travis234-websec-mcp 0.1.0__tar.gz

travis234_websec_mcp-0.1.0/PKG-INFO

@@ -0,0 +1,248 @@
+Metadata-Version: 2.4
+Name: travis234-websec-mcp
+Version: 0.1.0
+Summary: Independent bounded HTTP security workbench for MCP clients and Travis234.
+License-Expression: MIT
+Requires-Python: <3.14,>=3.13
+Description-Content-Type: text/markdown
+Requires-Dist: mcp<3,>=2.2
+Requires-Dist: pydantic<3,>=2.12
+Requires-Dist: httpx<1,>=0.27
+Requires-Dist: httpcore<2,>=1
+Requires-Dist: anyio<5,>=4
+Requires-Dist: ahocorasick-rs<2,>=1.0.3
+Requires-Dist: travis234-mcp-adapter<0.5,>=0.4
+
+# Travis234 Websec MCP
+
+An optional external HTTP workbench for Travis234 and standard stdio MCP clients.
+Python 3.13 and macOS or Linux are required. Travis core and its existing MCP
+adapter supply the host integration; this package owns requests, HTTP execution,
+sanitization and evidence. KHackBar is a workflow reference and is not a dependency.
+
+This milestone supports individual request experiments. Payload catalogs,
+generators, batch fuzzing, login/token extraction and browser capture remain
+future work. The package also includes imported assessment skills, built into
+Travis and exposed to other clients through MCP
+resources and prompts. These guides do not install external scanners. See the repository's
+[complete KHackBar feature mapping](../../docs/verification/2026-10-18-khackbar-feature-crosscheck.md).
+
+## Build, install and activate
+
+Run these commands from the Travis234 repository root:
+
+```sh
+uv sync --project packages/travis234-websec-mcp --locked --group source-test
+websec_dist_dir="$(mktemp -d "${TMPDIR:-/tmp}/websec-dist.XXXXXX")"
+uv build --wheel --out-dir "$websec_dist_dir" packages/travis234-mcp-adapter
+uv build --wheel --out-dir "$websec_dist_dir" packages/travis234-websec-mcp
+export PIP_FIND_LINKS="$websec_dist_dir"
+export UV_FIND_LINKS="$websec_dist_dir"
+websec_wheel_uri="$(packages/travis234-websec-mcp/.venv/bin/python -c 'from pathlib import Path; import sys; print(next(Path(sys.argv[1]).glob("travis234_websec_mcp-*.whl")).resolve().as_uri())' "$websec_dist_dir")"
+travis234 install "travis234-websec-mcp @ $websec_wheel_uri"
+travis234 --tools read,bash,websec
+```
+
+Installation registers the package-owned server and one `websec` facade through
+the shared adapter. Discovery and `status` do not send a testing request. Tool
+selection uses the existing `--tools` allowlist; there is no new Travis flag.
+
+For another MCP client, install the wheel and its dependencies into that client's
+Python 3.13 environment, then configure this stdio command:
+
+```sh
+travis234-websec-mcp mcp --transport stdio
+```
+
+The standalone server does not import the Travis extension. It uses the same
+configuration, request bounds and evidence format.
+
+## Imported assessment skills
+
+The source index is
+[htooayelwinict/awesome-ai-offensive-security](https://github.com/htooayelwinict/awesome-ai-offensive-security/tree/0e3180f4a0ffd5b6703943cf112d85017895a842).
+That repository contains links; the actual skills are imported from these
+linked MIT-licensed projects at fixed revisions:
+
+| Source | Included skills |
+| --- | --- |
+| [SnailSploit/Claude-Red](https://github.com/SnailSploit/Claude-Red/tree/a8de813edc9f66f60d44cfe42d47750e89d9930b) | `offensive-api-security`, `offensive-jwt`, `offensive-idor`, `offensive-ssrf`, `offensive-ssti`, `offensive-ai-security`, `offensive-reporting` |
+| [transilienceai/communitytools](https://github.com/transilienceai/communitytools/tree/95fdc128af4ca1ae16b3226f9430f1bad97b0656/skills/web-app-logic) | `web-app-logic`, including its reference and scenario files |
+
+All eight skills ship as read-only built-ins in Travis's Python and npm
+distributions, using its existing lazy loader, precedence and trust rules.
