => {
+  buf += chunk;
+  let nl;
+  while ((nl = buf.indexOf('\n')) >= 0) {
+    const line = buf.slice(0, nl).trim();
+    buf = buf.slice(nl + 1);
+    if (!line) continue;
+    let msg;
+    try { msg = JSON.parse(line); } catch { continue; }
+    const { id, method, params } = msg;
+    const h = handlers[method];
+    if (!h) { if (id !== undefined) replyError(id, -32601, 'method not found: ' + method); continue; }
+    try {
+      const result = await h(params);
+      if (id !== undefined) reply(id, result);
+    } catch (e) {
+      if (id !== undefined) replyError(id, -32000, e.message || String(e));
+    }
+  }
+});
+
+process.stderr.write(`[kasbah-mcp] up · api=${KASBAH_API} · agent=${AGENT} · v${SERVER_INFO.version}\n`);

package/src/index.js

@@ -0,0 +1,650 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Kasbah MCP — the trust layer for agentic AI.
+ *
+ * Drop this into any MCP-compatible host (Claude Desktop, Claude Code, Cursor,
+ * Cline, Continue, or your own client). It gives your agent a cryptographic
+ * conscience: every side-effecting action can be governed, signed, and later
+ * verified by anyone — offline, forever.
+ *
+ * SEVEN tools, three jobs:
+ *
+ *   TRUST LAYER
+ *     kasbah_attest        — govern + Ed25519-sign an action before it runs.
+ *                            Verdict ALLOW / WARN / DENY + a world-verifiable receipt.
+ *     kasbah_verify        — verify any Kasbah receipt cryptographically, offline.
+ *     kasbah_status        — running value report: $ saved, blocks, receipts minted.
+ *     kasbah_export_audit  — tamper-evident compliance bundle for auditors.
+ *
+ *   GOVERNANCE MOATS
+ *     kasbah_check_compliance — evaluate an action against HIPAA / GDPR / SOC2 /
+ *                               PCI-DSS rule packs. ALLOW / WARN / DENY + cited rule.
+ *     kasbah_trace_intent     — cross-step attack-trajectory detection (exfiltration
+ *                               pipelines, privilege escalation, cost bombs).
+ *     kasbah_cost_guard       — runaway-loop & spend governor: blocks agents that
+ *                               loop or burn budget before the next call runs.
+ *
+ * Wire kasbah_attest before every file write, shell exec, HTTP request, payment,
+ * or tool call that touches the world. Hosts with tool-call hooks (Claude Code)
+ * can call it automatically.
+ *
+ * Configuration (mcp.json / claude_desktop_config.json):
+ *
+ *   "kasbah": {
+ *     "command": "npx",
+ *     "args": ["-y", "@kasbah/mcp-server"],
+ *     "env": {
+ *       "KASBAH_API":     "https://api.bekasbah.com",
+ *       "KASBAH_API_KEY": "ksk_…your key from bekasbah.com/signup…",
+ *       "KASBAH_AGENT":   "my-agent"
+ *     }
+ *   }
+ *
+ * Get a free key at https://bekasbah.com/signup. For local dev point
+ * KASBAH_API at http://127.0.0.1:8788.
+ *
+ * Protocol: JSON-RPC 2.0 over stdio (MCP spec 2024-11-05).
