ccs-mcp-server 1.0.0

package/README.md

@@ -0,0 +1,108 @@
+# CCS Runtime Evidence MCP Server
+
+A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that brings **CCS runtime verification** to any MCP-compatible client — Claude Desktop, Cursor, Windsurf, ChatGPT apps, and more.
+
+It verifies AI agent tool calls at runtime, blocks unsafe ones by default, and issues **tamper-evident evidence records** for every call (allowed and denied).
+
+> **This is a runtime enforcement layer, not a static scanner.** It runs on every live tool call — not once on source code.
+
+## Tools
+
+| Tool | What it does |
+|---|---|
+| `verify_tool_call` | Verify a tool call across 7 CCS dimensions + semantic attack-chain analysis + math overflow detection. Returns `verdict: allowed/denied`. **Blocks by default.** |
+| `issue_evidence` | Issue a cryptographically bound CCS evidence record (`content_hash` + `evidence_hash`) for a call. Independently verifiable. |
+| `audit_mcp_config` | Audit an MCP configuration JSON for security risks: plain HTTP, weak secrets, disabled TLS, missing commands. |
+
+## Quick Start
+
+### Install and run with npx
+
+```bash
+npx @correctover/ccs-mcp-server
+```
+
+### Claude Desktop / Cursor configuration
+
+Add to your MCP client settings:
+
+```json
+{
+  "mcpServers": {
+    "ccs-runtime-evidence": {
+      "command": "npx",
+      "args": ["-y", "@correctover/ccs-mcp-server"]
+    }
+  }
+}
+```
+
+## What it detects
+
+- **Command injection**: shell metacharacters, `$()`, backticks, dangerous commands
+- **Path traversal**: `../`, `/etc/passwd`, `/proc/self/`, Windows system paths
+- **SSRF**: localhost, link-local (169.254.x.x), private IP ranges
+- **Prompt injection**: "ignore previous instructions", system prompt extraction, special tokens
+- **SQL injection**: UNION SELECT, `OR 1=1`, `DROP TABLE`
+- **Attack chains**: multi-step combinations (e.g. path traversal + SSRF = exfiltration chain)
+- **Math safety**: integer overflow (>2^53-1), NaN/Infinity, DoS strings
+- **Caller identity**: agent ID verification against allowlist
+- **Schema violations**: type, enum, range, required field checks
+- **MCP config risks**: plain HTTP, weak secrets, `--insecure`, disabled TLS
+
+## Evidence format
+
+Every call produces evidence like:
+
+```json
+{
+  "evidence_type": "ccs.tool_call.verification",
+  "evidence_id": "uuid-v4",
+  "tool": "shell.exec",
+  "caller": "agent-001",
+  "verdict": "denied",
+  "mode": "block",
+  "params_hash": "sha256:...",
+  "policy_hash": "sha256:...",
+  "content_hash": "sha256:...",
+  "evidence_hash": "sha256:...",
+  "dimensions": {
+    "Structure": {"status": "pass"},
+    "Schema": {"status": "pass"},
+    "Security": {"status": "fail", "reason": "cmd: command_injection; cmd: path_traversal; cmd: ssrf"},
+    "Identity": {"status": "pass"}
+  },
+  "semantic_analysis": {
+    "attack_chains": [{"chain": "exfil_chain", "severity": "critical"}],
+    "semantic_severity": "critical"
+  },
+  "issued_at": "2026-08-22T12:00:00.000Z"
+}
+```
+
+The dual-hash design (`content_hash` + `evidence_hash`) means any tampering is detectable by any third party.
+
+## About CCS
+
+CCS (Correctover Conformance Shape) is a 7-dimension runtime verification standard for AI agent tool calls:
+
+1. **Structure** — valid tool name, argument format, nesting depth, payload size
+2. **Schema** — type, required fields, enums, ranges, string lengths
+3. **Security** — injection, traversal, SSRF, prompt injection, SQL injection
+4. **Identity** — caller agent ID verification
+5. **Integrity** — request hash validation
+6. **Latency** — execution time budget (warn)
+7. **Cost** — cost budget (warn)
+
+Plus: semantic intent analysis (attack chains, obfuscation signals, privilege escalation) and mathematical verification (overflow, NaN, DoS).
