protect-mcp 0.11.0 → 0.11.1

package/dist/{chunk-3FSKOGGK.mjs → chunk-UBTX3A3D.mjs}

@@ -18,7 +18,8 @@ import {
 import {
   evaluateCedar,
   isCedarAvailable,
-  loadCedarPolicies
+  loadCedarPolicies,
+  runEvaluatorSelfTest
 } from "./chunk-FGCNKEEW.mjs";
 import {
   receiptHash
@@ -826,6 +827,41 @@ async function startHookServer(options = {}) {
       }
     }
   }
+  if (enforce) {
+    const selfTest = await runEvaluatorSelfTest();
+    for (const c of selfTest.cases) {
+      if (!c.pass) {
+        process.stderr.write(
+          `[PROTECT_MCP] SELF-TEST FAIL: ${c.name} (expected ${c.expected}, got ${c.actual})
+`
+        );
+      }
+    }
+    if (!selfTest.passed) {
+      throw new Error(
+        "enforce mode refused to start: the restraint self-test failed. A gate that cannot prove it denies must not arm."
+      );
+    }
+    const receiptProbe = signDecision({
+      v: 2,
+      tool: "__protect_mcp_startup_selftest__",
+      decision: "deny",
+      reason_code: "startup_selftest",
+      policy_digest: policyDigest,
+      request_id: `selftest-${Date.now()}`,
+      mode: "enforce",
+      timestamp: Date.now()
+    });
+    if (receiptProbe.error) {
+      throw new Error(
+        `enforce mode refused to start: signing is configured but a denial receipt could not be produced (${receiptProbe.error}). An enforcing gate that cannot evidence a denial must not arm.`
+      );
+    }
+    process.stderr.write(
+      `[PROTECT_MCP] Restraint self-test passed (${selfTest.cases.length} vectors${selfTest.wasmAvailable ? "" : "; Cedar WASM absent, fail-closed invariant verified"})${receiptProbe.ok ? "; denial receipt signing verified" : ""}. Arming enforce mode.
+`
+    );
+  }
   const state = {
     cedarPolicies,
     cedarDir: cedarDir || null,

