protect-mcp 0.7.3 → 0.7.5

package/dist/{chunk-LYKNULYU.mjs → chunk-LJQOALYR.mjs}

@@ -136,6 +136,24 @@ var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
   528734635,
   1541459225
 ]);
+var SHA384_IV = /* @__PURE__ */ Uint32Array.from([
+  3418070365,
+  3238371032,
+  1654270250,
+  914150663,
+  2438529370,
+  812702999,
+  355462360,
+  4144912697,
+  1731405415,
+  4290775857,
+  2394180231,
+  1750603025,
+  3675008525,
+  1694076839,
+  1203062813,
+  3204075428
+]);
 var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   1779033703,
   4089235720,
@@ -525,8 +543,30 @@ var SHA512 = class extends HashMD {
     this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
   }
 };
+var SHA384 = class extends SHA512 {
+  constructor() {
+    super(48);
+    this.Ah = SHA384_IV[0] | 0;
+    this.Al = SHA384_IV[1] | 0;
+    this.Bh = SHA384_IV[2] | 0;
+    this.Bl = SHA384_IV[3] | 0;
+    this.Ch = SHA384_IV[4] | 0;
+    this.Cl = SHA384_IV[5] | 0;
+    this.Dh = SHA384_IV[6] | 0;
+    this.Dl = SHA384_IV[7] | 0;
+    this.Eh = SHA384_IV[8] | 0;
+    this.El = SHA384_IV[9] | 0;
+    this.Fh = SHA384_IV[10] | 0;
+    this.Fl = SHA384_IV[11] | 0;
+    this.Gh = SHA384_IV[12] | 0;
+    this.Gl = SHA384_IV[13] | 0;
+    this.Hh = SHA384_IV[14] | 0;
+    this.Hl = SHA384_IV[15] | 0;
+  }
+};
 var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
 var sha512 = /* @__PURE__ */ createHasher(() => new SHA512());
+var sha384 = /* @__PURE__ */ createHasher(() => new SHA384());
 
 // node_modules/@noble/curves/esm/utils.js
 var _0n = /* @__PURE__ */ BigInt(0);
@@ -550,6 +590,10 @@ function _abytes2(value, length, title = "") {
   }
   return value;
 }
+function numberToHexUnpadded(num) {
+  const hex = num.toString(16);
+  return hex.length & 1 ? "0" + hex : hex;
+}
 function hexToNumber(hex) {
   if (typeof hex !== "string")
     throw new Error("hex string expected, got " + typeof hex);
@@ -612,6 +656,56 @@ function bitLen(n) {
   return len;
 }
 var bitMask = (n) => (_1n << BigInt(n)) - _1n;
+function createHmacDrbg(hashLen, qByteLen, hmacFn) {
+  if (typeof hashLen !== "number" || hashLen < 2)
+    throw new Error("hashLen must be a number");
+  if (typeof qByteLen !== "number" || qByteLen < 2)
+    throw new Error("qByteLen must be a number");
+  if (typeof hmacFn !== "function")
+    throw new Error("hmacFn must be a function");
+  const u8n = (len) => new Uint8Array(len);
+  const u8of = (byte) => Uint8Array.of(byte);
+  let v = u8n(hashLen);
+  let k = u8n(hashLen);
+  let i = 0;
+  const reset = () => {
+    v.fill(1);
+    k.fill(0);
+    i = 0;
+  };
+  const h = (...b) => hmacFn(k, v, ...b);
+  const reseed = (seed = u8n(0)) => {
+    k = h(u8of(0), seed);
+    v = h();
+    if (seed.length === 0)
+      return;
+    k = h(u8of(1), seed);
+    v = h();
+  };
+  const gen = () => {
+    if (i++ >= 1e3)
+      throw new Error("drbg: tried 1000 values");
+    let len = 0;
+    const out = [];
+    while (len < qByteLen) {
+      v = h();
+      const sl = v.slice();
+      out.push(sl);
+      len += v.length;
+    }
+    return concatBytes(...out);
+  };
+  const genUntil = (seed, pred) => {
+    reset();
+    reseed(seed);
+    let res = void 0;
+    while (!(res = pred(gen())))
+      reseed();
+    reset();
+    return res;
+  };
+  return genUntil;
+}
 function isHash(val) {
   return typeof val === "function" && Number.isSafeInteger(val.outputLen);
 }
@@ -975,6 +1069,26 @@ function FpSqrtEven(Fp2, elm) {
   const root = Fp2.sqrt(elm);
   return Fp2.isOdd(root) ? Fp2.neg(root) : root;
 }
+function getFieldBytesLength(fieldOrder) {
+  if (typeof fieldOrder !== "bigint")
+    throw new Error("field order must be bigint");
+  const bitLength = fieldOrder.toString(2).length;
+  return Math.ceil(bitLength / 8);
+}
+function getMinHashLength(fieldOrder) {
+  const length = getFieldBytesLength(fieldOrder);
+  return length + Math.ceil(length / 2);
+}
+function mapHashToField(key, fieldOrder, isLE = false) {
+  const len = key.length;
+  const fieldLen = getFieldBytesLength(fieldOrder);
+  const minLen = getMinHashLength(fieldOrder);
+  if (len < 16 || len < minLen || len > 1024)
+    throw new Error("expected " + minLen + "-1024 bytes of input, got " + len);
+  const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);
+  const reduced = mod(num, fieldOrder - _1n2) + _1n2;
+  return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+}
 
