mcp-glp-audit-proxy 0.1.0__tar.gz

mcp_glp_audit_proxy-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Antonio Castellon / Castellon.CH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mcp_glp_audit_proxy-0.1.0/PKG-INFO

@@ -0,0 +1,201 @@
+Metadata-Version: 2.4
+Name: mcp-glp-audit-proxy
+Version: 0.1.0
+Summary: Local MCP proxy that writes a tamper-evident audit trail. Designed to support GLP traceability.
+Author-email: Antonio Castellon <antonio@castellon.ch>
+License: MIT
+Project-URL: Homepage, https://github.com/antonio-castellon/mcp-glp-audit-proxy
+Project-URL: Issues, https://github.com/antonio-castellon/mcp-glp-audit-proxy/issues
+Project-URL: Documentation, https://github.com/antonio-castellon/mcp-glp-audit-proxy/blob/main/docs/STANDARDS.md
+Keywords: mcp,glp,audit,proxy,part-11,alcoa
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: mcp<3,>=2.2.0
+Requires-Dist: rfc8785==0.1.4
+Provides-Extra: dev
+Requires-Dist: pytest>=8.3; extra == "dev"
+Requires-Dist: jsonschema>=4.21; extra == "dev"
+Requires-Dist: hypothesis>=6.110; extra == "dev"
+Requires-Dist: pytest-cov>=5.0; extra == "dev"
+Requires-Dist: PyYAML>=6.0; extra == "dev"
+Requires-Dist: pip-audit>=2.7; extra == "dev"
+Requires-Dist: bandit>=1.7; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: defusedxml>=0.7; extra == "dev"
+Dynamic: license-file
+
+mcp-name: io.github.antonio-castellon/mcp-glp-audit-proxy
+
+# mcp-glp-audit-proxy
+
+Local MCP proxy that sits between an MCP host and your MCP servers and writes a tamper-evident audit trail. Community edition, v0.1.0.
+
+It is designed to support GLP, ALCOA+, 21 CFR Part 11 and EU GMP Annex 11 traceability. Data stays on the customer's infrastructure. This package is the open core. Signed checkpoints, WORM storage, Part 11 electronic signatures, PDF/CSV reports, the IQ/OQ pack and SSO/OAuth are Pro features and are not in this repository.
+
+```
+host (Claude, Cursor, Grok, self-hosted LLM)
+        |  stdio JSON-RPC
+        v
+mcp-glp-audit-proxy
+  policy (allow / deny, reason, human approval)
+  audit  (append-only JSONL, RFC 8785, SHA-256 chain)
+        |  stdio or HTTPS (TLS 1.3)
+        v
+upstream MCP servers (Excel, ELN, LIMS, databases, instruments)
+```
+
+## Install
+
+Requires Python 3.11 or newer.
+
+```bash
+pip install mcp-glp-audit-proxy
+```
+
+From a checkout:
+
+```bash
+pip install -e ".[dev]"
+```
+
+The `mcp` dependency is pinned to `>=2.2.0,<3`. That floor is outside GHSA-84m7-p3x7-pcfv (affected ranges are `mcp >=1.8.0,<1.30.0` and `>=2.0.0,<2.2.0`). The process refuses to start on an older SDK.
+
+## Run
+
+```bash
+export GLP_PRINCIPAL_ID=operator-1
+export GLP_PRINCIPAL_NAME="Ada Analyst"
+export GLP_PRINCIPAL_ROLE=operator
+mcp-glp-audit-proxy --config config.json
+```
+
+Stdio identity comes from the environment. There is no HTTP listener in 0.1.0. A Cursor snippet is in `mcp.json`. A full config is in `config.example.json`.
+
+Verify a chain and write a searchable JSON export (the export is skipped when the chain does not verify):
+
+```bash
+mcp-glp-audit-proxy-verify data/audit.jsonl --json-export exports/audit.json
+mcp-glp-audit-proxy-verify data/audit.jsonl --tool excel__write_cell --status ok
+mcp-glp-audit-proxy-verify data/audit.jsonl --print-head
+```
+
+`--print-head` prints `seq` and `entry_hash`. Copy that line into a ticket, an email or a LIMS record. The sidecar `data/audit.jsonl.head` makes a cut of whole trailing lines fail verification. Someone who can edit both the log and the sidecar can move them together; the external copy is the control. Signed checkpoints and WORM storage are Pro.