+
+## Links
+
+- npm: https://www.npmjs.com/package/@correctover/ccs-mcp-server
+- Website: https://correctover.com
+- IETF Draft: https://www.ietf.org/archive/id/draft-correctover-ccs-05.txt
+- SkillHub: https://skillhub.cn
+
+## License
+
+Proprietary Commercial License. Reference implementation for CCS standard evaluation.

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "ccs-mcp-server",
+  "version": "1.0.0",
+  "description": "CCS Runtime Evidence MCP Server — verify AI agent tool calls, issue tamper-evident evidence, audit MCP configs. For Claude Desktop, Cursor, Windsurf, and any MCP client.",
+  "type": "commonjs",
+  "bin": {
+    "ccs-mcp-server": "src/index.js"
+  },
+  "main": "src/index.js",
+  "files": ["src", "README.md", "LICENSE"],
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "mcp-server",
+    "mcp-security",
+    "ai-agent-security",
+    "runtime-verification",
+    "ccs",
+    "correctover",
+    "audit",
+    "evidence",
+    "supply-chain-security",
+    "agent-security",
+    "security",
+    "developer-tools"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Correctover/ccs-mcp-server.git"
+  },
+  "homepage": "https://correctover.com",
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {},
+  "mcp": {
+    "name": "ccs-runtime-evidence",
+    "displayName": "CCS Runtime Evidence",
+    "description": "Verify AI agent tool calls and issue tamper-evident CCS evidence records. Blocks command injection, path traversal, SSRF, SQL injection; validates caller identity, schema, cost/latency budgets; produces cryptographically bound evidence."
+  }
+}

package/src/index.js

@@ -0,0 +1,426 @@
+#!/usr/bin/env node
+/**
+ * CCS Runtime Evidence MCP Server v1.0.0
+ *
+ * A standalone Model Context Protocol (MCP) server that exposes CCS runtime
+ * verification as MCP tools, so any MCP-compatible client (Claude Desktop,
+ * Cursor, Windsurf, ChatGPT apps, etc.) can verify AI agent tool calls and
+ * obtain tamper-evident evidence records.
+ *
+ * Tools exposed:
+ *   verify_tool_call   Verify a tool call against CCS 7 dimensions + semantic + math
+ *   issue_evidence     Issue a signed CCS evidence record (allow + deny)
+ *   audit_mcp_config   Audit an MCP server configuration for security risks
+ *
+ * Transport: stdio (per MCP spec). To run:
+ *   npx @correctover/ccs-mcp-server
+ *
+ * License: Proprietary Commercial License (reference implementation).
+ *
+ * This server is a self-contained JavaScript implementation of the CCS
+ * runtime verification reference (mirroring the Python SkillHub distribution
+ * ccs-runtime-verifier). Zero runtime dependencies.
+ */
+
+"use strict";
+
+const crypto = require("crypto");
+const readline = require("readline");
+
+// ---------------------------------------------------------------------------
+// CCS Verifier Core (pure stdlib Node.js)
+// ---------------------------------------------------------------------------
+
+const CCS_VERSION = "1.0.0";
+
+const DEFAULT_POLICY = {
+  mode: "block",
+  max_nesting_depth: 8,
+  max_argument_bytes: 65536,
+  max_string_length: 16384,
+  latency_budget_us: 5000000,
+  cost_budget: 0.05,
+  allowed_tools: [],
+  denied_tools: [],
+  tool_schemas: {},
+  require_caller_identity: true,
+  require_request_hash: false,
+  allowed_callers: [],
+  enable_semantic_analysis: true,
+  enable_math_verification: true,
+};
+
+const INJECTION_PATTERNS = {
+  command_injection: [
+    /[;&|`$]\s*(rm|curl|wget|bash|sh|nc|cat|chmod|eval|exec)\b/i,
+    /\$\([^)]+\)/,
+    /`[^`]+`/,
+    /\|\|\s*\w+/,
+  ],
+  path_traversal: [
+    /\.\.[\/\\]/,
+    /\/etc\/(passwd|shadow|hosts)/,
+    /\/proc\/self\//,
+    /\\windows\\system32/i,
+  ],
+  ssrf: [
+    /https?:\/\/(127\.0\.0\.1|localhost|0\.0\.0\.0|169\.254\.169\.254)/i,
+    /https?:\/\/10\.\d+\.\d+\.\d+/,
+    /https?:\/\/192\.168\.\d+\.\d+/,
+    /https?:\/\/172\.(1[6-9]|2\d|3[01])\.\d+\.\d+/,
+  ],
