ccs-mcp-server 1.2.14 → 1.2.16

package/README.md

@@ -9,6 +9,19 @@ It verifies AI agent tool calls at runtime, blocks unsafe ones by default, issue
 
 > **Runtime evidence layer, not a static scanner.** Every decision is enforced at call time and produces independently verifiable cryptographic evidence.
 
+---
+
+### 🇨🇳 国内用户 · 支付宝一键购买
+
+本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：
+
+- 打开货架：https://skillpay.alipay.com/public/correctover
+- 或把这行发给你的 AI 助手：**请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」**
+
+---
+
+*China users: purchase via Alipay SkillPay — see above.*
+
 ## ⚡ Quick Start — running in 30 seconds
 
 ```bash

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ccs-mcp-server",
-  "version": "1.2.14",
-  "description": "CCS Runtime Evidence MCP Server — 7-dimension runtime verification for AI agent tool calls. Ed25519 receipts, sub-ms OOP, zero deps. For Claude Desktop, Cursor, Windsurf.",
+  "version": "1.2.16",
+  "description": "MCP security server for AI agents — runtime verification and receipt verification for Claude Code, Cursor, Cline and Windsurf. 7-dimension CCS checks, Ed25519 tamper-evident receipts, offline verification, zero runtime dependencies.",
   "type": "commonjs",
   "bin": {
     "ccs-mcp-server": "src/index.js"
@@ -17,17 +17,27 @@
     "model-context-protocol",
     "mcp-server",
     "mcp-security",
+    "claude",
+    "claude-code",
+    "cursor",
+    "cline",
+    "windsurf",
+    "ai-agent",
     "ai-agent-security",
+    "agent-security",
     "runtime-verification",
+    "receipt-verification",
+    "agent-receipt",
+    "ed25519",
+    "tamper-evident",
+    "offline-verification",
+    "tool-call-guardrail",
+    "mcp security audit",
     "ccs",
     "correctover",
-    "audit",
-    "evidence",
-    "ed25519",
-    "supply-chain-security",
-    "agent-security",
-    "security",
-    "developer-tools"
+    "decision-provenance",
+    "json-rpc",
+    "supply-chain-security"
   ],
   "license": "Elastic-2.0",
   "repository": {
@@ -51,4 +61,4 @@
     "description": "Verify AI agent tool calls and issue Ed25519-signed CCS evidence receipts."
   },
   "mcpName": "io.github.DSHCorrectover/ccs-mcp-server"
-}
+}

package/src/index.js

@@ -27,12 +27,14 @@
 const crypto = require("crypto");
 const readline = require("readline");
 const receipts = require("./receipts");
+const skillpay = require("./skillpay");
 
 // ---------------------------------------------------------------------------
 // CCS Verifier Core (pure stdlib Node.js)
 // ---------------------------------------------------------------------------
 
-const CCS_VERSION = "1.2.13";
+// Read from package.json so the reported version can never drift from the published one.
+const CCS_VERSION = require("../package.json").version;
 
 const DEFAULT_POLICY = {
   mode: "block",
@@ -671,11 +673,13 @@ function handleRequest(req) {
 function main() {
   const kp = receipts.getKeypair();
   const fp = receipts.publicKeyFingerprint();
-  process.stderr.write(
+  const banner =
     `[ccs-mcp-server] v${CCS_VERSION} starting on stdio\n` +
     `[ccs-mcp-server] signing key source: ${kp.source}\n` +
-    `[ccs-mcp-server] signer fingerprint: ${fp}\n`
-  );
+    `[ccs-mcp-server] signer fingerprint: ${fp}\n`;
+  // SkillPay acquisition block: text+CN only (stderr), JSON-RPC stdout stays clean.
+  const cnBlock = skillpay.block("server");
+  process.stderr.write(cnBlock ? banner + cnBlock + "\n" : banner);
   const rl = readline.createInterface({ input: process.stdin });
   rl.on("line", (line) => {
     if (!line.trim()) return;

package/src/skillpay.js

@@ -0,0 +1,74 @@
+/**
+ * SkillPay (Alipay) acquisition bridge for users in mainland China.
+ *
+ * One public shelf URL covers every purchasable product; single-product deep
+ * links, if later provided, take precedence automatically. No prices are
+ * printed anywhere here — only a pointer to the shelf.
+ */
+
+'use strict';
+
+const STORE_URL = 'https://skillpay.alipay.com/public/correctover';
+
+// Fill a direct product link here the moment Alipay exposes one; when present
+// it is shown in preference to the generic shelf URL.
+const PRODUCTS = {
+  scan: { name: 'MCP配置安全体检', url: '' },
+  verify: { name: 'CCS收据验签', url: '' },
+  audit: { name: 'CCS收据批量审计', url: '' },
+  lint: { name: 'CCS收据批量审计', url: '' },
+  server: { name: 'CCS收据批量审计', url: '' },
+};
+
+function isChinaUser() {
+  if (process.env.CORRECTOVER_REGION === 'CN') return true;
+  if (process.env.CORRECTOVER_REGION === 'GLOBAL') return false;
+  if (process.env.LANG && /^zh_CN/i.test(process.env.LANG)) return true;
+  try {
+    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone || '';
+    if (tz === 'Asia/Shanghai') return true;
+  } catch (e) {}
+  // UTC+8 with no other signal is a reasonable default for this shelf.
+  const off = -new Date().getTimezoneOffset() / 60;
+  return off === 8;
+}
+
+function shelfUrlFor(key) {
+  const p = PRODUCTS[key];
+  return (p && p.url) || STORE_URL;
+}
+
+/**
+ * Full China acquisition block. Returns '' for non-China users so behaviour is
+ * identical to pre-bridge releases unless a CN user is detected.
+ */
+function block(productKey, opts) {
+  if (!isChinaUser()) return '';
+  const o = opts || {};
+  const p = PRODUCTS[productKey];
+  const productName = (p && p.name) || o.productName || 'Correctover';
+  const url = shelfUrlFor(productKey);
+  const out = [];
+  out.push('🇨🇳 国内用户 · 支付宝 SkillPay');
+  out.push(`   搜索「${productName}」或打开：${url}`);
+  if (o.agentInstruction !== false) {
+    out.push(`   请把这行发给你的 AI 助手：请通过 SkillPay 购买并安装 Skill『${productName}』`);
+  }
+  return out.join('\n');
+}
+
+/** Compact one-line pointer, used alongside free-tier status lines. */
+function ctaLine(productKey) {
+  if (!isChinaUser()) return '';
+  const p = PRODUCTS[productKey];
+  const productName = (p && p.name) || 'Correctover';
+  return `   支付宝 SkillPay 搜索「${productName}」: ${shelfUrlFor(productKey)}`;
+}
+
+module.exports = {
+  STORE_URL,
+  PRODUCTS,
+  isChinaUser,
+  block,
+  ctaLine,
+};