cmcp-runtime 0.1.0__tar.gz

cmcp_runtime-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,13 @@
+# Default owners for all files
+* @agentrust-io/maintainers
+
+# Security-sensitive paths require security-reviewers sign-off
+src/cmcp_gateway/audit/ @agentrust-io/security-reviewers @agentrust-io/maintainers
+src/cmcp_gateway/tee/ @agentrust-io/security-reviewers @agentrust-io/maintainers
+src/cmcp_gateway/policy/ @agentrust-io/security-reviewers @agentrust-io/maintainers
+
+# CI/CD workflow changes
+.github/workflows/ @agentrust-io/maintainers
+
+# Package configuration
+pyproject.toml @agentrust-io/maintainers

cmcp_runtime-0.1.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Defect in gateway behavior
+labels: bug
+assignees: ''
+---
+
+## cmcp-gateway version
+
+<!-- Output of `cmcp-gateway --version` or the git SHA if building from source -->
+
+## Python version
+
+<!-- Output of `python --version` -->
+
+## TEE provider
+
+<!-- e.g. Intel TDX, AMD SEV-SNP, AWS Nitro Enclaves, none -->
+
+## Reproduction steps
+
+1.
+2.
+3.
+
+## Expected behavior
+
+<!-- What you expected to happen -->
+
+## Actual behavior
+
+<!-- What actually happened -->
+
+## Relevant logs or TRACE Claim output
+
+```
+<!-- Paste log output or TRACE Claim JSON here -->
+```
+
+## Conformance test ID (if applicable)
+
+<!-- Prefix with ATTEST, POLICY, AUDIT, or TRACE — e.g. ATTEST-007, POLICY-003 -->

cmcp_runtime-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/agentrust-io/cmcp/security/advisories/new
+    about: Report a security vulnerability via GitHub Security Advisories. Do not open a public issue.
+  - name: Design discussion
+    url: https://github.com/agentrust-io/cmcp/discussions
+    about: Start a design discussion or ask a broad question in GitHub Discussions before opening an issue.
+  - name: Trace spec proposal
+    url: https://github.com/agentrust-io/trace-spec/issues/new
+    about: Propose a change to the cMCP trace specification in the trace-spec repo.

cmcp_runtime-0.1.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,25 @@
+---
+name: Feature request
+about: Propose a new capability
+labels: enhancement
+---
+
+## Problem statement
+
+<!-- Describe the problem or gap this feature addresses. Be specific about who is affected and under what conditions. -->
+
+## Proposed solution
+
+<!-- Describe the capability you want added. Include enough detail for an implementer to scope the work. -->
+
+## Alternatives considered
+
+<!-- List other approaches you evaluated and why you ruled them out. -->
+
+## Security/TEE impact
+
+<!-- Required. Describe any impact on the TEE boundary, attestation flow, secret handling, or threat model. Write "None" if not applicable. -->
+
+## Spec alignment
+
+<!-- Does this require a change to the trace spec? If yes, describe which fields or events are affected and link to the relevant spec section. If no, write "No trace-spec change required." -->

cmcp_runtime-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## What
+
+<!-- Brief description of the change. One to three sentences. -->
+
+## Why
+
+<!-- Motivation and context. Link the issue this closes, e.g. Closes #123. -->
+
+## Security impact
+
+<!-- Required. If this change touches TEE boundaries, message signing, audit chain integrity,
+     capability tokens, or trust-score inputs, describe the impact. Otherwise write "None". -->
+
+## Test plan
+
+- [ ] `pytest` passes
+- [ ] `ruff check` passes
+- [ ] `mypy` passes
+- [ ] Manual test performed (describe steps below if applicable)
+
+<!-- Manual test steps (delete if not applicable): -->
+
+## DCO sign-off
+
+- [ ] I certify that I wrote or have the right to submit this contribution, and I agree to the
+      Developer Certificate of Origin (https://developercertificate.org).

