protect-mcp 0.9.5 → 0.9.7

package/dist/{chunk-PB3TC7E3.mjs → chunk-YM6SOJBR.mjs}

@@ -2,13 +2,15 @@ import {
   ReceiptBuffer,
   buildActionReadback,
   checkRateLimit,
-  evaluateCedar,
   getToolPolicy,
   isSigningEnabled,
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-G6X763MH.mjs";
+import {
+  evaluateCedar
+} from "./chunk-MWXDXYWH.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";

package/dist/cli.js

@@ -6414,6 +6414,277 @@ var init_sample = __esm({
   }
 });
 
+// src/mcp-server.ts
+var mcp_server_exports = {};
+__export(mcp_server_exports, {
+  runMcpServer: () => runMcpServer
+});
+async function loadArtifacts() {
+  if (artifacts) return artifacts;
+  const moduleName = "@veritasacta/artifacts";
+  const mod2 = await import(
+    /* @vite-ignore */
+    moduleName
+  );
+  artifacts = mod2;
+  return mod2;
+}
+function buildReceiptPayload(args) {
+  return {
+    tool: args.tool,
+    decision: args.decision,
+    reason_code: args.reason_code ?? (args.decision === "deny" ? "policy_denied" : "post_execution_receipt"),
+    policy_digest: args.policy_digest ?? "none",
+    scope: args.request_id,
+    mode: "enforce",
+    request_id: args.request_id,
+    spec: "draft-farley-acta-signed-receipts-01",
+    issuer_certification: "self-signed",
+    public_key: args.public_key
+  };
+}
+function newRequestId() {
+  return `mcp-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+}
+async function callEvaluate(args) {
+  const tool = typeof args.tool === "string" ? args.tool : "";
+  const policySource = typeof args.policy === "string" ? args.policy : "";
+  const input = args.input && typeof args.input === "object" ? args.input : {};
+  if (!tool) return { error: "missing_tool" };
+  if (!policySource.trim()) return { allowed: false, decision: "deny", reason: "no policy provided (fail-closed)", policy_digest: "none" };
+  const policySet = policySetFromSource(policySource);
+  const decision = await evaluateCedar(
+    policySet,
+    { tool, tier: "unknown", context: { ...input, input }, toolInput: input },
+    void 0,
+    { failClosed: true }
+  );
+  return {
+    allowed: decision.allowed,
+    decision: decision.allowed ? "allow" : "deny",
+    reason: decision.reason || (decision.allowed ? "allowed" : "denied by policy"),
+    policy_digest: policySet.digest
+  };
+}
+async function callSign(args) {
+  const tool = typeof args.tool === "string" ? args.tool : "";
+  const decision = args.decision === "deny" ? "deny" : args.decision === "allow" ? "allow" : null;
+  if (!tool) return { error: "missing_tool" };
+  if (!decision) return { error: 'decision must be "allow" or "deny"' };
+  const a = await loadArtifacts();
+  let privateKey = typeof args.private_key_hex === "string" ? args.private_key_hex : "";
+  let publicKey;
+  let ephemeral = false;
+  if (privateKey) {
+    publicKey = a.getPublicKey(privateKey);
+  } else {
+    const kp = a.generateKeypair();
+    privateKey = kp.privateKey;
+    publicKey = kp.publicKey;
+    ephemeral = true;
+  }
+  const requestId = newRequestId();
+  const payload = buildReceiptPayload({
+    tool,
+    decision,
+    reason_code: typeof args.reason_code === "string" ? args.reason_code : void 0,
+    policy_digest: typeof args.policy_digest === "string" ? args.policy_digest : void 0,
+    request_id: requestId,
+    public_key: publicKey
+  });
+  const artifactType = decision === "deny" ? "gateway_restraint" : "decision_receipt";
+  const { artifact } = a.createSignedArtifact(artifactType, payload, privateKey, { kid: "mcp", issuer: "protect-mcp" });
+  return { receipt: artifact, artifact_type: artifactType, public_key: publicKey, ephemeral };
+}
+async function callVerify(args) {
+  const receipt = args.receipt;
+  if (!receipt || typeof receipt !== "object") return { valid: false, error: "missing_receipt" };
+  const a = await loadArtifacts();
+  const embedded = receipt.payload?.public_key;