+
+## What is recorded
+
+Every mediated call, including denials and failures, is one JSON object on an append-only JSONL file. Each line is RFC 8785 canonical JSON. `entry_hash` is the SHA-256 of that object with `entry_hash` removed. `prev_hash` is the previous entry (64 zero digits for the first). `hash_algo` and `canonicalization` are stored on the entry. The open schema is `schema/audit-record.schema.json`. Cross-language vectors are in `schema/jcs-test-vectors.json`.
+
+Fields include who (`principal` id, name, role), which tool, inputs, outputs, UTC timestamp plus `utc_offset`, protocol version, optional session id, record class (`gxp_data`, `access`, `technical`, `config`), reason for writes, and the previous hash.
+
+The GxP trail is that file. The Python `logging` logger `mcp_glp_audit_proxy.technical` writes method, status and record class to stderr. It is not the record. Arguments are not written there.
+
+## Policy
+
+- Allow list and deny list use shell-style globs on the exposed tool name (`excel__write_cell`). Deny wins. An empty allow list denies every upstream tool.
+- Roles are `operator`, `approver`, `qa` and `admin`. Only `operator` may call upstream tools. `qa` is read-only on the trail (`glp_verify_chain`, `glp_search_audit`, `glp_export_audit`). `approver` may record an approval and read the trail. `admin` may change policy and read the trail, and cannot call upstream tools.
+- Auditing cannot be switched off. `glp_update_policy` with `audit_enabled: false` is denied and logged.
+- Write tools (names matching `write_tools`) require a reason by default. The reason is `_meta["io.github.antonio-castellon/reason"]` or the argument `_glp_reason` (stripped before the upstream call).
+- Optional human approval holds the write until a different person in the `approver` role records meaning `approved`. `reviewed` is stored and does not authorise the write. `rejected` rejects it. An approval is single-use, bound to the SHA-256 of the canonical `{tool, arguments}`, and expires (default 3600 seconds). The record label is `approval`. It is not an electronic signature.
+- Fail closed is the default. The store is checked before a call is forwarded. If the append after a successful upstream call fails, the upstream payload is not returned to the host. Denied and failed calls are still logged. If the upstream may already have applied a write, follow `docs/RECONCILIATION_SOP.md`.
+
+## Protocol
+
+The proxy speaks both handshake-era MCP revisions (`2024-11-05`, `2025-03-26`, `2025-06-18`, `2025-11-25`, with `initialize`) and spec `2026-07-28` (`server/discover`, no initialize, no session). A session id is recorded only when that revision has one. Upstream protocol `auto` tries `server/discover` and falls back to `initialize` at `2025-11-25`.
+
+Exposed tool names are `server__tool`. Resource URIs are prefixed `server:`. Credential-bearing `_meta` keys are stripped, their names are logged, and their values are neither stored nor forwarded. Upstream stdio receives a safe environment allow-list from the MCP SDK, plus the env block in the config.
+
+## Regulatory coverage
+
+mcp-glp-audit-proxy is designed to support the audit-trail requirements below. Meeting them still depends on your validated use, SOPs and reviews. The clause-by-clause matrix is `docs/COVERAGE.md`. The norms and the verification log are `docs/STANDARDS.md`.
+
+| Framework | What the proxy helps with | Edition |
+|---|---|---|
+| OECD GLP No. 17 (3.4) / Swiss GLPV Annex 2 | Always-on, append-only audit trail; who/what/when/why; admin-only settings; QA read-only role; 10-year Swiss retention profile | Community core; WORM retention and PDF reports in Pro |
+| FDA 21 CFR Part 11 | Computer-generated, time-stamped, hash-chained audit trail (11.10(e)); tamper detection; complete copies; authority checks. Part 11 approval e-signatures (11.50, 11.70, 11.200) are Pro only: the Community `approval` is not an electronic signature | Community core; e-signatures (Pro only), reports, signing, SSO in Pro |
+| EU GMP Annex 11 (2011; 2025 draft) | Audit trail of changes with reason; role, time zone; locked audit trail; searchable complete export; access log | Community core; review tooling and inactivity logout in Pro |
+| MHRA / PIC/S PI 041-1 / WHO TRS 1033 | ALCOA+ data integrity, segregation of duties, metadata with each record, true-copy exports | Community core; signed manifests and validation pack in Pro |
+| ISPE GAMP 5 / FDA CSA | Supplier documentation, proposed Cat. 4 configured components, machine-readable test evidence | Pro (validation pack) |
+| EU AI Act Art. 12, 19, 26(6) | Automatic event logging, minimum 6-month retention | Community |
+| Crypto and time (RFC 8785, SHA-256, Ed25519/ECDSA, RFC 3161, eIDAS/ZertES, TLS 1.3) | Canonical hashing and encrypted transport | Hash chain and TLS in Community; signing and timestamps in Pro |
+| MCP authorization, OWASP LLM/Agentic | No token passthrough, tool allowlist/denylist, approval before write tools, OAuth 2.1 | Allowlist and no-passthrough in Community; OAuth/SSO in Pro |
+| ISO/IEC 42001, NIST AI RMF | Event-log evidence for AI governance and monitoring | Community (supporting evidence only) |
+
+Default retention is the Swiss GLP profile: 10 years after study completion, with a floor of 6 months. The `minimum` profile may use a shorter year count but cannot go under 6 months. A legal-hold flag refuses disposal. The JSONL backend has no delete. Retention-period WORM enforcement is a Pro backend.