+Installing this optional package adds the Websec tools. When the user asks to
+use Websec MCP, its facade instructs the agent to try loading all eight
+SKILL.md guides before its first Websec call, like Evidence MCP's research
+skill. This guidance also accompanies authorized delegation. User overrides
+and `--no-skills` remain effective; unavailable guides are reported. Additional
+reference files load only as needed. The package does not register duplicate
+skill directories. A standalone installation exposes the same documents
+through MCP resources and prompts. No skill is copied into the user's Codex installation.
+
+Each imported skill has a `TRAVIS234.md` guide describing the supported tools
+and request workflow. Local changes add compatible YAML metadata and a link to
+that guide. Upstream methodology and references are retained. Each skill keeps
+its upstream license; [SOURCES.json](travis234_websec_mcp/resources/skills/SOURCES.json)
+records repository revisions, source paths, original hashes and shipped hashes.
+Imports are bundled: startup, discovery and reads do not fetch updates or run
+upstream code.
+
+For a standard MCP client:
+
+- `resources/list` enumerates skill documents in pages of eight. Pass its
+  `nextCursor` back as `cursor` until it is absent.
+- Read `websec://skills/index` for the skill index, then a skill's
+  `websec://skills/<name>/TRAVIS234.md` and `websec://skills/<name>/SKILL.md`.
+- A document larger than 4 KiB returns an ordered part index. Read the listed
+  `?part=1`, `?part=2`, … URIs in order. All bytes are retained, with UTF-8
+  characters kept intact. Relative references resolve within the skill's URI
+  directory. Each part is at most 4 KiB before protocol encoding. When literal
+  code examples cannot pass the existing text classifier unchanged, the read
+  uses a standard MCP blob with the same MIME type: Base64-decode it as UTF-8
+  to recover the exact text.
+- `prompts/list` exposes eight entry prompts, named `websec-<skill-name>`.
+  `prompts/get` takes that name and no arguments; it directs the client to the
+  integration guide and relevant upstream resources.
+
+Resource reads accept only bundled catalog URIs. Unknown URIs, prompts and
+cursors return fixed errors. The original document is checked before any part
+is returned, and the existing final MCP frame checks still apply. When a known
+credential overlaps a document, its read fails without returning that document.
+
+The existing seven request operations retain their contracts. Browser sessions,
+raw protocol experiments, parallel probes and external tools mentioned in a
+guide require those capabilities separately. Imported methodology does not
+enable them in the Websec executor.
+
+## Try the actual acceptance fixture
+
+In one terminal, start the bundled fixture. It prints its actual loopback origin:
+
+```sh
+packages/travis234-websec-mcp/.venv/bin/python packages/travis234-websec-mcp/tests/http_fixture.py
+```
+
+Keep it running. In a second terminal, copy that origin into
+`WEBSEC_FIXTURE_ORIGIN`, then create an isolated lab configuration:
+
+```sh
+export WEBSEC_FIXTURE_ORIGIN='http://127.0.0.1:<printed-port>'
+export WEBSEC_LAB_TOKEN='synthetic-lab-token'
+websec_lab_dir="$(mktemp -d "${TMPDIR:-/tmp}/websec-lab.XXXXXX")"
+export TRAVIS234_CODING_AGENT_DIR="$websec_lab_dir/agent"
+packages/travis234-websec-mcp/.venv/bin/python - <<'PY'
+import json
+import os
+from pathlib import Path
+from urllib.parse import urlsplit
+
+origin = os.environ['WEBSEC_FIXTURE_ORIGIN']
+assert urlsplit(origin).hostname == '127.0.0.1' and urlsplit(origin).port
+path = Path(os.environ['TRAVIS234_CODING_AGENT_DIR']) / 'websec' / 'config.json'
+path.parent.mkdir(parents=True, exist_ok=True)
+path.write_text(json.dumps({'version': 1, 'profiles': {'lab': {
+    'origins': [origin],
+    'headers': {'Authorization': 'Bearer ${WEBSEC_LAB_TOKEN}'},
+    'deadline_seconds': 10,
+}}}))
+PY
+```
+
+Run installation and activation in that same terminal so Travis inherits the
+directory override and credential reference. Stop the fixture with Ctrl-C.
