v0.1.4 - Aileron is now an MCP server too

Added

aileron serve — a read-only MCP server over your journals.

Aileron sits in front of MCP servers. This makes it one, so you can ask an assistant what an agent did and have it read the answer out of the tamper-evident record instead of scrolling an HTML timeline.

Three tools: verify_journal, query_events, explain_rule.

Read-only is load-bearing, not cosmetic. The agent being recorded is the untrusted party, so a write or delete tool would hand the suspect the evidence locker. There is none, and a test enforces it.

Four defences beyond that, each for a specific attack:

• Paths are confined to --root and only .jsonl opens, because verify_journal(path) would otherwise be an arbitrary file read.
• Every answer carries its own integrity status. Confinement stops an agent reading files it should not. It does not stop one writing a plausible journal inside the root and handing you invented history, so each reply states whether the chain verifies and whether a signed checkpoint agrees.
• Recorded values are treated as hostile. Tool names are attacker-chosen, so they are stripped of control characters, truncated, and labelled untrusted. A tool named IGNORE PREVIOUS INSTRUCTIONS... is evidence to report, not an instruction to follow.
• Replies are byte-capped, the same reasoning as MAX_MESSAGE_BYTES in the proxy.

32 bundled detection rules, up from 2. Credential theft, cloud metadata abuse, exfiltration, supply chain, persistence, anti-forensics, database destruction, and agent-specific abuse. Every rule ships with the calls it must catch and the ordinary work it must ignore. A false positive fails the build.

server.json for the official MCP Registry. Aileron was not a server before this release, so listing it earlier would have been miscategorised.

An incident replay and writeup in examples/incident_replay.py and docs/what-did-it-touch.md, built around the July 2026 Hugging Face agent intrusion. The replay is honest about what the rules miss: the actual exfiltration walks past them, because it stages credentials to a temp file first. That is the argument for the journal rather than against it.

212 tests. Full detail in CHANGELOG.md.