+
+## Community and Pro
+
+This repository is the Community edition. Pro is available as a licensed / paid service - contact [antonio@castellon.ch](mailto:antonio@castellon.ch).
+
+Pro adds SQL and S3 WORM backends, Ed25519 and ECDSA signing, RFC 3161 timestamps, Part 11 e-signatures, PDF and CSV auditor reports, an IQ/OQ validation pack, and SSO. It also includes the GLP Lab Data Pack for [mcp-advanced-excel](https://github.com/antonio-castellon/mcp-advanced-excel), unlocked by the same offline licence key. The free mcp-advanced-excel server reads and writes lab spreadsheets. The Data Pack adds what a GLP lab needs on top: provenance hashes that tie every result back to its source file, instrument templates for common lab exports, advanced LOD/LOQ calculations and molar unit conversions, batch processing of many files in one run, and Ed25519 signed output.
+
+| Capability | Community (this repo) | Pro (licensed service) |
+|---|---|---|
+| Proxy core, both protocol eras | yes | plugs in, does not fork |
+| Append-only JSONL hash chain | yes | |
+| PostgreSQL / MSSQL append-only | | yes |
+| S3 Object Lock | | yes |
+| Verify CLI and searchable JSON export | yes | |
+| Plain-text verify listing | yes | |
+| PDF / CSV auditor reports | | yes |
+| Audit-trail review tooling (flags, reviewer sign-off) | search, filter, export | yes |
+| DE / FR / EN report templates | | later |
+| Old/new value capture for write tools | planned | change highlighting in reports |
+| Tool allowlist / denylist | yes | |
+| Local roles (operator, approver, qa, admin) | yes | |
+| Human approval before writes | yes (label: approval) | |
+| Part 11 electronic signatures | | yes |
+| Ed25519 / ECDSA signed checkpoints | unsigned checkpoints only | yes |
+| RFC 3161 timestamps | | yes |
+| IQ/OQ validation pack | | yes |
+| SSO / OAuth | | yes |
+| Syslog (RFC 5424) / SIEM export | | yes |
+| Key management (KMS/HSM), field-level encryption and redaction | | yes |
+| FIPS 140-3 mode | | on request |
+| Merkle log with inclusion / consistency proofs | | later |
+| OpenTelemetry spans (technical telemetry, not the audit record) | planned | |
+| GLP Lab Data Pack for mcp-advanced-excel (provenance hashes, instrument templates, advanced LOD/LOQ and molar units, batch processing, Ed25519 signed output) | | yes |
+| TLS 1.3 to remote upstreams, no token passthrough | yes | |
+| Offline licence file, no phone-home | yes | reads the same file |
+
+Plugin entry points, the `AuditStore` / `Signer` / `Reporter` contracts, and the licence file are described in `docs/PLUGINS.md`.
+
+## Local tools
+
+| Tool | Who | What |
+|---|---|---|
+| `glp_verify_chain` | qa, approver, admin | Check chain integrity. Still returns the report if the chain is broken. |
+| `glp_search_audit` | qa, approver, admin | Filter entries. The audit of the search stores the filter and the count, not a second copy of every row. |
+| `glp_export_audit` | qa, approver, admin | JSON electronic export with a hash manifest. A filtered export is marked `complete: false`. A broken chain is not exported. |
+| `glp_approve` | approver | Record meaning `approved`, `reviewed` or `rejected`. |
+| `glp_update_policy` | admin | Append a config event. Policy is replayed from the log. |
+
+## Safety
+
+Read `SAFETY.md`. Short version: fail closed, no token passthrough, secrets are stripped from `_meta`, stdio children do not inherit the parent environment, an approval is not an electronic signature, and the JSONL file is tamper-evident, not a WORM store.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+python -m pytest -q
+```
+
+CI runs the same suite on Python 3.11, 3.12 and 3.13 (`.github/workflows/ci.yml`).
