protect-mcp 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 0.9.5: replayable from scratch
+
+The public demo film (legate.scopeblind.com/record) is now reproducible by
+anyone in 60 seconds, and the CLI answers the first two commands every new
+user types.
+
+- **`sample`.** Seeds a clearly-labeled sample record (fresh Ed25519 keypair,
+  kid `sample-demo`): 8 decisions including one BLOCKED network call and two
+  payments ($0.02 x402-style per-call, $12.50 invoice), plus
+  `demo-tampered.jsonl` with one decision flipped after signing. The receipts
+  are real signed artifacts (same envelope and canonical-JSON preimage as the
+  gate's signer), so `record`, `claim --payment-under`, `verify-claim`, and
+  `anchor-record` work on the folder immediately. Refuses to touch an existing
+  record or signing key; `--force` overrides.
+- **`--version` / `version` / `-V`.** Prints the installed version. Previously
+  these fell through to wrap-mode parsing and errored demanding a `--`
+  separator, which was the first thing many new users saw.
+- **`help` word.** `npx protect-mcp help` prints usage (previously errored).
+  Help and version flags are now only recognized BEFORE the `--` separator, so
+  `protect-mcp -- node server.js --version` wraps that command as intended
+  instead of printing our help.
+
+## 0.9.4: agent payments get receipts, records get heartbeats, anchors get names
+
+The provenance layer reaches the agentic economy's payment rails (x402), the
+record gains continuous completeness, and anchoring can carry an identity.
+
+- **Payment receipts (x402 interop).** The gate now tags agent payments with a
+  signed `payment` capability, detected broadly across x402 wire shapes
+  (`paymentRequirements`, `X-PAYMENT`, EIP-3009 `transferWithAuthorization`)
+  and payment-shaped tools. Receipts carry minimum-disclosure payment facts:
+  amount (only when clearly readable in human units), asset, a HASHED recipient,
+  and the x402 scheme. `claim --no payment` proves no agent paid anything;
+  `claim --payment-under <cap>` proves every payment stayed under a cap, and an
+  amount the gate could not read counts as OVER (you cannot prove an amount you
+  could not read, so the claim cannot lie).
+- **Record checkpoints (`anchor-record`).** Anchors the record's CURRENT
+  commitment (the same Merkle root a claim commits to, plus count and time
+  range) into the public log. Run it on a heartbeat and the record grows an
+  anchored history: a later claim whose root matches a checkpoint is provably
+  over the complete set as of that checkpoint. Skips when the record is
+  unchanged; writes a local `.protect-mcp-anchors.jsonl` history; only the
+  root, count, and time range leave the machine.
+- **Pinned identity in the anchor loop.** `claim --anchor`, `anchor-record`,
+  and `verify-claim` now resolve the anchoring key against the public ScopeBlind
+  key directory: an enrolled key shows "anchored as <Org> (key pinned)", a
+  revoked key fails verification, an anonymous key points at enrollment. The
+  free anchor stays anonymous; the named identity is the paid upgrade.
+
 ## 0.9.3: the skeptic's tools sharpen
 
 Two verification upgrades: the anchor check moves into the verifier, and the

package/README.md

@@ -185,6 +185,24 @@ npx protect-mcp claim --no net.egress --anchor
 This is an accountable, position-blind attestation, not full zero-knowledge: it
 reveals the shape, not the content.
 
+## Try it in 60 seconds (no agent required)
+
+Watch the two-minute film at [legate.scopeblind.com/record](https://legate.scopeblind.com/record), then replay it against your own copy:
+
+```bash
+npx protect-mcp sample     # seed a labeled sample record (8 decisions: 1 blocked, 2 payments)
+npx protect-mcp record     # open it: signatures verified in your browser
+
+npx protect-mcp claim --payment-under 100 --anchor --output payments-under-100.json
+npx protect-mcp verify-claim payments-under-100.json
+npx protect-mcp anchor-record
+```
+
+Drop the generated `demo-tampered.jsonl` into the record page to watch a
+post-signing edit get caught. `sample` refuses to touch an existing record, so
+run it in an empty folder. When you are ready for the real thing, wire the gate
+below and the same commands run against your agent's own record.