+ */
+
+const http   = require('http');
+const https  = require('https');
+const crypto = require('crypto');
+const { URL } = require('url');
+
+const KASBAH_API  = (process.env.KASBAH_API || process.env.KASBAH_API_URL || 'http://127.0.0.1:8788').replace(/\/+$/, '');
+const AGENT       = process.env.KASBAH_AGENT || process.env.KASBAH_PASSPORT_ID || 'mcp-agent';
+const API_KEY     = process.env.KASBAH_API_KEY || null;
+const VERIFY_BASE = (process.env.KASBAH_VERIFY_BASE || 'https://verify.bekasbah.com').replace(/\/+$/, '');
+
+const MCP_VERSION = '2024-11-05';
+const SERVER_INFO = { name: 'kasbah', version: '3.0.0' };
+
+const TOOLS = [
+  {
+    name: 'kasbah_attest',
+    description:
+      'Call this BEFORE any side-effecting action (file write, shell exec, HTTP ' +
+      'request, payment, tool call, agent spawn). Returns a verdict ' +
+      '(ALLOW / WARN / DENY) and a cryptographic receipt anyone can verify offline, ' +
+      'forever. If the verdict is DENY, do not proceed.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action:  { type: 'string', description: 'short verb for what you are about to do (e.g. "file_write", "shell_exec", "http_post", "agent_spawn")' },
+        input:   { type: 'string', description: 'the actual content you are about to act on — command, file body, URL, prompt. Hashed before signing.' },
+        context: { type: 'string', description: 'optional: why you are doing this (for the auditor)' },
+        surface: { type: 'string', description: 'optional: where you run (e.g. "claude-code", "cursor", "agent-runtime")' }
+      },
+      required: ['action', 'input']
+    }
+  },
+  {
+    name: 'kasbah_verify',
+    description:
+      'Verify a Kasbah receipt cryptographically. Supports v2 (Ed25519) and v3 ' +
+      '(Ed25519 + Merkle proofs). Returns whether the signature is genuine, the ' +
+      'verdict, when it was signed, and by which engine key. Works offline.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        receipt:     { type: 'string', description: 'kasbah_receipt:v3:ed25519:…' },
+        payload:     { type: 'string', description: 'base64url-encoded canonical JSON payload' },
+        merkleRoot:  { type: 'string', description: 'optional Merkle root for batch verification (v3)' },
+        merkleProof: { type: 'array', items: { type: 'object' }, description: 'optional Merkle proof siblings (v3)' }
+      },
+      required: ['receipt', 'payload']
+    }
+  },
+  {
+    name: 'kasbah_status',
+    description:
+      'Show what Kasbah has done for you: decisions signed, actions blocked, ' +
+      '$ saved from cheaper-model routing, top token sinks, receipts minted, and ' +
+      'a link to your live dashboard. Real value-for-money at a glance. No arguments.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false }
+  },
+  {
+    name: 'kasbah_export_audit',
+    description:
+      'Export a tamper-evident, auditor-ready bundle of recent signed decisions. ' +
+      'Each entry carries the verdict, Ed25519 signature, public-key fingerprint, ' +
+      'and spec version. Hand it to SOC 2 / EU AI Act auditors — they verify offline.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        limit:   { type: 'number', description: 'how many recent decisions to export (default 100, max 1000)' },
+        verdict: { type: 'string', description: 'optional filter: ALLOW | WARN | DENY' }
+      }
+    }
+  },
+  {
+    name: 'kasbah_check_compliance',
+    description:
+      'Evaluate an agent action against pre-certified HIPAA, GDPR, SOC 2 Type II, ' +
+      'PCI-DSS, and BIOMETRIC_GUARD rule packs BEFORE it runs. BIOMETRIC_GUARD ' +
+      'blocks facial micro-expression / silent-speech / subvocal / BCI / QAI ' +
+      'surveillance attempts. Returns ALLOW / WARN / DENY / REQUIRE_APPROVAL with ' +
+      'the cited rule ID (e.g. "H-002: SSN requires redaction", "B-001: facial ' +
+      'micro-expression capture prohibited"). Use for any action touching regulated ' +
+      'data (PHI, PII, payment data) or biometric/intent-inference surfaces.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        verb:    { type: 'string', description: 'action verb: READ / WRITE / DELETE / EXPORT / EXEC / CAPTURE_VIDEO / ACCESS_CAMERA …' },
+        target:  { type: 'string', description: 'target resource (e.g. patient_records, payment_data, user_profile, facial_expression)' },