+
+## MCP registry
+
+`server.json` names this server `io.github.antonio-castellon/mcp-glp-audit-proxy` for the official MCP Registry. The marker on the first line of this file is the registry check.
+
+## Licence
+
+MIT. Copyright (c) 2026 Antonio Castellon / Castellon.CH. See `LICENSE`.

mcp_glp_audit_proxy-0.1.0/README.md

@@ -0,0 +1,165 @@
+mcp-name: io.github.antonio-castellon/mcp-glp-audit-proxy
+
+# mcp-glp-audit-proxy
+
+Local MCP proxy that sits between an MCP host and your MCP servers and writes a tamper-evident audit trail. Community edition, v0.1.0.
+
+It is designed to support GLP, ALCOA+, 21 CFR Part 11 and EU GMP Annex 11 traceability. Data stays on the customer's infrastructure. This package is the open core. Signed checkpoints, WORM storage, Part 11 electronic signatures, PDF/CSV reports, the IQ/OQ pack and SSO/OAuth are Pro features and are not in this repository.
+
+```
+host (Claude, Cursor, Grok, self-hosted LLM)
+        |  stdio JSON-RPC
+        v
+mcp-glp-audit-proxy
+  policy (allow / deny, reason, human approval)
+  audit  (append-only JSONL, RFC 8785, SHA-256 chain)
+        |  stdio or HTTPS (TLS 1.3)
+        v
+upstream MCP servers (Excel, ELN, LIMS, databases, instruments)
+```
+
+## Install
+
+Requires Python 3.11 or newer.
+
+```bash
+pip install mcp-glp-audit-proxy
+```
+
+From a checkout:
+
+```bash
+pip install -e ".[dev]"
+```
+
+The `mcp` dependency is pinned to `>=2.2.0,<3`. That floor is outside GHSA-84m7-p3x7-pcfv (affected ranges are `mcp >=1.8.0,<1.30.0` and `>=2.0.0,<2.2.0`). The process refuses to start on an older SDK.
+
+## Run
+
+```bash
+export GLP_PRINCIPAL_ID=operator-1
+export GLP_PRINCIPAL_NAME="Ada Analyst"
+export GLP_PRINCIPAL_ROLE=operator
+mcp-glp-audit-proxy --config config.json
+```
+
+Stdio identity comes from the environment. There is no HTTP listener in 0.1.0. A Cursor snippet is in `mcp.json`. A full config is in `config.example.json`.
+
+Verify a chain and write a searchable JSON export (the export is skipped when the chain does not verify):
+
+```bash
+mcp-glp-audit-proxy-verify data/audit.jsonl --json-export exports/audit.json
+mcp-glp-audit-proxy-verify data/audit.jsonl --tool excel__write_cell --status ok
+mcp-glp-audit-proxy-verify data/audit.jsonl --print-head
+```
+
+`--print-head` prints `seq` and `entry_hash`. Copy that line into a ticket, an email or a LIMS record. The sidecar `data/audit.jsonl.head` makes a cut of whole trailing lines fail verification. Someone who can edit both the log and the sidecar can move them together; the external copy is the control. Signed checkpoints and WORM storage are Pro.
+
+## What is recorded
+
+Every mediated call, including denials and failures, is one JSON object on an append-only JSONL file. Each line is RFC 8785 canonical JSON. `entry_hash` is the SHA-256 of that object with `entry_hash` removed. `prev_hash` is the previous entry (64 zero digits for the first). `hash_algo` and `canonicalization` are stored on the entry. The open schema is `schema/audit-record.schema.json`. Cross-language vectors are in `schema/jcs-test-vectors.json`.
+
+Fields include who (`principal` id, name, role), which tool, inputs, outputs, UTC timestamp plus `utc_offset`, protocol version, optional session id, record class (`gxp_data`, `access`, `technical`, `config`), reason for writes, and the previous hash.