+
 ## Claude Code hook quickstart
 
 ```bash
@@ -368,12 +386,14 @@ To report a vulnerability, see [SECURITY.md](./SECURITY.md).
 |---------|-------------|
 | `serve` | Start the HTTP hook server for Claude Code (port 9377). `--enforce` runs the restraint self-test first; `--cedar <dir>` and `--policy <path>` select the policy. |
 | `init` | Generate an Ed25519 keypair (`keys/gateway.json`), a config template, and a sample policy. |
+| `sample` | Seed a clearly-labeled sample record (8 decisions: one blocked call, two payments; kid `sample-demo`) plus a tampered copy, so `record`, `claim`, `verify-claim`, and `anchor-record` are replayable from scratch before wiring an agent. Refuses to touch an existing record; `--force` overrides. |
 | `wrap` | Print a protected MCP command or patch Claude Desktop MCP servers. Dry-run by default; use `--write` to update Claude Desktop config. |
 | `dashboard` | Start a local-only dashboard on `127.0.0.1` showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit export. |
 | `recommend` | Draft a reviewable JSON policy from observed local calls. Dry-run by default; use `--write` to create `protect-mcp.recommended.json`. |
 | `registry` | Create an org identity, anchor receipt digests, and write a static verifier page. Hosted mode uploads digests only. |
 | `record` | Open a local, searchable viewer over your receipts (`--live` streams as the agent runs): Ed25519 signatures verified in your browser against your gateway key, capability tags, a provenance tree, and one-click signed export. All local, nothing uploaded. |
-| `claim` | Mint a signed, position-blind attestation of a predicate over the record (`--no <cap>`, `--only <c1,c2>`, `--no-verdict <verdict>`, `--count <verdict>`), disclosing only decision categories. Add `--anchor` to record the claim digest in the public transparency log. |
+| `claim` | Mint a signed, position-blind attestation of a predicate over the record (`--no <cap>` incl. `--no payment`, `--only <c1,c2>`, `--no-verdict <verdict>`, `--count <verdict>`, `--payment-under <cap>`), disclosing only decision categories. Add `--anchor` to record the claim digest in the public transparency log; enrolled keys anchor as a named org. |
+| `anchor-record` | Checkpoint the record's Merkle root + count + time range into the public log (heartbeat-friendly: skips when unchanged). A later claim whose commitment matches an anchored checkpoint is provably over the complete record as of that checkpoint. |
 | `verify-claim` | Verify a claim pack offline: signature, recomputed Merkle root, independently recomputed predicate, and the anchor sidecar when present (binds the anchored envelope to this exact claim, then confirms the public log holds it). `--check-anchor` requires the anchor; `--offline` skips the log hop. |
 | `killer-demo` | Generate a complete shadow-mode to policy to approval to signed-receipt demo pack. |
 | `verify-disclosure` | Verify a `scopeblind.selective_disclosure.v0` package and explain disclosed versus hidden fields. |

package/dist/{chunk-DX7QOA3E.mjs → chunk-H332ZNJ6.mjs}

@@ -1,6 +1,6 @@
 import {
   buildEnrichment
-} from "./chunk-HPKHMVZX.mjs";
+} from "./chunk-WWPQNIVF.mjs";
 import {
   ReceiptBuffer,
   buildActionReadback,

package/dist/{chunk-HPKHMVZX.mjs → chunk-WWPQNIVF.mjs}

@@ -43,7 +43,11 @@ var RULES = [
   { cap: "secret.adjacent", text: /\.env\b|secret|credential|passwd|password|api[_-]?key|private[_-]?key|\.pem\b|\.key\b|id_rsa|bearer\s|aws_(access|secret)|authorization/ },
   { cap: "destructive", text: /rm\s+-[a-z]*[rf]|\brmdir\b|drop\s+table|truncate\s+table|delete\s+from|reset\s+--hard|--force\b|\bmkfs\b|\bdd\s+if=|shutdown|reboot|kill\s+-9|>\s*\/dev\/sd/ },
   { cap: "financial", text: /\b(order|trade|buy|sell|transfer|wire|payment|withdraw|deposit|swap|invoice|charge|refund|settle)\b/ },
-  { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ }
+  { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ },
+  // Agent payments (x402 / value transfer). Deliberately BROAD: a false positive
+  // only makes a `claim --no payment` harder to assert (conservative); a false
+  // negative would let a real payment escape the record's payment claims.
