ccs-mcp-server 1.2.8 → 1.2.10

package/README.md

@@ -1,18 +1,21 @@
 # CCS Runtime Evidence MCP Server
 
+[![IETF Internet-Draft](https://img.shields.io/badge/IETF-draft--correctover--ccs-blue)](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
+[![npm version](https://img.shields.io/npm/v/ccs-mcp-server.svg)](https://www.npmjs.com/package/ccs-mcp-server)
+
 A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that brings **CCS runtime verification** to any MCP-compatible client — Claude Desktop, Cursor, Windsurf, and more.
 
 It verifies AI agent tool calls at runtime, blocks unsafe ones by default, issues **tamper-evident evidence records** for every decision, and verifies that actual tool arguments match the agent's declared intent — catching cross-model parameter drift.
 
 > **Runtime evidence layer, not a static scanner.** Every decision is enforced at call time and produces independently verifiable cryptographic evidence.
 
-## Quick Start
+## ⚡ Quick Start — running in 30 seconds
 
 ```bash
 npx -y ccs-mcp-server
 ```
 
-### MCP Client Configuration
+Add it to any MCP client — paste this into your `mcpServers` config in Claude Desktop, Cursor or Cline:
 
 ```json
 {
@@ -25,7 +28,9 @@ npx -y ccs-mcp-server
 }
 ```
 
-Zero dependencies. 44KB. Pure Node.js stdlib. No install scripts.
+Or install from the official MCP Registry: search **"Correctover"** inside your client, or open [registry.modelcontextprotocol.io](https://registry.modelcontextprotocol.io/) and find `io.github.Correctover/ccs`.
+
+No API key, no account, no environment variables required — an Ed25519 signing key is generated automatically on first run (set `CCS_KEY_DIR`, or `CCS_PRIVATE_KEY`/`CCS_PUBLIC_KEY`, only if you want to pin a persistent key). Zero dependencies. Pure Node.js stdlib (Node ≥ 18). No install scripts.
 
 ## Tools
 
@@ -34,7 +39,8 @@ Zero dependencies. 44KB. Pure Node.js stdlib. No install scripts.
 | `verify_tool_call` | 7-dimension runtime verification (Structure/Schema/Security/Identity/Integrity/Latency/Cost) + semantic attack-chain analysis + math overflow detection. **Blocks by default.** |
 | `issue_evidence` | Issue a tamper-evident evidence record (`content_hash` + `evidence_hash`, chainable). Produced for allowed AND denied calls. |
 | `audit_mcp_config` | Audit MCP configuration JSON for security risks. |
-| `verify_intent_binding` | **(v1.1.0)** Verify actual tool arguments match a declared intent — zero tolerance, zero LLM calls. Catches cross-model parameter drift (planner says `amount: 100`, executor writes `amount: 10000` → DENIED). |
+| `verify_intent_binding` | Verify actual tool arguments match a declared intent — zero tolerance, zero LLM calls. Catches cross-model parameter drift (planner says `amount: 100`, executor writes `amount: 10000` → DENIED). |
+| `verify_receipt` | Offline-verify a CCS Ed25519-signed receipt: checks the signature against the embedded signer public key, reports tampering, and optionally pins an expected signer key or fingerprint. |
 