 // node_modules/@noble/curves/esm/abstract/curve.js
 var _0n3 = BigInt(0);
@@ -1168,6 +1282,21 @@ var wNAF = class {
     return getW(elm) !== 1;
   }
 };
+function mulEndoUnsafe(Point, point, k1, k2) {
+  let acc = point;
+  let p1 = Point.ZERO;
+  let p2 = Point.ZERO;
+  while (k1 > _0n3 || k2 > _0n3) {
+    if (k1 & _1n3)
+      p1 = p1.add(acc);
+    if (k2 & _1n3)
+      p2 = p2.add(acc);
+    acc = acc.double();
+    k1 >>= _1n3;
+    k2 >>= _1n3;
+  }
+  return { p1, p2 };
+}
 function pippenger(c, fieldN, points, scalars) {
   validateMSMPoints(points, c);
   validateMSMScalars(scalars, fieldN);
@@ -2417,6 +2546,29 @@ var hash_to_ristretto255 = /* @__PURE__ */ (() => ristretto255_hasher.hashToCurv
 
 export {
   sha256,
+  sha512,
+  sha384,
+  _abool2,
+  _abytes2,
+  numberToHexUnpadded,
+  bytesToNumberBE,
+  ensureBytes,
+  aInRange,
+  bitLen,
+  bitMask,
+  createHmacDrbg,
+  _validateObject,
+  memoized,
+  nLength,
+  Field,
+  getMinHashLength,
+  mapHashToField,
+  negateCt,
+  normalizeZ,
+  wNAF,
+  mulEndoUnsafe,
+  pippenger,
+  _createCurveFields,
   ed25519,
   ed25519ctx,
   ed25519ph,

package/dist/{chunk-5JXFV37Y.mjs → chunk-PM2ZO57M.mjs}

@@ -1,7 +1,7 @@
 // src/bundle.ts
 function createAuditBundle(opts) {
   const receipts = opts.receipts.filter(
-    (r) => r && typeof r === "object" && typeof r.signature === "string"
+    (r) => r && typeof r === "object" && (typeof r.signature === "string" || r.signature !== null && typeof r.signature === "object")
   );
   if (receipts.length === 0) {
     throw new Error("Audit bundle requires at least one signed receipt");
@@ -30,10 +30,18 @@ function createAuditBundle(opts) {
     time_range: timeRange,
     receipts,
     anchors: opts.anchors || [],
+    selective_disclosures: opts.selectiveDisclosures || [],
+    privacy: {
+      selective_disclosure: {
+        supported: true,
+        model: "salted_commitments_merkle_v0",
+        statement: "Committed receipts may disclose selected fields with salted Merkle openings. Undisclosed committed fields remain hidden while staying bound to the signed commitment root."
+      }
+    },
     verification: {
       algorithm: "ed25519",
       signing_keys: Array.from(keyMap.values()),
-      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. CLI: npx @veritasacta/verify bundle.json --bundle`
+      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. For scopeblind.selective_disclosure.v0 packages, recompute each disclosed leaf and verify it against the receipt committed_fields_root; fields not disclosed remain hidden. CLI: npx @veritasacta/verify bundle.json --bundle`
     }
   };
 }