+  prompt_injection: [
+    /ignore\s+(all\s+)?(previous|above|prior)\s+(instructions?|prompts?)/i,
+    /disregard\s+(all\s+)?(previous|above)/i,
+    /you\s+are\s+now\s+(?:a|an|the)\s+/i,
+    /system\s*prompt/i,
+    /<\|im_start\|>|<\|im_end\|>/,
+  ],
+  sql_injection: [
+    /(\bunion\b.*\bselect\b)/i,
+    /(\bor\b\s+1\s*=\s*1)/i,
+    /(;\s*drop\s+table)/i,
+  ],
+};
+
+const TOOL_RISK_PROFILES = {
+  shell: 0.9, exec: 0.9, system: 0.95,
+  filesystem: 0.6, file: 0.6,
+  network: 0.7, http: 0.7,
+  database: 0.75, sql: 0.8,
+  read: 0.2, math: 0.1,
+};
+
+const DANGEROUS_COMBOS = [
+  { name: "exfil_chain", indicators: ["path_traversal", "ssrf"], severity: "critical" },
+  { name: "rce_chain", indicators: ["command_injection", "path_traversal"], severity: "critical" },
+  { name: "sql_exfil", indicators: ["sql_injection", "ssrf"], severity: "critical" },
+  { name: "prompt_hijack", indicators: ["prompt_injection", "command_injection"], severity: "critical" },
+];
+
+function deepMerge(base, override) {
+  const result = { ...base };
+  for (const [k, v] of Object.entries(override || {})) {
+    if (v && typeof v === "object" && !Array.isArray(v) && result[k] && typeof result[k] === "object") {
+      result[k] = deepMerge(result[k], v);
+    } else {
+      result[k] = v;
+    }
+  }
+  return result;
+}
+
+function canonical(obj) {
+  return JSON.stringify(obj, Object.keys(obj).sort());
+}
+
+function sha256(s) {
+  return "sha256:" + crypto.createHash("sha256").update(s).digest("hex");
+}
+
+function scanValue(val, findings, path = "<root>") {
+  if (typeof val === "string") {
+    for (const [cat, pats] of Object.entries(INJECTION_PATTERNS)) {
+      for (const pat of pats) {
+        if (pat.test(val)) {
+          findings.push(`${path}: ${cat}`);
+          break;
+        }
+      }
+    }
+    if (val.length > 1e7) findings.push(`${path}: dos_string`);
+  } else if (typeof val === "number") {
+    if (Number.isNaN(val) || !Number.isFinite(val)) findings.push(`${path}: nan_or_infinity`);
+    else if (Math.abs(val) > Number.MAX_SAFE_INTEGER) findings.push(`${path}: integer_overflow`);
+    else if (Math.abs(val) > 1e9) findings.push(`${path}: unreasonable_magnitude`);
+    else if (val < 0 && !/offset|delta|diff|change/i.test(path)) findings.push(`${path}: negative_value`);
+  } else if (val && typeof val === "object") {
+    if (Array.isArray(val)) {
+      val.forEach((v, i) => scanValue(v, findings, `${path}[${i}]`));
+    } else {
+      for (const [k, v] of Object.entries(val)) scanValue(v, findings, path === "<root>" ? k : `${path}.${k}`);
+    }
+  }
+}
+
+function structureCheck(call, policy) {
+  const tool = call.tool;
+  if (!tool || typeof tool !== "string") return { ok: false, reason: "missing or invalid 'tool' field" };
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)*$/.test(tool))
+    return { ok: false, reason: `tool name '${tool}' has invalid format` };
+  if (call.arguments !== undefined && typeof call.arguments !== "object")
+    return { ok: false, reason: "'arguments' must be an object or array" };
+  if (policy.denied_tools?.includes(tool)) return { ok: false, reason: `tool '${tool}' is denied` };
+  if (policy.allowed_tools?.length && !policy.allowed_tools.includes(tool))
+    return { ok: false, reason: `tool '${tool}' not in allowed list` };
+  const argBytes = Buffer.byteLength(JSON.stringify(call.arguments || {}));
+  if (argBytes > policy.max_argument_bytes)
+    return { ok: false, reason: `argument size ${argBytes} exceeds limit ${policy.max_argument_bytes}` };
+  return { ok: true };
+}
+
+function securityCheck(call) {
+  const findings = [];
+  scanValue(call.arguments || {}, findings);
+  if (findings.length) return { ok: false, reason: findings.slice(0, 5).join("; "), findings };
+  return { ok: true, findings: [] };
+}
+
+function identityCheck(call, policy) {