package/dist/cli.js

@@ -4930,6 +4930,41 @@ async function startHookServer(options = {}) {
       }
     }
   }
+  if (enforce) {
+    const selfTest = await runEvaluatorSelfTest();
+    for (const c of selfTest.cases) {
+      if (!c.pass) {
+        process.stderr.write(
+          `[PROTECT_MCP] SELF-TEST FAIL: ${c.name} (expected ${c.expected}, got ${c.actual})
+`
+        );
+      }
+    }
+    if (!selfTest.passed) {
+      throw new Error(
+        "enforce mode refused to start: the restraint self-test failed. A gate that cannot prove it denies must not arm."
+      );
+    }
+    const receiptProbe = signDecision({
+      v: 2,
+      tool: "__protect_mcp_startup_selftest__",
+      decision: "deny",
+      reason_code: "startup_selftest",
+      policy_digest: policyDigest,
+      request_id: `selftest-${Date.now()}`,
+      mode: "enforce",
+      timestamp: Date.now()
+    });
+    if (receiptProbe.error) {
+      throw new Error(
+        `enforce mode refused to start: signing is configured but a denial receipt could not be produced (${receiptProbe.error}). An enforcing gate that cannot evidence a denial must not arm.`
+      );
+    }
+    process.stderr.write(
+      `[PROTECT_MCP] Restraint self-test passed (${selfTest.cases.length} vectors${selfTest.wasmAvailable ? "" : "; Cedar WASM absent, fail-closed invariant verified"})${receiptProbe.ok ? "; denial receipt signing verified" : ""}. Arming enforce mode.
+`
+    );
+  }
   const state = {
     cedarPolicies,
     cedarDir: cedarDir || null,
@@ -5281,6 +5316,8 @@ function buildCoverageStatement(input) {
     not_governed: [...DEFAULT_NOT_GOVERNED, ...extras],
     residual_bypass_routes: RESIDUAL_BYPASS_ROUTES,
     self_test: input.probe,
+    ...input.evaluatorSelfTest !== void 0 ? { evaluator_self_test: input.evaluatorSelfTest } : {},
+    basis: "configuration-at-generation-time",
     attestation_note: ATTESTATION_NOTE
   };
 }
@@ -5337,6 +5374,7 @@ async function handleCoverage(args) {
     return;
   }
   const version = process.env.PROTECT_MCP_VERSION || "unknown";
+  const evaluatorSelfTest = await runEvaluatorSelfTest();
   let statement;
   let signingConfig;
   if (opts.cedarDir) {
@@ -5357,6 +5395,7 @@ async function handleCoverage(args) {
         reason: "cedar policies are evaluated per-request; a static probe would not exercise the WASM evaluation path. Run the gate with --enforce to exercise live evaluation."
       },
       extraNotGoverned: opts.extraNotGoverned,
+      evaluatorSelfTest,
       packageVersion: version
     });
   } else if (opts.policyPath) {
@@ -5374,6 +5413,7 @@ async function handleCoverage(args) {
       wildcardRule: analyzed.wildcardRule,
       probe: analyzed.probe,
       extraNotGoverned: opts.extraNotGoverned,
+      evaluatorSelfTest,
       packageVersion: version
     });
   } else {
@@ -5387,6 +5427,7 @@ async function handleCoverage(args) {
       blockedTools: [],
       probe: { method: "none", reason: "no policy loaded; the gate would allow all tool calls" },
       extraNotGoverned: opts.extraNotGoverned,
+      evaluatorSelfTest,
       packageVersion: version
     });
   }
@@ -5428,6 +5469,7 @@ async function handleCoverage(args) {
   governed    : ${statement.governed.tools_with_explicit_rules.length} tools with explicit rules${statement.governed.explicitly_blocked_tools.length ? `, ${statement.governed.explicitly_blocked_tools.length} explicitly blocked` : ""}
   not governed: ${statement.not_governed.length} declared items (defaults cannot be removed)
   self test   : ${statement.self_test.method}${statement.self_test.would_deny !== void 0 ? ` (would_deny=${statement.self_test.would_deny})` : ""}
+  evaluator   : live self-test ${evaluatorSelfTest.passed ? "passed" : "FAILED"} (${evaluatorSelfTest.cases.length} vectors)
   signed      : ${signer ? `yes (kid ${signer.kid})` : "no (unsigned declaration)"}
 `
   );
@@ -5473,7 +5515,7 @@ var init_coverage = __esm({
         residual_risk: "downstream system behavior (not this layer)"
       }
     ];
-    ATTESTATION_NOTE = "This statement enumerates what the gate is configured to govern and declares what it does not see. It is a scope declaration, not a proof of the absence of other action paths: making the gate the only path is a deployment property (single-endpoint configuration, or egress lockdown for a hard guarantee). Shadow enforcement observes and receipts but does not block.";
+    ATTESTATION_NOTE = "This statement enumerates what the gate is configured to govern and declares what it does not see. It is a scope declaration, not a proof of the absence of other action paths: making the gate the only path is a deployment property (single-endpoint configuration, or egress lockdown for a hard guarantee). Shadow enforcement observes and receipts but does not block. The statement reflects configuration at generation time; a statement emitted by the running gateway (observed coverage, with intended-versus-observed mismatch flagging) is on the roadmap. In enforce mode the gate refuses to arm unless the live restraint self-test passes.";
     CHANNEL_DESCRIPTION = {
       hook: "every tool call the agent harness routes through the pre-tool-call hook",
       proxy: "every call made to the gate HTTP endpoint wrapping the tool server"

package/dist/cli.mjs

@@ -4529,7 +4529,7 @@ async function main() {
     return;
   }
   if (args[0] === "coverage") {
-    const { handleCoverage } = await import("./coverage-NB55FTYL.mjs");
+    const { handleCoverage } = await import("./coverage-IHN7MUBH.mjs");
     await handleCoverage(args.slice(1));
     process.exit(process.exitCode || 0);
   }