+
+The GxP trail is that file. The Python `logging` logger `mcp_glp_audit_proxy.technical` writes method, status and record class to stderr. It is not the record. Arguments are not written there.
+
+## Policy
+
+- Allow list and deny list use shell-style globs on the exposed tool name (`excel__write_cell`). Deny wins. An empty allow list denies every upstream tool.
+- Roles are `operator`, `approver`, `qa` and `admin`. Only `operator` may call upstream tools. `qa` is read-only on the trail (`glp_verify_chain`, `glp_search_audit`, `glp_export_audit`). `approver` may record an approval and read the trail. `admin` may change policy and read the trail, and cannot call upstream tools.
+- Auditing cannot be switched off. `glp_update_policy` with `audit_enabled: false` is denied and logged.
+- Write tools (names matching `write_tools`) require a reason by default. The reason is `_meta["io.github.antonio-castellon/reason"]` or the argument `_glp_reason` (stripped before the upstream call).
+- Optional human approval holds the write until a different person in the `approver` role records meaning `approved`. `reviewed` is stored and does not authorise the write. `rejected` rejects it. An approval is single-use, bound to the SHA-256 of the canonical `{tool, arguments}`, and expires (default 3600 seconds). The record label is `approval`. It is not an electronic signature.
+- Fail closed is the default. The store is checked before a call is forwarded. If the append after a successful upstream call fails, the upstream payload is not returned to the host. Denied and failed calls are still logged. If the upstream may already have applied a write, follow `docs/RECONCILIATION_SOP.md`.
+
+## Protocol
+
+The proxy speaks both handshake-era MCP revisions (`2024-11-05`, `2025-03-26`, `2025-06-18`, `2025-11-25`, with `initialize`) and spec `2026-07-28` (`server/discover`, no initialize, no session). A session id is recorded only when that revision has one. Upstream protocol `auto` tries `server/discover` and falls back to `initialize` at `2025-11-25`.
+
+Exposed tool names are `server__tool`. Resource URIs are prefixed `server:`. Credential-bearing `_meta` keys are stripped, their names are logged, and their values are neither stored nor forwarded. Upstream stdio receives a safe environment allow-list from the MCP SDK, plus the env block in the config.
+
+## Regulatory coverage
+
+mcp-glp-audit-proxy is designed to support the audit-trail requirements below. Meeting them still depends on your validated use, SOPs and reviews. The clause-by-clause matrix is `docs/COVERAGE.md`. The norms and the verification log are `docs/STANDARDS.md`.
+
+| Framework | What the proxy helps with | Edition |
+|---|---|---|
+| OECD GLP No. 17 (3.4) / Swiss GLPV Annex 2 | Always-on, append-only audit trail; who/what/when/why; admin-only settings; QA read-only role; 10-year Swiss retention profile | Community core; WORM retention and PDF reports in Pro |
+| FDA 21 CFR Part 11 | Computer-generated, time-stamped, hash-chained audit trail (11.10(e)); tamper detection; complete copies; authority checks. Part 11 approval e-signatures (11.50, 11.70, 11.200) are Pro only: the Community `approval` is not an electronic signature | Community core; e-signatures (Pro only), reports, signing, SSO in Pro |
+| EU GMP Annex 11 (2011; 2025 draft) | Audit trail of changes with reason; role, time zone; locked audit trail; searchable complete export; access log | Community core; review tooling and inactivity logout in Pro |
+| MHRA / PIC/S PI 041-1 / WHO TRS 1033 | ALCOA+ data integrity, segregation of duties, metadata with each record, true-copy exports | Community core; signed manifests and validation pack in Pro |
+| ISPE GAMP 5 / FDA CSA | Supplier documentation, proposed Cat. 4 configured components, machine-readable test evidence | Pro (validation pack) |
+| EU AI Act Art. 12, 19, 26(6) | Automatic event logging, minimum 6-month retention | Community |
+| Crypto and time (RFC 8785, SHA-256, Ed25519/ECDSA, RFC 3161, eIDAS/ZertES, TLS 1.3) | Canonical hashing and encrypted transport | Hash chain and TLS in Community; signing and timestamps in Pro |
+| MCP authorization, OWASP LLM/Agentic | No token passthrough, tool allowlist/denylist, approval before write tools, OAuth 2.1 | Allowlist and no-passthrough in Community; OAuth/SSO in Pro |
+| ISO/IEC 42001, NIST AI RMF | Event-log evidence for AI governance and monitoring | Community (supporting evidence only) |
+
+Default retention is the Swiss GLP profile: 10 years after study completion, with a floor of 6 months. The `minimum` profile may use a shorter year count but cannot go under 6 months. A legal-hold flag refuses disposal. The JSONL backend has no delete. Retention-period WORM enforcement is a Pro backend.