+  const key = typeof args.public_key_hex === "string" && args.public_key_hex ? args.public_key_hex : typeof embedded === "string" ? embedded : null;
+  if (!key) {
+    return { valid: false, error: "no_public_key", type: receipt.type ?? "unknown", kid: null, issuer: null };
+  }
+  const result = a.verifyArtifact(receipt, key);
+  return {
+    valid: !!result.valid,
+    error: result.valid ? null : result.error || "invalid_signature",
+    type: receipt.type ?? "unknown",
+    kid: receipt.kid ?? null,
+    issuer: receipt.issuer ?? null
+  };
+}
+async function callSelfTest() {
+  const details = {};
+  const denied = await callEvaluate({ tool: "Bash", input: { command: "rm -rf /" }, policy: SELF_TEST_POLICY });
+  const gateDeniesForbidden = denied.allowed === false;
+  details.forbidden_action = { tool: "Bash", command: "rm -rf /", allowed: denied.allowed, reason: denied.reason };
+  const allowed = await callEvaluate({ tool: "Read", input: { path: "./notes.txt" }, policy: SELF_TEST_POLICY });
+  details.safe_action = { tool: "Read", allowed: allowed.allowed };
+  let signVerifyRoundtrip = false;
+  try {
+    const signed = await callSign({ tool: "Bash", decision: "deny", reason_code: "self_test" });
+    if (signed.receipt && signed.public_key) {
+      const ok = await callVerify({ receipt: signed.receipt, public_key_hex: signed.public_key });
+      const tampered = JSON.parse(JSON.stringify(signed.receipt));
+      if (tampered.payload) tampered.payload.tool = "tampered";
+      const bad = await callVerify({ receipt: tampered, public_key_hex: signed.public_key });
+      signVerifyRoundtrip = ok.valid === true && bad.valid === false;
+      details.sign_verify = { valid_verifies: ok.valid, tampered_rejected: bad.valid === false };
+    }
+  } catch (err) {
+    details.sign_verify_error = err instanceof Error ? err.message : String(err);
+  }
+  return {
+    ok: gateDeniesForbidden && allowed.allowed === true && signVerifyRoundtrip,
+    gate_denies_forbidden: gateDeniesForbidden,
+    sign_verify_roundtrip: signVerifyRoundtrip,
+    details,
+    note: "No network was contacted."
+  };
+}
+function textResult(id, value) {
+  return JSON.stringify({ jsonrpc: "2.0", id, result: { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] } });
+}
+async function handleRequest(request) {
+  if (request.method === "initialize") {
+    return JSON.stringify({
+      jsonrpc: "2.0",
+      id: request.id,
+      result: {
+        protocolVersion: "2024-11-05",
+        serverInfo: { name: "protect-mcp", version: process.env.PROTECT_MCP_VERSION || "0.9.7" },
+        capabilities: { tools: {} }
+      }
+    });
+  }
+  if (request.method === "notifications/initialized") return "";
+  if (request.method === "tools/list") {
+    return JSON.stringify({ jsonrpc: "2.0", id: request.id, result: { tools: TOOLS } });
+  }
+  if (request.method === "tools/call") {
+    const name = request.params?.name || "";
+    const args = request.params?.arguments || {};
+    try {
+      let value;
+      switch (name) {
+        case "evaluate_action":
+          value = await callEvaluate(args);
+          break;
+        case "sign_decision":
+          value = await callSign(args);
+          break;
+        case "verify_receipt":
+          value = await callVerify(args);
+          break;
+        case "self_test":
+          value = await callSelfTest();
+          break;
+        default:
+          value = { error: `unknown tool: ${name}` };
+      }
+      return textResult(request.id, value);
+    } catch (err) {
+      return textResult(request.id, { error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (request.id !== void 0) {
+    return JSON.stringify({ jsonrpc: "2.0", id: request.id, error: { code: -32601, message: `Method not found: ${request.method}` } });
+  }
+  return "";
+}
+async function runMcpServer() {
+  const rl = (0, import_node_readline2.createInterface)({ input: process.stdin, crlfDelay: Infinity });
+  let chain = Promise.resolve();
+  rl.on("line", (line) => {