package/dist/{chunk-J6L4XCTE.mjs → chunk-SETXVE2K.mjs}

@@ -35040,6 +35040,48 @@ var TOOLS = [
       },
       required: ["environment"]
     }
+  },
+  {
+    name: "github_create_pr",
+    description: "Create a GitHub pull request",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: { type: "string", description: "Repository name" },
+        branch: { type: "string", description: "Source branch" },
+        title: { type: "string", description: "Pull request title" }
+      },
+      required: ["repo", "branch", "title"]
+    }
+  },
+  {
+    name: "send_email",
+    description: "Send an email",
+    inputSchema: {
+      type: "object",
+      properties: {
+        to: { type: "string", description: "Recipient email address" },
+        subject: { type: "string", description: "Subject line" },
+        body: { type: "string", description: "Message body" }
+      },
+      required: ["to", "subject"]
+    }
+  },
+  {
+    name: "pms_book_fill",
+    description: "Book a fill into the mock portfolio management system",
+    inputSchema: {
+      type: "object",
+      properties: {
+        account: { type: "string", description: "Portfolio or fund account" },
+        symbol: { type: "string", description: "Instrument symbol" },
+        side: { type: "string", enum: ["BUY", "SELL"] },
+        quantity: { type: "number" },
+        price: { type: "number" },
+        strategy: { type: "string" }
+      },
+      required: ["account", "symbol", "side", "quantity", "price"]
+    }
   }
 ];
 function handleRequest(request) {
@@ -35049,7 +35091,7 @@ function handleRequest(request) {
       id: request.id,
       result: {
         protocolVersion: "2024-11-05",
-        serverInfo: { name: "protect-mcp-demo", version: "0.5.3" },
+        serverInfo: { name: "protect-mcp-demo", version: process.env.PROTECT_MCP_VERSION || "0.5.3" },
         capabilities: { tools: {} }
       }
     });
@@ -35087,6 +35129,15 @@ Contents: Hello from protect-mcp demo server!`;
       case "deploy":
         resultText = `[demo] Deployed to ${args.environment || "staging"}${args.reason ? ` (reason: ${args.reason})` : ""}`;
         break;
+      case "github_create_pr":
+        resultText = `[demo] Created PR in ${args.repo || "scopeblind/demo"} from ${args.branch || "agent/demo"}: ${args.title || "Agent change"}`;
+        break;
+      case "send_email":
+        resultText = `[demo] Drafted email to ${args.to || "pm@example.com"}: ${args.subject || "Agent update"}`;
+        break;
+      case "pms_book_fill":
+        resultText = `[demo] Booked ${args.side || "BUY"} ${args.quantity || 0} ${args.symbol || "AAPL"} @ ${args.price || 0} into ${args.account || "Demo Fund"} (${args.strategy || "Unassigned"})`;
+        break;
       default:
         resultText = `[demo] Unknown tool: ${toolName}`;
     }
@@ -35126,7 +35177,7 @@ function createSandboxServer() {
   const { z } = require_zod();
   const server = new McpServer({
     name: "protect-mcp",
-    version: "0.4.5",
+    version: process.env.PROTECT_MCP_VERSION || "0.4.5",
     description: "Security gateway for MCP servers. Per-tool policies, Ed25519-signed receipts, human approval gates, trust tiers."
   });
   server.tool(
@@ -35159,6 +35210,30 @@ function createSandboxServer() {
     { environment: z.enum(["staging", "production"]).describe("Target environment"), reason: z.string().optional().describe("Deployment reason") },
     async (args) => ({ content: [{ type: "text", text: `[demo] Deployed to ${args.environment}` }] })
   );
+  server.tool("github_create_pr", "Create a GitHub pull request", {
+    repo: z.string(),
+    branch: z.string(),
+    title: z.string()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] PR created in ${args.repo} from ${args.branch}: ${args.title}` }]
+  }));
+  server.tool("send_email", "Send an email", {
+    to: z.string(),
+    subject: z.string(),
+    body: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Email prepared for ${args.to}: ${args.subject}` }]
+  }));
+  server.tool("pms_book_fill", "Book a fill into a mock PMS", {
+    account: z.string(),
+    symbol: z.string(),
+    side: z.enum(["BUY", "SELL"]),
+    quantity: z.number(),
+    price: z.number(),
+    strategy: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Booked ${args.side} ${args.quantity} ${args.symbol} @ ${args.price} into ${args.account}` }]
+  }));
   return server;
 }
 