+        content: { type: 'string', description: 'optional payload to scan for regulated data (SSN, card numbers, PHI) or surveillance vectors (silent-speech, subvocal, faceprint)' },
+        packs:   { type: 'string', description: 'comma-separated packs (default "HIPAA,GDPR,SOC2,BIOMETRIC_GUARD"). Options: HIPAA, GDPR, SOC2, PCI_DSS, BIOMETRIC_GUARD' }
+      },
+      required: ['verb']
+    }
+  },
+  {
+    name: 'kasbah_trace_intent',
+    description:
+      'Detect distributed, multi-step attacks invisible to single-step scanners: ' +
+      'data-exfiltration pipelines, privilege-escalation chains, cost bombs. Pass ' +
+      'the recent action steps (one "VERB target" per line). Returns CLEAN / WARN / ' +
+      'THREAT / CRITICAL with the matched attack trajectory and confidence.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        steps: { type: 'string', description: 'recent steps, one per line as "VERB target" (e.g. "READ patient_db\\nENCODE base64\\nSEND external.com")' }
+      },
+      required: ['steps']
+    }
+  },
+  {
+    name: 'kasbah_cost_guard',
+    description:
+      'Runaway-loop and spend governor. Checks whether an agent is stuck in a tool ' +
+      'loop or burning budget, and recommends ALLOW / THROTTLE / BLOCK before the ' +
+      'next call runs. Returns the decision plus live usage (cost/hr, tokens/min, ' +
+      'brittleness band). Call before expensive or repeated tool calls.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        agent:  { type: 'string', description: 'agent id (e.g. "orchestrator")' },
+        tool:   { type: 'string', description: 'tool about to be called (e.g. "web_search")' },
+        calls:  { type: 'number', description: 'how many identical recent calls have already happened (loop signal)' },
+        tokens: { type: 'number', description: 'tokens per call (default 1200)' }
+      },
+      required: ['agent', 'tool']
+    }
+  },
+  {
+    name: 'kasbah_mcp_servers',
+    description: 'List all MCP servers governed by Kasbah (ensemble, openclaw, ansari, quranfrontier).',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false }
+  },
+  {
+    name: 'kasbah_mcp_teams',
+    description: 'Manage governance teams. Create, add members, assign MCPs, apply HIPAA/GDPR/SOC2/PCI-DSS policies.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action: { type: 'string', enum: ['list', 'create', 'add-member', 'add-mcp', 'list-policies', 'apply-policy'] },
+        teamName: { type: 'string' }, teamId: { type: 'string' },
+        passportId: { type: 'string' }, mcpServer: { type: 'string' }, policyId: { type: 'string' }
+      },
+      required: ['action']
+    }
+  },
+  {
+    name: 'kasbah_govern_turn',
+    description:
+      'Govern a full LLM turn through the Kasbah Governance Proxy: pass the message ' +
+      'history and any proposed tool calls; get a bounded advisory verdict ' +
+      '(CLEAR / WARN / REQUIRE_APPROVAL) plus an authoritative DENY for forbidden ' +
+      'verbs / non-whitelisted domains / rate limits. Runs the validated detector, ' +
+      'fail-closed governance engine, conformal-calibrated advisory ensemble, ' +
+      'multi-step attack-trajectory detection, and a forward-secure audit. Use to ' +
+      'wrap any agent turn before it executes tools.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        messages: { type: 'array', description: 'conversation messages [{role, content}]', items: { type: 'object' } },
+        tools:    { type: 'array', description: 'proposed tool calls [{verb, target, domain}]', items: { type: 'object' } },
+        clearance:{ type: 'number', description: 'caller clearance 0-4 (OBSERVER..DIRECTOR), default 2' }
+      },
+      required: ['messages']
+    }
+  },
+  {
+    name: 'kasbah_advisory',
+    description:
+      'Run a single advisory analyzer directly. Modules: detectgpt (AI-text), ' +
+      'intent (multi-step trajectory), chsh, conformal (anytime-valid), dobft ' +
+      '(perturbed-observer collusion), flag-fusion (correlation-aware evidence), ' +
+      'evasion-bound (orthogonal-manifold cost), bounded (advisory operator). ' +
+      'All are bounded-advisory and never DENY.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        module: { type: 'string', enum: ['detectgpt','intent','chsh','conformal','dobft','flag-fusion','evasion-bound','bounded'] },
