Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Guidance for governing AI agent tool calls using Cedar policies and Ed25519 signed receipts. This skill teaches how to write access-control policies for MCP servers, run them in shadow mode for observation, and verify the cryptographic audit trail.
When to Use This Skill
Use when you need to control which MCP tools an agent can call and under what conditions
Use when you want a tamper-evident audit trail for agent tool executions
Use when rolling out governance policies gradually (shadow mode first, then enforce)
Use when authoring Cedar policies for MCP tool access control
Use when verifying that a receipt or audit bundle has not been tampered with
Do Not Use This Skill
When you need general application security auditing (use @security-auditor)
When you need to scan code for vulnerabilities (use @security-audit)
When you need compliance framework guidance without agent-specific governance
How It Works
protect-mcp intercepts MCP tool calls, evaluates them against Cedar policies (the same policy engine used by AWS Verified Permissions), and signs every decision as an Ed25519 receipt. The receipt is a cryptographic proof that a specific policy was evaluated against a specific tool call at a specific time.
Agent → protect-mcp → Cedar policy evaluation → MCP Server
↓
Ed25519 signed receipt
Three modes of operation:
Shadow mode (default) — logs decisions without blocking. Use this to observe what your policies would do before enforcing them.
Enforce mode — blocks tool calls that violate policy. Use after shadow-mode validation.
Hooks mode — integrates with Claude Code hooks for pre/post tool-call governance.
Core Concepts
Cedar Policies
Cedar is a policy language designed for authorization. Policies are evaluated locally via WASM — no network calls required.
// Allow read-only file operations
permit(
principal,
action == Action::"call_tool",
resource
) when {
resource.tool_name in ["read_file", "list_directory", "search_files"]
};
// Deny destructive operations
forbid(
principal,
action == Action::"call_tool",
resource
) when {
resource.tool_name in ["execute_command", "delete_file", "write_file"]
&& resource has args
&& resource.args.contains("rm -rf")
};
# Initialize hooks
npx protect-mcp init-hooks
# Claude Code now generates a signed receipt for every tool call.# Receipts are stored in .protect-mcp/receipts/
Explanation: After initialization, every tool call Claude Code makes is logged with a signed receipt. No tool calls are blocked (shadow mode).
Example 2: Restrict a Production MCP Server
// Only allow approved tools with rate limiting
permit(
principal,
action == Action::"call_tool",
resource
) when {
resource.tool_name in [
"get_customer",
"search_orders",
"list_products"
]
};
forbid(
principal,
action == Action::"call_tool",
resource
) when {
resource.tool_name in [
"delete_customer",
"modify_payment",
"execute_sql"
]
};
Explanation: A production MCP server that serves customer data. Read-only operations are permitted; destructive operations are blocked.
Example 3: Verify an Audit Bundle After an Incident
# Export the session's audit bundle
npx protect-mcp export-bundle --session sess_abc123 --out audit.json
# Verify every receipt in the bundle
npx @veritasacta/verify audit.json --bundle
# Expected output:# ✓ Bundle: VALID# Total: 47# Passed: 47# Failed: 0
Explanation: After an incident, export the audit bundle and verify that no receipts have been tampered with. The bundle contains all receipts from the session plus the signing keys needed for verification.
Best Practices
✅ Do: Start in shadow mode and observe before enforcing
✅ Do: Use policy_digest to track which policy version produced each decision
✅ Do: Store receipts alongside your application logs for correlation
✅ Do: Pin the verifier version when integrating into CI (@veritasacta/verify@0.2.5)
❌ Don't: Skip shadow mode and go straight to enforce in production
❌ Don't: Trust claimed_issuer_tier without independent verification
❌ Don't: Treat a valid signature as proof the signer is trustworthy — it only proves the receipt has not been tampered with since signing
Troubleshooting
Problem: Receipts fail verification with no_public_key
Symptoms:npx @veritasacta/verify receipt.json returns exit 2 with no_public_keySolution: Provide the public key explicitly: --key <64 hex chars>. The receipt does not embed the public key by default. Check protect-mcp.config.json for the issuer's public key.
Problem: Shadow mode shows unexpected denials
Symptoms: Shadow log shows deny decisions for tools you expected to be allowed
Solution: Check your Cedar policy ordering. Cedar evaluates forbid rules before permit rules — a broad forbid will override specific permit rules.
Problem: Enforce mode blocks a legitimate tool call
Symptoms: Agent reports a tool call was denied after switching to enforce mode
Solution: Add the tool to your permit policy or switch back to shadow mode: remove --enforce flag. Review the receipt's deny_reason field for the specific policy violation.
Related Skills
@security-auditor — General security auditing and compliance
@security-audit — Code vulnerability scanning
@mcp-development — MCP server development patterns
