claudecodexArchived

protect-mcp

Cedar policy enforcement + Ed25519 signed receipts for every Claude Code tool call. First cryptographic governance plugin — receipts independently verifiable offline.

0 on GitHubby Tom Farleyv0.1.1MITupdated 10 days ago

Not in a marketplace yet, so it loads for one session with --plugin-dir.

Plugin protect-mcp in smartwatermelon/claude-code-workflows-agents. Commands read from the repo's manifest — 10 days ago.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (1)

  • protect-mcp-setup

    Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.

Slash commands (2)

  • /protect-mcp:audit-chain

    Walk the receipt chain in ./receipts/ verifying every signature and hash link. Detects insertions, deletions, and tampering across the entire audit trail.

  • /protect-mcp:verify-receipt

    Verify a single Ed25519-signed receipt file. Returns exit 0 if valid, 1 if tampered, 2 if malformed.

Subagents (2)

  • policy-enforcer

    Cedar policy author and reviewer for Claude Code tool calls. Writes, audits, and explains Cedar policies that govern Bash, Edit, Write, WebFetch, and other tools. Use when you need declarative, formally verifiable rules for what an AI agent can and cannot do in a project.

  • receipt-verifier

    Expert in Ed25519 signed receipts, JCS canonicalization, hash chains, and offline verification. Use when you need to verify receipt authenticity, audit a receipt chain, detect tampering, or explain why verification failed.

Hooks (2)

  • PreToolUse

    npx [email protected] evaluate --policy "${PROTECT_MCP_POLICY:-./protect.cedar}" --tool "$TOOL_NAME" --input "$TOOL_INPUT" --fail-on-missing-policy false

  • PostToolUse

    npx [email protected] sign --tool "$TOOL_NAME" --input "$TOOL_INPUT" --output "$TOOL_OUTPUT" --receipts "${PROTECT_MCP_RECEIPTS:-./receipts/}" --key "${PROTECT_MCP_KEY:-./protect-mcp.key}"

View source on GitHub

Problems found in this repo's manifests

  • .claude-plugin/marketplace.json is not valid JSON
  • .agents/plugins/marketplace.json is not valid JSON

More from smartwatermelon/claude-code-workflows-agents

All 91 plugins →

python-development

claudecodex

Modern Python development with Python 3.12+, Django, FastAPI, async patterns, and production best practices

16 skills · 1 command · 3 agents

0

backend-development

claudecodex

Fork of wshobson/agents (comprehensive-review plugin source) with trimmed agent descriptions

9 skills · 1 command · 8 agents

0

agent-teams

claudecodex

Fork of wshobson/agents (comprehensive-review plugin source) with trimmed agent descriptions

6 skills · 7 commands · 4 agents

0

ui-design

claudecodex

Fork of wshobson/agents (comprehensive-review plugin source) with trimmed agent descriptions

9 skills · 4 commands · 3 agents

0

cloud-infrastructure

claudecodex

Cloud architecture design for AWS/Azure/GCP/OCI, Kubernetes cluster configuration, Terraform infrastructure-as-code, hybrid cloud networking, and multi-cloud cost optimization

8 skills · 7 agents

0

llm-finetuning

claudecodex

Eval-gated LLM fine-tuning lifecycle: LoRA/QLoRA SFT, preference optimization (DPO/ORPO/KTO), GRPO/RLVR, vision SFT, and quantized export — Unsloth-first with TRL fallback, no eval harness means no fine-tune

10 skills · 2 commands · 3 agents

0

Maintain protect-mcp?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins91 plugins