protect-mcp 0.9.6 → 0.9.7

package/README.md

@@ -57,6 +57,36 @@ The dashboard binds to `127.0.0.1`, reads only local log/receipt files, and does
 not upload anything. Use `npx protect-mcp connect` only if you explicitly want a
 hosted ScopeBlind dashboard.
 
+## The gate as an MCP server
+
+If you would rather call the gate as tools than wire the Claude Code hooks, run
+it as an MCP server:
+
+```bash
+npx protect-mcp mcp
+```
+
+It speaks MCP over stdio and exposes four read-only tools, the whole loop:
+
+- **`evaluate_action`**: decide a proposed tool call against an inline Cedar policy, fail-closed (any policy error is DENY). Returns `{ allowed, decision, reason, policy_digest }`.
+- **`sign_decision`**: turn a decision into an Ed25519 signed receipt (a denial signs a `gateway_restraint`, an allow a `decision_receipt`). Returns the receipt and its public key; generates an ephemeral key if you do not supply one.
+- **`verify_receipt`**: verify a signed receipt offline against a public key. Returns `{ valid, error, type, kid, issuer }`.
+- **`self_test`**: prove it, no inputs. A known-forbidden action is denied, then a signed receipt round-trips and a tampered copy fails.
+
+Point any MCP host at it, for example Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "protect-mcp": { "command": "npx", "args": ["-y", "protect-mcp", "mcp"] }
+  }
+}
+```
+
+Receipts are byte-compatible with the ones the gate signs at runtime, so a
+receipt minted here verifies with [`@veritasacta/verify`](https://www.npmjs.com/package/@veritasacta/verify)
+and the browser verifier just the same.
+
 ### Local Action Dashboard
 
 `protect-mcp dashboard` is the operator view for moving from visibility to

package/dist/{chunk-WCZJGEBO.mjs → chunk-AUUAVWQM.mjs}

@@ -5,17 +5,19 @@ import {
   ReceiptBuffer,
   buildActionReadback,
   checkRateLimit,
-  evaluateCedar,
   getSignerInfo,
   getToolPolicy,
   initSigning,
-  isCedarAvailable,
   isSigningEnabled,
-  loadCedarPolicies,
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-G6X763MH.mjs";
+import {
+  evaluateCedar,
+  isCedarAvailable,
+  loadCedarPolicies
+} from "./chunk-MWXDXYWH.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";

package/dist/{chunk-XLJUZ4WO.mjs → chunk-G6X763MH.mjs}

@@ -236,213 +236,10 @@ function isSigningEnabled() {
   return signingConfigured && signingInitError === null && signerState !== null && artifactsModule !== null;
 }
 