+    const trimmed = line.trim();
+    if (!trimmed) return;
+    chain = chain.then(async () => {
+      try {
+        const request = JSON.parse(trimmed);
+        const response = await handleRequest(request);
+        if (response) process.stdout.write(response + "\n");
+      } catch {
+      }
+    });
+  });
+  process.stderr.write("[PROTECT_MCP] gate MCP server started \u2014 4 tools: evaluate_action, sign_decision, verify_receipt, self_test\n");
+  await new Promise((resolve) => rl.on("close", () => resolve()));
+}
+var import_node_readline2, artifacts, RO, TOOLS, SELF_TEST_POLICY;
+var init_mcp_server = __esm({
+  "src/mcp-server.ts"() {
+    "use strict";
+    import_node_readline2 = require("readline");
+    init_cedar_evaluator();
+    artifacts = null;
+    RO = { readOnlyHint: true, destructiveHint: false, openWorldHint: false };
+    TOOLS = [
+      {
+        name: "evaluate_action",
+        description: `Decide whether a proposed agent tool call is allowed by a Cedar policy, fail-closed. Evaluates the call against the policy the same way the protect-mcp gate does at runtime, and on any policy error the decision is DENY (never a silent allow). Inputs: tool (the tool name, e.g. "Bash" or "send_email"), input (the tool's arguments object; the policy sees it at context.input.*), and policy (inline Cedar source text). Returns JSON { allowed: boolean, decision: "allow" | "deny", reason: string, policy_digest: string (sha256 prefix of the policy) }. A missing or unparseable policy denies. Use this before an agent acts; pair with sign_decision to make the decision auditable.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            tool: { type: "string", description: 'The tool name being evaluated, e.g. "Bash", "Write", "send_email".' },
+            input: { type: "object", description: "The tool's arguments. Reachable in the policy at context.input.* (e.g. context.input.command)." },
+            policy: { type: "string", description: 'Inline Cedar policy source. Use MCP::Tool::call as the action and Tool::"<name>" as the resource.' }
+          },
+          required: ["tool", "policy"]
+        },
+        annotations: { title: "Evaluate an action against a Cedar policy", idempotentHint: true, ...RO }
+      },
+      {
+        name: "sign_decision",
+        description: `Turn a gate decision into an Ed25519 signed receipt (Veritas Acta format, JCS-canonical). A denial signs a gateway_restraint artifact; an allow signs a decision_receipt. This is what makes 'what the agent was blocked from doing' provable after the fact. Inputs: tool (required), decision ("allow" | "deny", required), reason_code (optional), policy_digest (optional), and private_key_hex (optional 64-hex Ed25519 secret; if omitted, an ephemeral keypair is generated and its public key is returned so the receipt still verifies). Returns JSON { receipt: object (the signed artifact), artifact_type: "decision_receipt" | "gateway_restraint", public_key: string (hex, pass this to verify_receipt or pin it), ephemeral: boolean }. Writes nothing to disk and contacts no network.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            tool: { type: "string", description: "The tool the decision is about." },
+            decision: { type: "string", enum: ["allow", "deny"], description: "The gate decision to receipt." },
+            reason_code: { type: "string", description: 'Optional machine reason, e.g. "restricted_list" or "post_execution_receipt".' },
+            policy_digest: { type: "string", description: "Optional digest of the policy that produced the decision (e.g. from evaluate_action)." },
+            private_key_hex: { type: "string", description: "Optional 64-character hex Ed25519 secret key. If omitted, an ephemeral key is generated and its public key is returned." }
+          },
+          required: ["tool", "decision"]
+        },
+        // Not idempotent: an ephemeral key and a fresh request_id are minted per call.