 ## Intent Binding — Cross-Model Drift Detection
 
@@ -101,6 +107,8 @@ evidence 3: denied   (http.fetch SSRF)    parent: ev2
 evidence 4: denied   (fs + curl exfil)    parent: ev3
 ```
 
+Receipts are Ed25519-signed and JSON-based: verify them offline with the built-in `verify_receipt` tool, or independently with any Ed25519 library. Cross-tool receipt verification (same crypto, chain linkage, field mapping) is designed to work without this package installed.
+
 ## The 7 CCS Dimensions
 
 1. **Structure** — valid tool name, argument format, nesting depth, payload size
@@ -111,45 +119,19 @@ evidence 4: denied   (fs + curl exfil)    parent: ev3
 6. **Latency** — execution time budget
 7. **Cost** — cost budget
 
-## Interoperability
-
-CCS receipts are Ed25519-signed, JSON-based, and verifiable offline with zero dependencies. If your project produces or verifies signed attestations, receipts, or evidence records, see **[INTEGRATION.md](INTEGRATION.md)** — a one-page guide covering:
-
-- Full receipt field schema (22 fields)
-- JCS canonicalization spec
-- Three levels of interop (same crypto → cross-referenced chains → field-aligned)
-- 30-second verification snippets (Node.js + Python)
-- Clear scope boundaries (what CCS does / does not cover)
-
-Join technical discussions in **[GitHub Discussions](https://github.com/DSHCorrectover/ccs-mcp-server/discussions)** — receipt interoperability, field mapping proposals, and protocol feedback welcome.
-
 ## Protocol Context
 
-- **IETF**: [draft-correctover-ccs-06](https://datatracker.ietf.org/doc/draft-correctover-ccs/) (Experimental) — RT#55620 submitted
+- **IETF**: [draft-correctover-ccs](https://datatracker.ietf.org/doc/draft-correctover-ccs/) — an individual Internet-Draft; not an RFC or IETF endorsement, and the Datatracker page is authoritative for revision and status
 - **Complements**: [VAP draft-samal-vap-00](https://datatracker.ietf.org/doc/draft-samal-vap/) (scope/budget/purpose), [Microsoft ACS](https://github.com/microsoft/agent-governance-toolkit) (policy decisions), AP2 (human authorization)
 - **Does not replace**: authentication, payment networks, policy engines
 
-## Ecosystem
-
-| Project | What it does |
-|---------|-------------|
-| [ccs-demo](https://github.com/DSHCorrectover/ccs-demo) | Complete INSPECT→SIGN→VERIFY walkthrough — 6 scenarios, zero dependencies, `node demo.js` |
-| [ccs-verifier-action](https://github.com/DSHCorrectover/ccs-verifier-action) | GitHub Action — verify CCS receipts in CI/CD pipelines |
-| [ccs-mcp-server](https://github.com/DSHCorrectover/ccs-mcp-server) | Core MCP server (this repo) — runtime verification + evidence signing |
-| [ccs-proxy](https://dshcorrectover.github.io/ccs-proxy/) | **Commercial** — inline enforcement proxy with L2 protocol attestation + L3 execution binding (Ed25519 signed receipts) |
-
 ## Links
 
 - npm: https://www.npmjs.com/package/ccs-mcp-server
 - GitHub: https://github.com/DSHCorrectover/ccs-mcp-server
 - IETF Draft: https://datatracker.ietf.org/doc/draft-correctover-ccs/
 - PyPI (full verifier): https://pypi.org/project/ccs-verifier/
-- Demo: https://github.com/DSHCorrectover/ccs-demo
-- GitHub Action: https://github.com/DSHCorrectover/ccs-verifier-action
-- Discussions: https://github.com/DSHCorrectover/ccs-mcp-server/discussions
-- CCS Proxy (commercial): https://dshcorrectover.github.io/ccs-proxy/
-- Integration Guide: [INTEGRATION.md](INTEGRATION.md)
 
 ## License
 
-[Elastic License 2.0 (ELv2)](LICENSE) — see the full terms. Reference implementation for CCS standard evaluation.
+Elastic License 2.0 (ELv2). See [LICENSE](LICENSE).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccs-mcp-server",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "description": "CCS Runtime Evidence MCP Server — 7-dimension runtime verification for AI agent tool calls. Ed25519 receipts, sub-ms OOP, zero deps. For Claude Desktop, Cursor, Windsurf.",
   "type": "commonjs",
   "bin": {

package/src/index.js

@@ -32,7 +32,7 @@ const receipts = require("./receipts");
 // CCS Verifier Core (pure stdlib Node.js)
 // ---------------------------------------------------------------------------
 
-const CCS_VERSION = "1.2.8";
+const CCS_VERSION = "1.2.9";
 
 const DEFAULT_POLICY = {
   mode: "block",