chp-mcp

CHP MCP is an MCP implementation of the Consensus Hardening Protocol, focused on approval receipts and policy gates. The core problem it solves is: the managed allowlists of MCP clients (such as Cursor, Claude Desktop, Claude Code) can only answer "is this tool name installed", and cannot bind tenant, parameters, risk, or human decisions. This server treats this gap as a hard denial unless there is a signed approval receipt matching the call about to run.

Main capabilities include:

• Install MCP with a single command, wrapping @cubiczan/chp, so that any MCP client can call evaluate_spend_gate without embedding protocol code.
• Engine digests match the canonical golden vectors (Profile B 30/30).
• Approval receipts use HMAC-SHA256 to sign CHP canonical JSON, covering tenant, parameters, risk, and human decisions.
• Structured denial ledger; denial events must be written to the CHP-signed ledger before the caller sees them.
• Receipt-gated financial instruments (place_equity_order, wire_treasury_transfer, rebalance_portfolio); these tools are synthetic tools with no real trading venue or banking channel, and use a separate kind: "authorization" receipt binding the tool, scope, and parameter hash.
• Support for host-injected args and gateway _meta, preventing the model from choosing indices, keys, or tenants on its own.

Usage:

• Set CHP_RECEIPT_KEY (or AUDIT_LEDGER_KEY) in the MCP server environment. When unset, it falls back to a documented insecure default, suitable only for the local cookbook, not for production.
• Example policy file: examples/tool-approval-policy.json. stripe.create_charge is on the allowlist, but still requires a receipt bound to acct_live_acme and the exact charge parameters in order to run.
• Host-injected policy example: examples/host-injected-policy.json.
• Set CHP_AUDIT_LEDGER to a JSONL path (default./data/chp-audit.jsonl), or :memory: for testing.
• Run tests: npm test builds and then runs node --test dist/.test.js (approval receipts + host-injected binding) and node --import tsx --test test/**/.test.ts (denial ledger).

Applicable scenarios:

• MCP tool calls that require human-in-the-loop approval.
• Host environments such as Semantic Kernel that need to prevent the model from choosing tenants or indices on its own.
• Financial or sensitive operations that require auditable denial records.
• Spend/capital gates that require receipt gating.

Limitations:

• The financial instruments are synthetic tools with no real trading venue or banking channel.
• When CHP_RECEIPT_KEY is unset, it falls back to an insecure default, not suitable for production.
• This Cubiczan mirror may omit GitHub Actions, so the test suite must be run locally.
• A denial ledger failure throws an exception rather than returning a denial object, ensuring that an unrecorded denial cannot occur.
• Once a receipt is successfully consumed, the nonce is burned, and replay is denied.
• A receipt cannot be revived after expiration, and clock rollback cannot restore it either.
• Ambiguous cases (such as resource: "*", any, all, empty string, missing parameters, no concrete version policy, actor/tool wildcards, extra receipt keys) never produce a usable allow receipt, and deny_on_ambiguity cannot be turned off.