+        annotations: { title: "Sign a decision into a receipt", idempotentHint: false, ...RO }
+      },
+      {
+        name: "verify_receipt",
+        description: 'Verify a signed receipt offline against a public key. No network, no accounts: the Ed25519 signature is checked over the canonical bytes. Inputs: receipt (the signed artifact object, required) and public_key_hex (optional; falls back to a public_key embedded in the receipt payload). Returns JSON { valid: boolean, error: string | null (e.g. "invalid_signature", "no_public_key"), type: string, kid: string | null, issuer: string | null }. For authenticity you should verify against a key you pinned out of band, not only the one carried inside the receipt.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            receipt: { type: "object", description: "The signed receipt/artifact to verify." },
+            public_key_hex: { type: "string", description: "Optional Ed25519 public key hex to verify against. Defaults to a key embedded in the receipt payload." }
+          },
+          required: ["receipt"]
+        },
+        annotations: { title: "Verify a receipt offline", idempotentHint: true, ...RO }
+      },
+      {
+        name: "self_test",
+        description: "Prove the gate works, end to end, with no inputs. Runs a known-forbidden action (rm -rf) against a sample deny policy and asserts it is DENIED, then signs a decision and verifies the receipt round-trips. Returns JSON { ok: boolean, gate_denies_forbidden: boolean, sign_verify_roundtrip: boolean, details: object }. This is the 'a gate that cannot prove it denies does not start' check, exposed as a callable tool. Contacts no network.",
+        inputSchema: { type: "object", properties: {} },
+        annotations: { title: "Prove the gate denies and receipts verify", idempotentHint: true, ...RO }
+      }
+    ];
+    SELF_TEST_POLICY = `
+permit(principal, action == Action::"MCP::Tool::call", resource);
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"Bash")
+  when {
+    context has input && context.input has command &&
+    (context.input.command like "*rm -rf*" || context.input.command like "*mkfs*")
+  };
+`;
+    if (process.argv[1] && /mcp-server\.(js|mjs|cjs|ts)$/.test(process.argv[1])) {
+      runMcpServer();
+    }
+  }
+});
+
 // src/scopeblind-bridge.ts
 function getScopeBlindBridge() {
   if (!singleton) singleton = new ScopeBlindBridge();
@@ -6650,6 +6921,7 @@ async function handlePreToolUse(input, state) {
     ...input.teamName && { team_name: input.teamName },
     ...input.agentType && { agent_type: input.agentType }
   };
+  maybeReloadCedar(state);
   if (state.cedarPolicies) {
     try {
       const cedarDecision = await evaluateCedar(state.cedarPolicies, {
@@ -6687,10 +6959,13 @@ async function handlePreToolUse(input, state) {
           sandbox_state: detectSandboxState(),
           plan_receipt_id: state.activePlanReceiptId || void 0
         });
+        const isDefaultDeny = !reason || reason === "cedar_deny" || /reason":\[\]/.test(reason);
+        const policyRef = state.cedarDir ? ` Policy: ${state.cedarDir}.` : "";
+        const howTo = isDefaultDeny ? ` No permit matched (default-deny, fail-closed).${policyRef} Allow it: npx protect-mcp policy allow ${toolName}` : ` Blocked by an explicit forbid rule.${policyRef} Review: npx protect-mcp policy show`;
         if (denyCount === 1) {
           process.stderr.write(
-            `[PROTECT_MCP] No Cedar permit for "${toolName}" \u2014 suggest:
-  ${suggestion}
+            `[PROTECT_MCP] Denied "${toolName}" (${isDefaultDeny ? "default-deny" : "forbid"}).
+  Allow with: npx protect-mcp policy allow ${toolName}
 `
           );
         }
@@ -6698,7 +6973,7 @@ async function handlePreToolUse(input, state) {
           hookSpecificOutput: {
             hookEventName: "PreToolUse",
             permissionDecision: "deny",
-            permissionDecisionReason: `[ScopeBlind] Denied by Cedar policy. ${reason}. Forbidden: "${toolName}" is not permitted. Try a read-only alternative.` + (denyCount > 1 ? ` (attempt ${denyCount})` : "")
+            permissionDecisionReason: `[ScopeBlind] Denied "${toolName}".${howTo}` + (denyCount > 1 ? ` (attempt ${denyCount})` : "")
           }
         };
       }
@@ -7197,6 +7472,9 @@ async function startHookServer(options = {}) {
   }
   const state = {
     cedarPolicies,
+    cedarDir: cedarDir || null,
+    cedarMtimeMs: cedarDir ? newestCedarMtime(cedarDir) : 0,
+    cedarCheckedMs: 0,
     jsonPolicy,
     rateLimitStore: /* @__PURE__ */ new Map(),
     receiptBuffer: new ReceiptBuffer(),
@@ -7387,6 +7665,39 @@ async function startHookServer(options = {}) {
   process.on("SIGTERM", shutdown);
   return server;
 }
+function newestCedarMtime(dir) {
+  try {
+    let newest = 0;
+    for (const f of (0, import_node_fs11.readdirSync)(dir)) {
+      if (!f.endsWith(".cedar")) continue;
+      const m = (0, import_node_fs11.statSync)((0, import_node_path8.join)(dir, f)).mtimeMs;
+      if (m > newest) newest = m;
+    }
+    return newest;
+  } catch {
+    return 0;
+  }
+}
+function maybeReloadCedar(state) {
+  if (!state.cedarDir) return;
+  const nowMs = Date.now();
+  if (nowMs - state.cedarCheckedMs < CEDAR_CHECK_THROTTLE_MS) return;
+  state.cedarCheckedMs = nowMs;
+  const m = newestCedarMtime(state.cedarDir);
+  if (m <= state.cedarMtimeMs) return;
+  try {
+    const reloaded = loadCedarPolicies(state.cedarDir);
+    state.cedarPolicies = reloaded;
+    state.policyDigest = reloaded.digest;
+    state.cedarMtimeMs = m;
+    process.stderr.write(`[PROTECT_MCP] Cedar policy reloaded (digest: ${reloaded.digest}) after on-disk change.
