protect-mcp 0.9.1 → 0.9.2

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 0.9.2: anchor a claim to the public log
+
+Closes the one honest gap in a bare claim: that the disclosed set is complete.
+
+- Added `protect-mcp claim --anchor`: records the claim's digest in the public,
+  append-only ScopeBlind transparency log, so a counterparty who does not trust
+  you can confirm the exact claim existed at a time and was not quietly re-cut.
+  Only the hash is sent; the claim, its leaves, and every receipt stay on your
+  machine. Writes a `<claim>.anchor.json` sidecar with the log entry and a
+  verify URL. Anonymous and free; enrolling an org identity a counterparty can
+  pin is the paid upgrade (scopeblind.com/enroll).
+
+## 0.9.1: prove a claim without revealing the record
+
+The record viewer closes the loop from a decision to a portable proof.
+
+- The `record` viewer surfaces the exact `claim` command when you filter by a
+  capability, so a decision becomes a signed, position-blind attestation in one
+  step, with copy-to-clipboard and an offline `verify-claim` hint.
+- The browser drop-viewer (legate.scopeblind.com/record) reached parity with
+  the CLI: signed capability tags, a capability facet, and a provenance tree.
+
+## 0.9.0: signed, position-blind claim attestations
+
+Prove a predicate over the record without revealing it.
+
+- Added `protect-mcp claim`: mints a signed attestation of a predicate over the
+  record (`--no <cap>` for "no action carried this capability", `--only`,
+  `--count`/`--no-verdict <verdict>`), disclosing only per-decision categories
+  (receipt digest, verdict, capability tags), never inputs, outputs, or data.
+- Added `protect-mcp verify-claim`: checks it offline via Ed25519 over the pack,
+  a recomputed Merkle root over the disclosed set, and the predicate recomputed
+  independently. Honest trust model: an accountable position-blind attestation,
+  not zero-knowledge; set-completeness is issuer-attested.
+
+## 0.8.0: deterministic receipt enrichment
+
+Each signed decision now carries minimum-disclosure, rule-derived metadata.
+
+- `input_digest`: SHA-256 of the canonicalized tool input, so you can prove what
+  was requested without storing it.
+- Signed `capabilities`: deterministic, rule-derived tags (fs.read, fs.write,
+  net.egress, secret.adjacent, destructive, financial, exec.shell, ...) so the
+  record is queryable by what an action touched.
+- `resource`: the hashed target (path, host, or command). The gate sees tool
+  calls, not the model's prompt or reasoning, and does not claim to.
+
+## 0.7.6: the live record viewer
+
+- Added `protect-mcp record --live`: a local, streaming view of the receipt
+  file that turns decisions into a searchable, auto-labelled record as the agent
+  runs (stat strip, per-row signed badge and digest, a List/Tree provenance
+  view), all local, nothing uploaded.
+- One-click export: `.jsonl` carrying the real signatures (so a recipient
+  verifies offline with `npx @veritasacta/verify`) plus a Markdown report.
+
+## 0.7.5: honest version strings and the record viewer
+
+- Added `protect-mcp record`, a local browser viewer over the receipts file
+  (the answer to "the receipts are a hidden dotfile I cannot find").
+- Fixed hard-coded version strings in the banner and health/serverInfo: they
+  read the resolved package version now.
+- WebAuthn co-sign hardening: verify the rpIdHash and enforce challenge expiry.
+
 ## 0.7.4: the self-serve trial path
 
 Everything the scopeblind.com trial and docs pages describe now ships in the

package/README.md

@@ -189,7 +189,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.3 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
+            "command": "npx protect-mcp@0.9.1 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
           }
         ]
       }
@@ -200,7 +200,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.3 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
+            "command": "npx protect-mcp@0.9.1 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
           }
         ]
       }