package/dist/{chunk-OHUTUFTC.mjs → chunk-VTPZ4G5I.mjs}

@@ -1,5 +1,6 @@
 import {
   ReceiptBuffer,
+  buildActionReadback,
   checkRateLimit,
   evaluateCedar,
   getToolPolicy,
@@ -7,7 +8,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-546U3A7R.mjs";
+} from "./chunk-WIPWNWMJ.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";
@@ -758,6 +759,8 @@ var ProtectGateway = class {
     const toolName = request.params?.name || "unknown";
     const requestId = randomUUID().slice(0, 12);
     const mode = this.config.enforce ? "enforce" : "shadow";
+    const toolInput = request.params?.arguments && typeof request.params.arguments === "object" ? request.params.arguments : request.params || {};
+    const actionReadback = buildActionReadback(toolName, toolInput);
     let resolvedAgentKid = this.admissionResult?.agent_id;
     let effectiveToolPolicy;
     if (this.config.multiAgent?.enabled) {
@@ -767,7 +770,7 @@ var ProtectGateway = class {
       if (agentOverrides && agentOverrides[toolName]) {
         effectiveToolPolicy = { ...getToolPolicy(toolName, this.config.policy), ...agentOverrides[toolName] };
       } else if (!resolvedAgentKid && this.config.multiAgent.unknownAgentPolicy === "deny") {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied: unidentified agent`);
         }
@@ -788,7 +791,7 @@ var ProtectGateway = class {
       if (cred.resolved) {
         credentialRef = cred.label;
       } else if (cred.error && !cred.error.includes("not configured")) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Credential error for tool "${toolName}"`);
         }
@@ -803,13 +806,13 @@ var ProtectGateway = class {
         });
         if (!cedarDecision.allowed) {
           const reason = cedarDecision.reason || "cedar_deny";
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by Cedar policy`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       } catch (err) {
         if (this.config.verbose) this.log(`Cedar evaluation error: ${err instanceof Error ? err.message : err}`);
@@ -827,7 +830,7 @@ var ProtectGateway = class {
         const externalDecision = await queryExternalPDP(ctx, this.config.policy.external);
         if (!externalDecision.allowed) {
           const reason = `external_pdp_deny${externalDecision.reason ? ": " + externalDecision.reason : ""}`;
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by external policy engine`);
           }
@@ -839,7 +842,7 @@ var ProtectGateway = class {
     }
     if (toolPolicy.min_tier) {
       if (!meetsMinTier(this.currentTier, toolPolicy.min_tier)) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" requires tier "${toolPolicy.min_tier}"`);
         }
@@ -847,7 +850,7 @@ var ProtectGateway = class {
       }
     }
     if (toolPolicy.block) {
-      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.config.enforce) {
         return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" is blocked by policy`);
       }
@@ -858,10 +861,10 @@ var ProtectGateway = class {
       const alwaysGrant = this.approvalStore.get(`always:${toolName}`);
       if (grant && Date.now() < grant.expires_at || alwaysGrant && Date.now() < alwaysGrant.expires_at) {
         if (grant && grant.mode === "once") this.approvalStore.delete(requestId);
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       }
-      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.notificationConfig) {
         sendApprovalNotification(this.notificationConfig, {
           requestId,
@@ -884,7 +887,7 @@ var ProtectGateway = class {
             content: [
               {
                 type: "text",
-                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
+                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Exact action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
               }
             ],
             isError: true
@@ -900,19 +903,19 @@ var ProtectGateway = class {
         const key = `tool:${toolName}:${this.currentTier}`;
         const { allowed, remaining } = checkRateLimit(key, limit, this.rateLimitStore);
         if (!allowed) {
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" rate limit exceeded (${rateSpec})`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       } catch {
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       }
     } else {
       const reasonCode = this.config.enforce ? "policy_allow" : "observe_mode";
-      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
     }
     return null;
   }
@@ -949,6 +952,7 @@ var ProtectGateway = class {
       ...entry.rate_limit_remaining !== void 0 && { rate_limit_remaining: entry.rate_limit_remaining },
       ...entry.tier && { tier: entry.tier },
       ...entry.credential_ref && { credential_ref: entry.credential_ref },
+      ...entry.action_readback && { action_readback: entry.action_readback },
       otel_trace_id: otelTraceId,
       otel_span_id: otelSpanId
     };