cmcp_runtime-0.1.0/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5

cmcp_runtime-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Branch or SHA to run CI on"
+        required: false
+        default: ""
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+        os: [ubuntu-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+
+      - name: Security scan
+        run: pip install bandit pip-audit && bandit -r src/ -c pyproject.toml && pip-audit
+
+      - name: Lint
+        run: ruff check src/ tests/
+
+      - name: Type check
+        run: mypy src/cmcp_runtime/
+
+      - name: Test
+        run: pytest tests/unit/ -v --tb=short --cov=src --cov-report=xml
+
+      - name: Upload coverage report
+        uses: codecov/codecov-action@v6
+        with:
+          fail_ci_if_error: false
+
+  benchmark:
+    runs-on: ubuntu-latest
+    needs: test
+    if: github.ref == 'refs/heads/main'
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+
+      - name: Run benchmark (software-only, CI gate p99 < 5ms)
+        run: python -m cmcp_runtime.benchmarks --provider software-only --calls 10000 --out benchmarks/
+
+      - name: Upload benchmark results
+        uses: actions/upload-artifact@v7
+        with:
+          name: benchmark-results
+          path: benchmarks/
+          if-no-files-found: warn

cmcp_runtime-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,43 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '15 3 * * 0'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          queries: +security-extended
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        continue-on-error: true
+        with:
+          category: /language:python

cmcp_runtime-0.1.0/.github/workflows/docker.yml

@@ -0,0 +1,40 @@
+name: Docker publish
+
+on:
+  push:
+    tags:
+      - "v*"
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract tag name
+        id: tag
+        run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/agentrust-io/cmcp-gateway:${{ steps.tag.outputs.tag }}
+            ghcr.io/agentrust-io/cmcp-gateway:latest

cmcp_runtime-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+  id-token: write  # for OIDC trusted publishing
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build
+        run: pip install build
+
+      - name: Build distributions
+        run: python -m build
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

cmcp_runtime-0.1.0/.github/workflows/release-drafter.yml

@@ -0,0 +1,25 @@
+name: Release Drafter
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  draft-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --title "cmcp ${{ github.ref_name }}" \
+            --generate-notes \
+            --draft

cmcp_runtime-0.1.0/.github/workflows/sbom.yml

@@ -0,0 +1,30 @@
+name: SBOM
+
+on:
+  push:
+    branches: [main]
+  release:
+    types: [published]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          format: spdx-json
+          output-file: sbom.spdx.json
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom
+          path: sbom.spdx.json

cmcp_runtime-0.1.0/.github/workflows/scorecard.yml

@@ -0,0 +1,37 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '30 4 * * 1'
+  push:
+    branches:
+      - main
+
+permissions:
+  security-events: write
+  id-token: write
+  contents: read
+  actions: read
+
+jobs:
+  scorecard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@v2
+        with:
+          results_file: scorecard-results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: scorecard-results.sarif

cmcp_runtime-0.1.0/.gitignore

@@ -0,0 +1,18 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.venv/
+venv/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+*.egg
+MANIFEST
+.eggs/
+htmlcov/
+.coverage
+.coverage.*
+coverage.xml
+*.cover

cmcp_runtime-0.1.0/ADOPTERS.md

@@ -0,0 +1,7 @@
+# Adopters
+
+Organizations using cMCP in production or evaluation. Open a PR to add your organization.
+
+| Organization | Use Case | Since |
+|---|---|---|
+| Your org here | - | - |

cmcp_runtime-0.1.0/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-06-23
+
+### Added
+
+- Initial TEE gateway with provider support for TPM, SEV-SNP, TDX, and Opaque
+- Cedar policy enforcement for request authorization at the gateway layer
+- TRACE Claim generation using the `GatewayClaim` envelope from `agentrust-trace`
+- `cmcp-verify` standalone verifier for validating TRACE Claims offline
+- Audit chain with Ed25519 signing for tamper-evident log integrity
+
+[Unreleased]: https://github.com/agentrust-io/cmcp/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/agentrust-io/cmcp/releases/tag/v0.1.0

