omitly-mcp 0.1.6 → 0.1.8

package/README.md

@@ -9,13 +9,15 @@ anywhere**. Redaction runs on-device through the Omitly engine and returns a
 signed audit log proving the data was removed — the opposite of pasting a
 confidential file into a chat model.
 
-**Four of the seven tools (`find_sensitive_regions`, `locate_text`,
+**Four of the eight tools (`find_sensitive_regions`, `locate_text`,
 `check_redaction`, `verify_redaction`) work out of the box — `npm install`,
 no Rust toolchain, no native binary, no desktop app.** They run on a
 wasm-bindgen build of the same detector that powers the web leak-checker at
-omitly.app, bundled directly in this package. `create_pdf` and the two
-write tools (`redact_pdf`, `redact_by_entity`) still need a configured
-native engine — see "Build & run" below.
+omitly.app, bundled directly in this package. `create_pdf`, the two
+write tools (`redact_pdf`, `redact_by_entity`), and `verify_seal` still need
+a configured native engine — see "Build & run" below. `verify_seal` has no
+wasm fallback at all: there is no wasm seal-verification path, so it always
+requires the native engine.
 
 ## Tools
 
@@ -25,7 +27,8 @@ native engine — see "Build & run" below.
 | `locate_text` | Resolves literal strings the model supplies (names, addresses — anything regex can't catch) to their page + coordinates. The model does the recognition; the engine does the geometry. |
 | `redact_by_entity` | One-shot: find + filter by kind (`email`/`ssn`/`phone`/`card`/`tfn`/`abn`/`acn`/`medicare`/`crn`/`ihi`/`bsb`) and/or `regions` + redact + verify. The "just scrub the obvious PII" shortcut. |
 | `redact_pdf` | Removes the underlying data from given regions of a PDF, verifies nothing survives, writes the redacted file, and returns the audit log. |
-| `verify_redaction` | Re-scans an already-redacted PDF and returns the verification verdict. |
+| `verify_redaction` | Re-scans an already-redacted PDF and returns the verification verdict — the redaction-completeness check. |
+| `verify_seal` | Cryptographically checks a PDF's embedded Omitly audit report and trailing Ed25519 tamper-evidence seal — the tamper-evidence check, distinct from `verify_redaction`. **Integrity, not identity:** the signing key is per-install and rides inside the file, so a valid seal means "unchanged since sealed by the holder of this key", never "produced by Omitly" — compare `sealFingerprint` out-of-band for origin. Requires a native engine; no wasm fallback exists. |
 | `create_pdf` | Generates a clean PDF from Markdown/HTML on-device, rendered through a real browser engine so it looks printed — instead of writing a throwaway reportlab/LaTeX script. |
 
 ## PDF generation (`create_pdf`)
@@ -59,7 +62,7 @@ See [DEMO.md](./DEMO.md) for a full Claude Code walkthrough.
 
 ## Status
 
-The MCP surface (seven tools, schemas, transport), the native engine binary
+The MCP surface (eight tools, schemas, transport), the native engine binary
 (`crates/omitly-cli`, built as `omitly-redact`), and the bundled wasm engine
 (`crates/leakcheck-wasm`, covering the four free tools without a native
 binary) are all implemented and pass end-to-end tests. `find_sensitive_regions`
@@ -104,6 +107,22 @@ a JSON response from stdout. Any failure returns `{ "ok": false, "error": "..."
   "hiddenContent": [ { "class": "thumbnails", "verification": { "result": "pass" } }, ... ] }
 ```
 
+```jsonc
+// stdin — checks the embedded audit report + trailing Ed25519 seal, not
+// redaction completeness (that's "verify" above)
+{ "command": "verify_seal", "pdfPath": "..." }
+// stdout — verdict is one of: no_report | seal_invalid |
+// seal_unsupported_version | incomplete | verified. seal_unsupported_version
+// means this verifier is too old to check the seal at all — sealValid is
+// `null` (checked nothing), never true or false; carriesAuditReport flags
+// whether the file also carries an Omitly audit report (escalation signal).
+{ "ok": true, "verdict": "verified", "sealValid": true, "sealFingerprint": "...",
+  "allPassed": true, "metadataScrubbed": true, "regionCount": 2, "pageCount": 4,
+  "warnings": [], "licenseProvenance": null,
+  "inputSha256": "...", "outputSha256": "...",
+  "sourceFilename": "...", "outputFilename": "..." }
+```
+
 ## Build & run
 
 **Free tools only (find_sensitive_regions, locate_text, check_redaction,
@@ -122,8 +141,11 @@ source** (this repo) does need `wasm-pack` (`cargo install wasm-pack`) and
 the `wasm32-unknown-unknown` target, since `npm run build` regenerates the
 wasm bundle from `../crates/leakcheck-wasm` via `npm run build:wasm`.
 
-**Everything, including `create_pdf` and the two write tools
-(`redact_pdf`, `redact_by_entity`):**
+**Everything, including `create_pdf`, `verify_seal`, and the two write tools
+(`redact_pdf`, `redact_by_entity`):** `verify_seal` has no wasm fallback —
+unlike the four free tools above, it always needs the native engine
+configured, even though it carries no licence requirement (see "Licensing"
+below).
 
 ```bash
 # 1. Build the local engine binaries (from the repo root)
@@ -176,9 +198,11 @@ fallback — wasm never touches these two tools): a Pro or Personal licence
 same machine) runs unmarked; otherwise the shared 14-day trial applies and
 the audit output is permanently marked as evaluation output. The redaction
 itself is never degraded, and licence checks never touch the network.
-`find_sensitive_regions`, `locate_text`, `check_redaction`, and
-`verify_redaction` are free forever — the wasm build backing them has no
-licence logic at all, because there's nothing to gate.
+`find_sensitive_regions`, `locate_text`, `check_redaction`, `verify_redaction`,
+and `verify_seal` are free forever — the four wasm-backed tools have no
+licence logic at all because there's nothing to gate, and `verify_seal`
+(native-only) is free by the same design in `crates/omitly-cli` (no Pro/
+Personal licence check on that command path either).
 
 ## Register with Claude Code