-// src/cedar-evaluator.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync3, readdirSync, existsSync as existsSync2 } from "fs";
-import { join, extname } from "path";
-var cedarWasm = null;
-var loadAttempted = false;
-async function ensureCedarWasm() {
-  if (cedarWasm) return true;
-  if (loadAttempted) return false;
-  loadAttempted = true;
-  try {
-    const moduleName = "@cedar-policy/cedar-wasm";
-    cedarWasm = await import(
-      /* @vite-ignore */
-      moduleName
-    );
-    return true;
-  } catch {
-    return false;
-  }
-}
-function loadCedarPolicies(dirPath) {
-  if (!existsSync2(dirPath)) {
-    throw new Error(`Cedar policy directory not found: ${dirPath}`);
-  }
-  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
-  if (entries.length === 0) {
-    throw new Error(`No .cedar files found in: ${dirPath}`);
-  }
-  const sources = [];
-  for (const file of entries) {
-    const content = readFileSync3(join(dirPath, file), "utf-8");
-    sources.push(content);
-  }
-  const concatenated = sources.join("\n\n");
-  const digest = createHash2("sha256").update(concatenated).digest("hex").slice(0, 16);
-  return {
-    source: concatenated,
-    digest,
-    fileCount: entries.length,
-    files: entries
-  };
-}
-function buildEntities(req) {
-  const agentId = req.agentId || req.tier;
-  return [
-    {
-      uid: { type: "Agent", id: agentId },
-      attrs: {
-        tier: req.tier,
-        ...req.agentId ? { agent_id: req.agentId } : {}
-      },
-      parents: []
-    },
-    {
-      uid: { type: "Tool", id: req.tool },
-      attrs: {},
-      parents: []
-    }
-  ];
-}
-function onEvalError(reason, failClosed, extra) {
-  return {
-    allowed: !failClosed,
-    reason: failClosed ? reason : `${reason} (observe mode; would DENY under enforcement)`,
-    metadata: { error: true, fail_closed: failClosed, would_deny: true, ...extra || {} }
-  };
-}
-async function evaluateCedar(policySet, req, schema, options) {
-  const failClosed = options?.failClosed ?? true;
-  const available = await ensureCedarWasm();
-  if (!available) {
-    return onEvalError("cedar_wasm_not_available", failClosed, { fallback: true });
-  }
-  try {
-    const agentId = req.agentId || req.tier;
-    const context = {
-      tier: req.tier,
-      ...req.context || {}
-    };
-    if (req.toolInput && Object.keys(req.toolInput).length > 0) {
-      context.input = req.toolInput;
-    }
-    const authRequest = {
-      principal: { type: "Agent", id: agentId },
-      action: { type: "Action", id: "MCP::Tool::call" },
-      resource: { type: "Tool", id: req.tool },
-      context
-    };
-    const entities = buildEntities(req);
-    const cedarSchema = schema?.schemaJson ?? null;
-    let result;
-    if (typeof cedarWasm.isAuthorized === "function") {
-      result = cedarWasm.isAuthorized({
-        policies: { staticPolicies: policySet.source },
-        entities,
-        principal: authRequest.principal,
-        action: authRequest.action,
-        resource: authRequest.resource,
-        context: authRequest.context,
-        schema: cedarSchema
-      });
-    } else if (typeof cedarWasm.checkAuthorization === "function") {
-      result = cedarWasm.checkAuthorization(
-        policySet.source,
-        JSON.stringify(entities),
-        JSON.stringify(authRequest)
-      );
-    } else {
-      const cedarEngine = cedarWasm.default || cedarWasm;
-      if (typeof cedarEngine.isAuthorized === "function") {
-        result = cedarEngine.isAuthorized({
-          policies: { staticPolicies: policySet.source },
-          entities,
-          principal: authRequest.principal,
-          action: authRequest.action,
-          resource: authRequest.resource,
-          context: authRequest.context,
-          schema: cedarSchema
-        });
-      } else {
-        return onEvalError("cedar_wasm_api_unsupported", failClosed, { exports: Object.keys(cedarWasm) });
-      }
-    }
-    const parsed = parseWasmResult(result);
-    const policyErrors = extractPolicyErrors(result);
-    if (parsed.kind === "error") {
-      return onEvalError(`cedar_unparseable_result: ${parsed.diagnostics}`, failClosed);
-    }
-    if (policyErrors.length > 0) {
-      return onEvalError(
-        `cedar_policy_errored: ${policyErrors.length} policy error(s); decision is unsound`,
-        failClosed,
-        { policy_errors: policyErrors.slice(0, 5), policy_digest: policySet.digest }
