protect-mcp 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.7.2: run the gate in other agents (Codex, Cursor, Gemini, Hermes)
+
+The `evaluate` and `sign` verbs now accept `--format <host>`
+(claude | codex | gemini | cursor | hermes | grok). With it, the verb reads the
+host's hook payload from stdin (tool name and input) and emits the deny verdict
+in that host's hook contract, so the same fail-closed Cedar gate works as a
+PreToolUse/PostToolUse hook outside Claude Code.
+
+The load-bearing detail: **Hermes ignores hook exit codes** and reads the verdict
+from stdout, so `--format hermes` denies via `{"decision":"block"}` on stdout. A
+raw exit-2 (which every other host honors) would have silently failed open there.
+Cursor and Gemini receive their structured stdout deny verdict in addition to
+exit 2. Without `--format`, the verbs behave exactly as before (the
+`--tool`/`--input` flag mode is unchanged).
+
 ## 0.7.1: documentation and security policy
 
 No code change from 0.7.0. Rewrote the README to lead with the fail-closed and

package/README.md

@@ -93,6 +93,26 @@ session always runs the gate you tested:
 configured, and if no signer is available it records an honest unsigned line
 (`"signed": false`) rather than failing the tool.
 
+## Use it in other agents (Codex, Cursor, Gemini, Hermes)
+
+The same fail-closed gate runs as a tool hook in any agent that supports them. Add
+`--format <host>` so the verb reads that host's hook payload from stdin and denies
+in its contract:
+
+```bash
+# the PreToolUse / before-tool command for each host
+npx -y protect-mcp@latest evaluate --format codex  --cedar ./cedar   # OpenAI Codex
+npx -y protect-mcp@latest evaluate --format gemini --cedar ./cedar   # Gemini CLI BeforeTool
+npx -y protect-mcp@latest evaluate --format cursor --cedar ./cedar   # Cursor beforeShellExecution
+npx -y protect-mcp@latest evaluate --format hermes --cedar ./cedar   # Hermes pre_tool_call
+```
+
+Pair each with `sign --format <host>` on the post-tool event for receipts. The
+important case is **Hermes**, which ignores hook exit codes and reads the verdict
+from stdout, so `--format hermes` denies via `{"decision":"block"}` rather than
+exit 2 (a raw exit-2 would silently fail open there). Without `--format`, the
+verbs read `--tool`/`--input` flags exactly as in the Claude Code section above.
+
 ## Write a policy
 
 Cedar policies live in a directory you point at with `--cedar`. A `forbid` rule

package/dist/cli.js

@@ -7622,17 +7622,65 @@ function loadPolicyArg(argv) {
   }
   return null;
 }
+async function readHookStdin() {
+  if (process.stdin.isTTY) return null;
+  try {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const raw = Buffer.concat(chunks).toString("utf-8").trim();
+    return raw ? JSON.parse(raw) : null;
+  } catch {
+    return null;
+  }
+}
+function mapHookPayload(j) {
+  const tool = j.tool_name ?? j.toolName;
+  const input = j.tool_input ?? j.toolInput;
+  if (input === void 0 && j.command !== void 0) {
+    return { tool: tool ?? "Bash", input: { command: j.command } };
+  }
+  return { tool, input };
+}
+function emitDecision(format, allowed, reason) {
+  if (format === "hermes") {
+    process.stdout.write(JSON.stringify(allowed ? {} : { decision: "block", reason }) + "\n");
+    process.exit(0);
+  }
+  if (allowed) {
+    process.stdout.write(JSON.stringify({ allowed: true, reason }) + "\n");
+    process.exit(0);
+  }
+  if (format === "cursor") {
+    process.stdout.write(JSON.stringify({ permission: "deny", userMessage: reason }) + "\n");
+  } else if (format === "gemini") {
+    process.stdout.write(JSON.stringify({ decision: "deny", reason }) + "\n");
+  }
+  process.stderr.write(`protect-mcp denied: ${reason}
+`);
+  process.exit(2);
+}
 async function handleEvaluate(argv) {
-  const tool = flagValue(argv, "--tool") || "";
-  const inputRaw = flagValue(argv, "--input") || "{}";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
+  let inputRaw = flagValue(argv, "--input") || "{}";
   const contextRaw = flagValue(argv, "--context");
   const failOnMissing = flagValue(argv, "--fail-on-missing-policy") !== "false";
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+      if (m.input !== void 0) inputRaw = JSON.stringify(m.input);
+    }
+  }
   const policySet = loadPolicyArg(argv);
   if (!policySet) {
     if (failOnMissing) {
+      if (format) emitDecision(format, false, "policy not found (fail-closed)");
       process.stderr.write("protect-mcp evaluate: policy not found; denying (fail-closed). Pass --fail-on-missing-policy false to allow.\n");
       process.exit(2);
     }
+    if (format) emitDecision(format, true, "no_policy_configured");
     process.stdout.write(JSON.stringify({ allowed: true, reason: "no_policy_configured" }) + "\n");
     process.exit(0);
   }
@@ -7653,13 +7701,22 @@ async function handleEvaluate(argv) {
     context.command_pattern = input.command;
   }
   const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context }, void 0, { failClosed: true });
+  if (format) emitDecision(format, decision.allowed, decision.reason || (decision.allowed ? "allowed" : "denied by policy"));
   process.stdout.write(JSON.stringify({ allowed: decision.allowed, reason: decision.reason, policy_digest: policySet.digest }) + "\n");
   process.exit(decision.allowed ? 0 : 2);
 }
 async function handleSign(argv) {
-  const tool = flagValue(argv, "--tool") || "";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
   const receiptsDir = flagValue(argv, "--receipts") || "./receipts/";
   const keyPath = flagValue(argv, "--key");
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+    }
+  }
   if (keyPath && (0, import_node_fs10.existsSync)(keyPath)) {
     try {
       await initSigning({ enabled: true, key_path: keyPath });
@@ -7685,6 +7742,10 @@ async function handleSign(argv) {
     (0, import_node_fs10.appendFileSync)((0, import_node_path6.join)(receiptsDir, "receipts.jsonl"), line + "\n");
   } catch {
   }
+  if (format === "hermes") {
+    process.stdout.write("{}\n");
+    process.exit(0);
+  }
   process.stdout.write(JSON.stringify({ signed: Boolean(signed.signed), artifact_type: signed.artifact_type, request_id: requestId }) + "\n");
   process.exit(0);
 }