+Normal operator configuration lives at `~/.travis234/agent/websec/config.json`;
+the existing `TRAVIS234_CODING_AGENT_DIR` override changes the agent directory.
+The package never loads `.env` files. Headers accept exact `$env:NAME` references
+or `${NAME}` interpolation. Missing or empty references leave offline operations
+available and make `send` return `authentication_unavailable` before connecting.
+
+## Request workflow
+
+Call `websec` with the following operation arguments. Replace the fixture origin
+with its printed value and copy each returned ID exactly:
+
+| Operation | Arguments and result |
+| --- | --- |
+| `status` | `{}` or `{"operation":"status"}` returns configuration, profiles and limits. |
+| `prepare` | `{"operation":"prepare","profile":"lab","request":{"url":"<fixture-origin>/query-echo?q=original&q=untouched"}}` creates an immutable request ID. Optional request fields are `method`, header pairs and a UTF-8 `body`. |
+| `mutate` | `{"operation":"mutate","request_id":"<original-id>","location":"query","index":0,"value":"changed"}` creates a new ID. Header mutation is also indexed; body mutation replaces the whole body. |
+| `transform` | `{"operation":"transform","value":"a b","codec":"url","direction":"encode"}` returns `a%20b`. Codecs are `url`, `base64`, `hex`, `double_url`, `html`, `unicode` and `reverse`; both directions are supported. |
+| `send` | `{"operation":"send","request_id":"<request-id>"}` executes that snapshot once. Send the original and changed IDs separately. |
+| `compare` | `{"operation":"compare","left_response_id":"<original-response-id>","right_response_id":"<changed-response-id>"}` returns measured differences, completeness and an optional sanitized diff. |
+| `export` | The same response pair with `"operation":"export"` writes a new evidence file and returns its basename, ID and byte count. |
+
+The fixture receives `original`, then `changed`, with the second query entry
+unchanged. Its UTF-8 response bodies have 8 and 7 bytes respectively. Reusing the
+original ID sends the original value again. `prepare` also accepts strict raw
+HTTP/1.1 text using `raw_request` and an explicit `origin`, instead of `request`.
+Ambiguous framing, invalid fields and unavailable IDs return specific bounded
+errors. Comparisons report observations rather than vulnerability verdicts.
+
+### Additional text codecs
+
+| Codec | Defined behavior |
+| --- | --- |
+| `double_url` | Apply the existing UTF-8 URL conversion exactly twice. Decoding rejects malformed percent escapes or invalid UTF-8 at either step. A literal `+` stays `+`. |
+| `html` | Encode the five HTML special characters; the apostrophe becomes `&#x27;`. Decode named/numeric entities once using HTML5 rules. Markup stays text: decoding `&lt;b&gt;é&lt;/b&gt;` returns `<b>é</b>`. |
+| `unicode` | Encode each UTF-16 unit as a lowercase `\uXXXX` escape, including valid pairs for supplementary characters. Decode those escapes once, combine valid surrogate pairs and reject malformed or unpaired units. Other backslash sequences and percent escapes stay literal. |
+| `reverse` | Reverse Unicode code points. Both directions perform the same operation; `A😀é` becomes `é😀A`. Combining marks reverse individually. |
+
+These operations retain the 16 KiB input and 64 KiB output limits. The aggregate
+MCP frame limit also applies, so a valid engine result can return `output_limit`
+at the public boundary. Errors never return a successful partial transformation.
+Known credentials are checked in both the source value and the derived result.
+
+## Bounds, credentials and lifetime
+
+Origins are exact normalized scheme/host/port allowlists. Every send checks its
+final target. The client performs one exchange, follows no redirects, retries
+nothing, carries no cookie jar, verifies TLS and ignores proxy environment
+variables. Only one send runs at a time; an overlapping send returns `busy`.
+Cancellation and shutdown close and join owned HTTP work.