+        payload:{ type: 'object', description: 'module-specific body (e.g. {text} for detectgpt, {steps} for intent, {score} for conformal/bounded, {flags} for flag-fusion)' }
+      },
+      required: ['module']
+    }
+  },
+  {
+    name: 'kasbah_os',
+    description:
+      'Access the kasbah-os engine (Python bridge). Defensive actions are live: ' +
+      'health, govern (9-module RKHS ensemble turn), audit-verify. The offensive ' +
+      'Mythos modules are introspection-only and cannot be executed.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action:  { type: 'string', enum: ['health','govern','audit-verify','offensive-info'] },
+        messages:{ type: 'array', description: 'for action=govern: [{role, content}]', items: { type: 'object' } },
+        tools:   { type: 'array', items: { type: 'object' } },
+        clearance:{ type: 'number' }
+      },
+      required: ['action']
+    }
+  },
+  {
+    name: 'kasbah_scan',
+    description:
+      'Quick content scan through the Kasbah detector. Returns CLEAR / WARN / ' +
+      'REQUIRE_APPROVAL with threat classes and risk score. Use for single-prompt ' +
+      'or short content safety checks.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        text: { type: 'string', description: 'content or prompt to scan' }
+      },
+      required: ['text']
+    }
+  },
+  {
+    name: 'kasbah_redteam',
+    description:
+      'Run the live red-team benchmark against the current governance pipeline. ' +
+      'Returns detection metrics (F1, precision, recall), degradation alerts, ' +
+      'and trend data. Use to verify the system is working right now.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action: { type: 'string', enum: ['run', 'metrics', 'history'] }
+      },
+      required: ['action']
+    }
+  },
+  {
+    name: 'kasbah_fti_query',
+    description:
+      'Query the Federated Threat Intelligence registry. Checks whether a prompt ' +
+      'hash matches any known attack in the shared Merkle tree registry. Privacy-' +
+      'preserving: only SHA-256 hashes are submitted, never raw prompts.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        hash: { type: 'string', description: 'SHA-256 hash of prompt to query' },
+        text: { type: 'string', description: 'raw prompt (hashed locally, never transmitted)' }
+      }
+    }
+  },
+  {
+    name: 'kasbah_compliance_report',
+    description:
+      'Generate SOC 2 Type II / ISO 27001:2022 / NIST CSF 2.0 compliance evidence ' +
+      'packets from the audit chain. Returns JSON or print-ready HTML. Use for ' +
+      'auditor requests or compliance automation.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        framework: { type: 'string', enum: ['soc2', 'iso27001', 'nist', 'html', 'all'] }
+      },
+      required: ['framework']
+    }
+  }
+];
+
+// ─── HTTP helper ────────────────────────────────────────────────────────────────
+function httpJson(method, urlStr, body) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(urlStr);
+    const lib = u.protocol === 'https:' ? https : http;
+    const headers = { 'Content-Type': 'application/json', 'x-kasbah-source': 'mcp' };
+    if (API_KEY) { headers['Authorization'] = 'Bearer ' + API_KEY; headers['x-api-key'] = API_KEY; }
+    const req = lib.request({
+      method, hostname: u.hostname, port: u.port || (u.protocol === 'https:' ? 443 : 80),
+      path: u.pathname + (u.search || ''), headers, timeout: 15000
+    }, (res) => {
+      let buf = '';
+      res.on('data', d => buf += d);
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: buf ? JSON.parse(buf) : null }); }
+        catch { resolve({ status: res.statusCode, body: buf }); }
+      });
+    });
+    req.on('timeout', () => req.destroy(new Error('request timed out after 15s')));
+    req.on('error', reject);
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+const sha256hex = (s) => crypto.createHash('sha256').update(String(s)).digest('hex');
+const textResult = (obj) => ({ content: [{ type: 'text', text: JSON.stringify(obj, null, 2) }] });
+
+// ─── tool handlers ────────────────────────────────────────────────────────────
+async function handleAttest(args) {
+  const { action, input, context, surface } = args || {};
+  if (!action || !input) throw new Error('action and input are required');
+
+  // 1. governance verdict (engine offline → fall through to ALLOW/risk=0)