+`);
+  } catch (err) {
+    process.stderr.write(`[PROTECT_MCP] Cedar reload failed, keeping the previous policy: ${err instanceof Error ? err.message : err}
+`);
+    state.cedarMtimeMs = m;
+  }
+}
 function findCedarDir() {
   for (const candidate of ["cedar", "policies", "."]) {
     try {
@@ -7412,7 +7723,7 @@ function normalizeHookInput(raw) {
   }
   return result;
 }
-var import_node_http2, import_node_crypto6, import_node_fs11, import_node_path8, DEFAULT_PORT, LOG_FILE3, RECEIPTS_FILE2, PAYLOAD_HASH_THRESHOLD, SNAKE_TO_CAMEL_MAP;
+var import_node_http2, import_node_crypto6, import_node_fs11, import_node_path8, DEFAULT_PORT, LOG_FILE3, RECEIPTS_FILE2, PAYLOAD_HASH_THRESHOLD, CEDAR_CHECK_THROTTLE_MS, SNAKE_TO_CAMEL_MAP;
 var init_hook_server = __esm({
   "src/hook-server.ts"() {
     "use strict";
@@ -7431,6 +7742,7 @@ var init_hook_server = __esm({
     LOG_FILE3 = ".protect-mcp-log.jsonl";
     RECEIPTS_FILE2 = ".protect-mcp-receipts.jsonl";
     PAYLOAD_HASH_THRESHOLD = 1024;
+    CEDAR_CHECK_THROTTLE_MS = 2e3;
     SNAKE_TO_CAMEL_MAP = {
       hook_event_name: "hookEventName",
       session_id: "sessionId",
@@ -8857,6 +9169,7 @@ protect-mcp: Enterprise security gateway for MCP servers & Claude Code hooks
 Usage:
   protect-mcp [options] -- <command> [args...]
   protect-mcp serve [--port <port>] [--enforce] [--policy <path>] [--cedar <dir>]
+  protect-mcp mcp                                 # the gate as an MCP server (evaluate/sign/verify/self_test tools)
   protect-mcp init-hooks [--dir <path>] [--port <port>]
   protect-mcp quickstart [--connect]
   protect-mcp wrap [--write] [--claude-desktop] [-- <command>]
@@ -8871,6 +9184,7 @@ Usage:
   protect-mcp connect
   protect-mcp init [--dir <path>]
   protect-mcp sample [--dir <path>] [--force]
+  protect-mcp policy list|show|allow <tool>|deny <tool>|path
   protect-mcp demo
   protect-mcp trace <receipt_id> [--endpoint <url>] [--depth <n>]
   protect-mcp status [--dir <path>]
@@ -11872,7 +12186,7 @@ async function handleKillerDemo(argv) {
   const { ed25519: ed255192 } = await Promise.resolve().then(() => (init_ed25519(), ed25519_exports));
   const { bytesToHex: bytesToHex2 } = await Promise.resolve().then(() => (init_utils(), utils_exports));
   const { randomBytes: randomBytes4 } = await import("crypto");
-  const artifacts = await import("@veritasacta/artifacts");
+  const artifacts2 = await import("@veritasacta/artifacts");
   const {
     createSelectiveDisclosurePackage: createSelectiveDisclosurePackage2,
     signCommittedDecision: signCommittedDecision2,
@@ -11999,8 +12313,8 @@ async function handleKillerDemo(argv) {
   } else {
     tamperedArtifact.tool = "send_email";
   }
-  const validOriginal = artifacts.verifyArtifact(receiptArtifact, keypair.publicKey);
-  const validTampered = artifacts.verifyArtifact(tamperedArtifact, keypair.publicKey);
+  const validOriginal = artifacts2.verifyArtifact(receiptArtifact, keypair.publicKey);