+
+## Community and Pro
+
+This repository is the Community edition. Pro is available as a licensed / paid service - contact [antonio@castellon.ch](mailto:antonio@castellon.ch).
+
+Pro adds SQL and S3 WORM backends, Ed25519 and ECDSA signing, RFC 3161 timestamps, Part 11 e-signatures, PDF and CSV auditor reports, an IQ/OQ validation pack, and SSO. It also includes the GLP Lab Data Pack for [mcp-advanced-excel](https://github.com/antonio-castellon/mcp-advanced-excel), unlocked by the same offline licence key. The free mcp-advanced-excel server reads and writes lab spreadsheets. The Data Pack adds what a GLP lab needs on top: provenance hashes that tie every result back to its source file, instrument templates for common lab exports, advanced LOD/LOQ calculations and molar unit conversions, batch processing of many files in one run, and Ed25519 signed output.
+
+| Capability | Community (this repo) | Pro (licensed service) |
+|---|---|---|
+| Proxy core, both protocol eras | yes | plugs in, does not fork |
+| Append-only JSONL hash chain | yes | |
+| PostgreSQL / MSSQL append-only | | yes |
+| S3 Object Lock | | yes |
+| Verify CLI and searchable JSON export | yes | |
+| Plain-text verify listing | yes | |
+| PDF / CSV auditor reports | | yes |
+| Audit-trail review tooling (flags, reviewer sign-off) | search, filter, export | yes |
+| DE / FR / EN report templates | | later |
+| Old/new value capture for write tools | planned | change highlighting in reports |
+| Tool allowlist / denylist | yes | |
+| Local roles (operator, approver, qa, admin) | yes | |
+| Human approval before writes | yes (label: approval) | |
+| Part 11 electronic signatures | | yes |
+| Ed25519 / ECDSA signed checkpoints | unsigned checkpoints only | yes |
+| RFC 3161 timestamps | | yes |
+| IQ/OQ validation pack | | yes |
+| SSO / OAuth | | yes |
+| Syslog (RFC 5424) / SIEM export | | yes |
+| Key management (KMS/HSM), field-level encryption and redaction | | yes |
+| FIPS 140-3 mode | | on request |
+| Merkle log with inclusion / consistency proofs | | later |
+| OpenTelemetry spans (technical telemetry, not the audit record) | planned | |
+| GLP Lab Data Pack for mcp-advanced-excel (provenance hashes, instrument templates, advanced LOD/LOQ and molar units, batch processing, Ed25519 signed output) | | yes |
+| TLS 1.3 to remote upstreams, no token passthrough | yes | |
+| Offline licence file, no phone-home | yes | reads the same file |
+
+Plugin entry points, the `AuditStore` / `Signer` / `Reporter` contracts, and the licence file are described in `docs/PLUGINS.md`.
+
+## Local tools
+
+| Tool | Who | What |
+|---|---|---|
+| `glp_verify_chain` | qa, approver, admin | Check chain integrity. Still returns the report if the chain is broken. |
+| `glp_search_audit` | qa, approver, admin | Filter entries. The audit of the search stores the filter and the count, not a second copy of every row. |
+| `glp_export_audit` | qa, approver, admin | JSON electronic export with a hash manifest. A filtered export is marked `complete: false`. A broken chain is not exported. |
+| `glp_approve` | approver | Record meaning `approved`, `reviewed` or `rejected`. |
+| `glp_update_policy` | admin | Append a config event. Policy is replayed from the log. |
+
+## Safety
+
+Read `SAFETY.md`. Short version: fail closed, no token passthrough, secrets are stripped from `_meta`, stdio children do not inherit the parent environment, an approval is not an electronic signature, and the JSONL file is tamper-evident, not a WORM store.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+python -m pytest -q
+```
+
+CI runs the same suite on Python 3.11, 3.12 and 3.13 (`.github/workflows/ci.yml`).
+
+## MCP registry
+
+`server.json` names this server `io.github.antonio-castellon/mcp-glp-audit-proxy` for the official MCP Registry. The marker on the first line of this file is the registry check.