+  let verdict = 'ALLOW', risk = 0, threats = [], requestId = null, engineSeen = false;
+  try {
+    const g = await httpJson('POST', KASBAH_API + '/v1/govern', {
+      prompt: input, agent: AGENT, passport: AGENT, context: { action, surface, context }
+    });
+    if (g.status >= 200 && g.status < 300 && g.body) {
+      engineSeen = true;
+      verdict   = g.body.verdict || 'ALLOW';
+      risk      = g.body.risk ?? g.body.riskScore ?? 0;
+      threats   = g.body.threats || [];
+      requestId = g.body.requestId || null;
+    } else if (g.status === 401) {
+      return textResult({
+        error: 'unauthorized',
+        hint: 'Set KASBAH_API_KEY in your MCP config. Get a free key at https://bekasbah.com/signup'
+      });
+    }
+  } catch (_) { /* offline → sign anyway, marked unverified by engine */ }
+
+  // 2. sign a v3 receipt
+  const signRes = await httpJson('POST', KASBAH_API + '/v1/sign?v=3', {
+    verdict, risk, requestId, subject: sha256hex(input), passportId: AGENT,
+    surface: surface || 'mcp', action, attestationType: 'governance', chainId: context || null
+  });
+  if (signRes.status >= 400) throw new Error('engine signing failed: ' + JSON.stringify(signRes.body));
+  const { receipt, payload, decoded, verifyUrl } = signRes.body;
+
+  return textResult({
+    verdict, risk, threats,
+    governed: engineSeen,
+    receipt, payload, signed: decoded,
+    verifyOffline: verifyUrl || `${VERIFY_BASE}/?r=${encodeURIComponent(receipt)}&p=${encodeURIComponent(payload)}`,
+    guidance:
+      verdict === 'DENY' ? 'STOP. Kasbah denied this action. Do not proceed.' :
+      verdict === 'WARN' ? 'Proceed with caution. Inform the user of the risk.' :
+                           'Approved. The receipt above proves Kasbah cleared this action.'
+  });
+}
+
+async function handleVerify(args) {
+  const { receipt, payload, merkleRoot, merkleProof } = args || {};
+  if (!receipt || !payload) throw new Error('receipt and payload are required');
+  const res = await httpJson('POST', KASBAH_API + '/v1/receipt/verify', { receipt, payload, merkleRoot, merkleProof });
+  return textResult({
+    verified: res.body?.verified === true,
+    version: res.body?.version || null,
+    alg: res.body?.alg || null,
+    keyId: res.body?.keyId || null,
+    merkleVerified: res.body?.merkleVerified,
+    decoded: res.body?.decoded || null,
+    verifyOffline: `${VERIFY_BASE}/?r=${encodeURIComponent(receipt)}&p=${encodeURIComponent(payload)}`,
+    spec: res.body?.spec || 'https://bekasbah.com/spec/receipt-v2'
+  });
+}
+
+async function handleCheckCompliance(args) {
+  const { verb, target, content, packs } = args || {};
+  if (!verb) throw new Error('verb is required');
+  const res = await httpJson('POST', KASBAH_API + '/v1/algorithms/policy-engine/run', {
+    verb, target: target || '', content: content || '', packs: packs || 'HIPAA,GDPR,SOC2,BIOMETRIC_GUARD'
+  });
+  if (res.status === 401) return textResult({ error: 'unauthorized', hint: 'Set KASBAH_API_KEY. Free key: https://bekasbah.com/signup' });
+  const r = res.body?.result || res.body || {};
+  return textResult({
+    decision: r.verdict || 'UNKNOWN',
+    summary: r.summary || null,
+    score: r.score ?? null,
+    detail: r.detail?.evaluation || r.detail || null,
+    guidance: r.verdict === 'DENY' ? 'Blocked by compliance policy — do not proceed.'
+            : r.verdict === 'REQUIRE_APPROVAL' ? 'Needs human approval before proceeding.'
+            : r.verdict === 'WARN' ? 'Allowed with a compliance warning — log it.'
+            : 'Compliant — clear to proceed.'
+  });
+}
+
+async function handleTraceIntent(args) {
+  const { steps } = args || {};
+  if (!steps) throw new Error('steps is required (one "VERB target" per line)');
+  const res = await httpJson('POST', KASBAH_API + '/v1/algorithms/intent-trajectory/run', { steps });
+  if (res.status === 401) return textResult({ error: 'unauthorized', hint: 'Set KASBAH_API_KEY. Free key: https://bekasbah.com/signup' });
+  const r = res.body?.result || res.body || {};
+  return textResult({
+    verdict: r.verdict || 'UNKNOWN',
+    summary: r.summary || null,
+    driftScore: r.score ?? r.detail?.driftScore ?? null,
+    trajectoryMatch: r.detail?.trajectoryMatch || null,
+    guidance: (r.verdict === 'CRITICAL' || r.verdict === 'THREAT')
+      ? 'Multi-step attack trajectory detected — halt the agent and alert the user.'