+
+| Resource | Limit |
+| --- | --- |
+| URL / request body / raw import | 8 / 64 / 128 KiB |
+| Wire headers, including authentication and framing | 100 entries / 32 KiB |
+| Transform input / output | 16 / 64 KiB |
+| Deadline | Default 10 seconds; profile integer 1–30. A caller may only lower it with `timeout_seconds`. |
+| Retained response / text preview | 1 MiB / 8 KiB |
+| Requests / responses in memory | 32 / 16; unpinned oldest entries are evicted. |
+| Complete outgoing MCP frame / exported JSON | 32 KiB / 4 MiB |
+
+Compressed responses are reported as `unsupported_encoding` and are not decoded.
+Binary and incomplete responses preserve honest byte measurements; comparison
+does not infer complete text equality or an exact complete-body length from them.
+Incomplete or oversized presentation values are withheld in full, with explicit
+omission flags. Complete bounded JSON can retain unrelated public fields.
+
+Keep credentials in the operator environment and profile references. Never paste
+them into tool arguments: the host records those inputs before the plugin sees
+them. Available referenced values and bounded URL/Base64/hex forms are sanitized
+from returned results and exports. Authentication values go only to an allowed
+origin's request.
+
+Request and response IDs belong to one server process. Shutdown, reload or
+eviction can invalidate them. Exports persist under
+`<agent-directory>/websec/evidence/` as new atomic mode-0600 JSON files; the tool
+does not accept arbitrary export paths or overwrite prior evidence.
+
+Restart the entire Travis process after changing profile configuration,
+credential references/environment or the installed package. Registrations are
+process-local; an existing host does not replace a different descriptor in place.
+Stop Travis before removing the package, then start a new process to confirm the
+facade is absent. Removing the package preserves exported evidence.
+
+## Qualification
+
+```sh
+PYTHONDONTWRITEBYTECODE=1 packages/travis234-websec-mcp/.venv/bin/python -m pytest -q -p no:cacheprovider packages/travis234-websec-mcp/tests
+```
+
+The acceptance test builds actual wheels, installs through Travis's package
+manager in a fresh interpreter outside the checkout, binds a real session, uses
+a deterministic model stream and real HTTP/MCP transports, scans persisted
+session JSONL, and checks A1–A13. Container qualification uses the same driver
+with offline wheels, a nonroot user and Docker networking disabled. A build or
+unit-test pass alone does not establish installed acceptance or deployment.

travis234_websec_mcp-0.1.0/README.md

@@ -0,0 +1,233 @@
+# Travis234 Websec MCP
+
+An optional external HTTP workbench for Travis234 and standard stdio MCP clients.
+Python 3.13 and macOS or Linux are required. Travis core and its existing MCP
+adapter supply the host integration; this package owns requests, HTTP execution,
+sanitization and evidence. KHackBar is a workflow reference and is not a dependency.
+
+This milestone supports individual request experiments. Payload catalogs,
+generators, batch fuzzing, login/token extraction and browser capture remain
+future work. The package also includes imported assessment skills, built into
+Travis and exposed to other clients through MCP
+resources and prompts. These guides do not install external scanners. See the repository's
+[complete KHackBar feature mapping](../../docs/verification/2026-10-18-khackbar-feature-crosscheck.md).
+
+## Build, install and activate
+
+Run these commands from the Travis234 repository root:
+
+```sh
+uv sync --project packages/travis234-websec-mcp --locked --group source-test
+websec_dist_dir="$(mktemp -d "${TMPDIR:-/tmp}/websec-dist.XXXXXX")"
+uv build --wheel --out-dir "$websec_dist_dir" packages/travis234-mcp-adapter
+uv build --wheel --out-dir "$websec_dist_dir" packages/travis234-websec-mcp
+export PIP_FIND_LINKS="$websec_dist_dir"
+export UV_FIND_LINKS="$websec_dist_dir"
+websec_wheel_uri="$(packages/travis234-websec-mcp/.venv/bin/python -c 'from pathlib import Path; import sys; print(next(Path(sys.argv[1]).glob("travis234_websec_mcp-*.whl")).resolve().as_uri())' "$websec_dist_dir")"
+travis234 install "travis234-websec-mcp @ $websec_wheel_uri"
+travis234 --tools read,bash,websec
+```
+
+Installation registers the package-owned server and one `websec` facade through
+the shared adapter. Discovery and `status` do not send a testing request. Tool
+selection uses the existing `--tools` allowlist; there is no new Travis flag.