+  if (!policy.require_caller_identity) return { ok: true };
+  const caller = call.caller;
+  if (!caller || typeof caller !== "object") return { ok: false, reason: "missing 'caller' object" };
+  if (!caller.agent_id) return { ok: false, reason: "caller missing 'agent_id'" };
+  if (policy.allowed_callers?.length && !policy.allowed_callers.includes(caller.agent_id))
+    return { ok: false, reason: `caller '${caller.agent_id}' not in allowed_callers` };
+  return { ok: true };
+}
+
+function schemaCheck(call, policy) {
+  const schema = policy.tool_schemas?.[call.tool];
+  if (!schema || !call.arguments || typeof call.arguments !== "object") return { ok: true };
+  for (const [field, def] of Object.entries(schema.properties || {})) {
+    if (!(field in call.arguments)) {
+      if ((schema.required || []).includes(field))
+        return { ok: false, reason: `missing required field '${field}'` };
+      continue;
+    }
+    const val = call.arguments[field];
+    if (def.type === "string" && typeof val !== "string") return { ok: false, reason: `field '${field}' must be string` };
+    if (def.type === "number" && typeof val !== "number") return { ok: false, reason: `field '${field}' must be number` };
+    if (def.type === "integer" && !Number.isInteger(val)) return { ok: false, reason: `field '${field}' must be integer` };
+    if (def.type === "boolean" && typeof val !== "boolean") return { ok: false, reason: `field '${field}' must be boolean` };
+    if (def.type === "array" && !Array.isArray(val)) return { ok: false, reason: `field '${field}' must be array` };
+    if (typeof val === "string" && val.length > policy.max_string_length)
+      return { ok: false, reason: `field '${field}' exceeds max length` };
+    if (def.enum && !def.enum.includes(val)) return { ok: false, reason: `field '${field}' not in enum` };
+  }
+  return { ok: true };
+}
+
+function semanticAnalysis(tool, secFindings) {
+  const ns = (tool || "").split(".")[0].toLowerCase();
+  const baseRisk = TOOL_RISK_PROFILES[ns] ?? 0.4;
+  const cats = new Set();
+  for (const f of secFindings) {
+    const m = f.split(": ").pop();
+    if (INJECTION_PATTERNS[m]) cats.add(m);
+  }
+  const chains = DANGEROUS_COMBOS
+    .filter((c) => c.indicators.every((i) => cats.has(i)))
+    .map((c) => ({ chain: c.name, severity: c.severity }));
+  let score = baseRisk + cats.size * 0.15;
+  let severity = "info";
+  if (chains.some((c) => c.severity === "critical")) severity = "critical";
+  else if (score >= 0.9) severity = "critical";
+  else if (score >= 0.7) severity = "high";
+  else if (score >= 0.5) severity = "medium";
+  else if (score >= 0.3) severity = "low";
+  return { tool_namespace: ns, base_risk: baseRisk, attack_chains: chains,
+           finding_categories: [...cats], semantic_severity: severity };
+}
+
+function verifyCall(call, policyOverride) {
+  const policy = deepMerge(DEFAULT_POLICY, policyOverride || {});
+  const dimensions = {};
+
+  const checks = [
+    ["Structure", () => structureCheck(call, policy)],
+    ["Schema", () => schemaCheck(call, policy)],
+    ["Security", () => securityCheck(call)],
+    ["Identity", () => identityCheck(call, policy)],
+  ];
+
+  let secFindings = [];
+  for (const [name, fn] of checks) {
+    const r = fn();
+    dimensions[name] = { status: r.ok ? "pass" : "fail" };
+    if (!r.ok) dimensions[name].reason = r.reason;
+    if (name === "Security") secFindings = r.findings || [];
+  }
+
+  // Latency/Cost (warn-only)
+  const meta = call.metadata || {};
+  dimensions.Latency = { status: "pass" };
+  if (meta.execution_time_us != null && policy.latency_budget_us && meta.execution_time_us > policy.latency_budget_us)
+    dimensions.Latency = { status: "warn", reason: `latency ${meta.execution_time_us}us exceeds budget` };
+  dimensions.Cost = { status: "pass" };
+  if (meta.cost != null && policy.cost_budget && meta.cost > policy.cost_budget)