-      );
-    }
-    return {
-      allowed: parsed.kind === "allow",
-      reason: parsed.kind === "allow" ? void 0 : `cedar_deny${parsed.diagnostics ? ": " + parsed.diagnostics : ""}`,
-      metadata: {
-        policy_digest: policySet.digest,
-        ...parsed.matchedPolicies ? { matched_policies: parsed.matchedPolicies } : {}
-      }
-    };
-  } catch (err) {
-    return onEvalError(`cedar_eval_error: ${err instanceof Error ? err.message : "unknown"}`, failClosed);
-  }
-}
-function parseWasmResult(result) {
-  if (!result) return { kind: "error", diagnostics: "null result from Cedar WASM" };
-  if (result.type === "failure") {
-    return { kind: "error", diagnostics: `cedar failure: ${JSON.stringify(result.errors ?? [])}` };
-  }
-  if (result.type === "success" && result.response) {
-    const dec = result.response.decision;
-    const reasons = result.response.diagnostics?.reason;
-    if (dec === "allow" || dec === "Allow") return { kind: "allow", matchedPolicies: reasons };
-    if (dec === "deny" || dec === "Deny") {
-      return { kind: "deny", diagnostics: result.response.diagnostics ? JSON.stringify(result.response.diagnostics) : void 0, matchedPolicies: reasons };
-    }
-  }
-  if (result.type === "allow" || result.decision === "Allow") return { kind: "allow" };
-  if (result.type === "deny" || result.decision === "Deny") return { kind: "deny" };
-  if (typeof result === "boolean") return result ? { kind: "allow" } : { kind: "deny" };
-  return { kind: "error", diagnostics: `unknown result format: ${JSON.stringify(result)}` };
-}
-function extractPolicyErrors(result) {
-  if (!result || typeof result !== "object") return [];
-  const raw = result.errors ?? result.response?.diagnostics?.errors ?? result.diagnostics?.errors ?? [];
-  if (!Array.isArray(raw)) return [];
-  return raw.map((e) => typeof e === "string" ? e : e?.message ?? e?.error ?? JSON.stringify(e)).filter(Boolean);
-}
-async function isCedarAvailable() {
-  return ensureCedarWasm();
-}
-function policySetFromSource(source, name = "inline") {
-  const digest = createHash2("sha256").update(source).digest("hex").slice(0, 16);
-  return { source, digest, fileCount: 1, files: [name] };
-}
-async function runEvaluatorSelfTest() {
-  const wasmAvailable = await isCedarAvailable();
-  const cases = [];
-  const run = async (name, expected, policy, context) => {
-    const d = await evaluateCedar(policy, { tool: "Bash", tier: "unknown", context }, void 0, { failClosed: true });
-    const actual = d.allowed ? "ALLOW" : "DENY";
-    cases.push({ name, expected, actual, pass: actual === expected, reason: d.reason });
-  };
-  if (!wasmAvailable) {
-    await run("engine unavailable denies", "DENY", policySetFromSource("permit(principal, action, resource);"), {});
-    return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
-  }
-  const correct = policySetFromSource(
-    'forbid(principal, action, resource) when { ["rm", "dd", "mkfs"].contains(context.command) };\npermit(principal, action, resource);'
-  );
-  await run("forbid denies rm", "DENY", correct, { command: "rm" });
-  await run("permit allows ls", "ALLOW", correct, { command: "ls" });
-  const broken = policySetFromSource(
-    'forbid(principal, action, resource) when { context.command in ["rm", "dd"] };\npermit(principal, action, resource);'
-  );
-  await run("in-on-String forbid does not permit-all", "DENY", broken, { command: "rm" });
-  return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
-}
-
 // src/http-server.ts
 import { createServer } from "http";
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { join } from "path";
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var MAX_RECEIPTS = 100;
 var ReceiptBuffer = class {
@@ -535,13 +332,13 @@ function handleHealth(res, startTime, config) {
   }));
 }
 function handleStatus(res, logDir) {
-  const logPath = join2(logDir, LOG_FILE);
-  if (!existsSync3(logPath)) {
+  const logPath = join(logDir, LOG_FILE);
+  if (!existsSync2(logPath)) {
     res.writeHead(200);
     res.end(JSON.stringify({ entries: 0, message: "no log file yet" }));
     return;
   }
-  const raw = readFileSync4(logPath, "utf-8");
+  const raw = readFileSync3(logPath, "utf-8");
   const lines = raw.trim().split("\n").filter(Boolean);
   const entries = [];
   for (const line of lines) {
@@ -665,7 +462,7 @@ function handleListApprovals(res, approvalStore) {
 }
 