+
+## Licence
+
+MIT. Copyright (c) 2026 Antonio Castellon / Castellon.CH. See `LICENSE`.

mcp_glp_audit_proxy-0.1.0/pyproject.toml

@@ -0,0 +1,82 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "mcp-glp-audit-proxy"
+version = "0.1.0"
+description = "Local MCP proxy that writes a tamper-evident audit trail. Designed to support GLP traceability."
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.11"
+authors = [
+  { name = "Antonio Castellon", email = "antonio@castellon.ch" },
+]
+keywords = ["mcp", "glp", "audit", "proxy", "part-11", "alcoa"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Security",
+]
+dependencies = [
+  # 2.2.0 is the first 2.x release outside GHSA-84m7-p3x7-pcfv
+  # (affected: mcp >=1.8.0,<1.30.0 and >=2.0.0,<2.2.0).
+  "mcp>=2.2.0,<3",
+  # Pinned: audit hashes must be reproducible. See schema/jcs-test-vectors.json.
+  "rfc8785==0.1.4",
+]
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=8.3",
+  "jsonschema>=4.21",
+  "hypothesis>=6.110",
+  "pytest-cov>=5.0",
+  "PyYAML>=6.0",
+  "pip-audit>=2.7",
+  "bandit>=1.7",
+  "ruff>=0.6",
+  "defusedxml>=0.7",
+]
+
+[project.scripts]
+mcp-glp-audit-proxy = "mcp_glp_audit_proxy.__main__:main"
+mcp-glp-audit-proxy-verify = "mcp_glp_audit_proxy.cli:main"
+mcp-glp-audit-proxy-oq = "mcp_glp_audit_proxy.verification.oq:main"
+
+[project.urls]
+Homepage = "https://github.com/antonio-castellon/mcp-glp-audit-proxy"
+Issues = "https://github.com/antonio-castellon/mcp-glp-audit-proxy/issues"
+Documentation = "https://github.com/antonio-castellon/mcp-glp-audit-proxy/blob/main/docs/STANDARDS.md"
+
+# The licensed Pro edition registers additional names in these
+# groups. This repo ships only the Community implementations.
+[project.entry-points."mcp_glp_audit_proxy.storage"]
+jsonl = "mcp_glp_audit_proxy.storage.jsonl:JsonlAuditStore"
+
+[project.entry-points."mcp_glp_audit_proxy.signers"]
+unsigned = "mcp_glp_audit_proxy.signers.unsigned:UnsignedSigner"
+
+[project.entry-points."mcp_glp_audit_proxy.reporters"]
+json = "mcp_glp_audit_proxy.reporters.json_export:JsonReporter"
+text = "mcp_glp_audit_proxy.reporters.text_export:TextReporter"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src", "tests"]
+
+[tool.coverage.run]
+source = ["mcp_glp_audit_proxy"]
+patch = ["subprocess"]
+
+[tool.coverage.report]
+show_missing = true

mcp_glp_audit_proxy-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

mcp_glp_audit_proxy-0.1.0/src/mcp_glp_audit_proxy/__init__.py

@@ -0,0 +1,10 @@
+"""Community edition of the GLP audit MCP proxy.
+
+This package is designed to support audit-trail traceability. It does not
+certify a customer's system. Pro features are a separately licensed
+edition and plug in through entry points.
+"""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"

mcp_glp_audit_proxy-0.1.0/src/mcp_glp_audit_proxy/__main__.py

@@ -0,0 +1,19 @@
+"""python -m mcp_glp_audit_proxy - start the stdio MCP proxy."""
+
+from __future__ import annotations
+
+
+def main() -> None:
+    import sys
+
+    if len(sys.argv) > 1 and sys.argv[1] == "oq-report":
+        from .verification.oq import main as report
+
+        raise SystemExit(report(sys.argv[2:]))
+    from .server import main as run
+
+    run()
+
+
+if __name__ == "__main__":
+    main()

mcp_glp_audit_proxy-0.1.0/src/mcp_glp_audit_proxy/anchor.py

@@ -0,0 +1,149 @@
+"""Sidecar head for the JSONL log.
+
+``<log>.head`` stores the latest ``seq`` and ``entry_hash`` after each fsynced
+line. It is written to a temp file in the same directory, fsynced, then
+renamed into place.