package/dist/{chunk-546U3A7R.mjs → chunk-WIPWNWMJ.mjs}

@@ -190,6 +190,7 @@ function signDecision(entry) {
     if (entry.timing) payload.timing = entry.timing;
     if (entry.swarm) payload.swarm = entry.swarm;
     if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
+    if (entry.action_readback) payload.action_readback = entry.action_readback;
     if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
     const result = artifactsModule.createSignedArtifact(
       artifactType,
@@ -523,7 +524,7 @@ function handleHealth(res, startTime, config) {
     status: "ok",
     uptime_ms: Date.now() - startTime,
     mode: config.mode,
-    version: "0.3.1"
+    version: process.env.PROTECT_MCP_VERSION || "unknown"
   }));
 }
 function handleStatus(res, logDir) {
@@ -656,6 +657,95 @@ function handleListApprovals(res, approvalStore) {
   res.end(JSON.stringify({ grants }));
 }
 
+// src/action-readback.ts
+import { createHash as createHash3 } from "crypto";
+var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
+var DESTINATION_KEYS = [
+  "path",
+  "file_path",
+  "filePath",
+  "url",
+  "uri",
+  "endpoint",
+  "host",
+  "hostname",
+  "repo",
+  "repository",
+  "branch",
+  "channel",
+  "to",
+  "recipient",
+  "symbol",
+  "account",
+  "bucket",
+  "database",
+  "table",
+  "service"
+];
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`).join(",")}}`;
+}
+function redact(value, path = [], redacted = [], disclosed = [], depth = 0) {
+  if (depth > 4) return "[truncated-depth]";
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") {
+    if (path.length > 0) disclosed.push(path.join("."));
+    if (typeof value === "string" && value.length > 240) return `${value.slice(0, 240)}...`;
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item, idx) => redact(item, [...path, String(idx)], redacted, disclosed, depth + 1));
+  }
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = [...path, key];
+    if (SECRET_KEY_RE.test(key)) {
+      redacted.push(childPath.join("."));
+      out[key] = "[redacted]";
+      continue;
+    }
+    out[key] = redact(child, childPath, redacted, disclosed, depth + 1);
+  }
+  return out;
+}
+function firstStringValue(input, keys) {
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+  }
+  return void 0;
+}
+function actionFor(tool, input) {
+  const explicit = firstStringValue(input, ["action", "operation", "method", "verb", "command"]);
+  if (explicit) return explicit.length > 90 ? `${explicit.slice(0, 90)}...` : explicit;
+  return tool;
+}
+function buildActionReadback(tool, input) {
+  const normalized = input && typeof input === "object" && !Array.isArray(input) ? input : { value: input };
+  const canonical = stableStringify(normalized);
+  const redactedFields = [];
+  const disclosedFields = [];
+  const payloadPreview = redact(normalized, [], redactedFields, disclosedFields);
+  const action = actionFor(tool, normalized);
+  const destination = firstStringValue(normalized, DESTINATION_KEYS);
+  const summary = destination ? `${tool} -> ${destination}` : `${tool} request`;
+  return {
+    tool,
+    action,
+    destination,
+    payload_preview: payloadPreview,
+    payload_hash: createHash3("sha256").update(canonical).digest("hex"),
+    payload_bytes: Buffer.byteLength(canonical, "utf-8"),
+    disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
+    redacted_fields: [...new Set(redactedFields)].slice(0, 80),
+    summary
+  };
+}
+
 export {
   loadPolicy,
   getToolPolicy,
@@ -671,5 +761,6 @@ export {
   policySetFromSource,
   runEvaluatorSelfTest,
   ReceiptBuffer,
-  startStatusServer
+  startStatusServer,
+  buildActionReadback
 };