+
+For another MCP client, install the wheel and its dependencies into that client's
+Python 3.13 environment, then configure this stdio command:
+
+```sh
+travis234-websec-mcp mcp --transport stdio
+```
+
+The standalone server does not import the Travis extension. It uses the same
+configuration, request bounds and evidence format.
+
+## Imported assessment skills
+
+The source index is
+[htooayelwinict/awesome-ai-offensive-security](https://github.com/htooayelwinict/awesome-ai-offensive-security/tree/0e3180f4a0ffd5b6703943cf112d85017895a842).
+That repository contains links; the actual skills are imported from these
+linked MIT-licensed projects at fixed revisions:
+
+| Source | Included skills |
+| --- | --- |
+| [SnailSploit/Claude-Red](https://github.com/SnailSploit/Claude-Red/tree/a8de813edc9f66f60d44cfe42d47750e89d9930b) | `offensive-api-security`, `offensive-jwt`, `offensive-idor`, `offensive-ssrf`, `offensive-ssti`, `offensive-ai-security`, `offensive-reporting` |
+| [transilienceai/communitytools](https://github.com/transilienceai/communitytools/tree/95fdc128af4ca1ae16b3226f9430f1bad97b0656/skills/web-app-logic) | `web-app-logic`, including its reference and scenario files |
+
+All eight skills ship as read-only built-ins in Travis's Python and npm
+distributions, using its existing lazy loader, precedence and trust rules.
+Installing this optional package adds the Websec tools. When the user asks to
+use Websec MCP, its facade instructs the agent to try loading all eight
+SKILL.md guides before its first Websec call, like Evidence MCP's research
+skill. This guidance also accompanies authorized delegation. User overrides
+and `--no-skills` remain effective; unavailable guides are reported. Additional
+reference files load only as needed. The package does not register duplicate
+skill directories. A standalone installation exposes the same documents
+through MCP resources and prompts. No skill is copied into the user's Codex installation.
+
+Each imported skill has a `TRAVIS234.md` guide describing the supported tools
+and request workflow. Local changes add compatible YAML metadata and a link to
+that guide. Upstream methodology and references are retained. Each skill keeps
+its upstream license; [SOURCES.json](travis234_websec_mcp/resources/skills/SOURCES.json)
+records repository revisions, source paths, original hashes and shipped hashes.
+Imports are bundled: startup, discovery and reads do not fetch updates or run
+upstream code.
+
+For a standard MCP client:
+
+- `resources/list` enumerates skill documents in pages of eight. Pass its
+  `nextCursor` back as `cursor` until it is absent.
+- Read `websec://skills/index` for the skill index, then a skill's
+  `websec://skills/<name>/TRAVIS234.md` and `websec://skills/<name>/SKILL.md`.
+- A document larger than 4 KiB returns an ordered part index. Read the listed
+  `?part=1`, `?part=2`, … URIs in order. All bytes are retained, with UTF-8
+  characters kept intact. Relative references resolve within the skill's URI
+  directory. Each part is at most 4 KiB before protocol encoding. When literal
+  code examples cannot pass the existing text classifier unchanged, the read
+  uses a standard MCP blob with the same MIME type: Base64-decode it as UTF-8
+  to recover the exact text.
+- `prompts/list` exposes eight entry prompts, named `websec-<skill-name>`.
+  `prompts/get` takes that name and no arguments; it directs the client to the
+  integration guide and relevant upstream resources.
+
+Resource reads accept only bundled catalog URIs. Unknown URIs, prompts and
+cursors return fixed errors. The original document is checked before any part
+is returned, and the existing final MCP frame checks still apply. When a known
+credential overlaps a document, its read fails without returning that document.
+
+The existing seven request operations retain their contracts. Browser sessions,
+raw protocol experiments, parallel probes and external tools mentioned in a
+guide require those capabilities separately. Imported methodology does not
+enable them in the Websec executor.