+  { cap: "payment", tool: /(^|[_.-])(pay|payment|x402|checkout)($|[_.-])|wallet.*send|send.*payment/, text: /x402|x-payment|paymentrequirements|maxamountrequired|payto|"pay_to"|eip-3009|transferwithauthorization|payment_intent|send_payment|create_payment/ }
 ];
 function deriveCapabilities(tool, input) {
   const t = String(tool || "").toLowerCase();
@@ -77,6 +81,33 @@ function deriveResource(input) {
   }
   return void 0;
 }
+function findField(input, names, depth = 0) {
+  if (depth > 4 || input === null || typeof input !== "object") return void 0;
+  const o = input;
+  const keys = Object.keys(o).sort();
+  for (const k of keys) {
+    if (names.indexOf(k.toLowerCase()) >= 0 && o[k] !== void 0 && o[k] !== null) return o[k];
+  }
+  for (const k of keys) {
+    const v = findField(o[k], names, depth + 1);
+    if (v !== void 0) return v;
+  }
+  return void 0;
+}
+function derivePayment(tool, input) {
+  if (deriveCapabilities(tool, input).indexOf("payment") < 0) return void 0;
+  const p = { amount: null, asset: null, recipient_digest: null };
+  const amt = findField(input, ["amount"]);
+  if (typeof amt === "number" && Number.isFinite(amt) && amt >= 0) p.amount = amt;
+  else if (typeof amt === "string" && /^\d{1,15}(\.\d{1,18})?$/.test(amt.trim()) && amt.indexOf(".") >= 0) p.amount = parseFloat(amt);
+  const asset = findField(input, ["asset", "currency", "token"]);
+  if (typeof asset === "string" && asset.trim()) p.asset = asset.trim().slice(0, 64);
+  const to = findField(input, ["payto", "pay_to", "recipient", "destination", "to"]);
+  if (typeof to === "string" && to.trim()) p.recipient_digest = sha256Hex(to.trim().toLowerCase());
+  const scheme = findField(input, ["scheme"]);
+  if (typeof scheme === "string" && scheme.trim()) p.scheme = scheme.trim().slice(0, 32);
+  return p;
+}
 function buildEnrichment(tool, input) {
   const e = {
     v: ENRICHMENT_VERSION,
@@ -85,6 +116,8 @@ function buildEnrichment(tool, input) {
   };
   const resource = deriveResource(input);
   if (resource) e.resource = resource;
+  const payment = derivePayment(tool, input);
+  if (payment) e.payment = payment;
   return e;
 }
 

package/dist/{claim-3EBRPP5U.mjs → claim-RIXFOQM7.mjs}

@@ -1,6 +1,6 @@
 import {
   canonicalJson
-} from "./chunk-HPKHMVZX.mjs";
+} from "./chunk-WWPQNIVF.mjs";
 import {
   sha256
 } from "./chunk-AYNQIEN7.mjs";
@@ -30,7 +30,13 @@ function receiptToLeaf(e) {
   const ms = typeof tsRaw === "number" ? tsRaw : typeof tsRaw === "string" ? Date.parse(tsRaw) : NaN;
   const t = isFinite(ms) ? new Date(ms).toISOString() : "";
   const d = sha256Hex(canonicalJson(e));
-  return { d, v, c, t };
+  const leaf = { d, v, c, t };
+  const pay = enr && enr.payment;
+  if (pay && typeof pay === "object") {
+    const amt = pay.amount;
+    leaf.p = typeof amt === "number" && Number.isFinite(amt) ? amt : null;
+  }
+  return leaf;
 }
 function leafHash(leaf) {
   return sha256Hex(canonicalJson(leaf));
@@ -63,6 +69,10 @@ function evaluate(pred, leaves) {
     const matched2 = leaves.filter((l) => l.v === pred.verdict).length;
     return { statement: `No action was ${pred.verdict}`, holds: matched2 === 0, matched: matched2 };
   }
+  if (pred.kind === "payment_under") {
+    const matched2 = leaves.filter((l) => "p" in l && (l.p === null || l.p >= pred.cap)).length;
+    return { statement: `Every payment stayed under ${pred.cap} (unknown amounts count as over)`, holds: matched2 === 0, matched: matched2 };
+  }
   const matched = leaves.filter((l) => l.v === pred.verdict).length;
   return { statement: `${matched} action${matched === 1 ? " was" : "s were"} ${pred.verdict}`, holds: true, matched };
 }
@@ -229,11 +239,9 @@ async function checkClaimAnchor(pack, sidecar, opts) {
     return out;
   }
 }
-async function anchorClaim(pack, key, opts) {
-  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
-  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