package/dist/cli.mjs

@@ -1297,17 +1297,65 @@ function loadPolicyArg(argv) {
   }
   return null;
 }
+async function readHookStdin() {
+  if (process.stdin.isTTY) return null;
+  try {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const raw = Buffer.concat(chunks).toString("utf-8").trim();
+    return raw ? JSON.parse(raw) : null;
+  } catch {
+    return null;
+  }
+}
+function mapHookPayload(j) {
+  const tool = j.tool_name ?? j.toolName;
+  const input = j.tool_input ?? j.toolInput;
+  if (input === void 0 && j.command !== void 0) {
+    return { tool: tool ?? "Bash", input: { command: j.command } };
+  }
+  return { tool, input };
+}
+function emitDecision(format, allowed, reason) {
+  if (format === "hermes") {
+    process.stdout.write(JSON.stringify(allowed ? {} : { decision: "block", reason }) + "\n");
+    process.exit(0);
+  }
+  if (allowed) {
+    process.stdout.write(JSON.stringify({ allowed: true, reason }) + "\n");
+    process.exit(0);
+  }
+  if (format === "cursor") {
+    process.stdout.write(JSON.stringify({ permission: "deny", userMessage: reason }) + "\n");
+  } else if (format === "gemini") {
+    process.stdout.write(JSON.stringify({ decision: "deny", reason }) + "\n");
+  }
+  process.stderr.write(`protect-mcp denied: ${reason}
+`);
+  process.exit(2);
+}
 async function handleEvaluate(argv) {
-  const tool = flagValue(argv, "--tool") || "";
-  const inputRaw = flagValue(argv, "--input") || "{}";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
+  let inputRaw = flagValue(argv, "--input") || "{}";
   const contextRaw = flagValue(argv, "--context");
   const failOnMissing = flagValue(argv, "--fail-on-missing-policy") !== "false";
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+      if (m.input !== void 0) inputRaw = JSON.stringify(m.input);
+    }
+  }
   const policySet = loadPolicyArg(argv);
   if (!policySet) {
     if (failOnMissing) {
+      if (format) emitDecision(format, false, "policy not found (fail-closed)");
       process.stderr.write("protect-mcp evaluate: policy not found; denying (fail-closed). Pass --fail-on-missing-policy false to allow.\n");
       process.exit(2);
     }
+    if (format) emitDecision(format, true, "no_policy_configured");
     process.stdout.write(JSON.stringify({ allowed: true, reason: "no_policy_configured" }) + "\n");
     process.exit(0);
   }
@@ -1328,13 +1376,22 @@ async function handleEvaluate(argv) {
     context.command_pattern = input.command;
   }
   const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context }, void 0, { failClosed: true });
+  if (format) emitDecision(format, decision.allowed, decision.reason || (decision.allowed ? "allowed" : "denied by policy"));
   process.stdout.write(JSON.stringify({ allowed: decision.allowed, reason: decision.reason, policy_digest: policySet.digest }) + "\n");
   process.exit(decision.allowed ? 0 : 2);
 }
 async function handleSign(argv) {
-  const tool = flagValue(argv, "--tool") || "";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
   const receiptsDir = flagValue(argv, "--receipts") || "./receipts/";
   const keyPath = flagValue(argv, "--key");
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+    }
+  }
   if (keyPath && existsSyncCli(keyPath)) {
     try {
       await initSigning({ enabled: true, key_path: keyPath });
@@ -1360,6 +1417,10 @@ async function handleSign(argv) {
     appendFileSyncCli(joinCli(receiptsDir, "receipts.jsonl"), line + "\n");
   } catch {
   }
+  if (format === "hermes") {
+    process.stdout.write("{}\n");
+    process.exit(0);
+  }
   process.stdout.write(JSON.stringify({ signed: Boolean(signed.signed), artifact_type: signed.artifact_type, request_id: requestId }) + "\n");
   process.exit(0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + signed receipts for AI agent tool calls. Blocks what breaks the rules before it runs, denies on any policy error, and proves the gate is live with a startup self-test.",
   "main": "dist/index.js",