Metadata-Version: 2.4
Name: protect-mcp
Version: 0.4.0
Summary: MCP security gateway — per-tool policies, Ed25519-signed receipts, shadow mode
Author-email: Tom Farley <tommy@scopeblind.com>
License: MIT
Project-URL: Homepage, https://scopeblind.com
Project-URL: Repository, https://github.com/tomjwxf/scopeblind-gateway
Project-URL: Documentation, https://scopeblind.com/docs/protect-mcp
Project-URL: IETF Draft, https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/
Keywords: mcp,security,ai,agent,receipts,ed25519,gateway
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# protect-mcp

MCP security gateway — per-tool policies, Ed25519-signed decision receipts, shadow mode.

## Install

```bash
pip install protect-mcp
```

Requires Node.js (for npx). Install from https://nodejs.org.

## Usage

```bash
# Shadow mode — log everything, block nothing
protect-mcp -- node your-server.js

# Enforce mode — apply per-tool policies
protect-mcp --policy policy.json --enforce -- node your-server.js

# Verify receipts offline (MIT licensed, no ScopeBlind dependency)
npx @veritasacta/verify --self-test
```

## What it does

Wraps any MCP server as a transparent stdio proxy. Every tool call decision is logged and optionally Ed25519-signed.

- **Shadow mode** (default): See what agents are doing without blocking
- **Enforce mode**: Block, rate-limit, or require approval per tool
- **Signed receipts**: Ed25519 + JCS canonicalization, verifiable offline
- **CVE-anchored policies**: Pre-built packs for known attack patterns
- **OWASP coverage**: Maps to OWASP Agentic Top 10

## Links

- npm (canonical): https://npmjs.com/package/protect-mcp
- Docs: https://scopeblind.com/docs/protect-mcp
- IETF Draft: https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/
- License: MIT
