ccs-mcp-server 1.2.17 → 1.4.0

package/package.json

@@ -1,50 +1,66 @@
 {
   "name": "ccs-mcp-server",
-  "version": "1.2.17",
-  "description": "MCP security server for AI agents — runtime verification and receipt verification for Claude Code, Cursor, Cline and Windsurf. 7-dimension CCS checks, Ed25519 tamper-evident receipts, offline verification, zero runtime dependencies.",
+  "version": "1.4.0",
+  "description": "MCP security server for AI agents — runtime verification, receipt verification and field-level tamper localization for Claude Code, Cursor, Cline and Windsurf. 7-dimension CCS checks, Ed25519 tamper-evident receipts, offline verification, zero runtime dependencies.",
   "type": "commonjs",
   "bin": {
-    "ccs-mcp-server": "src/index.js"
+    "ccs-mcp-server": "src/index.js",
+    "agent-runtime-guard": "src/index.js"
   },
   "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./receipts": "./src/receipts.js",
+    "./dsh": "./dsh/index.js",
+    "./dsh/cordis.patch.yml": "./dsh/cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
   "files": [
     "src",
+    "dsh",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "test"
   ],
   "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "mcp-server",
-    "mcp-security",
+    "agent-guard",
+    "agent-runtime",
+    "agent-security",
+    "ai-agent-security",
     "claude",
     "claude-code",
-    "cursor",
     "cline",
-    "windsurf",
-    "ai-agent",
-    "ai-agent-security",
-    "agent-security",
-    "runtime-verification",
-    "receipt-verification",
-    "agent-receipt",
+    "command-injection",
+    "correctover",
+    "credential-protection",
+    "cursor",
+    "deepseek-harness",
+    "dsh-plugin",
     "ed25519",
+    "fail-closed",
+    "forensics",
+    "json-pointer",
+    "mcp",
+    "mcp-security",
+    "mcp-server",
+    "model-context-protocol",
+    "prompt-injection",
+    "rfc6901",
+    "runtime-interception",
+    "runtime-verification",
+    "ssrf",
+    "supply-chain-security",
     "tamper-evident",
-    "offline-verification",
+    "tamper-localization",
     "tool-call-guardrail",
-    "mcp security audit",
-    "ccs",
-    "correctover",
-    "decision-provenance",
-    "json-rpc",
-    "supply-chain-security"
+    "windsurf"
   ],
   "license": "Elastic-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/DSHCorrectover/ccs-mcp-server.git"
   },
-  "homepage": "https://github.com/DSHCorrectover/ccs-mcp-server#readme",
+  "homepage": "https://correctover.com",
   "bugs": {
     "url": "https://github.com/DSHCorrectover/ccs-mcp-server/issues"
   },
@@ -52,13 +68,21 @@
     "node": ">=18"
   },
   "dependencies": {},
+  "peerDependencies": {
+    "@deepseek-ai/dsh": ">=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh": {
+      "optional": true
+    }
+  },
   "scripts": {
     "test": "node test/run-tests.js"
   },
   "mcp": {
-    "name": "ccs-runtime-evidence",
-    "displayName": "CCS Runtime Evidence",
-    "description": "Verify AI agent tool calls and issue Ed25519-signed CCS evidence receipts."
+    "name": "ccs-mcp-server",
+    "displayName": "CCS MCP Server",
+    "description": "Full-stack runtime interception for AI agents — blocks destructive commands, credential theft, SSRF and injection, with Ed25519 evidence receipts."
   },
   "mcpName": "io.github.DSHCorrectover/ccs-mcp-server"
 }

