AgentAlley

Skills · Security

protect-mcp — Policy Enforcement + Signed Receipts

Unverified●30/40

Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.

Originally by wshobson · MIT

Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add protect-mcp-setup

This command does not work yet — the CLI is still being built. Until then, use Raw in the reader below to take the file.

Who is stuck, and on what

Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.

The whole source

No sign-in, no blur, nothing truncated
protect-mcp-setup/SKILL.md215 lines6.6 KBRawView on GitHub
Frontmatter — 2 properties
nameprotect-mcp-setup
descriptionConfigure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.
1---
2name: protect-mcp-setup
3description: Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.
4---A5 — No allowed-tools declared — no way to tell what this skill may touch
5 
6# protect-mcp — Policy Enforcement + Signed Receipts
7 
8Cryptographic governance for every Claude Code tool call. Each invocation is
9evaluated against a Cedar policy and produces an Ed25519-signed receipt that
10anyone can verify offline.
11 
12## Overview
13 
14Claude Code runs powerful tools: `Bash`, `Edit`, `Write`, `WebFetch`. By defaultA4 — This skill pulls in web or user content but never says to treat that content as data. A signal, not proof.
15there is no audit trail, no policy enforcement, and no way to prove what was
16decided after the fact. `protect-mcp` closes all three gaps:
17 
18- **Cedar policies** (AWS's open authorization engine) evaluate every tool call
19 before execution. Cedar deny is authoritative.
20- **Ed25519 receipts** record each decision with its inputs, the policy that
21 governed it, and the outcome. Receipts are hash-chained.
22- **Offline verification** via `npx @veritasacta/verify`. No server, no account,
23 no trust in the operator.
24 
25## Problem
26 
27AI agents make decisions that affect money, safety, and rights. The Claude Code
28session log records what happened, but the log is:
29 
30- Mutable — anyone with access can edit it
31- Unsigned — there is no way to prove integrity
32- Operator-bound — verification requires trusting whoever holds the log
33 
34For compliance contexts (finance, healthcare, regulated research), this is not
35sufficient. You need tamper-evident evidence that can be verified by third
36parties without trusting you.
37 
38## Solution
39 
40Add `protect-mcp` to your Claude Code project:
41 
42```bash
43# 1. Install the plugin (adds hooks + skill to your project)
44claude plugin install wshobson/agents/protect-mcp
45 
46# 2. Create ./protect.cedar (see below). The plugin installs the hooks.
47 
48# 3. Start the receipt-signing server (runs locally, no external calls)
49npx protect-mcp@latest serve --enforce
50 
51# 4. Use Claude Code normally. Every tool call is now policy-evaluated
52# and produces a signed receipt in ./receipts/
53```
54 
55## Hook Configuration
56 
57Installing the plugin adds both hooks from `hooks/hooks.json`. Each hook runs a
58script bundled with the plugin:
59 
60```json
61{
62 "hooks": {
63 "PreToolUse": [
64 {
65 "matcher": ".*",
66 "hooks": [
67 { "type": "command", "command": "\"${CLAUDE_PLUGIN_ROOT}\"/hooks/evaluate.sh" }
68 ]
69 }
70 ],
71 "PostToolUse": [
72 {
73 "matcher": ".*",
74 "hooks": [
75 { "type": "command", "command": "\"${CLAUDE_PLUGIN_ROOT}\"/hooks/sign.sh" }
76 ]
77 }
78 ]
79 }
80}
81```
82 
83Claude Code passes the hook event to the command as JSON on stdin and does not
84set `TOOL_NAME` or `TOOL_INPUT` variables. `evaluate.sh` reads `tool_name` and
85`tool_input` from that payload and passes them to `protect-mcp` as flags; `sign.sh` reads
86`tool_name` only, because the 0.7.4 signer records nothing else. Set
87`PROTECT_MCP_POLICY`, `PROTECT_MCP_RECEIPTS`, and `PROTECT_MCP_KEY` to change the
88default paths. When the policy file is missing, the PreToolUse hook prints a
89warning to stderr and allows the call.
90 
91### What each hook does
92 
93**PreToolUse** — Runs BEFORE the tool executes. Evaluates the tool call against
94your Cedar policy file. If Cedar returns `deny`, the hook exits with code 2 and