+  const validTampered = artifacts2.verifyArtifact(tamperedArtifact, keypair.publicKey);
   (0, import_node_fs13.writeFileSync)((0, import_node_path9.join)(dir, "receipts", "tampered.receipt.json"), JSON.stringify(tamperedArtifact, null, 2) + "\n");
   const committed = signCommittedDecision2(
     executedEntry,
@@ -12977,6 +13291,151 @@ ${bold("\u{1F6E1} Sample record seeded")} \xB7 8 decisions (1 blocked, 2 payment
 `);
   process.exit(0);
 }
+async function handlePolicy(argv) {
+  const { readFileSync: rf, writeFileSync: wf, existsSync: ex, readdirSync: rd, appendFileSync: af } = await import("fs");
+  const { join: pj } = await import("path");
+  const { createHash: createHash6 } = await import("crypto");
+  const sub = argv[0] || "list";
+  const findDir = () => {
+    for (const c of ["cedar", "policies", "."]) {
+      try {
+        if (ex(c) && rd(c).some((f) => f.endsWith(".cedar"))) return c;
+      } catch {
+      }
+    }
+    return null;
+  };
+  const dir = findDir();
+  const cedarFiles = dir ? rd(dir).filter((f) => f.endsWith(".cedar")).sort() : [];
+  const readAll = () => cedarFiles.map((f) => rf(pj(dir, f), "utf-8")).join("\n\n");
+  const digestOf = (src) => createHash6("sha256").update(src).digest("hex").slice(0, 16);
+  const stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "");
+  const targetFile = cedarFiles.includes("agent.cedar") ? "agent.cedar" : cedarFiles[0];
+  if (sub === "path") {
+    if (!dir) {
+      process.stdout.write("No Cedar policy directory found (looked in ./cedar, ./policies, .).\n");
+      process.exit(0);
+    }
+    process.stdout.write(`${pj(dir, targetFile)}
+`);
+    process.exit(0);
+  }
+  if (sub === "show") {
+    if (!dir) {
+      process.stderr.write("No Cedar policy found. Run: npx protect-mcp init-hooks\n");
+      process.exit(1);
+    }
+    const src = readAll();
+    process.stdout.write(`${bold("Cedar policy")} ${dim(`(${cedarFiles.length} file${cedarFiles.length === 1 ? "" : "s"} in ${dir}, digest ${digestOf(src)})`)}
+
+`);
+    process.stdout.write(src.endsWith("\n") ? src : src + "\n");
+    process.exit(0);
+  }
+  if (sub === "allow" || sub === "deny") {
+    const tool = argv[1];
+    if (!tool) {
+      process.stderr.write(`Usage: npx protect-mcp policy ${sub} <ToolName>
+`);
+      process.exit(1);
+    }
+    if (!/^[A-Za-z0-9_.:-]+$/.test(tool)) {
+      process.stderr.write(`Refusing: "${tool}" is not a valid tool name.
+`);
+      process.exit(1);
+    }
+    if (!dir) {
+      process.stderr.write("No Cedar policy found. Run: npx protect-mcp init-hooks\n");
+      process.exit(1);
+    }
+    const effect = sub === "allow" ? "permit" : "forbid";
+    const before = readAll();
+    const ruleRe = new RegExp(`${effect}\\s*\\([^)]*resource\\s*==\\s*Tool::"${tool.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}"`, "s");
+    if (ruleRe.test(stripComments(before))) {
+      process.stdout.write(`${dim("No change:")} a ${effect} rule for ${bold(tool)} already exists in ${targetFile}.