package/src/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * CCS Runtime Evidence MCP Server v1.0.0
+ * CCS Runtime Evidence MCP Server
  *
  * A standalone Model Context Protocol (MCP) server that exposes CCS runtime
  * verification as MCP tools, so any MCP-compatible client (Claude Desktop,
@@ -11,6 +11,9 @@
  *   verify_tool_call   Verify a tool call against CCS 7 dimensions + semantic + math
  *   issue_evidence     Issue a signed CCS evidence record (allow + deny)
  *   audit_mcp_config   Audit an MCP server configuration for security risks
+ *   verify_intent_binding  Verify call arguments match declared intent
+ *   verify_receipt     Offline-verify a CCS Ed25519-signed receipt
+ *   locate_tampering   Field-level localization of which fields differ (RFC 6901)
  *
  * Transport: stdio (per MCP spec). To run:
  *   npx @correctover/ccs-mcp-server
@@ -28,6 +31,7 @@ const crypto = require("crypto");
 const readline = require("readline");
 const receipts = require("./receipts");
 const skillpay = require("./skillpay");
+const tamper = require("./locate_tampering");
 
 // ---------------------------------------------------------------------------
 // CCS Verifier Core (pure stdlib Node.js)
@@ -431,7 +435,7 @@ function verifyIntentBinding(intent, toolName, toolArgs, now = Date.now()) {
 // ---------------------------------------------------------------------------
 
 const PROTOCOL_VERSION = "2024-11-05";
-const SERVER_INFO = { name: "ccs-runtime-evidence", version: CCS_VERSION, title: "CCS Runtime Evidence" };
+const SERVER_INFO = { name: "agent-runtime-guard", version: CCS_VERSION, title: "Agent Runtime Guard" };
 
 // MCP tool annotations (spec 2024-11-05+). Hints describe the tool's real
 // runtime behaviour so clients/registries can drive consent, UI gating and
@@ -604,6 +608,38 @@ const TOOLS = [
       required: ["receipt"],
     },
   },
+  {
+    name: "locate_tampering",
+    title: "Locate which fields differ between two artifacts",
+    description:
+      "Field-level tamper localization. Given an original and a suspect artifact, returns an " +
+      "RFC 6901 JSON-Pointer list of every changed field with change type, before/after values, " +
+      "severity, and remediation. This is what verify_receipt alone cannot tell you: it says WHICH " +
+      "field changed, not merely that the signature failed. Severity is assigned by field semantics " +
+      "(verdict-bearing fields are critical), not by diff size.",
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+    },
+    inputSchema: {
+      type: "object",
+      properties: {
+        original: {
+          type: "object",
+          description: "The trusted/original artifact (receipt, evidence record, or config).",
+          additionalProperties: true,
+        },
+        suspect: {
+          type: "object",
+          description: "The artifact to compare against the original.",
+          additionalProperties: true,
+        },
+      },
+      required: ["original", "suspect"],
+    },
+  },
 ];
 
 function handleRequest(req) {
@@ -649,6 +685,18 @@ function handleRequest(req) {
           content: [{ type: "text", text: JSON.stringify(verdict, null, 2) }],
           isError: verdict.allowed === false,
         };
+      } else if (name === "locate_tampering") {
+        if (typeof args.original !== "object" || args.original === null ||
+            typeof args.suspect !== "object" || args.suspect === null) {
+          result = {
+            content: [{ type: "text",
+              text: "Error: both 'original' and 'suspect' must be JSON objects." }],
+            isError: true,
+          };
+        } else {
+          const report = tamper.buildReport(args.original, args.suspect);
+          result = { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+        }
       } else if (name === "verify_receipt") {
         const v = args.expected_signer
           ? receipts.verifyReceiptWithKey(args.receipt, args.expected_signer)
@@ -670,7 +718,67 @@ function handleRequest(req) {
   return null;
 }
 