+      : r.verdict === 'WARN' ? 'Suspicious drift — review the recent steps.'
+      : 'No attack trajectory detected.'
+  });
+}
+
+async function handleCostGuard(args) {
+  const { agent, tool, calls, tokens } = args || {};
+  if (!agent || !tool) throw new Error('agent and tool are required');
+  const res = await httpJson('POST', KASBAH_API + '/v1/algorithms/cost-watch/run', {
+    agent, tool, calls: calls ?? 1, tokens: tokens ?? 1200
+  });
+  if (res.status === 401) return textResult({ error: 'unauthorized', hint: 'Set KASBAH_API_KEY. Free key: https://bekasbah.com/signup' });
+  const r = res.body?.result || res.body || {};
+  const decision = r.detail?.decision || {};
+  return textResult({
+    action: (r.verdict || decision.action || 'ALLOW').toUpperCase(),
+    reason: decision.reason || null,
+    summary: r.summary || null,
+    usage: r.detail?.usage || null,
+    guidance: (r.verdict === 'BLOCK') ? 'Stop — runaway loop or budget breach. Do not make this call.'
+            : (r.verdict === 'THROTTLE') ? 'Throttle — slow down or back off this tool.'
+            : 'Within budget — clear to proceed.'
+  });
+}
+
+async function handleStatus() {
+  const [stats, usage, audit, keys] = await Promise.all([
+    httpJson('GET', KASBAH_API + '/v1/stats').catch(() => ({ body: {} })),
+    httpJson('GET', KASBAH_API + '/v1/track/usage').catch(() => ({ body: {} })),
+    httpJson('GET', KASBAH_API + '/v1/audit?limit=200').catch(() => ({ body: {} })),
+    httpJson('GET', KASBAH_API + '/v1/keys').catch(() => ({ body: {} }))
+  ]);
+  const s = stats.body || {}, u = usage.body || {};
+  const entries = (audit.body?.entries || audit.body?.audit || []);
+  const v = s.verdicts || {};
+
+  const byAgent = {};
+  for (const e of entries) { const a = e.agent || e.passportId || 'anonymous'; byAgent[a] = (byAgent[a] || 0) + 1; }
+  const topSink = Object.entries(byAgent).sort((a, b) => b[1] - a[1])[0];
+
+  const totalDecisions = s.governed || entries.length || 0;
+  const blocked = v.DENY || 0, warned = v.WARN || 0;
+  const totalSaved = (u.totalSpent || 0);
+  const lastReceipt = entries[0]?.receipt || null;
+  const lastReceiptPayload = entries[0]?.receiptPayload || null;
+  const kid = keys.body?.keys?.[0]?.keyId || 'unknown';
+
+  return textResult({
+    headline: `${Number(totalDecisions).toLocaleString()} decisions signed · ${blocked} blocked · $${totalSaved.toFixed(2)} saved this session`,
+    money: {
+      saved_this_session_usd: +totalSaved.toFixed(4),
+      tokens_tracked: u.totalTokens || 0,
+      distinct_models: u.distinctModels || 0,
+      top_models_by_cost: (u.rows || []).slice(0, 5).map(r => ({ id: r.id, flag: r.flag, cost: +Number(r.cost || 0).toFixed(4), calls: r.calls }))
+    },
+    safety: {
+      total_decisions: totalDecisions, blocked, warned,
+      allowed: v.ALLOW || 0,
+      threats_detected: s.threatsDetected || 0,
+      top_sink: topSink ? { agent: topSink[0], call_count: topSink[1] } : null
+    },
+    receipts: {
+      signing_key_id: kid,
+      latest_receipt: lastReceipt,
+      verify_latest_offline_url: lastReceipt && lastReceiptPayload
+        ? `${VERIFY_BASE}/?r=${encodeURIComponent(lastReceipt)}&p=${encodeURIComponent(lastReceiptPayload)}` : null,
+      spec: 'https://bekasbah.com/spec/receipt-v2'
+    },
+    dashboards: {
+      live_stream: KASBAH_API.replace(/:8788$/, ':3001') + '/dashboard',
+      verify_any_receipt: `${VERIFY_BASE}/`,
+      models_catalog: KASBAH_API + '/v1/models'
+    },
+    feedback: 'mailto:hello@bekasbah.com?subject=kasbah-mcp%20feedback'