 // src/action-readback.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
 var DESTINATION_KEYS = [
   "path",
@@ -745,7 +542,7 @@ function buildActionReadback(tool, input) {
     action,
     destination,
     payload_preview: payloadPreview,
-    payload_hash: createHash3("sha256").update(canonical).digest("hex"),
+    payload_hash: createHash2("sha256").update(canonical).digest("hex"),
     payload_bytes: Buffer.byteLength(canonical, "utf-8"),
     disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
     redacted_fields: [...new Set(redactedFields)].slice(0, 80),
@@ -762,11 +559,6 @@ export {
   signDecision,
   getSignerInfo,
   isSigningEnabled,
-  loadCedarPolicies,
-  evaluateCedar,
-  isCedarAvailable,
-  policySetFromSource,
-  runEvaluatorSelfTest,
   ReceiptBuffer,
   startStatusServer,
   buildActionReadback

package/dist/{chunk-7MHK5RF4.mjs → chunk-MOXINIMB.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-PB3TC7E3.mjs";
+} from "./chunk-YM6SOJBR.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-G6X763MH.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/chunk-MWXDXYWH.mjs

@@ -0,0 +1,210 @@
+// src/cedar-evaluator.ts
+import { createHash } from "crypto";
+import { readFileSync, readdirSync, existsSync } from "fs";
+import { join, extname } from "path";
+var cedarWasm = null;
+var loadAttempted = false;
+async function ensureCedarWasm() {
+  if (cedarWasm) return true;
+  if (loadAttempted) return false;
+  loadAttempted = true;
+  try {
+    const moduleName = "@cedar-policy/cedar-wasm";
+    cedarWasm = await import(
+      /* @vite-ignore */
+      moduleName
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function loadCedarPolicies(dirPath) {
+  if (!existsSync(dirPath)) {
+    throw new Error(`Cedar policy directory not found: ${dirPath}`);
+  }
+  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  if (entries.length === 0) {
+    throw new Error(`No .cedar files found in: ${dirPath}`);
+  }
+  const sources = [];
+  for (const file of entries) {
+    const content = readFileSync(join(dirPath, file), "utf-8");
+    sources.push(content);
+  }
+  const concatenated = sources.join("\n\n");
+  const digest = createHash("sha256").update(concatenated).digest("hex").slice(0, 16);
+  return {
+    source: concatenated,
+    digest,
+    fileCount: entries.length,
+    files: entries
+  };
+}
+function buildEntities(req) {
+  const agentId = req.agentId || req.tier;
+  return [
+    {
+      uid: { type: "Agent", id: agentId },
+      attrs: {
+        tier: req.tier,
+        ...req.agentId ? { agent_id: req.agentId } : {}
+      },
+      parents: []
+    },
+    {
+      uid: { type: "Tool", id: req.tool },
+      attrs: {},
+      parents: []
+    }
+  ];
+}
+function onEvalError(reason, failClosed, extra) {
+  return {
+    allowed: !failClosed,
+    reason: failClosed ? reason : `${reason} (observe mode; would DENY under enforcement)`,
+    metadata: { error: true, fail_closed: failClosed, would_deny: true, ...extra || {} }
+  };
+}
+async function evaluateCedar(policySet, req, schema, options) {
+  const failClosed = options?.failClosed ?? true;
+  const available = await ensureCedarWasm();
+  if (!available) {
+    return onEvalError("cedar_wasm_not_available", failClosed, { fallback: true });
+  }
+  try {
+    const agentId = req.agentId || req.tier;
+    const context = {
+      tier: req.tier,
+      ...req.context || {}
+    };
+    if (req.toolInput && Object.keys(req.toolInput).length > 0) {
+      context.input = req.toolInput;
+    }
+    const authRequest = {
+      principal: { type: "Agent", id: agentId },
+      action: { type: "Action", id: "MCP::Tool::call" },
+      resource: { type: "Tool", id: req.tool },
+      context
+    };
+    const entities = buildEntities(req);
+    const cedarSchema = schema?.schemaJson ?? null;
+    let result;
+    if (typeof cedarWasm.isAuthorized === "function") {
+      result = cedarWasm.isAuthorized({
+        policies: { staticPolicies: policySet.source },
+        entities,
+        principal: authRequest.principal,
+        action: authRequest.action,
+        resource: authRequest.resource,
+        context: authRequest.context,
+        schema: cedarSchema
+      });
+    } else if (typeof cedarWasm.checkAuthorization === "function") {
+      result = cedarWasm.checkAuthorization(
+        policySet.source,
+        JSON.stringify(entities),
+        JSON.stringify(authRequest)
+      );
+    } else {
+      const cedarEngine = cedarWasm.default || cedarWasm;
+      if (typeof cedarEngine.isAuthorized === "function") {
+        result = cedarEngine.isAuthorized({
+          policies: { staticPolicies: policySet.source },
+          entities,
+          principal: authRequest.principal,
+          action: authRequest.action,