cmcp_runtime-0.1.0/CHARTER.md

@@ -0,0 +1,80 @@
+# Technical Charter — cMCP
+
+**Proposed hosting**: Agentic AI Foundation (AAIF).  
+**Status**: Pre-acceptance draft — effective upon host organization acceptance.
+
+> **Note for external contributors:** This charter is a working draft and has not yet been accepted by a host organization. Governance terms, IP policy, and trademark ownership described here are proposed, not final. Do not assume binding foundation commitments until formal acceptance.
+
+**Version**: 0.1 (aligned with gateway v0.1)
+
+---
+
+## 1. Mission
+
+The cMCP project develops and maintains an open implementation of the Confidential MCP (Model Context Protocol) gateway — hardware-attested policy enforcement for AI agent tool calls. The mission is to make tool-call authorization cryptographically verifiable by any party, without trusting the operator, without requiring closed infrastructure, and without vendor lock-in to any silicon vendor, cloud provider, or AI platform.
+
+## 2. Scope
+
+The project includes:
+
+- **cMCP Gateway** — the reference open-source implementation of the confidential gateway, including the gRPC/HTTP proxy, policy engine, and hardware attestation bridge.
+- **Hardware Provider API** — the normalized interface (`BaseProvider`) for integrating TEE platforms (TPM, AMD SEV-SNP, Intel TDX, and others).
+- **Python SDK** — the `cmcp-gateway` package and client libraries for policy authoring and runtime integration.
+- **TRACE integration** — built-in emission of TRACE Trust Records for every attested tool call (see [agentrust-io/trace-spec](https://github.com/agentrust-io/trace-spec)).
+- **Agent Manifest binding** — verification of agent identity via Agent Manifest at tool-call time (see [agentrust-io/agent-manifest](https://github.com/agentrust-io/agent-manifest)).
+- **Integration examples** — working examples across financial services, healthcare, and multi-tenant SaaS deployment patterns.
+
+Out of scope: AI model governance beyond tool-call enforcement, hardware TEE platform SDKs, network-level policy outside the MCP protocol boundary, and MCP server implementations themselves.
+
+## 3. Technical Steering Committee
+
+Upon host organization acceptance, governance transitions from the current Project Lead model to a Technical Steering Committee (TSC).
+
+**Composition**: 3–7 members. No single organization may hold more than 40% of TSC seats. The founding Project Lead (Imran Siddique, Opaque Systems) holds one founding seat for the v1.0 release cycle.
+
+**Election**: TSC members are elected annually by active contributors (at least one merged pull request in the preceding 12 months). Each contributor has one vote.
+
+**Quorum**: Two-thirds of TSC members must participate for a vote to be valid.
+
+**Decisions**:
+- Patch releases and editorial changes: simple TSC majority
+- Minor releases (new hardware providers, new policy primitives): two-thirds TSC majority + 7-day public comment
+- Breaking API changes (gateway protocol, provider API): two-thirds TSC majority + 30-day public comment + explicit migration guide
+
+**Meetings**: Monthly public TSC meeting. Notes published within 5 business days.
+
+## 4. Intellectual Property Policy
+
+All contributions must be made under the terms of [LICENSE](LICENSE). Contributors must sign commits with the Developer Certificate of Origin (DCO). No contribution may incorporate material covered by a patent the contributor is unwilling to license royalty-free to conforming implementations.
+
+Code and schemas are licensed under Apache 2.0 with Patent Promise (see LICENSE).
+
+## 5. Trademark Policy
+
+"cMCP" and "cMCP-compatible" as project and conformance marks are currently held by Opaque Systems, Inc. Upon host organization acceptance, trademark ownership transfers to AAIF under their standard trademark policy.
+
+Use of "cMCP-compatible" to describe a gateway deployment requires that the implementation satisfies the hardware attestation and policy enforcement requirements defined in the project documentation for the version being claimed.
+
+## 6. Relationship to other projects
+
+cMCP builds on and does not replace:
+
+- **MCP (Model Context Protocol, Anthropic)** — the underlying tool-call protocol that cMCP extends with attestation
+- **TRACE** ([agentrust-io/trace-spec](https://github.com/agentrust-io/trace-spec)) — governance record emitted per attested tool call
+- **Agent Manifest** ([agentrust-io/agent-manifest](https://github.com/agentrust-io/agent-manifest)) — agent identity bound at tool-call time
+- **SPIFFE / SPIRE** — workload identity for gateway and agent services
+- **RATS / EAT (RFC 9711)** — attestation evidence format
+- **OPA / Cedar** — policy engine integration surface
+
+## 7. Transition timeline
+
+| Milestone | Target |
+|---|---|
+| v0.1 developer preview — CC Summit announcement | June 2026 |
+| Hardware provider API stabilization, TRACE v0.2 integration | Q3 2026 |
+| AAIF project proposal submission | Q3 2026 |
+| v1.0 stable release under TSC governance | 2027 |
+
+## 8. Amendments
+
+Amendments to this charter require a two-thirds TSC majority and a 30-day public comment period. Before host organization acceptance, amendments require Project Lead approval and 14-day notice to contributors.

