create-metamynd-agent 0.7.0 → 0.7.2

package/README.md

@@ -16,6 +16,10 @@ enforcement boundary — see [Separate tool gateway](#separate-tool-gateway-defa
 
 ## Free local harness (no account, no network, `--harness`)
 
+> **Without MetaMynd, you can be bypassed.** `--harness` proves your policy logic works — it does
+> not enforce it against a caller trying to get around it. See [What this is not](#what-this-is-not)
+> below before you rely on it for anything beyond testing rules.
+
 ```bash
 npm create metamynd-agent@latest -- --harness   # or: npx create-metamynd-agent --harness
 ```
@@ -39,6 +43,8 @@ my-agent/
 
 ### What this is not
 
+**Without MetaMynd, you can be bypassed.** Everything below is why, precisely.
+
 No anchored or cross-party-verifiable identity, no dashboard reachable when your machine is off, no
 owner queue someone *else* can approve from, no anchored evidence, no enforced platform Standards.
 That set of things is the hosted platform — and getting there later is a **config change, not a
@@ -81,6 +87,8 @@ agent with your own limits.
 
 `--sandbox` always scaffolds the single-process shape (no `gateway/`) — it's a shared identity never
 meant to hold real credentials, so there's nothing here worth a separate enforcement boundary for.
+Note this is a narrower gap than `--harness`'s: `--sandbox` DOES call MetaMynd for the decision, it
+just still has nowhere else for the tool to live, so the same in-process bypass applies regardless.
 The generated project's own README says so. The full flow below is what scaffolds one by default.
 
 ## Use
@@ -126,24 +134,49 @@ npm start
 
 ### Separate tool gateway (default)
 
+This is the other half of **without MetaMynd, you can be bypassed**: WITH it — specifically, with
+`gateway/`, the second process this scaffolds by default — calling the tool directly instead of
+through the check no longer works, the same way the hosted platform's own MCP counterparty can't
+be talked around by a compromised agent. See [Not solved by the gateway](#not-solved-by-the-gateway)
+below for the two things this specifically does **not** cover.
+
 `guard.guardTool()` in `index.mjs` still runs — it's a fast, local, client-side pre-check that gives
 good UX (fail fast on an obviously-blocked call, no round trip) — but it is **not** what stops a
 bypass. It still calls its handler in the SAME process regardless of where the decision came from,
 so anything able to call that handler directly gets the same result the gate would have given it.
 
-What actually stops a bypass is that `bookFlight()` doesn't exist in the agent's process at all.
+What actually stops that bypass is that `bookFlight()` doesn't exist in the agent's process at all.
 It exists only in `gateway/server.mjs` — a separate process, started separately, holding any real
 tool credentials the agent process never sees — which independently re-verifies every request
-against the agent's own published policy bundle before running it (same shape as the mutual
-counterparty check in [`@metamynd/agentsafe-mcp-guard`](https://www.npmjs.com/package/@metamynd/agentsafe-mcp-guard),
-built with [`@metamynd/agentsafe-http-gateway`](https://www.npmjs.com/package/@metamynd/agentsafe-http-gateway)).
-It's a minimal slice of the same pattern proven end to end in `demo/duffel-mcp-gateway` in the
+against the agent's own published policy bundle before running it, and **binds that request to the
+actual body being executed** (`@metamynd/agentsafe-http-gateway` ≥ 0.2.0) — closing a confused-deputy
+gap found during testing, where a signed cheap request could be governed while a different, expensive
+body was the one that actually ran. Same shape as the mutual counterparty check in
+[`@metamynd/agentsafe-mcp-guard`](https://www.npmjs.com/package/@metamynd/agentsafe-mcp-guard), built
+with [`@metamynd/agentsafe-http-gateway`](https://www.npmjs.com/package/@metamynd/agentsafe-http-gateway).
+It's a minimal slice of the fuller pattern proven end to end in `demo/duffel-mcp-gateway` in the
 AgentSafe repo (mutual handshake, x402 payment binding, capability tokens) — this scaffold gives you
-just the part that closes the bypass, not the whole protocol.
+just the part that closes the direct-call bypass, not the whole protocol.
+
+#### Not solved by the gateway
+
+Named precisely, not left implicit:
+
+- **Replay.** The gateway checks a signed request is fresh, not that it hasn't been used before —
+  a captured valid request can be resent within the freshness window. Single-use nonce consumption
+  is the stateful issuer gate's job (`POST /policy/mandate/authorize`); this scaffold never calls it.
+- **Cumulative spend.** Each call is checked against the per-transaction cap correctly, but the
+  mandate's TOTAL budget isn't tracked at the gateway — many separately-legal calls can still add
+  up past it. The real total is only enforced where a hold is actually reserved: the issuer gate.
+
+Both require wiring the full authorize-before-execute flow (agent calls the stateful gate first,
+gateway checks a decision bound to that specific authorization) rather than per-request policy
+re-evaluation alone — see `gateway/README.md`'s own "Beyond this minimal slice" section.
 
