Skip to content

v0.1.1 — the MCP tool now requires the signed envelope

Latest
Latest

Choose a tag to compare

View all tags
@GChief117 GChief117 released this 16 Sep 03:40
v0.1.1
2439302
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes a confirmed first-use defect. If you arrived from a listing and got
HTTP 400 invalid_request on your first verify_action call, this is why.

What was wrong

POST /v1/demo/verify (free) and POST /v1/verify (paid) take different shapes,
and nothing on the MCP path said so.

Endpoint Expects
/v1/demo/verify {mandate: {…claims…}, action: {…}} — raw claims
/v1/verify {mandate: {mandate: {…claims…}, signature: "…"}, action: {…}} — a signed envelope

The envelope is the whole response body of POST /v1/mandates: {mandate, signature, requestId}.

The tool's input schema was mandate: z.record(z.string(), z.unknown()), which accepts
any object. So the journey was: run the keyless demo, learn the raw-claims shape, install
the server, call verify_action with the shape you just learned, and get a 400 naming an
internal field path.

What changed

  • The input schema now requires {mandate: object, signature: string}, so the tool
    rejects locally with a clear message instead of forwarding a request destined to fail.
  • The tool description states that the mandate must be the envelope returned by
    POST /v1/mandates, and that the free demo route takes raw claims instead.
  • createServer reported version 0.1.0 while the package said 0.1.1. Fixed, and a
    test now pins the two together.
  • New: examples/verify-mandate.mjs, a runnable walkthrough.

29/29 tests pass. No change to the verification engine, signing, or billing.

Try it

git clone https://github.com/API-Disk-Integrations/agent-mandate-mcp.git
cd agent-mandate-mcp && git checkout v0.1.1 && npm ci
AGENT_MANDATE_API_KEY=your_key node examples/verify-mandate.mjs

It creates a mandate, verifies an action through the MCP tool, then raises
approvalRequiredAboveMinor from 25,000 to 999,999 while keeping the original
signature and verifies again. That second call is the point: a tampered envelope
would turn a requires_approval into an allow, so the script exits non-zero if it
ever succeeds. It starts the released artifact, not your working tree.

The free tier includes 500 verified actions per month. Issuing mandates is free.

Installing

npm still serves 0.1.0, which is the version with the defect. Publishing 0.1.1 is
pending a registry step. Until then install from the tarball attached here:

curl -fsSLO https://github.com/API-Disk-Integrations/agent-mandate-mcp/releases/download/v0.1.1/api-disk-integrations-agent-mandate-mcp-0.1.1.tgz
shasum -a 256 api-disk-integrations-agent-mandate-mcp-0.1.1.tgz
npm install -g ./api-disk-integrations-agent-mandate-mcp-0.1.1.tgz

SHA-256:

3bccda202e8a4b24f5a6cd9317207eef4852b8e825551624fb3d8017c6431fda
Assets 4
Loading