cmcp_runtime-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,17 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We pledge to make participation in our community a harassment-free experience for everyone.
+
+## Our Standards
+
+Positive behavior: welcoming and inclusive language, respecting differing viewpoints, gracefully accepting constructive criticism, focusing on what is best for the community.
+
+Unacceptable behavior: sexualized language or imagery, trolling, insulting comments, personal or political attacks, public or private harassment, publishing others' private information without permission.
+
+## Enforcement
+
+Report instances of abusive behavior by opening a GitHub issue labeled `code of conduct`, or by posting in [GitHub Discussions](https://github.com/orgs/agentrust-io/discussions). Security vulnerabilities belong in SECURITY.md, not here.
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

cmcp_runtime-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,85 @@
+# Contributing to cMCP
+
+Thank you for contributing. This document covers everything you need to get started.
+
+## Before you start
+
+cMCP is a hardware-attested policy gateway. Changes to the TEE boundary, signing path, audit chain, or TRACE Claim generation require extra care — these are security-critical components. When in doubt, open an issue first.
+
+## Developer certificate of origin
+
+All commits must include a `Signed-off-by` line. This is a lightweight way to certify you wrote the code or have the right to contribute it. No CLA required.
+
+```
+git commit -s -m "feat: your change"
+```
+
+The sign-off certifies the [Developer Certificate of Origin v1.1](https://developercertificate.org/).
+
+## Development setup
+
+Requires Python 3.11+.
+
+```bash
+git clone https://github.com/agentrust-io/cmcp
+cd cmcp
+pip install -e ".[dev]"
+```
+
+## Running checks locally
+
+```bash
+ruff check src/ tests/        # lint
+mypy src/cmcp_gateway/        # type check
+bandit -r src/ -c pyproject.toml  # security scan
+pytest tests/unit/ -v          # unit tests
+```
+
+All four must pass before a PR is mergeable.
+
+## Commit format
+
+Follow [Conventional Commits](https://www.conventionalcommits.org/):
+
+```
+feat: add sev-snp provider
+fix: correct nonce encoding in RuntimeInfo
+docs: clarify TRACE profile envelope structure
+test: add coverage for stale attestation path
+refactor: extract _build_policy helper
+```
+
+Keep commits small and focused. One logical change per commit. Do not bundle unrelated fixes.
+
+## Pull request process
+
+1. Branch from `main`: `git checkout -b feat/your-change`
+2. Write tests for new behaviour — the test suite must pass
+3. Run all four checks locally (see above)
+4. Open a PR against `main` with the template filled in
+5. At least one maintainer must approve before merge
+6. Squash if the commit history is noisy; preserve meaningful commits
+
+## Security-critical components
+
+Changes to these paths require two maintainer approvals and a comment explaining the security impact:
+
+- `src/cmcp_gateway/audit/` — signing, audit chain, TRACE Claim generation
+- `src/cmcp_gateway/tee/` — TEE provider integration
+- `src/cmcp_gateway/policy/` — Cedar policy evaluation
+
+## Reporting security vulnerabilities
+
+Do **not** open a public issue. Use [GitHub Security Advisories](https://github.com/agentrust-io/cmcp/security/advisories/new) for private disclosure. See [SECURITY.md](SECURITY.md).
+
+## Code conventions
+
+- Python 3.11+ syntax throughout (`X | Y`, `match`, etc.)
+- `ruff` enforces style; do not add `# noqa` without a comment explaining why
+- `mypy --strict` on `src/cmcp_gateway/`; new public functions need type annotations
+- No comments that describe *what* the code does — only *why* when non-obvious
+- Tests live in `tests/unit/` and follow the existing `test_<module>.py` naming
+
+## Questions
+
+Open a [GitHub Discussion](https://github.com/agentrust-io/cmcp/discussions) for design questions or proposals before writing code.