package/dist/{claim-U7Q3A4WW.mjs → claim-TUDH2WPB.mjs}

@@ -118,9 +118,81 @@ function verifyClaim(pack, overridePublicKey) {
     reasons
   };
 }
+var ANCHOR_SCHEMA = "scopeblind.protect-mcp.anchor.v1";
+var DEFAULT_LOG = "https://scopeblind.com";
+function anchorDeepSort(o) {
+  if (o === null || typeof o !== "object") return o;
+  if (Array.isArray(o)) return o.map(anchorDeepSort);
+  const src = o;
+  const out = {};
+  for (const k of Object.keys(src).sort()) out[k] = anchorDeepSort(src[k]);
+  return out;
+}
+function toBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function claimDigest(pack) {
+  return sha256Hex(canonicalJson(pack));
+}
+function buildAnchorEnvelope(pack, key, issuedAt) {
+  const signed = {
+    type: "evidence_pack",
+    schema: ANCHOR_SCHEMA,
+    anchors: "protect-mcp-claim",
+    claim_digest: claimDigest(pack),
+    record_root: pack.record.root,
+    statement: pack.claim.statement,
+    holds: pack.claim.holds,
+    matched: pack.claim.matched,
+    total: pack.scope.total,
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts.fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+  const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
+  try {
+    const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ encoded })
+    });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
+      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+    }
+    return {
+      ok: true,
+      claim_digest: envelope.claim_digest,
+      seq: data.seq,
+      entry_url: `${base}/fn/log/${data.seq}`,
+      anchored_at: data.anchored_at,
+      already_anchored: !!data.already_anchored,
+      envelope
+    };
+  } catch {
+    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+  }
+}
 export {
+  ANCHOR_SCHEMA,
   CLAIM_TYPE,
+  DEFAULT_LOG,
+  anchorClaim,
+  buildAnchorEnvelope,
   buildClaim,
+  claimDigest,
   evaluate,
   leafHash,
   merkleRoot,

package/dist/cli.js

@@ -5176,8 +5176,13 @@ var init_receipt_enrichment = __esm({
 // src/claim.ts
 var claim_exports = {};
 __export(claim_exports, {
+  ANCHOR_SCHEMA: () => ANCHOR_SCHEMA,
   CLAIM_TYPE: () => CLAIM_TYPE,
+  DEFAULT_LOG: () => DEFAULT_LOG,
+  anchorClaim: () => anchorClaim,
+  buildAnchorEnvelope: () => buildAnchorEnvelope,
   buildClaim: () => buildClaim,
+  claimDigest: () => claimDigest,
   evaluate: () => evaluate,
   leafHash: () => leafHash,
   merkleRoot: () => merkleRoot,
@@ -5286,7 +5291,72 @@ function verifyClaim(pack, overridePublicKey) {
     reasons
   };
 }
-var CLAIM_TYPE;
+function anchorDeepSort(o) {
+  if (o === null || typeof o !== "object") return o;
+  if (Array.isArray(o)) return o.map(anchorDeepSort);
+  const src = o;
+  const out = {};
+  for (const k of Object.keys(src).sort()) out[k] = anchorDeepSort(src[k]);
+  return out;
+}
+function toBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function claimDigest(pack) {
+  return sha256Hex3(canonicalJson(pack));
+}
+function buildAnchorEnvelope(pack, key, issuedAt) {
+  const signed = {
+    type: "evidence_pack",
+    schema: ANCHOR_SCHEMA,
+    anchors: "protect-mcp-claim",
+    claim_digest: claimDigest(pack),
+    record_root: pack.record.root,
+    statement: pack.claim.statement,
+    holds: pack.claim.holds,
+    matched: pack.claim.matched,
+    total: pack.scope.total,
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha2562(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts.fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+  const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
+  try {
+    const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ encoded })
+    });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
+      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+    }
+    return {
+      ok: true,
+      claim_digest: envelope.claim_digest,
+      seq: data.seq,
+      entry_url: `${base}/fn/log/${data.seq}`,
+      anchored_at: data.anchored_at,
+      already_anchored: !!data.already_anchored,
+      envelope
+    };
+  } catch {
+    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+  }
+}
+var CLAIM_TYPE, ANCHOR_SCHEMA, DEFAULT_LOG;
 var init_claim = __esm({
   "src/claim.ts"() {
     "use strict";
@@ -5295,6 +5365,8 @@ var init_claim = __esm({
     init_ed25519();
     init_receipt_enrichment();
     CLAIM_TYPE = "scopeblind.claim.v1";
+    ANCHOR_SCHEMA = "scopeblind.protect-mcp.anchor.v1";
+    DEFAULT_LOG = "https://scopeblind.com";
   }
 });
 