-  const doFetch = opts.fetchImpl || globalThis.fetch;
-  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+async function submitEnvelope(envelope, base, fetchImpl) {
+  const doFetch = fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, error: "fetch_unavailable" };
   const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
   try {
     const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
@@ -243,32 +251,101 @@ async function anchorClaim(pack, key, opts) {
     });
     const data = await resp.json().catch(() => null);
     if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
-      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+      return { ok: false, error: data && data.error || `http_${resp.status}` };
     }
+    return { ok: true, seq: data.seq, anchored_at: data.anchored_at, already_anchored: !!data.already_anchored };
+  } catch {
+    return { ok: false, error: "network_error" };
+  }
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = await submitEnvelope(envelope, base, opts.fetchImpl);
+  if (!out.ok) return { ok: false, claim_digest: envelope.claim_digest, error: out.error, envelope };
+  return {
+    ok: true,
+    claim_digest: envelope.claim_digest,
+    seq: out.seq,
+    entry_url: `${base}/fn/log/${out.seq}`,
+    anchored_at: out.anchored_at,
+    already_anchored: out.already_anchored,
+    envelope
+  };
+}
+var CHECKPOINT_SCHEMA = "scopeblind.protect-mcp.record-checkpoint.v1";
+function buildRecordCheckpoint(receipts, key, issuedAt) {
+  const leaves = receipts.map(receiptToLeaf);
+  const times = leaves.map((l) => l.t).filter(Boolean).sort();
+  const signed = {
+    type: "evidence_pack",
+    schema: CHECKPOINT_SCHEMA,
+    anchors: "protect-mcp-record",
+    record_root: merkleRoot(leaves.map(leafHash)),
+    total: leaves.length,
+    from: times[0] || "",
+    to: times[times.length - 1] || "",
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+async function anchorRecordCheckpoint(receipts, key, opts) {
+  const checkpoint = buildRecordCheckpoint(receipts, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = await submitEnvelope(checkpoint, base, opts.fetchImpl);
+  if (!out.ok) return { ok: false, record_root: checkpoint.record_root, total: checkpoint.total, checkpoint, error: out.error };
+  return {
+    ok: true,
+    record_root: checkpoint.record_root,
+    total: checkpoint.total,
+    seq: out.seq,
+    entry_url: `${base}/fn/log/${out.seq}`,
+    anchored_at: out.anchored_at,
+    already_anchored: out.already_anchored,
+    checkpoint
+  };
+}
+async function lookupPinnedIdentity(publicKey, opts) {
+  const base = (opts && opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts && opts.fetchImpl || globalThis.fetch;
+  if (!doFetch || !/^[0-9a-f]{64}$/i.test(publicKey)) return null;
+  try {
+    const resp = await doFetch(`${base}/fn/log/keys/lookup/${publicKey.toLowerCase()}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!data || data.ok !== true) return null;
+    if (!data.found) return { found: false };
     return {
-      ok: true,
-      claim_digest: envelope.claim_digest,
-      seq: data.seq,
-      entry_url: `${base}/fn/log/${data.seq}`,
-      anchored_at: data.anchored_at,
-      already_anchored: !!data.already_anchored,
-      envelope
+      found: true,
+      name: data.name,
+      slug: data.slug,
+      kid: data.kid,
+      enrolled_at: data.enrolled_at,
+      revoked: !!(data.revoked || data.revoked_at)
     };
   } catch {
-    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+    return null;
   }
 }
 export {
   ANCHOR_SCHEMA,
+  CHECKPOINT_SCHEMA,
   CLAIM_TYPE,
   DEFAULT_LOG,
   anchorClaim,
+  anchorRecordCheckpoint,
   buildAnchorEnvelope,
   buildClaim,
+  buildRecordCheckpoint,
   checkClaimAnchor,
   claimDigest,
   evaluate,
   leafHash,
+  lookupPinnedIdentity,
   merkleRoot,
   receiptToLeaf,
   verifyAnchorEnvelope,