+
+## Try the actual acceptance fixture
+
+In one terminal, start the bundled fixture. It prints its actual loopback origin:
+
+```sh
+packages/travis234-websec-mcp/.venv/bin/python packages/travis234-websec-mcp/tests/http_fixture.py
+```
+
+Keep it running. In a second terminal, copy that origin into
+`WEBSEC_FIXTURE_ORIGIN`, then create an isolated lab configuration:
+
+```sh
+export WEBSEC_FIXTURE_ORIGIN='http://127.0.0.1:<printed-port>'
+export WEBSEC_LAB_TOKEN='synthetic-lab-token'
+websec_lab_dir="$(mktemp -d "${TMPDIR:-/tmp}/websec-lab.XXXXXX")"
+export TRAVIS234_CODING_AGENT_DIR="$websec_lab_dir/agent"
+packages/travis234-websec-mcp/.venv/bin/python - <<'PY'
+import json
+import os
+from pathlib import Path
+from urllib.parse import urlsplit
+
+origin = os.environ['WEBSEC_FIXTURE_ORIGIN']
+assert urlsplit(origin).hostname == '127.0.0.1' and urlsplit(origin).port
+path = Path(os.environ['TRAVIS234_CODING_AGENT_DIR']) / 'websec' / 'config.json'
+path.parent.mkdir(parents=True, exist_ok=True)
+path.write_text(json.dumps({'version': 1, 'profiles': {'lab': {
+    'origins': [origin],
+    'headers': {'Authorization': 'Bearer ${WEBSEC_LAB_TOKEN}'},
+    'deadline_seconds': 10,
+}}}))
+PY
+```
+
+Run installation and activation in that same terminal so Travis inherits the
+directory override and credential reference. Stop the fixture with Ctrl-C.
+Normal operator configuration lives at `~/.travis234/agent/websec/config.json`;
+the existing `TRAVIS234_CODING_AGENT_DIR` override changes the agent directory.
+The package never loads `.env` files. Headers accept exact `$env:NAME` references
+or `${NAME}` interpolation. Missing or empty references leave offline operations
+available and make `send` return `authentication_unavailable` before connecting.
+
+## Request workflow
+
+Call `websec` with the following operation arguments. Replace the fixture origin
+with its printed value and copy each returned ID exactly:
+
+| Operation | Arguments and result |
+| --- | --- |
+| `status` | `{}` or `{"operation":"status"}` returns configuration, profiles and limits. |
+| `prepare` | `{"operation":"prepare","profile":"lab","request":{"url":"<fixture-origin>/query-echo?q=original&q=untouched"}}` creates an immutable request ID. Optional request fields are `method`, header pairs and a UTF-8 `body`. |
+| `mutate` | `{"operation":"mutate","request_id":"<original-id>","location":"query","index":0,"value":"changed"}` creates a new ID. Header mutation is also indexed; body mutation replaces the whole body. |
+| `transform` | `{"operation":"transform","value":"a b","codec":"url","direction":"encode"}` returns `a%20b`. Codecs are `url`, `base64`, `hex`, `double_url`, `html`, `unicode` and `reverse`; both directions are supported. |
+| `send` | `{"operation":"send","request_id":"<request-id>"}` executes that snapshot once. Send the original and changed IDs separately. |
+| `compare` | `{"operation":"compare","left_response_id":"<original-response-id>","right_response_id":"<changed-response-id>"}` returns measured differences, completeness and an optional sanitized diff. |
+| `export` | The same response pair with `"operation":"export"` writes a new evidence file and returns its basename, ID and byte count. |
+
+The fixture receives `original`, then `changed`, with the second query entry
+unchanged. Its UTF-8 response bodies have 8 and 7 bytes respectively. Reusing the
+original ID sends the original value again. `prepare` also accepts strict raw
+HTTP/1.1 text using `raw_request` and an explicit `origin`, instead of `request`.
+Ambiguous framing, invalid fields and unavailable IDs return specific bounded
+errors. Comparisons report observations rather than vulnerability verdicts.
+
+### Additional text codecs
+
+| Codec | Defined behavior |
+| --- | --- |
+| `double_url` | Apply the existing UTF-8 URL conversion exactly twice. Decoding rejects malformed percent escapes or invalid UTF-8 at either step. A literal `+` stays `+`. |
+| `html` | Encode the five HTML special characters; the apostrophe becomes `&#x27;`. Decode named/numeric entities once using HTML5 rules. Markup stays text: decoding `&lt;b&gt;é&lt;/b&gt;` returns `<b>é</b>`. |
+| `unicode` | Encode each UTF-16 unit as a lowercase `\uXXXX` escape, including valid pairs for supplementary characters. Decode those escapes once, combine valid surrogate pairs and reject malformed or unpaired units. Other backslash sequences and percent escapes stay literal. |
+| `reverse` | Reverse Unicode code points. Both directions perform the same operation; `A😀é` becomes `é😀A`. Combining marks reverse individually. |
+
+These operations retain the 16 KiB input and 64 KiB output limits. The aggregate
+MCP frame limit also applies, so a valid engine result can return `output_limit`
+at the public boundary. Errors never return a successful partial transformation.