@@ -10712,8 +10784,11 @@ Attest a signed, position-blind claim over your record:
   --only <c1,c2,...>       all actions confined to these capabilities
   --no-verdict <verdict>   e.g. ${dim("--no-verdict blocked")}
   --count <verdict>        how many, e.g. ${dim("--count blocked")}
+  --anchor                 also record the claim digest in the public append-only
+                           log so a counterparty can trust it is complete (only the
+                           hash is sent; your record stays local)
 
-Example: ${bold("npx protect-mcp claim --no net.egress")}
+Example: ${bold("npx protect-mcp claim --no net.egress --anchor")}
 
 `);
     process.exit(0);
@@ -10789,7 +10864,36 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
   process.stdout.write(`  Written to ${out}
 `);
   process.stdout.write(`  Hand it to anyone. They verify offline: ${bold("npx protect-mcp verify-claim " + out)}
-
+`);
+  if (argv.indexOf("--anchor") !== -1) {
+    const { anchorClaim: anchorClaim2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+    const li = argv.indexOf("--log");
+    const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
+    process.stdout.write(`
+  ${dim("Anchoring the claim digest to the public append-only log (only the hash leaves your machine)...")}
+`);
+    const res = await anchorClaim2(
+      pack,
+      { privateKey: key.privateKey, publicKey: key.publicKey, kid: key.kid || "gateway", issuer: "protect-mcp" },
+      { log: logBase, issuedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    if (res.ok) {
+      const sidecar = out.replace(/\.json$/, "") + ".anchor.json";
+      writeFileSync4(sidecar, JSON.stringify({ log: logBase || "https://scopeblind.com", seq: res.seq, entry_url: res.entry_url, anchored_at: res.anchored_at, claim_digest: res.claim_digest, envelope: res.envelope }, null, 2) + "\n");
+      process.stdout.write(`  ${green("Anchored")} as log entry ${bold("#" + res.seq)}${res.already_anchored ? dim(" (already present)") : ""}  ${dim(res.entry_url || "")}
+`);
+      process.stdout.write(`  ${dim("A counterparty can now confirm this exact claim existed at " + (res.anchored_at || "this time") + " and cannot be quietly re-cut.")}
+`);
+      process.stdout.write(`  ${dim("Anchor record written to " + sidecar + ". Only the digest was sent; your record stayed local.")}
+`);
+      process.stdout.write(`  ${dim("To anchor as your enrolled org identity (a key a counterparty can pin), see")} ${bold("scopeblind.com/enroll")}
+`);
+    } else {
+      process.stdout.write(`  ${yellow("Anchor skipped")} ${dim("(" + (res.error || "unavailable") + "). The claim above is complete and verifiable offline without it.")}
+`);
+    }
+  }
+  process.stdout.write(`
 `);
   process.exit(0);
 }

package/dist/cli.mjs

@@ -2235,7 +2235,7 @@ if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(functio
 async function handleClaim(argv) {
   const { readFileSync, existsSync, writeFileSync } = await import("fs");
   const { join } = await import("path");
-  const { buildClaim } = await import("./claim-U7Q3A4WW.mjs");
+  const { buildClaim } = await import("./claim-TUDH2WPB.mjs");
   let dir = process.cwd();
   const di = argv.indexOf("--dir");
   if (di !== -1 && argv[di + 1]) dir = argv[di + 1];
@@ -2254,8 +2254,11 @@ Attest a signed, position-blind claim over your record:
   --only <c1,c2,...>       all actions confined to these capabilities
   --no-verdict <verdict>   e.g. ${dim("--no-verdict blocked")}
   --count <verdict>        how many, e.g. ${dim("--count blocked")}
+  --anchor                 also record the claim digest in the public append-only
+                           log so a counterparty can trust it is complete (only the
+                           hash is sent; your record stays local)
 
-Example: ${bold("npx protect-mcp claim --no net.egress")}
+Example: ${bold("npx protect-mcp claim --no net.egress --anchor")}
 