+function cliInfo() {
+  const S = "  ";
+  return [
+    `ccs-mcp-server v${CCS_VERSION} — Agent 运行时验证 + CCS 收据验签`,
+    ``,
+    `用法:`,
+    `${S}npx -y ccs-mcp-server              # 作为 MCP server 启动（stdio）`,
+    `${S}npx -y ccs-mcp-server --help       # 显示本说明`,
+    `${S}npx -y ccs-mcp-server --version    # 显示版本`,
+    `${S}npx -y ccs-mcp-server --tools      # 列出可用工具`,
+    ``,
+    `配置到 MCP 客户端（Claude Code / Cursor / Cline / Windsurf）:`,
+    `${S}{ "mcpServers": { "ccs-mcp-server": { "command": "npx", "args": ["-y", "ccs-mcp-server"] } } }`,
+    ``,
+    `免费可用（本地离线，零依赖，无需 API key）:`,
+    `${S}verify_tool_call       7 维运行时验证，危险调用默认拦截（fail-closed）`,
+    `${S}issue_evidence         Ed25519 证据收据（放行与拦截都产生，第三方可离线验证）`,
+    `${S}audit_mcp_config       MCP 配置静态安全审计`,
+    `${S}verify_intent_binding  校验实际参数与声明意图是否一致（抓跨模型参数漂移）`,
+    `${S}verify_receipt         离线验签 CCS 收据、检测篡改`,
+    `${S}locate_tampering       逐字段定位收据被改动的位置（RFC 6901 路径）`,
+    ``,
+    `需要订阅（¥49.90/月，支付宝 SkillPay）:`,
+    `${S}· CCS收据验签        深度篡改取证`,
+    `${S}· CCS收据批量审计    目录级批量验签与合规留痕`,
+    `${S}· MCP配置安全体检    完整 7 维分级报告`,
+    `${S}货架: https://skillpay.alipay.com/public/correctover`,
+    ``,
+    `文档: https://github.com/DSHCorrectover/agent-runtime-guard`,
+  ].join("\n");
+}
+
+function cliTools() {
+  return [
+    "verify_tool_call       Runtime verification, 7 dimensions, fail-closed by default",
+    "issue_evidence         Issue an Ed25519-signed evidence receipt",
+    "audit_mcp_config       Static security audit of MCP server configuration",
+    "verify_intent_binding  Detect drift between declared intent and actual arguments",
+    "verify_receipt         Offline receipt verification and tamper detection",
+    "locate_tampering       Field-level localization of tampered fields (RFC 6901)",
+  ].join("\n");
+}
+
 function main() {
+  // CLI 参数层：只处理显式的信息类参数，未命中则行为与以往完全一致。
+  // 为什么需要这层：MCP 客户端调用不带参数，但人类用户会敲 --help / --version 探路。
+  // 之前无论传什么参数都直接启动 stdio 服务并打广告，用户得不到任何信息、命令还会挂住。
+  const argv = process.argv.slice(2);
+  if (argv.includes("--help") || argv.includes("-h") || argv.includes("help")) {
+    process.stdout.write(cliInfo() + "\n");
+    process.exit(0);
+  }
+  if (argv.includes("--version") || argv.includes("-v")) {
+    process.stdout.write(CCS_VERSION + "\n");
+    process.exit(0);
+  }
+  if (argv.includes("--tools")) {
+    process.stdout.write(cliTools() + "\n");
+    process.exit(0);
+  }
+
   const kp = receipts.getKeypair();
   const fp = receipts.publicKeyFingerprint();
   const banner =
@@ -692,4 +800,4 @@ function main() {
 }
 
 if (require.main === module) main();
-module.exports = { verifyCall, auditMcpConfig, verifyIntentBinding, receipts };
+module.exports = { verifyCall, auditMcpConfig, verifyIntentBinding, receipts, tamper };

