ccs-mcp-server 1.2.15 → 1.2.17

package/README.md

@@ -9,6 +9,8 @@ It verifies AI agent tool calls at runtime, blocks unsafe ones by default, issue
 
 > **Runtime evidence layer, not a static scanner.** Every decision is enforced at call time and produces independently verifiable cryptographic evidence.
 
+---
+
 ## ⚡ Quick Start — running in 30 seconds
 
 ```bash
@@ -32,6 +34,18 @@ Or install from the official MCP Registry: search **"Correctover"** inside your
 
 No API key, no account, no environment variables required — an Ed25519 signing key is generated automatically on first run (set `CCS_KEY_DIR`, or `CCS_PRIVATE_KEY`/`CCS_PUBLIC_KEY`, only if you want to pin a persistent key). Zero dependencies. Pure Node.js stdlib (Node ≥ 18). No install scripts.
 
+### 🇨🇳 免费验证之外 · 支付宝 SkillPay
+
+本服务的运行时验证与证据签发可免费使用。如果你需要人工深度审计或正式合规凭证，可以在支付宝 SkillPay 货架获取：
+
+- 货架首页：https://skillpay.alipay.com/public/correctover
+- 也可以在支持「支付宝 AI 付」的智能体对话里直接输入对应服务名唤起购买：
+  - **MCP配置安全体检**：`请通过 SkillPay 购买并安装 Skill「MCP配置安全体检」`
+  - **CCS收据批量审计**：`请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」`
+  - **CCS收据验签**：`请通过 SkillPay 购买并安装 Skill「CCS收据验签」`
+
+*Beyond the free verification: human-led deep audits and compliance evidence are available on the Alipay SkillPay shelf — open the link above, or type the service name (e.g. **CCS收据批量审计**) in an agent with Alipay AI Pay enabled.*
+
 ## Tools
 
 | Tool | Purpose |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccs-mcp-server",
-  "version": "1.2.15",
+  "version": "1.2.17",
   "description": "MCP security server for AI agents — runtime verification and receipt verification for Claude Code, Cursor, Cline and Windsurf. 7-dimension CCS checks, Ed25519 tamper-evident receipts, offline verification, zero runtime dependencies.",
   "type": "commonjs",
   "bin": {

package/src/index.js

@@ -27,6 +27,7 @@
 const crypto = require("crypto");
 const readline = require("readline");
 const receipts = require("./receipts");
+const skillpay = require("./skillpay");
 
 // ---------------------------------------------------------------------------
 // CCS Verifier Core (pure stdlib Node.js)
@@ -672,11 +673,13 @@ function handleRequest(req) {
 function main() {
   const kp = receipts.getKeypair();
   const fp = receipts.publicKeyFingerprint();
-  process.stderr.write(
+  const banner =
     `[ccs-mcp-server] v${CCS_VERSION} starting on stdio\n` +
     `[ccs-mcp-server] signing key source: ${kp.source}\n` +
-    `[ccs-mcp-server] signer fingerprint: ${fp}\n`
-  );
+    `[ccs-mcp-server] signer fingerprint: ${fp}\n`;
+  // SkillPay acquisition block: text+CN only (stderr), JSON-RPC stdout stays clean.
+  const cnBlock = skillpay.block("server");
+  process.stderr.write(cnBlock ? banner + cnBlock + "\n" : banner);
   const rl = readline.createInterface({ input: process.stdin });
   rl.on("line", (line) => {
     if (!line.trim()) return;

package/src/skillpay.js

@@ -0,0 +1,74 @@
+/**
+ * SkillPay (Alipay) acquisition bridge for users in mainland China.
+ *
+ * One public shelf URL covers every purchasable product; single-product deep
+ * links, if later provided, take precedence automatically. No prices are
+ * printed anywhere here — only a pointer to the shelf.
+ */
+
+'use strict';
+
+const STORE_URL = 'https://skillpay.alipay.com/public/correctover';
+
+// Fill a direct product link here the moment Alipay exposes one; when present
+// it is shown in preference to the generic shelf URL.
+const PRODUCTS = {
+  scan: { name: 'MCP配置安全体检', url: '' },
+  verify: { name: 'CCS收据验签', url: '' },
+  audit: { name: 'CCS收据批量审计', url: '' },
+  lint: { name: 'CCS收据批量审计', url: '' },
+  server: { name: 'CCS收据批量审计', url: '' },
+};
+
+function isChinaUser() {
+  if (process.env.CORRECTOVER_REGION === 'CN') return true;
+  if (process.env.CORRECTOVER_REGION === 'GLOBAL') return false;
+  if (process.env.LANG && /^zh_CN/i.test(process.env.LANG)) return true;
+  try {
+    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone || '';
+    if (tz === 'Asia/Shanghai') return true;
+  } catch (e) {}
+  // UTC+8 with no other signal is a reasonable default for this shelf.
+  const off = -new Date().getTimezoneOffset() / 60;
+  return off === 8;
+}
+
+function shelfUrlFor(key) {
+  const p = PRODUCTS[key];
+  return (p && p.url) || STORE_URL;
+}
+
+/**
+ * Full China acquisition block. Returns '' for non-China users so behaviour is
+ * identical to pre-bridge releases unless a CN user is detected.
+ */
+function block(productKey, opts) {
+  if (!isChinaUser()) return '';
+  const o = opts || {};
+  const p = PRODUCTS[productKey];
+  const productName = (p && p.name) || o.productName || 'Correctover';
+  const url = shelfUrlFor(productKey);
+  const out = [];
+  out.push('🇨🇳 国内用户 · 支付宝 SkillPay');
+  out.push(`   搜索「${productName}」或打开：${url}`);
+  if (o.agentInstruction !== false) {
+    out.push(`   请把这行发给你的 AI 助手：请通过 SkillPay 购买并安装 Skill『${productName}』`);
+  }
+  return out.join('\n');
+}
+
+/** Compact one-line pointer, used alongside free-tier status lines. */
+function ctaLine(productKey) {
+  if (!isChinaUser()) return '';
+  const p = PRODUCTS[productKey];
+  const productName = (p && p.name) || 'Correctover';
+  return `   支付宝 SkillPay 搜索「${productName}」: ${shelfUrlFor(productKey)}`;
+}
+
+module.exports = {
+  STORE_URL,
+  PRODUCTS,
+  isChinaUser,
+  block,
+  ctaLine,
+};