+`);
+      process.exit(0);
+    }
+    const block = `
+// ${effect === "permit" ? "Allow" : "Block"} ${tool} (added by \`protect-mcp policy ${sub}\`)
+${effect}(
+  principal,
+  action == Action::"MCP::Tool::call",
+  resource == Tool::"${tool}"
+);
+`;
+    af(pj(dir, targetFile), block);
+    const after = readAll();
+    process.stdout.write(`${bold(sub === "allow" ? "\u2713 Allowed" : "\u2713 Denied")} ${tool}
+`);
+    process.stdout.write(`  ${dim(`appended to ${pj(dir, targetFile)}`)}
+`);
+    process.stdout.write(`  ${dim(`policy digest ${digestOf(before)} \u2192 ${digestOf(after)}`)}
+`);
+    process.stdout.write(`
+${dim("A running gate (protect-mcp serve) hot-reloads on this change; no restart needed. The one-shot hook path re-reads per call.")}
+`);
+    process.exit(0);
+  }
+  if (sub === "list") {
+    if (!dir) {
+      process.stderr.write("No Cedar policy found. Run: npx protect-mcp init-hooks\n");
+      process.exit(1);
+    }
+    const src = readAll();
+    const active = stripComments(src);
+    const named = (effect) => {
+      const set = /* @__PURE__ */ new Set();
+      const re = new RegExp(`${effect}\\s*\\([\\s\\S]*?resource\\s*==\\s*Tool::"([^"]+)"[\\s\\S]*?\\);`, "g");
+      let m;
+      while (m = re.exec(active)) set.add(m[1]);
+      return set;
+    };
+    const permitted = named("permit"), forbidden = named("forbid");
+    const seen = /* @__PURE__ */ new Map();
+    try {
+      const logPath = pj(process.cwd(), ".protect-mcp-log.jsonl");
+      if (ex(logPath)) {
+        for (const line of rf(logPath, "utf-8").split("\n")) {
+          if (!line.trim()) continue;
+          try {
+            const e = JSON.parse(line);
+            if (!e.tool) continue;
+            const rec = seen.get(e.tool) || { allow: 0, deny: 0 };
+            if (e.decision === "deny") rec.deny++;
+            else rec.allow++;
+            seen.set(e.tool, rec);
+          } catch {
+          }
+        }
+      }
+    } catch {
+    }
+    process.stdout.write(`${bold("Cedar policy")} ${dim(`(${dir}, digest ${digestOf(src)}) \xB7 default-deny, fail-closed`)}
+
+`);
+    const allTools = /* @__PURE__ */ new Set([...permitted, ...forbidden, ...seen.keys()]);
+    if (allTools.size === 0) {
+      process.stdout.write(dim("  No rules and no decisions logged yet.\n"));
+      process.exit(0);
+    }
+    const rows = [...allTools].sort().map((t) => {
+      const label = forbidden.has(t) ? "forbid" : permitted.has(t) ? "permit" : "default-deny";
+      const colored = forbidden.has(t) ? red(label) : permitted.has(t) ? green(label) : yellow(label);
+      const pad = " ".repeat(Math.max(1, 13 - label.length));
+      const s = seen.get(t);
+      const hits = s ? dim(`  ${s.allow} allowed, ${s.deny} denied`) : "";
+      return `  ${colored}${pad}${bold(t)}${hits}`;
+    });
+    process.stdout.write(rows.join("\n") + "\n");
+    process.stdout.write(`
+${dim("Allow a tool: npx protect-mcp policy allow <ToolName>  \xB7  Block one: policy deny <ToolName>")}
+`);
+    process.exit(0);
+  }
+  process.stderr.write("Usage: npx protect-mcp policy <list|show|allow <tool>|deny <tool>|path>\n");
+  process.exit(1);
+}
 async function main() {
   sendInstallTelemetry().catch(() => {
   });
@@ -13000,6 +13459,10 @@ async function main() {
     await handleSign(args.slice(1));
     return;
   }
+  if (args[0] === "mcp") {
+    await (await Promise.resolve().then(() => (init_mcp_server(), mcp_server_exports))).runMcpServer();
+    return;
+  }
   if (args[0] === "serve") {
     const { startHookServer: startHookServer2 } = await Promise.resolve().then(() => (init_hook_server(), hook_server_exports));
     const portIdx = args.indexOf("--port");
@@ -13046,6 +13509,10 @@ async function main() {
     await handleSample(args.slice(1));
     return;
   }
+  if (args[0] === "policy") {
+    await handlePolicy(args.slice(1));
+    return;
+  }
   if (args[0] === "init-hooks") {
     await handleInitHooks(args.slice(1));
     process.exit(0);