 Pass `--no-gateway` to opt out and get the old single-process scaffold instead — e.g. if you're
-already running your own separate gateway and don't need this one. The generated project's own
-README says plainly that this is *not* a separate enforcement boundary if you do.
+already running your own separate gateway and don't need this one. **You are back to being
+bypassable if you do**, for the same structural reason `--harness` is; the generated project's own
+README says so plainly.
 
 ## Non-interactive
 

package/index.mjs

@@ -28,7 +28,9 @@ const GUARD_VERSION = '^0.5.0';
 const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 const MCP_GUARD_VERSION = '^0.1.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
-const GATEWAY_VERSION = '^0.1.0';
+// 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
+// never scaffold a range that could resolve below it.
+const GATEWAY_VERSION = '^0.2.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -420,6 +422,10 @@ console.log(dim('   - the blocked call never reached your tool at all.'));
 console.log(dim('   - every decision was recorded as tamper-evident evidence.'));
 console.log(dim('   - if the gate were unreachable the guard fails CLOSED: it blocks.'));
 console.log('');
+console.log(bold('  Without MetaMynd, you can be bypassed.') + ' bookFlight() runs in THIS process -');
+console.log(dim('  call it directly instead of gatedBookFlight and nothing above stops you.'));
+console.log(dim('  Re-scaffold without --sandbox/--no-gateway for the default shape, which does.'));
+console.log('');
 console.log('  Change the cap in the dashboard (Legal Entity -> SOPs) and run again.');
 console.log(dim('  The outcome changes. This file does not. That is the point.'));
 console.log('');
@@ -600,6 +606,9 @@ console.log(dim('     authority, because it cannot name an action nobody delegat
 console.log(dim('   - every blocked/escalated call never reached a real tool at all.'));
 console.log(dim('   - if the gate were unreachable the guard fails CLOSED: it blocks.'));
 console.log('');
+console.log(bold('  With MetaMynd, you can\\'t be bypassed.') + ' ./gateway is why - it independently');
+console.log(dim('  re-verified step 1 before running it, and holds the tool this file never can.'));
+console.log('');
 console.log('  Change the cap in the dashboard (Legal Entity -> SOPs) and run again.');
 console.log(dim('  The outcome changes. This file does not. That is the point.'));
 console.log('');
@@ -682,23 +691,27 @@ A MetaMynd/AgentSafe-governed agent, scaffolded with \`create-metamynd-agent\`.
 