95Claude Code blocks the tool call entirely.
96 
97**PostToolUse** — Runs AFTER the tool completes. Signs a receipt containing the
98tool name, input hash, output hash, decision, policy digest, and timestamp.
99Writes the receipt to `./receipts/<timestamp>.json`.
100 
101## Cedar Policy File
102 
103Create `./protect.cedar` at the project root:
104 
105```cedar
106// Allow read-only tools by default
107permit (
108 principal,
109 action in [Action::"Read", Action::"Glob", Action::"Grep", Action::"WebFetch"],
110 resource
111);
112 
113// Require explicit allow for destructive tools
114permit (
115 principal,
116 action == Action::"Bash",
117 resource
118) when {
119 // Allow safe commands only
120 context.command_pattern in ["git", "npm", "ls", "cat", "echo", "pwd", "test"]
121};
122 
123// Never allow recursive deletion
124forbid (
125 principal,
126 action == Action::"Bash",
127 resource
128) when {
129 context.command_pattern == "rm -rf"
130};
131 
132// Require confirmation for writes outside the project
133forbid (
134 principal,
135 action in [Action::"Edit", Action::"Write"],
136 resource
137) when {
138 context.path_starts_with != "."
139};
140```
141 
142## Verification
143 
144Verify a single receipt:
145 
146```bash
147npx @veritasacta/verify receipts/2026-04-15T10-30-00Z.json
148# Exit 0 = valid
149# Exit 1 = tampered
150# Exit 2 = malformed
151```
152 
153Verify the entire chain:
154 
155```bash
156npx @veritasacta/verify receipts/*.json
157```
158 
159Use the plugin's slash commands from within Claude Code:
160 
161```
162/verify-receipt receipts/latest.json
163/audit-chain ./receipts/ --last 20
164```
165 
166## Receipt Format
167 
168Each receipt is a JSON file with this structure:
169 
170```json
171{
172 "receipt_id": "rec_8f92a3b1",
173 "receipt_version": "1.0",
174 "issuer_id": "claude-code-protect-mcp",
175 "event_time": "2026-04-15T10:30:00.000Z",
176 "tool_name": "Bash",
177 "input_hash": "sha256:a3f8...",
178 "decision": "allow",
179 "policy_id": "autoresearch-safe",
180 "policy_digest": "sha256:b7e2...",
181 "parent_receipt_id": "rec_3d1ab7c2",
182 "public_key": "4437ca56815c0516...",
183 "signature": "4cde814b7889e987..."
184}
185```
186 
187- **Ed25519** signatures (RFC 8032)
188- **JCS canonicalization** (RFC 8785) before signing
189- **Hash-chained** to the previous receipt via `parent_receipt_id`
190- **Offline verifiable** — no network call, no vendor lookup
191 
192## Why This Matters
193 
194| Before | After |
195|--------|-------|
196| "Trust me, the agent only read files" | Cryptographically provable: every Read logged and signed |
197| "The log shows it happened" | The receipt proves it happened, and no one can edit it |
198| "You'd have to audit our system" | Anyone can verify every receipt offline |
199| "Logs might be different by now" | Ed25519 signatures lock the record at signing time |
200 
201## Standards
202 
203- **Ed25519** — RFC 8032 (digital signatures)
204- **JCS** — RFC 8785 (deterministic JSON canonicalization)
205- **Cedar** — AWS's open authorization policy language
206- **IETF draft** — [draft-farley-acta-signed-receipts](https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/)
207 
208## Related
209 
210- **npm**: [protect-mcp](https://www.npmjs.com/package/protect-mcp)
211- **Verify CLI**: [@veritasacta/verify](https://www.npmjs.com/package/@veritasacta/verify)
212- **Source**: [github.com/ScopeBlind/scopeblind-gateway](https://github.com/ScopeBlind/scopeblind-gateway)
213- **Protocol**: [veritasacta.com](https://veritasacta.com)
214- **Integrations**: Microsoft Agent Governance Toolkit (PR #667), AWS cedar-policy/cedar-for-agents (PR #64)
215 

Reviews

Installed this one?Write the first review and take the Trailblazer badge.

Reviews only open after a real install, so this is empty — and we leave it empty rather than invent one.

Alternatives

Also in Security
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.Security · MIT◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.Security · MIT◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.Security · MIT◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.Security · MIT◐◐◐◐◐●30/40