 `);
     process.exit(0);
@@ -2331,13 +2334,42 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
   process.stdout.write(`  Written to ${out}
 `);
   process.stdout.write(`  Hand it to anyone. They verify offline: ${bold("npx protect-mcp verify-claim " + out)}
-
+`);
+  if (argv.indexOf("--anchor") !== -1) {
+    const { anchorClaim } = await import("./claim-TUDH2WPB.mjs");
+    const li = argv.indexOf("--log");
+    const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
+    process.stdout.write(`
+  ${dim("Anchoring the claim digest to the public append-only log (only the hash leaves your machine)...")}
+`);
+    const res = await anchorClaim(
+      pack,
+      { privateKey: key.privateKey, publicKey: key.publicKey, kid: key.kid || "gateway", issuer: "protect-mcp" },
+      { log: logBase, issuedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    if (res.ok) {
+      const sidecar = out.replace(/\.json$/, "") + ".anchor.json";
+      writeFileSync(sidecar, JSON.stringify({ log: logBase || "https://scopeblind.com", seq: res.seq, entry_url: res.entry_url, anchored_at: res.anchored_at, claim_digest: res.claim_digest, envelope: res.envelope }, null, 2) + "\n");
+      process.stdout.write(`  ${green("Anchored")} as log entry ${bold("#" + res.seq)}${res.already_anchored ? dim(" (already present)") : ""}  ${dim(res.entry_url || "")}
+`);
+      process.stdout.write(`  ${dim("A counterparty can now confirm this exact claim existed at " + (res.anchored_at || "this time") + " and cannot be quietly re-cut.")}
+`);
+      process.stdout.write(`  ${dim("Anchor record written to " + sidecar + ". Only the digest was sent; your record stayed local.")}
+`);
+      process.stdout.write(`  ${dim("To anchor as your enrolled org identity (a key a counterparty can pin), see")} ${bold("scopeblind.com/enroll")}
+`);
+    } else {
+      process.stdout.write(`  ${yellow("Anchor skipped")} ${dim("(" + (res.error || "unavailable") + "). The claim above is complete and verifiable offline without it.")}
+`);
+    }
+  }
+  process.stdout.write(`
 `);
   process.exit(0);
 }
 async function handleVerifyClaim(argv) {
   const { readFileSync, existsSync } = await import("fs");
-  const { verifyClaim } = await import("./claim-U7Q3A4WW.mjs");
+  const { verifyClaim } = await import("./claim-TUDH2WPB.mjs");
   const file = argv.find((a) => !a.startsWith("--"));
   if (!file || !existsSync(file)) {
     process.stderr.write(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + Ed25519 signed receipts for AI agent tool calls. Denies on any policy error, proves the gate is live with a startup self-test, and turns every decision into a local searchable record you own. The open gate behind Legate by ScopeBlind. scopeblind.com",
   "main": "dist/index.js",

package/policies/agent.cedar

@@ -1,50 +0,0 @@
-// Generated by protect-mcp init-hooks
-// Customize these policies to match your security requirements.
-// Cedar deny decisions are AUTHORITATIVE — they cannot be overridden.
-
-// Allow all read-only tools by default
-permit(
-  principal,
-  action == Action::"MCP::Tool::call",
-  resource == Tool::"Read"
-);
-
-permit(
-  principal,
-  action == Action::"MCP::Tool::call",
-  resource == Tool::"Glob"
-);
-
-permit(
-  principal,
-  action == Action::"MCP::Tool::call",
-  resource == Tool::"Grep"
-);
-
-// Allow write/edit tools (remove these to require explicit approval)
-permit(
-  principal,
-  action == Action::"MCP::Tool::call",
-  resource == Tool::"Write"
-);
-
-permit(
-  principal,
-  action == Action::"MCP::Tool::call",
-  resource == Tool::"Edit"
-);
-
-// Allow Bash with caution (Cedar evaluates before hook patterns)
-permit(
-  principal,
-  action == Action::"MCP::Tool::call",
-  resource == Tool::"Bash"
-);
-
-// Block dangerous tools entirely
-// Uncomment any of these to block specific tools:
-// forbid(
-//   principal,
-//   action == Action::"MCP::Tool::call",
-//   resource == Tool::"delete_file"
-// );