 ${gatewaySection}${
     withGateway
-      ? `This scaffold's default shape (agent + separate gateway process, port ${gatewayPort} by
-default) is the actual enforcement boundary: \`guard.guardTool()\` in \`index.mjs\` is a
-client-side convenience, not a boundary — it still runs its handler in-process regardless of
-where the decision came from. What actually stops a bypass is that \`bookFlight()\` itself only
-exists in \`./gateway\`, a process this one cannot reach into, which independently re-verifies
-every request against this agent's own policy bundle. Re-scaffold with \`--no-gateway\` for the
-old single-process shape — it is NOT a separate enforcement boundary; see its own generated
-README for why.`
-      : `This scaffold has no separate gateway process (either \`--sandbox\`, which never
-provisions real credentials, or \`--no-gateway\` was passed): \`guard.guardTool()\` wraps a tool
-in the SAME process as the check itself. That is a client-side convenience, not a boundary — it
-still runs your tool's handler in-process regardless of where the decision came from, so
-anything able to call \`bookFlight()\` directly gets the same result the gate would have given
-it. If this tool ever holds a real credential, provision for real (drop \`--sandbox\`) without
-\`--no-gateway\` for the default shape, which puts the tool behind a separate process instead.
-This is the same structural gap \`--harness\`'s README documents, for the same reason: a
-cooperative in-process check has no counterparty to disagree with a caller that skips it.`
+      ? `**With MetaMynd's gateway, calling the tool directly and skipping the check no longer
+works** — that's what this section is about. This scaffold's default shape (agent + separate
+gateway process, port ${gatewayPort} by default) is the actual enforcement boundary for that
+specific bypass: \`guard.guardTool()\` in \`index.mjs\` is a client-side convenience, not a
+boundary — it still runs its handler in-process regardless of where the decision came from. What
+actually stops it is that \`bookFlight()\` itself only exists in \`./gateway\`, a process this one
+cannot reach into, which independently re-verifies every request against this agent's own policy
+bundle AND binds it to the actual body being executed. It does NOT track replay or cumulative
+spend across calls — see \`./gateway/README.md\`'s "Beyond this minimal slice" section. Re-scaffold
+with \`--no-gateway\` for the old single-process shape — it is NOT a separate enforcement boundary
+at all; see its own generated README for why.`
+      : `**Without MetaMynd, you can be bypassed** — this is that case. This scaffold has no
+separate gateway process (either \`--sandbox\`, which never provisions real credentials, or
+\`--no-gateway\` was passed): \`guard.guardTool()\` wraps a tool in the SAME process as the check
+itself. That is a client-side convenience, not a boundary — it still runs your tool's handler
+in-process regardless of where the decision came from, so anything able to call \`bookFlight()\`
+directly gets the same result the gate would have given it. If this tool ever holds a real
+credential, provision for real (drop \`--sandbox\`) without \`--no-gateway\` for the default
+shape, which puts the tool behind a separate process instead. This is the same structural gap
+\`--harness\`'s README documents, for the same reason: a cooperative in-process check has no
+counterparty to disagree with a caller that skips it.`
   }
 
 ## Change the rules
@@ -828,7 +841,11 @@ function gatewayGitignore() {
 function gatewayReadme(slug, scope, port) {
   return `# ${slug}-gateway
 
-This is the **real enforcement boundary** for \`${slug}\`'s tool(s) — not \`../index.mjs\`.
+**With MetaMynd, you can't call the tool directly and skip the check.** This process is why. It
+is the **real enforcement boundary** for \`${slug}\`'s tool(s) — not \`../index.mjs\` — for that
+specific bypass. See [Beyond this minimal slice](#beyond-this-minimal-slice) below for the two
+things it does NOT yet close on its own: replaying a captured request, and spend adding up
+across many separately-legal calls.
 
 ## Why this exists
 
@@ -873,10 +890,26 @@ add another protected route here rather than adding a local function back in \`i
 