+    dimensions.Cost = { status: "warn", reason: `cost ${meta.cost} exceeds budget` };
+  dimensions.Integrity = { status: "pass" };
+
+  const enforced = ["Structure", "Schema", "Security", "Identity"];
+  const verdict = (policy.mode === "audit" || enforced.every((d) => dimensions[d].status === "pass")) ? "allowed" : "denied";
+
+  const paramsHash = sha256(canonical(call.arguments || {}));
+  const policyHash = sha256(canonical(policy));
+
+  const semantic = policy.enable_semantic_analysis ? semanticAnalysis(call.tool, secFindings) : undefined;
+
+  const content = {
+    tool: call.tool, caller: call.caller?.agent_id || "unknown", verdict, mode: policy.mode,
+    params_hash: paramsHash, policy_hash: policyHash, dimensions,
+  };
+  const contentHash = sha256(canonical(content));
+
+  const evidence = {
+    evidence_type: "ccs.tool_call.verification",
+    evidence_version: CCS_VERSION,
+    evidence_id: crypto.randomUUID(),
+    tool: call.tool,
+    caller: call.caller?.agent_id || "unknown",
+    verdict,
+    mode: policy.mode,
+    params_hash: paramsHash,
+    policy_hash: policyHash,
+    content_hash: contentHash,
+    dimensions,
+    issued_at: new Date().toISOString(),
+  };
+  if (semantic) evidence.semantic_analysis = semantic;
+  if (call.parent_evidence_hash) evidence.parent_evidence_hash = call.parent_evidence_hash;
+
+  // Finalize evidence_hash
+  const hashBody = { ...evidence };
+  evidence.evidence_hash = sha256(canonical(hashBody));
+  return evidence;
+}
+
+function auditMcpConfig(config) {
+  const issues = [];
+  const servers = config.mcpServers || config.servers || {};
+  for (const [name, srv] of Object.entries(servers)) {
+    if (!srv.command && !srv.url) issues.push({ server: name, severity: "high", issue: "no command or url" });
+    if (srv.url && /^http:\/\//i.test(srv.url)) issues.push({ server: name, severity: "high", issue: "HTTP url (not HTTPS)" });
+    if (srv.env) {
+      for (const k of Object.keys(srv.env)) {
+        if (/KEY|TOKEN|SECRET|PASSWORD/i.test(k) && typeof srv.env[k] === "string" && srv.env[k].length < 8)
+          issues.push({ server: name, severity: "medium", issue: `weak ${k}` });
+      }
+    }
+    if (srv.args?.some((a) => /--insecure|--no-verify|-k$/i.test(a)))
+      issues.push({ server: name, severity: "critical", issue: "TLS verification disabled" });
+  }
+  return { total_servers: Object.keys(servers).length, issues,
+           risk: issues.some((i) => i.severity === "critical") ? "critical" :
+                 issues.some((i) => i.severity === "high") ? "high" :
+                 issues.length ? "medium" : "low" };
+}
+
+// ---------------------------------------------------------------------------
+// MCP Protocol (stdio JSON-RPC 2.0)
+// ---------------------------------------------------------------------------
+
+const PROTOCOL_VERSION = "2024-11-05";
+const SERVER_INFO = { name: "ccs-runtime-evidence", version: CCS_VERSION, title: "CCS Runtime Evidence" };
+
+const TOOLS = [
+  {
+    name: "verify_tool_call",
+    description: "Verify an AI agent tool call against CCS 7 dimensions (Structure, Schema, Security, Identity, Integrity, Latency, Cost) plus semantic attack-chain analysis and math overflow detection. Returns verdict (allowed/denied) with detailed findings. DEFAULT MODE BLOCKS UNSAFE CALLS.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tool: { type: "string", description: "Tool name as namespace.action, e.g. 'shell.exec' or 'read.file'" },
+        arguments: { type: "object", description: "Tool call arguments to verify", additionalProperties: true },
+        caller: { type: "object", description: "Caller identity, e.g. {agent_id: 'agent-001'}",
+                  properties: { agent_id: { type: "string" } }, required: ["agent_id"] },
+        metadata: { type: "object", description: "Optional metadata (execution_time_us, cost, request_id, etc.)", additionalProperties: true },