+Known credentials are checked in both the source value and the derived result.
+
+## Bounds, credentials and lifetime
+
+Origins are exact normalized scheme/host/port allowlists. Every send checks its
+final target. The client performs one exchange, follows no redirects, retries
+nothing, carries no cookie jar, verifies TLS and ignores proxy environment
+variables. Only one send runs at a time; an overlapping send returns `busy`.
+Cancellation and shutdown close and join owned HTTP work.
+
+| Resource | Limit |
+| --- | --- |
+| URL / request body / raw import | 8 / 64 / 128 KiB |
+| Wire headers, including authentication and framing | 100 entries / 32 KiB |
+| Transform input / output | 16 / 64 KiB |
+| Deadline | Default 10 seconds; profile integer 1–30. A caller may only lower it with `timeout_seconds`. |
+| Retained response / text preview | 1 MiB / 8 KiB |
+| Requests / responses in memory | 32 / 16; unpinned oldest entries are evicted. |
+| Complete outgoing MCP frame / exported JSON | 32 KiB / 4 MiB |
+
+Compressed responses are reported as `unsupported_encoding` and are not decoded.
+Binary and incomplete responses preserve honest byte measurements; comparison
+does not infer complete text equality or an exact complete-body length from them.
+Incomplete or oversized presentation values are withheld in full, with explicit
+omission flags. Complete bounded JSON can retain unrelated public fields.
+
+Keep credentials in the operator environment and profile references. Never paste
+them into tool arguments: the host records those inputs before the plugin sees
+them. Available referenced values and bounded URL/Base64/hex forms are sanitized
+from returned results and exports. Authentication values go only to an allowed
+origin's request.
+
+Request and response IDs belong to one server process. Shutdown, reload or
+eviction can invalidate them. Exports persist under
+`<agent-directory>/websec/evidence/` as new atomic mode-0600 JSON files; the tool
+does not accept arbitrary export paths or overwrite prior evidence.
+
+Restart the entire Travis process after changing profile configuration,
+credential references/environment or the installed package. Registrations are
+process-local; an existing host does not replace a different descriptor in place.
+Stop Travis before removing the package, then start a new process to confirm the
+facade is absent. Removing the package preserves exported evidence.
+
+## Qualification
+
+```sh
+PYTHONDONTWRITEBYTECODE=1 packages/travis234-websec-mcp/.venv/bin/python -m pytest -q -p no:cacheprovider packages/travis234-websec-mcp/tests
+```
+
+The acceptance test builds actual wheels, installs through Travis's package
+manager in a fresh interpreter outside the checkout, binds a real session, uses
+a deterministic model stream and real HTTP/MCP transports, scans persisted
+session JSONL, and checks A1–A13. Container qualification uses the same driver
+with offline wheels, a nonroot user and Docker networking disabled. A build or
+unit-test pass alone does not establish installed acceptance or deployment.

travis234_websec_mcp-0.1.0/extensions/websec_mcp.py

@@ -0,0 +1,11 @@
+from importlib import import_module
+from pathlib import Path
+import sys
+
+payload_root = Path(__file__).resolve().parents[1]
+if str(payload_root) not in sys.path:
+    sys.path.insert(0, str(payload_root))
+
+extension = import_module("travis234_websec_mcp.extension").extension
+
+__all__ = ["extension"]

travis234_websec_mcp-0.1.0/libexec/travis234-websec-mcp/server.py

@@ -0,0 +1,10 @@
+from importlib import import_module
+from pathlib import Path
+import sys
+
+payload_root = Path(__file__).resolve().parents[2]
+if str(payload_root) not in sys.path:
+    sys.path.insert(0, str(payload_root))
+
+module = import_module("travis234_websec_mcp.cli")
+raise SystemExit(module.main())

travis234_websec_mcp-0.1.0/pyproject.toml

@@ -0,0 +1,46 @@
+[build-system]
+requires = ["setuptools>=77.0.3", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "travis234-websec-mcp"
+version = "0.1.0"
+description = "Independent bounded HTTP security workbench for MCP clients and Travis234."