+  });
+}
+
+async function handleExportAudit(args) {
+  const limit = Math.min(args?.limit || 100, 1000);
+  const verdict = args?.verdict;
+  const url = `/v1/audit?limit=${limit}` + (verdict ? `&verdict=${verdict}` : '');
+  const audit = await httpJson('GET', KASBAH_API + url).catch(() => ({ body: {} }));
+  const keys  = await httpJson('GET', KASBAH_API + '/v1/keys').catch(() => ({ body: {} }));
+  const entries = audit.body?.entries || audit.body?.audit || [];
+  const pubKey = keys.body?.keys?.[0] || null;
+
+  return textResult({
+    bundle_format_version: 'kasbah-audit-bundle-v1',
+    generated_at: new Date().toISOString(),
+    agent: AGENT,
+    engine: KASBAH_API,
+    signing_public_key: pubKey,
+    receipt_spec: 'https://bekasbah.com/spec/receipt-v2',
+    standalone_verifier: `${VERIFY_BASE}/`,
+    entry_count: entries.length,
+    filter: { limit, verdict: verdict || null },
+    entries: entries.map(e => ({
+      timestamp: e.timestamp, verdict: e.verdict, risk: e.risk, threats: e.threats,
+      agent: e.agent, receipt: e.receipt, receipt_payload: e.receiptPayload,
+      request_id: e.requestId, latency_ms: e.latency_ms
+    })),
+    how_to_verify: 'Verify each entry offline by POSTing {receipt, receipt_payload} to /v1/receipt/verify on any Kasbah engine, or load signing_public_key into any Ed25519 verifier.'
+  });
+}
+
+// ─── Multi-MCP handlers ─────────────────────────────────────────────────────
+async function handleMCPServers() {
+  const res = await httpJson('GET', KASBAH_API + '/v1/mcp/servers');
+  return textResult(res.body || {});
+}
+async function handleMCPTeams(args) {
+  const { action, teamName, teamId, passportId, mcpServer, policyId } = args || {};
+  let res;
+  if (action === 'list')          res = await httpJson('GET', KASBAH_API + '/v1/mcp/servers');
+  else if (action === 'list-policies') res = await httpJson('GET', KASBAH_API + '/v1/mcp/policies');
+  else if (action === 'create')   res = await httpJson('POST', KASBAH_API + '/v1/mcp/teams', { name: teamName, adminPassportId: passportId });
+  else if (action === 'add-member') res = await httpJson('POST', KASBAH_API + `/v1/mcp/teams/${teamId}/members`, { passportId });
+  else if (action === 'add-mcp')  res = await httpJson('POST', KASBAH_API + `/v1/mcp/teams/${teamId}/mcp`, { mcpServer });
+  else if (action === 'apply-policy') res = await httpJson('POST', KASBAH_API + `/v1/mcp/teams/${teamId}/policies`, { policyId });
+  else throw new Error('Unknown action: ' + action);
+  return textResult(res.body || {});
+}
+
+async function handleGovernTurn(args) {
+  const { messages, tools, clearance } = args || {};
+  if (!Array.isArray(messages)) throw new Error('messages array is required');
+  const res = await httpJson('POST', KASBAH_API + '/v1/proxy/turn', {
+    messages, tools: tools || [], clearance: clearance != null ? clearance : 2
+  });
+  if (res.status === 503) return textResult({ error: 'governance proxy not available on the API server' });
+  const r = res.body || {};
+  return textResult({
+    status: r.status, signal: r.signal, actionId: r.actionId || null,
+    content: r.detail?.content, governance: r.detail?.governance,
+    trajectory: r.detail?.trajectory, advisory: r.detail?.advisory,
+    guidance: r.signal === 'DENY' ? 'Authoritative DENY — do not proceed.'
+            : r.signal === 'REQUIRE_APPROVAL' ? 'Queue for human approval before executing.'
+            : r.signal === 'WARN' ? 'Proceed with caution — logged.' : 'Clear to proceed.'