package/src/locate_tampering.js

@@ -0,0 +1,240 @@
+"use strict";
+/**
+ * CCS 字段级篡改定位 —— locate_tampering
+ *
+ * 为什么需要这个（它不是 verify_receipt 的替代品）:
+ *   verify_receipt 回一个布尔：签名对不对。审计人员拿到 false 之后
+ *   仍然不知道**哪里被改了**。要把话说清楚、要能举证，需要一份差异清单。
+ *
+ *   本模块产出 RFC 6901 JSON-Pointer 形式的字段变更清单，
+ *   每条带变化类型、原值、新值、严重度与整改建议。
+ *
+ * 与 Python 侧 correctover-ccs-mcp 的 ccs_locate_tampering 输出结构对齐，
+ * 使两个渠道（npm 运行时 / PyPI 取证）给出同一份证据格式。
+ *
+ * 零依赖：仅 crypto 用于可选的内容摘要。
+ *
+ * License: Elastic-2.0 (c) Correctover
+ */
+
+const crypto = require("crypto");
+
+// ---------------------------------------------------------------------------
+// RFC 6901 JSON-Pointer 转义
+// ---------------------------------------------------------------------------
+
+function pointerEscape(token) {
+  // 顺序不可颠倒：必须先转义 ~，否则会把 / 转出来的 ~1 再转一次
+  return String(token).replace(/~/g, "~0").replace(/\//g, "~1");
+}
+
+function joinPointer(base, token) {
+  return base + "/" + pointerEscape(token);
+}
+
+// ---------------------------------------------------------------------------
+// 严重度：按字段语义分级，不是按"改了多少字节"
+//
+// 设计取舍：改一个字符的 verdict 比改一百个字符的 latency 严重得多。
+// 分级的依据是**这个字段决定谁的结论**，不是差异大小。
+// ---------------------------------------------------------------------------
+
+const CRITICAL_EXACT = [
+  "/verdict", "/signature", "/signer_public_key", "/signature_alg",
+  "/evidence_hash", "/content_hash", "/receipt_id", "/instruction_digest",
+];
+const CRITICAL_PREFIX = ["/checks/", "/policy/", "/decision"];
+const HIGH_EXACT = [
+  "/reason", "/allowed", "/action", "/tool", "/principal", "/subject",
+  "/policy_mode", "/delegation",
+];
+const MEDIUM_PREFIX = ["/latency", "/cost", "/model", "/provider", "/intent"];
+
+function classifySeverity(pointer) {
+  if (CRITICAL_EXACT.includes(pointer)) return "critical";
+  if (CRITICAL_PREFIX.some((p) => pointer.startsWith(p))) return "critical";
+  if (HIGH_EXACT.includes(pointer)) return "high";
+  if (MEDIUM_PREFIX.some((p) => pointer.startsWith(p))) return "medium";
+  return "low";
+}
+
+const REMEDIATION = {
+  critical:
+    "A verdict-bearing field changed. Treat the artifact as untrusted: do not act on it, " +
+    "re-derive the conclusion from the original source, and re-issue the receipt.",
+  high:
+    "A context field changed. Confirm with the counterparty which version is authoritative " +
+    "before relying on either.",
+  medium:
+    "An operational field changed. Usually affects interpretation rather than the verdict; " +
+    "verify if it feeds a downstream decision.",
+  low:
+    "A non-decisional field changed. Low impact; record for completeness.",
+};
+
+// ---------------------------------------------------------------------------
+// 深度差异
+// ---------------------------------------------------------------------------
+
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+/**
+ * 返回字段级变更清单。
+ * 数组按**下标**逐项比较，不用集合语义——收据里的数组是有序的，
+ * 把 [a,b] 与 [b,a] 判为"相同"会漏掉真实的顺序篡改。
+ */
+function deepDiff(original, suspect, base = "") {
+  const changes = [];
+
+  const bothObjects = isPlainObject(original) && isPlainObject(suspect);
+  const bothArrays = Array.isArray(original) && Array.isArray(suspect);
+
+  if (bothObjects) {
+    const keys = new Set([...Object.keys(original), ...Object.keys(suspect)]);
+    for (const k of Array.from(keys).sort()) {
+      const ptr = joinPointer(base, k);
+      const hasO = Object.prototype.hasOwnProperty.call(original, k);
+      const hasS = Object.prototype.hasOwnProperty.call(suspect, k);
+      if (hasO && !hasS) {
+        changes.push(mk(ptr, "removed", original[k], undefined));
+      } else if (!hasO && hasS) {
+        changes.push(mk(ptr, "added", undefined, suspect[k]));
+      } else {
+        changes.push(...deepDiff(original[k], suspect[k], ptr));
+      }
+    }
+    return changes;
+  }
+
+  if (bothArrays) {