+
+A crash between the log fsync and this rename may leave the head one record
+behind. That lag is accepted when the extra record itself verifies. The next
+append, and startup, advance the head. Any other disagreement (missing head,
+shorter log, hash mismatch, lag of more than one) is a store error.
+
+Someone who can edit both files can move them together. A copy of the head
+kept outside this machine (ticket, email, LIMS) is the local control. Signed
+checkpoints and WORM storage are Pro.
+"""
+
+from __future__ import annotations
+
+import errno
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+from .canonical import canonicalize
+from .chain import VerifyReport, verify_file
+from .errors import AuditStoreError
+
+
+@dataclass
+class Head:
+    seq: int
+    entry_hash: str
+
+
+@dataclass
+class AnchorStatus:
+    ok: bool
+    errors: list[str]
+    lag: int
+
+
+def head_path(log: Path) -> Path:
+    return log.with_name(log.name + ".head")
+
+
+def read_head(log: Path) -> Head | None:
+    path = head_path(log)
+    if not path.exists():
+        return None
+    try:
+        raw = path.read_text(encoding="utf-8")
+        parsed = json.loads(raw)
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise AuditStoreError(f"audit head unreadable: {exc}") from exc
+    if not isinstance(parsed, dict):
+        raise AuditStoreError("audit head is not an object")
+    seq = parsed.get("seq")
+    entry_hash = parsed.get("entry_hash")
+    if isinstance(seq, bool) or not isinstance(seq, int) or seq < 1:
+        raise AuditStoreError("audit head seq is invalid")
+    if not isinstance(entry_hash, str) or len(entry_hash) != 64:
+        raise AuditStoreError("audit head entry_hash is invalid")
+    return Head(seq=seq, entry_hash=entry_hash)
+
+
+def write_head(log: Path, seq: int, entry_hash: str) -> None:
+    """Atomic replace. Raises OSError if the head cannot be made durable."""
+    target = head_path(log)
+    temporary = target.with_name(target.name + ".tmp")
+    payload = canonicalize({"entry_hash": entry_hash, "seq": seq}) + b"\n"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    try:
+        view = payload
+        while view:
+            written = os.write(fd, view)
+            if written <= 0:
+                raise OSError(errno.EIO, "short write on audit head")
+            view = view[written:]
+        os.fsync(fd)
+    except OSError:
+        try:
+            os.close(fd)
+        except OSError:
+            pass
+        try:
+            os.unlink(temporary)
+        except OSError:
+            pass
+        raise
+    os.close(fd)
+    os.replace(temporary, target)
+    directory = os.open(target.parent, os.O_RDONLY)
+    try:
+        os.fsync(directory)
+    finally:
+        os.close(directory)
+
+
+def assess(report: VerifyReport, head: Head | None) -> AnchorStatus:
+    """Compare a verified log with its sidecar. The log must already be intact."""
+    if not report.ok:
+        return AnchorStatus(False, list(report.errors), 0)
+    entries = report.entries
+    if not entries:
+        if head is None:
+            return AnchorStatus(True, [], 0)
+        return AnchorStatus(False, ["audit head present but log is empty"], 0)
+    if head is None:
+        return AnchorStatus(False, ["audit head missing for a non-empty log"], 0)
+    last = entries[-1]
+    if head.seq == last.get("seq") and head.entry_hash == last.get("entry_hash"):
+        return AnchorStatus(True, [], 0)
+    if len(entries) >= 2:
+        previous = entries[-2]
+        if head.seq == previous.get("seq") and head.entry_hash == previous.get("entry_hash"):
+            return AnchorStatus(True, [], 1)
+    return AnchorStatus(
+        False,
+        [f"audit head disagrees with log: head seq={head.seq} log seq={last.get('seq')}"],
+        0,
+    )
+
+
+def verify_anchored(path: Path) -> VerifyReport:
+    """Chain verify plus the sidecar. A one-record lag stays ok."""
+    report = verify_file(path)
+    if not report.ok:
+        return report
+    try:
+        head = read_head(path)
+    except AuditStoreError as exc:
+        return _failed(report, [str(exc)])
+    status = assess(report, head)
+    if not status.ok:
+        return _failed(report, status.errors)
+    report.anchor_lag = status.lag
+    return report
+
+
+def _failed(report: VerifyReport, errors: list[str]) -> VerifyReport:
+    return VerifyReport(
+        ok=False,
+        entries=report.entries,
+        errors=errors,
+        head_hash=report.head_hash,
+        anchor_lag=0,
+    )