+          resource: authRequest.resource,
+          context: authRequest.context,
+          schema: cedarSchema
+        });
+      } else {
+        return onEvalError("cedar_wasm_api_unsupported", failClosed, { exports: Object.keys(cedarWasm) });
+      }
+    }
+    const parsed = parseWasmResult(result);
+    const policyErrors = extractPolicyErrors(result);
+    if (parsed.kind === "error") {
+      return onEvalError(`cedar_unparseable_result: ${parsed.diagnostics}`, failClosed);
+    }
+    if (policyErrors.length > 0) {
+      return onEvalError(
+        `cedar_policy_errored: ${policyErrors.length} policy error(s); decision is unsound`,
+        failClosed,
+        { policy_errors: policyErrors.slice(0, 5), policy_digest: policySet.digest }
+      );
+    }
+    return {
+      allowed: parsed.kind === "allow",
+      reason: parsed.kind === "allow" ? void 0 : `cedar_deny${parsed.diagnostics ? ": " + parsed.diagnostics : ""}`,
+      metadata: {
+        policy_digest: policySet.digest,
+        ...parsed.matchedPolicies ? { matched_policies: parsed.matchedPolicies } : {}
+      }
+    };
+  } catch (err) {
+    return onEvalError(`cedar_eval_error: ${err instanceof Error ? err.message : "unknown"}`, failClosed);
+  }
+}
+function parseWasmResult(result) {
+  if (!result) return { kind: "error", diagnostics: "null result from Cedar WASM" };
+  if (result.type === "failure") {
+    return { kind: "error", diagnostics: `cedar failure: ${JSON.stringify(result.errors ?? [])}` };
+  }
+  if (result.type === "success" && result.response) {
+    const dec = result.response.decision;
+    const reasons = result.response.diagnostics?.reason;
+    if (dec === "allow" || dec === "Allow") return { kind: "allow", matchedPolicies: reasons };
+    if (dec === "deny" || dec === "Deny") {
+      return { kind: "deny", diagnostics: result.response.diagnostics ? JSON.stringify(result.response.diagnostics) : void 0, matchedPolicies: reasons };
+    }
+  }
+  if (result.type === "allow" || result.decision === "Allow") return { kind: "allow" };
+  if (result.type === "deny" || result.decision === "Deny") return { kind: "deny" };
+  if (typeof result === "boolean") return result ? { kind: "allow" } : { kind: "deny" };
+  return { kind: "error", diagnostics: `unknown result format: ${JSON.stringify(result)}` };
+}
+function extractPolicyErrors(result) {
+  if (!result || typeof result !== "object") return [];
+  const raw = result.errors ?? result.response?.diagnostics?.errors ?? result.diagnostics?.errors ?? [];
+  if (!Array.isArray(raw)) return [];
+  return raw.map((e) => typeof e === "string" ? e : e?.message ?? e?.error ?? JSON.stringify(e)).filter(Boolean);
+}
+async function isCedarAvailable() {
+  return ensureCedarWasm();
+}
+function policySetFromSource(source, name = "inline") {
+  const digest = createHash("sha256").update(source).digest("hex").slice(0, 16);
+  return { source, digest, fileCount: 1, files: [name] };
+}
+async function runEvaluatorSelfTest() {
+  const wasmAvailable = await isCedarAvailable();
+  const cases = [];
+  const run = async (name, expected, policy, context) => {
+    const d = await evaluateCedar(policy, { tool: "Bash", tier: "unknown", context }, void 0, { failClosed: true });
+    const actual = d.allowed ? "ALLOW" : "DENY";
+    cases.push({ name, expected, actual, pass: actual === expected, reason: d.reason });
+  };
+  if (!wasmAvailable) {
+    await run("engine unavailable denies", "DENY", policySetFromSource("permit(principal, action, resource);"), {});
+    return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+  }
+  const correct = policySetFromSource(
+    'forbid(principal, action, resource) when { ["rm", "dd", "mkfs"].contains(context.command) };\npermit(principal, action, resource);'
+  );
+  await run("forbid denies rm", "DENY", correct, { command: "rm" });
+  await run("permit allows ls", "ALLOW", correct, { command: "ls" });
+  const broken = policySetFromSource(
+    'forbid(principal, action, resource) when { context.command in ["rm", "dd"] };\npermit(principal, action, resource);'
+  );
+  await run("in-on-String forbid does not permit-all", "DENY", broken, { command: "rm" });
+  return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+}
+
+export {
+  loadCedarPolicies,
+  evaluateCedar,
+  isCedarAvailable,
+  policySetFromSource,
+  runEvaluatorSelfTest
+};

package/dist/{chunk-PB3TC7E3.mjs → chunk-YM6SOJBR.mjs}

@@ -2,13 +2,15 @@ import {
   ReceiptBuffer,
   buildActionReadback,
   checkRateLimit,
-  evaluateCedar,
   getToolPolicy,
   isSigningEnabled,
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-G6X763MH.mjs";
+import {
+  evaluateCedar
+} from "./chunk-MWXDXYWH.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";