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.13,<3.14"
+dependencies = [
+  "mcp>=2.2,<3",
+  "pydantic>=2.12,<3",
+  "httpx>=0.27,<1",
+  "httpcore>=1,<2",
+  "anyio>=4,<5",
+  "ahocorasick-rs>=1.0.3,<2",
+  "travis234-mcp-adapter>=0.4,<0.5",
+]
+
+[project.scripts]
+travis234-websec-mcp = "travis234_websec_mcp.cli:main"
+
+[dependency-groups]
+source-test = ["pytest>=8", "pytest-asyncio>=1", "travis234", "travis234-evidence-mcp"]
+
+[tool.uv.sources]
+travis234 = { path = "../..", editable = true }
+travis234-evidence-mcp = { path = "../travis234-evidence-mcp", editable = true }
+travis234-mcp-adapter = { path = "../travis234-mcp-adapter", editable = true }
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["travis234_websec_mcp*"]
+namespaces = false
+
+[tool.setuptools.package-data]
+travis234_websec_mcp = ["resources/skills/**/*.md", "resources/skills/**/LICENSE.txt", "resources/skills/SOURCES.json"]
+
+[tool.setuptools.data-files]
+"libexec/travis234-websec-mcp" = ["libexec/travis234-websec-mcp/server.py"]
+"extensions" = ["extensions/websec_mcp.py"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

travis234_websec_mcp-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

travis234_websec_mcp-0.1.0/tests/test_acceptance.py

@@ -0,0 +1,42 @@
+"""Acceptance uses a fresh installed host, real session, MCP child and loopback."""
+
+import hashlib
+import json
+from pathlib import Path
+import shutil
+import subprocess
+
+from installed_support import REPOSITORY, installed_environment, run
+
+
+def test_installed_artifact_satisfies_A1_through_A13(artifacts, tmp_path):
+    source = Path(__file__).with_name("acceptance_driver.py")
+    assert source.is_file(), "Missing planned installed-artifact acceptance driver."
+    built = artifacts()
+    python, environment = installed_environment(tmp_path / "installed", built)
+    project = tmp_path / "project"
+    project.mkdir()
+    for name in (source.name, "http_fixture.py", "skill_protocol_checks.py"):
+        shutil.copyfile(Path(__file__).with_name(name), project / name)
+    revision = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=REPOSITORY, text=True).strip()
+    report_path = tmp_path / "acceptance-report.json"
+    result = run([str(python), str(project / source.name), "--wheel", str(built.websec),
+        "--repository", str(REPOSITORY), "--source-revision", revision, "--report", str(report_path)],
+        cwd=project, environ=environment)
+    assert result.stderr == ""
+    report = json.loads(result.stdout)
+    assert json.loads(report_path.read_bytes()) == report
+    expected = {"A" + str(number) for number in range(1, 14)}
+    assert expected <= report.keys()
+    assert all(report[key]["passed"] is True and report[key]["observations"] for key in expected)
+    assert report["provenance"]["wheel_sha256"] == hashlib.sha256(built.websec.read_bytes()).hexdigest()
+    assert report["provenance"]["source_revision"] == revision
+    assert report["A3"]["observations"]["pair_values"] == ["original", "changed"]
+    assert report["A4"]["observations"]["body_bytes"] == [8, 7]
+    assert report["A8"]["observations"]["disconnect_seconds"] < 2
+    assert report["A10"]["observations"]["persisted_tool_results"] > 0
+    assert report["A12"]["observations"]["remaining_children"] == 0
+    assert report["A13"]["observations"]["skill_protocol"]["documents_reassembled"] == 80
+    assert report["A13"]["observations"]["skill_protocol"]["prompts_read"] == 8
+    assert "synthetic-websec-acceptance-private-token" not in result.stdout + result.stderr
+    print("Acceptance report:", report_path)