package/dist/{coverage-NB55FTYL.mjs → coverage-IHN7MUBH.mjs}

@@ -7,7 +7,8 @@ import {
   signGenericArtifact
 } from "./chunk-WMIWQ6TS.mjs";
 import {
-  loadCedarPolicies
+  loadCedarPolicies,
+  runEvaluatorSelfTest
 } from "./chunk-FGCNKEEW.mjs";
 import "./chunk-XOP3PEBM.mjs";
 import "./chunk-PQJP2ZCI.mjs";
@@ -47,7 +48,7 @@ var RESIDUAL_BYPASS_ROUTES = [
     residual_risk: "downstream system behavior (not this layer)"
   }
 ];
-var ATTESTATION_NOTE = "This statement enumerates what the gate is configured to govern and declares what it does not see. It is a scope declaration, not a proof of the absence of other action paths: making the gate the only path is a deployment property (single-endpoint configuration, or egress lockdown for a hard guarantee). Shadow enforcement observes and receipts but does not block.";
+var ATTESTATION_NOTE = "This statement enumerates what the gate is configured to govern and declares what it does not see. It is a scope declaration, not a proof of the absence of other action paths: making the gate the only path is a deployment property (single-endpoint configuration, or egress lockdown for a hard guarantee). Shadow enforcement observes and receipts but does not block. The statement reflects configuration at generation time; a statement emitted by the running gateway (observed coverage, with intended-versus-observed mismatch flagging) is on the roadmap. In enforce mode the gate refuses to arm unless the live restraint self-test passes.";
 var CHANNEL_DESCRIPTION = {
   hook: "every tool call the agent harness routes through the pre-tool-call hook",
   proxy: "every call made to the gate HTTP endpoint wrapping the tool server"
@@ -77,6 +78,8 @@ function buildCoverageStatement(input) {
     not_governed: [...DEFAULT_NOT_GOVERNED, ...extras],
     residual_bypass_routes: RESIDUAL_BYPASS_ROUTES,
     self_test: input.probe,
+    ...input.evaluatorSelfTest !== void 0 ? { evaluator_self_test: input.evaluatorSelfTest } : {},
+    basis: "configuration-at-generation-time",
     attestation_note: ATTESTATION_NOTE
   };
 }
@@ -133,6 +136,7 @@ async function handleCoverage(args) {
     return;
   }
   const version = process.env.PROTECT_MCP_VERSION || "unknown";
+  const evaluatorSelfTest = await runEvaluatorSelfTest();
   let statement;
   let signingConfig;
   if (opts.cedarDir) {
@@ -153,6 +157,7 @@ async function handleCoverage(args) {
         reason: "cedar policies are evaluated per-request; a static probe would not exercise the WASM evaluation path. Run the gate with --enforce to exercise live evaluation."
       },
       extraNotGoverned: opts.extraNotGoverned,
+      evaluatorSelfTest,
       packageVersion: version
     });
   } else if (opts.policyPath) {
@@ -170,6 +175,7 @@ async function handleCoverage(args) {
       wildcardRule: analyzed.wildcardRule,
       probe: analyzed.probe,
       extraNotGoverned: opts.extraNotGoverned,
+      evaluatorSelfTest,
       packageVersion: version
     });
   } else {
@@ -183,6 +189,7 @@ async function handleCoverage(args) {
       blockedTools: [],
       probe: { method: "none", reason: "no policy loaded; the gate would allow all tool calls" },
       extraNotGoverned: opts.extraNotGoverned,
+      evaluatorSelfTest,
       packageVersion: version
     });
   }
@@ -224,6 +231,7 @@ async function handleCoverage(args) {
   governed    : ${statement.governed.tools_with_explicit_rules.length} tools with explicit rules${statement.governed.explicitly_blocked_tools.length ? `, ${statement.governed.explicitly_blocked_tools.length} explicitly blocked` : ""}
   not governed: ${statement.not_governed.length} declared items (defaults cannot be removed)
   self test   : ${statement.self_test.method}${statement.self_test.would_deny !== void 0 ? ` (would_deny=${statement.self_test.would_deny})` : ""}
+  evaluator   : live self-test ${evaluatorSelfTest.passed ? "passed" : "FAILED"} (${evaluatorSelfTest.cases.length} vectors)
   signed      : ${signer ? `yes (kid ${signer.kid})` : "no (unsigned declaration)"}
 `
   );

package/dist/hook-server.js

@@ -109,6 +109,9 @@ function digestPolicyFiles(engine, files) {
     files: entries
   };
 }
+function digestCedarSource(source) {
+  return digestPolicyFiles("cedar", [{ name: "policy.cedar", content: source }]);
+}
 function digestBuiltinPolicy(policy) {
   return digestPolicyFiles("builtin", [{ name: "policy.json", content: canonicalize(policy) }]);
 }
@@ -284,6 +287,33 @@ function extractPolicyErrors(result) {
 async function isCedarAvailable() {
   return ensureCedarWasm();
 }
+function policySetFromSource(source, name = "inline") {
+  const digest = digestCedarSource(source).policy_digest;
+  return { source, digest, fileCount: 1, files: [name] };
+}
+async function runEvaluatorSelfTest() {
+  const wasmAvailable = await isCedarAvailable();
+  const cases = [];
+  const run = async (name, expected, policy, context) => {
+    const d = await evaluateCedar(policy, { tool: "Bash", tier: "unknown", context }, void 0, { failClosed: true });
+    const actual = d.allowed ? "ALLOW" : "DENY";
+    cases.push({ name, expected, actual, pass: actual === expected, reason: d.reason });
+  };
+  if (!wasmAvailable) {
+    await run("engine unavailable denies", "DENY", policySetFromSource("permit(principal, action, resource);"), {});
+    return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+  }
+  const correct = policySetFromSource(
+    'forbid(principal, action, resource) when { ["rm", "dd", "mkfs"].contains(context.command) };\npermit(principal, action, resource);'
+  );
+  await run("forbid denies rm", "DENY", correct, { command: "rm" });
+  await run("permit allows ls", "ALLOW", correct, { command: "ls" });
+  const broken = policySetFromSource(
+    'forbid(principal, action, resource) when { context.command in ["rm", "dd"] };\npermit(principal, action, resource);'
+  );
+  await run("in-on-String forbid does not permit-all", "DENY", broken, { command: "rm" });
+  return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+}
 