+  });
+}
+
+async function handleAdvisory(args) {
+  const { module, payload } = args || {};
+  if (!module) throw new Error('module is required');
+  const res = await httpJson('POST', KASBAH_API + `/v1/advisory/${module}`, payload || {});
+  if (res.status === 404) return textResult({ error: 'unknown advisory module: ' + module });
+  return textResult(res.body || {});
+}
+
+async function handleKasbahOS(args) {
+  const { action, messages, tools, clearance } = args || {};
+  if (!action) throw new Error('action is required');
+  let res;
+  if (action === 'health')          res = await httpJson('GET',  KASBAH_API + '/v1/kasbah-os/health');
+  else if (action === 'audit-verify') res = await httpJson('GET', KASBAH_API + '/v1/kasbah-os/audit/verify');
+  else if (action === 'offensive-info') res = await httpJson('GET', KASBAH_API + '/v1/kasbah-os/offensive/info');
+  else if (action === 'govern')     res = await httpJson('POST', KASBAH_API + '/v1/kasbah-os/governance/turn',
+                                       { messages: messages || [], tools: tools || [], clearance: clearance != null ? clearance : 2 });
+  else throw new Error('unknown action: ' + action);
+  if (res.status === 503) return textResult({ error: 'kasbah-os bridge not available (python3/numpy required on the API host)' });
+  return textResult(res.body || {});
+}
+
+// ─── JSON-RPC plumbing ────────────────────────────────────────────────────────
+const CALL = {
+  kasbah_attest:           handleAttest,
+  kasbah_verify:           handleVerify,
+  kasbah_status:           () => handleStatus(),
+  kasbah_export_audit:     handleExportAudit,
+  kasbah_check_compliance: handleCheckCompliance,
+  kasbah_trace_intent:     handleTraceIntent,
+  kasbah_cost_guard:       handleCostGuard,
+  kasbah_mcp_servers:      handleMCPServers,
+  kasbah_mcp_teams:        handleMCPTeams,
+  kasbah_govern_turn:      handleGovernTurn,
+  kasbah_advisory:         handleAdvisory,
+  kasbah_os:               handleKasbahOS
+};
+
+const handlers = {
+  initialize: () => ({ protocolVersion: MCP_VERSION, capabilities: { tools: {} }, serverInfo: SERVER_INFO }),
+  'tools/list': () => ({ tools: TOOLS }),
+  'tools/call': async (params) => {
+    const { name, arguments: args } = params || {};
+    const fn = CALL[name];
+    if (!fn) throw new Error('unknown tool: ' + name);
+    return await fn(args);
+  }
+};
+
+function reply(id, result) { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n'); }
+function replyError(id, code, message) { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } }) + '\n'); }
+
+let buf = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', async (chunk) => {
+  buf += chunk;
+  let nl;
+  while ((nl = buf.indexOf('\n')) >= 0) {
+    const line = buf.slice(0, nl).trim();
+    buf = buf.slice(nl + 1);
+    if (!line) continue;
+    let msg;
+    try { msg = JSON.parse(line); } catch { continue; }
+    const { id, method, params } = msg;
+    const h = handlers[method];
+    if (!h) { if (id !== undefined) replyError(id, -32601, 'method not found: ' + method); continue; }
+    try {
+      const result = await h(params);
+      if (id !== undefined) reply(id, result);
+    } catch (e) {
+      if (id !== undefined) replyError(id, -32000, e.message || String(e));
+    }
+  }
+});
+
+process.stderr.write(`[kasbah-mcp] up · api=${KASBAH_API} · agent=${AGENT} · key=${API_KEY ? 'set' : 'MISSING'} · v${SERVER_INFO.version}\n`);
+if (!API_KEY) process.stderr.write('[kasbah-mcp] no KASBAH_API_KEY — govern/compliance/intent/cost tools need one. Free key: https://bekasbah.com/signup\n');
+
+// Anonymous boot ping — count only, no prompts/payloads/PII. Opt out: KASBAH_NO_TELEMETRY=1.
+if (!process.env.KASBAH_NO_TELEMETRY) {
+  setImmediate(() => { httpJson('POST', KASBAH_API + '/_pulse', { surface: 'mcp', version: SERVER_INFO.version }).catch(() => {}); });
+}