ccs-mcp-server 1.0.0 → 1.1.0

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "ccs-mcp-server",
-  "version": "1.0.0",
-  "description": "CCS Runtime Evidence MCP Server — verify AI agent tool calls, issue tamper-evident evidence, audit MCP configs. For Claude Desktop, Cursor, Windsurf, and any MCP client.",
+  "version": "1.1.0",
+  "description": "CCS Runtime Evidence MCP Server — verify AI agent tool calls, issue tamper-evident evidence, audit MCP configs, and bind execution to declared intent (cross-model amount drift protection). For Claude Desktop, Cursor, Windsurf, and any MCP client.",
   "type": "commonjs",
   "bin": {
     "ccs-mcp-server": "src/index.js"
   },
   "main": "src/index.js",
-  "files": ["src", "README.md", "LICENSE"],
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
   "keywords": [
     "mcp",
     "model-context-protocol",

package/src/index.js

@@ -31,7 +31,7 @@ const readline = require("readline");
 // CCS Verifier Core (pure stdlib Node.js)
 // ---------------------------------------------------------------------------
 
-const CCS_VERSION = "1.0.0";
+const CCS_VERSION = "1.1.0";
 
 const DEFAULT_POLICY = {
   mode: "block",
@@ -307,6 +307,82 @@ function auditMcpConfig(config) {
                  issues.length ? "medium" : "low" };
 }
 
+// ---------------------------------------------------------------------------
+// Intent Binding (L4) — zero-LLM, deterministic, microsecond
+// ---------------------------------------------------------------------------
+// Agent framework declares structured intent before tool execution.
+// CCS verifies actual args match declared intent with zero tolerance.
+// This catches cross-model amount drift (planner says 100, executor writes 10000)
+// without any NLP or LLM call.
+
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) {
+    // numeric normalization: 100 == 100.0 == 1e2
+    if (typeof a === "number" && typeof b === "string") {
+      const n = Number(b);
+      return Number.isFinite(n) && a === n;
+    }
+    if (typeof b === "number" && typeof a === "string") {
+      const n = Number(a);
+      return Number.isFinite(n) && b === n;
+    }
+    return false;
+  }
+  if (typeof a !== "object" || a === null || b === null) return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  const ka = Object.keys(a), kb = Object.keys(b);
+  if (ka.length !== kb.length) return false;
+  return ka.every((k) => deepEqual(a[k], b[k]));
+}
+
+function verifyIntentBinding(intent, toolName, toolArgs, now = Date.now()) {
+  // 1. TTL check
+  if (intent.ttl_ms != null && now - intent.issued_at > intent.ttl_ms) {
+    return {
+      allowed: false,
+      reason: { type: "intent_expired", expected: intent.issued_at + intent.ttl_ms, actual: now },
+      intent_hash: crypto.createHash("sha256").update(canonical(intent)).digest("hex"),
+    };
+  }
+
+  // 2. Field-by-field comparison
+  const fields = intent.fields || {};
+  for (const [field, spec] of Object.entries(fields)) {
+    const actual = toolArgs[field];
+    const expected = spec.value;
+    const mode = spec.binding_mode || "exact";
+    let match = false;
+    if (mode === "exact") {
+      match = deepEqual(expected, actual);
+    } else if (mode === "numeric_tolerance") {
+      if (typeof expected === "number" && typeof actual === "number") {
+        match = Math.abs(expected - actual) <= (spec.tolerance || 0);
+      }
+    } else if (mode === "pattern") {
+      if (typeof actual === "string") {
+        try { match = new RegExp(spec.pattern).test(actual); } catch { match = false; }
+      }
+    }
+    if (!match) {
+      return {
+        allowed: false,
+        reason: {
+          type: "intent_arg_mismatch",
+          field, binding_mode: mode,
+          expected, actual,
+        },
+        intent_hash: crypto.createHash("sha256").update(canonical(intent)).digest("hex"),
+      };
+    }
+  }
+
+  return {
+    allowed: true,
+    intent_hash: crypto.createHash("sha256").update(canonical(intent)).digest("hex"),
+  };
+}
+
 // ---------------------------------------------------------------------------
 // MCP Protocol (stdio JSON-RPC 2.0)
 // ---------------------------------------------------------------------------
@@ -357,6 +433,44 @@ const TOOLS = [
       required: ["config"],
     },
   },
+  {
+    name: "verify_intent_binding",
+    description: "Verify that actual tool call arguments match a declared intent with zero tolerance. Catches cross-model parameter drift (planner says amount=100, executor writes amount=10000). No LLM needed — pure deterministic comparison. Supports exact match, numeric tolerance, and regex pattern binding modes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        intent: {
+          type: "object",
+          description: "Structured intent declaration from the agent framework",
+          properties: {
+            intent_id: { type: "string", description: "Unique intent identifier (UUID v7 recommended)" },
+            intent_type: { type: "string", description: "e.g. payment, file_write, api_call" },
+            fields: {
+              type: "object",
+              description: "Map of field name to binding specification",
+              additionalProperties: {
+                type: "object",
+                properties: {
+                  value: { description: "Expected value" },
+                  binding_mode: { type: "string", enum: ["exact", "numeric_tolerance", "pattern"] },
+                  tolerance: { type: "number", description: "Tolerance for numeric_tolerance mode" },
+                  pattern: { type: "string", description: "Regex for pattern mode" },
+                },
+                required: ["value"],
+              },
+            },
+            issued_at: { type: "integer", description: "Unix ms when intent was issued" },
+            ttl_ms: { type: "integer", description: "Time-to-live in ms (default 30000)" },
+            evidence_ref: { type: "string", description: "Optional hash of external evidence (invoice, authorization VC)" },
+          },
+          required: ["intent_id", "intent_type", "fields", "issued_at"],
+        },
+        tool: { type: "string", description: "Tool being called, e.g. payments.send" },
+        arguments: { type: "object", description: "Actual tool call arguments", additionalProperties: true },
+      },
+      required: ["intent", "tool", "arguments"],
+    },
+  },
 ];
 
 function handleRequest(req) {
@@ -396,6 +510,22 @@ function handleRequest(req) {
       } else if (name === "audit_mcp_config") {
         const report = auditMcpConfig(args.config || {});
         result = { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+      } else if (name === "verify_intent_binding") {
+        const verdict = verifyIntentBinding(args.intent, args.tool, args.arguments || {});
+        result = {
+          content: [{ type: "text", text: JSON.stringify({
+            allowed: verdict.allowed,
+            intent_id: args.intent.intent_id,
+            intent_hash: verdict.intent_hash,
+            tool: args.tool,
+            ...(verdict.reason ? { reason: verdict.reason } : {}),
+            blocked: !verdict.allowed,
+            message: verdict.allowed
+              ? "Intent binding verified — actual arguments match declared intent"
+              : `Intent binding DENIED: ${verdict.reason?.type}`,
+          }, null, 2) }],
+          isError: !verdict.allowed,
+        };
       } else {
         result = { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
       }