+        policy: { type: "object", description: "Optional CCS policy override (allowed_tools, denied_tools, mode, budgets, etc.)", additionalProperties: true },
+      },
+      required: ["tool"],
+    },
+  },
+  {
+    name: "issue_evidence",
+    description: "Issue a CCS evidence record for a tool call. Evidence is cryptographically bound (content_hash + evidence_hash), tamper-evident, independently verifiable. Issued for allowed AND denied calls.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tool: { type: "string" },
+        arguments: { type: "object", additionalProperties: true },
+        caller: { type: "object", properties: { agent_id: { type: "string" } }, required: ["agent_id"] },
+        metadata: { type: "object", additionalProperties: true },
+        policy: { type: "object", additionalProperties: true },
+      },
+      required: ["tool", "caller"],
+    },
+  },
+  {
+    name: "audit_mcp_config",
+    description: "Audit an MCP client/server configuration JSON for security risks: plain HTTP, weak secrets, disabled TLS, missing commands. Returns structured issues with severity.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        config: { type: "object", description: "MCP configuration JSON (e.g. Claude Desktop config)", additionalProperties: true },
+      },
+      required: ["config"],
+    },
+  },
+];
+
+function handleRequest(req) {
+  const { method, params, id } = req;
+  if (method === "initialize") {
+    return {
+      jsonrpc: "2.0", id,
+      result: {
+        protocolVersion: params?.protocolVersion || PROTOCOL_VERSION,
+        capabilities: { tools: {} },
+        serverInfo: SERVER_INFO,
+      },
+    };
+  }
+  if (method === "notifications/initialized" || method === "initialized") return null;
+  if (method === "ping") return { jsonrpc: "2.0", id, result: {} };
+  if (method === "tools/list") return { jsonrpc: "2.0", id, result: { tools: TOOLS } };
+  if (method === "tools/call") {
+    const name = params?.name;
+    const args = params?.arguments || {};
+    try {
+      let result;
+      if (name === "verify_tool_call") {
+        const ev = verifyCall(args, args.policy);
+        result = {
+          content: [{ type: "text", text: JSON.stringify({
+            verdict: ev.verdict, blocked: ev.verdict === "denied",
+            tool: ev.tool, caller: ev.caller,
+            dimensions: ev.dimensions, semantic_analysis: ev.semantic_analysis,
+            evidence_id: ev.evidence_id, evidence_hash: ev.evidence_hash,
+          }, null, 2) }],
+          isError: ev.verdict === "denied",
+        };
+      } else if (name === "issue_evidence") {
+        const ev = verifyCall(args, args.policy);
+        result = { content: [{ type: "text", text: JSON.stringify(ev, null, 2) }] };
+      } else if (name === "audit_mcp_config") {
+        const report = auditMcpConfig(args.config || {});
+        result = { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+      } else {
+        result = { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
+      }
+      return { jsonrpc: "2.0", id, result };
+    } catch (e) {
+      return { jsonrpc: "2.0", id,
+        result: { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true } };
+    }
+  }
+  if (id !== undefined) return { jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } };
+  return null;
+}
+
+function main() {
+  process.stderr.write(`[ccs-mcp-server] v${CCS_VERSION} starting on stdio\n`);
+  const rl = readline.createInterface({ input: process.stdin });
+  rl.on("line", (line) => {
+    if (!line.trim()) return;
+    let req;
+    try { req = JSON.parse(line); } catch { return; }
+    const res = handleRequest(req);
+    if (res) process.stdout.write(JSON.stringify(res) + "\n");
+  });
+  rl.on("close", () => process.exit(0));
+}
+
+if (require.main === module) main();
+module.exports = { verifyCall, auditMcpConfig };