+    const n = Math.max(original.length, suspect.length);
+    for (let i = 0; i < n; i++) {
+      const ptr = joinPointer(base, i);
+      if (i >= original.length) {
+        changes.push(mk(ptr, "added", undefined, suspect[i]));
+      } else if (i >= suspect.length) {
+        changes.push(mk(ptr, "removed", original[i], undefined));
+      } else {
+        changes.push(...deepDiff(original[i], suspect[i], ptr));
+      }
+    }
+    return changes;
+  }
+
+  if (!sameScalar(original, suspect)) {
+    changes.push(mk(base || "/", "modified", original, suspect));
+  }
+  return changes;
+}
+
+function sameScalar(a, b) {
+  if (a === b) return true;
+  if (typeof a === "number" && typeof b === "number" && Number.isNaN(a) && Number.isNaN(b)) {
+    return true;
+  }
+  if (isPlainObject(a) || isPlainObject(b) || Array.isArray(a) || Array.isArray(b)) {
+    // 类型不一致（对象 vs 标量）：交给 JSON 比较判等
+    return JSON.stringify(a) === JSON.stringify(b);
+  }
+  return false;
+}
+
+function preview(v) {
+  if (v === undefined) return null;
+  if (typeof v === "string") return v.length > 200 ? v.slice(0, 200) + "…" : v;
+  try {
+    const s = JSON.stringify(v);
+    return s && s.length > 200 ? s.slice(0, 200) + "…" : v;
+  } catch {
+    return String(v);
+  }
+}
+
+function mk(pointer, change, original, suspect) {
+  const severity = classifySeverity(pointer);
+  return {
+    path: pointer,
+    path_format: "rfc6901",
+    change,
+    original: preview(original),
+    suspect: preview(suspect),
+    severity,
+    remediation: REMEDIATION[severity],
+    // 兼容既有消费方（Python 侧曾输出点号路径）
+    path_dotted: pointer.replace(/^\//, "").replace(/\//g, "."),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// 报告
+// ---------------------------------------------------------------------------
+
+function digestOf(obj) {
+  try {
+    return "sha256:" + crypto
+      .createHash("sha256")
+      .update(JSON.stringify(sortDeep(obj)))
+      .digest("hex");
+  } catch {
+    return null;
+  }
+}
+
+function sortDeep(v) {
+  if (Array.isArray(v)) return v.map(sortDeep);
+  if (isPlainObject(v)) {
+    const out = {};
+    for (const k of Object.keys(v).sort()) out[k] = sortDeep(v[k]);
+    return out;
+  }
+  return v;
+}
+
+function buildReport(original, suspect) {
+  const changes = deepDiff(original, suspect);
+  const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const c of changes) counts[c.severity]++;
+
+  const originalDigest = digestOf(original);
+  const suspectDigest = digestOf(suspect);
+
+  let conclusion;
+  if (changes.length === 0) {
+    conclusion =
+      "No field-level differences found between the two artifacts. " +
+      "Note: this compares content only; it does not by itself prove either artifact is authentic.";
+  } else if (counts.critical > 0) {
+    conclusion =
+      `${changes.length} field(s) differ, including ${counts.critical} verdict-bearing field(s). ` +
+      "At least one change affects the conclusion itself, so the two artifacts are not interchangeable.";
+  } else {
+    conclusion =
+      `${changes.length} field(s) differ. None are verdict-bearing; differences are likely ` +
+      "operational or contextual rather than decisional.";
+  }
+
+  return {
+    schema: "correctover.tamper-localization.v1",
+    tampered: changes.length > 0,
+    counts,
+    changes,
+    digests: { original: originalDigest, suspect: suspectDigest },
+    conclusion,
+    limitations: [
+      "This compares two artifacts you supplied. It does not prove which one is authentic.",
+      "It reports content differences only; it does not verify any cryptographic signature.",
+      "Pair it with verify_receipt to establish authenticity, then use this to localize the change.",
+    ],
+  };
+}
+
+module.exports = {
+  deepDiff,
+  buildReport,
+  classifySeverity,
+  pointerEscape,
+  joinPointer,
+  digestOf,
+};