 ## Beyond this minimal slice
 
-This gateway only re-verifies a signed request (§9.3/§9.6 of the MAGP spec). It does not do the
-mutual DID handshake, x402 payment binding, or commitment-bound capability tokens that a
-production Service integration would add — see \`@metamynd/agentsafe-mcp-guard\`'s own README for
-those, and \`demo/duffel-mcp-gateway\` in the AgentSafe repo for a full worked example.
+This gateway independently re-verifies a signed request AND binds it to the actual request body
+(§9.3/§9.6 of the MAGP spec, plus payload binding — \`@metamynd/agentsafe-http-gateway\` ≥ 0.2.0).
+That closes the specific bypass this scaffold exists to close: an agent (or anything able to call
+its code) presenting one set of values while a different set actually executes.
+
+Two things it deliberately does NOT close, named precisely rather than left implicit:
+
+- **Replay.** \`verifyRequest()\` checks the signed request is fresh, not that it hasn't been used
+  before — a captured valid request can be resent within the freshness window. Single-use nonce
+  consumption is the stateful issuer gate's job, not this gateway's; this scaffold never calls it.
+- **Cumulative spend.** Each call is checked against the per-transaction cap correctly, but the
+  mandate's TOTAL budget isn't tracked here — many separately-legal calls can still add up past
+  it. The real total is only enforced where holds are actually reserved: \`POST
+  /policy/mandate/authorize\` on the issuer.
+
+Closing both means wiring the full authorize-before-execute flow — the agent calling that
+stateful endpoint first, this gateway checking a decision bound to that specific authorization —
+not just re-evaluating policy per request. See \`@metamynd/agentsafe-mcp-guard\`'s own README
+(mutual DID handshake, x402 payment binding, commitment-bound capability tokens) and
+\`demo/duffel-mcp-gateway\` in the AgentSafe repo for what that full pattern looks like.
 `;
 }
 
@@ -1552,12 +1585,17 @@ console.log(dim('     authority, because it cannot name an action nobody delegat
 console.log(dim('   - the blocked call never reached your tool at all.'));
 console.log(dim('   - every decision is in ./metamynd-harness.log.jsonl - yours, locally.'));
 console.log('');
+console.log(bold('  Without MetaMynd, you can be bypassed.') + ' bookFlight() above runs in THIS');
+console.log(dim('  process - call it directly instead of gatedBookFlight and nothing stops you.'));
+console.log(dim('  --harness proves your policy logic; it does not enforce it against that.'));
+console.log('');
 console.log('  Edit ./metamynd-rules.json (or the dashboard) and run again - the outcome');
 console.log(dim('  changes. This file does not. That is the point.'));
 console.log('');
 console.log(dim('  Ready for more than one machine, a queue someone else can approve from,'));
-console.log(dim('  anchored evidence, or KYC/KYB-backed identity? That is the hosted platform -'));
-console.log(dim('  same guardTool() call, same rules shape, drop --harness and provision there.'));
+console.log(dim('  anchored evidence, or KYC/KYB-backed identity, AND a separate gateway process'));
+console.log(dim('  that closes the bypass above? That is the hosted platform - drop --harness'));
+console.log(dim('  and provision there; the same guardTool() call keeps working.'));
 console.log('');
 dashboard.close();
 `;
@@ -1607,6 +1645,8 @@ open the dashboard to approve it), and a BLOCK (an action outside the mandate en
 
 ## What this is not
 
+**Without MetaMynd, you can be bypassed.** Everything below is why, precisely.
+
 No anchored/verifiable identity, no cross-party trust, no evidence anyone but you can audit,
 no dashboard reachable when this machine is off, no owner queue someone else can approve from.
 That's the hosted platform (\`npx create-metamynd-agent\`, without \`--harness\`) — same
@@ -1617,8 +1657,8 @@ cooperative library this process embeds — call the tool handler directly inste
 one and nothing stops you, because there is no second party in the loop to disagree with you.
 That's structural, not a bug: use this harness to govern your own agent's own honest behavior,
 not as a defense against an agent (or a person) actively trying to get around it. The hosted
-platform's \`guardTool()\` doesn't have this gap, because the MCP/tool service re-verifies the
-agent's signed authority for itself instead of trusting that the agent's own guard ran.
+platform's default scaffold doesn't have this gap, because a SEPARATE gateway process re-verifies
+the agent's signed authority for itself instead of trusting that the agent's own guard ran.
 `;
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.7.0",
-  "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process (the real enforcement boundary). --harness scaffolds a free, local, zero-network governance harness instead.",
+  "version": "0.7.2",
+  "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes the direct-call bypass. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {
     "create-metamynd-agent": "index.mjs"