 // src/signing.ts
 var import_node_fs3 = require("fs");
@@ -1536,6 +1566,41 @@ async function startHookServer(options = {}) {
       }
     }
   }
+  if (enforce) {
+    const selfTest = await runEvaluatorSelfTest();
+    for (const c of selfTest.cases) {
+      if (!c.pass) {
+        process.stderr.write(
+          `[PROTECT_MCP] SELF-TEST FAIL: ${c.name} (expected ${c.expected}, got ${c.actual})
+`
+        );
+      }
+    }
+    if (!selfTest.passed) {
+      throw new Error(
+        "enforce mode refused to start: the restraint self-test failed. A gate that cannot prove it denies must not arm."
+      );
+    }
+    const receiptProbe = signDecision({
+      v: 2,
+      tool: "__protect_mcp_startup_selftest__",
+      decision: "deny",
+      reason_code: "startup_selftest",
+      policy_digest: policyDigest,
+      request_id: `selftest-${Date.now()}`,
+      mode: "enforce",
+      timestamp: Date.now()
+    });
+    if (receiptProbe.error) {
+      throw new Error(
+        `enforce mode refused to start: signing is configured but a denial receipt could not be produced (${receiptProbe.error}). An enforcing gate that cannot evidence a denial must not arm.`
+      );
+    }
+    process.stderr.write(
+      `[PROTECT_MCP] Restraint self-test passed (${selfTest.cases.length} vectors${selfTest.wasmAvailable ? "" : "; Cedar WASM absent, fail-closed invariant verified"})${receiptProbe.ok ? "; denial receipt signing verified" : ""}. Arming enforce mode.
+`
+    );
+  }
   const state = {
     cedarPolicies,
     cedarDir: cedarDir || null,

package/dist/hook-server.mjs

@@ -1,6 +1,6 @@
 import {
   startHookServer
-} from "./chunk-3FSKOGGK.mjs";
+} from "./chunk-UBTX3A3D.mjs";
 import "./chunk-KRKZ2YX7.mjs";
 import "./chunk-CIWIK6BT.mjs";
 import "./chunk-WMIWQ6TS.mjs";

package/dist/index.js

@@ -38947,6 +38947,41 @@ async function startHookServer(options = {}) {
       }
     }
   }
+  if (enforce) {
+    const selfTest = await runEvaluatorSelfTest();
+    for (const c of selfTest.cases) {
+      if (!c.pass) {
+        process.stderr.write(
+          `[PROTECT_MCP] SELF-TEST FAIL: ${c.name} (expected ${c.expected}, got ${c.actual})
+`
+        );
+      }
+    }
+    if (!selfTest.passed) {
+      throw new Error(
+        "enforce mode refused to start: the restraint self-test failed. A gate that cannot prove it denies must not arm."
+      );
+    }
+    const receiptProbe = signDecision({
+      v: 2,
+      tool: "__protect_mcp_startup_selftest__",
+      decision: "deny",
+      reason_code: "startup_selftest",
+      policy_digest: policyDigest,
+      request_id: `selftest-${Date.now()}`,
+      mode: "enforce",
+      timestamp: Date.now()
+    });
+    if (receiptProbe.error) {
+      throw new Error(
+        `enforce mode refused to start: signing is configured but a denial receipt could not be produced (${receiptProbe.error}). An enforcing gate that cannot evidence a denial must not arm.`
+      );
+    }
+    process.stderr.write(
+      `[PROTECT_MCP] Restraint self-test passed (${selfTest.cases.length} vectors${selfTest.wasmAvailable ? "" : "; Cedar WASM absent, fail-closed invariant verified"})${receiptProbe.ok ? "; denial receipt signing verified" : ""}. Arming enforce mode.
+`
+    );
+  }
   const state = {
     cedarPolicies,
     cedarDir: cedarDir || null,

package/dist/index.mjs

@@ -49,7 +49,7 @@ import {
   forwardReceipt,
   getScopeBlindBridge,
   startHookServer
-} from "./chunk-3FSKOGGK.mjs";
+} from "./chunk-UBTX3A3D.mjs";
 import "./chunk-KRKZ2YX7.mjs";
 import "./chunk-CIWIK6BT.mjs";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + Ed25519 signed receipts for AI agent tool calls. Denies on any policy error, proves the gate is live with a startup self-test, and turns every decision into a local searchable record you own. The open gate behind Legate by ScopeBlind. scopeblind.com",
   "main": "dist/index.js",