DLX7 AZT MCP Interceptor

Zero Trust governance for AI coding agents. Validates every file edit and shell command before execution. Works in VS Code (GitHub Copilot), Cursor, Windsurf, and Claude Desktop.

Every agent action passes through the AZT policy engine. Unsafe actions are blocked. All decisions are logged for forensic audit.

---

Install

npm install -g dlx7-mcp-interceptor

Then find the installed path:

node -e "require('path').resolve(require.resolve('dlx7-mcp-interceptor/package.json'), '..')" 2>/dev/null \
  || node --input-type=module --eval "import {createRequire} from 'module'; const r=createRequire(import.meta.url); console.log(r.resolve('dlx7-mcp-interceptor').replace('/server.js',''))"

Or if you prefer to clone directly:

git clone https://github.com/dlx7shieldnet/dlx7-azt-mcp.git
cd dlx7-azt-mcp && npm install

---

Quick Start by IDE

VS Code (GitHub Copilot)

Create or edit .mcp.json in your project root:

{
  "servers": {
    "dlx7-azt-interceptor": {
      "command": "node",
      "args": ["/path/to/dlx7-azt-mcp/server.js"],
      "env": {
        "SUPABASE_URL": "",
        "SUPABASE_SERVICE_ROLE_KEY": ""
      }
    }
  }
}

Restart VS Code. Verify: Command Palette → MCP: List Servers → dlx7-azt-interceptor shows Running.

---

Windsurf (Codeium)

Open or create ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "dlx7-azt-interceptor": {
      "command": "node",
      "args": ["/path/to/dlx7-azt-mcp/server.js"],
      "env": {
        "SUPABASE_URL": "",
        "SUPABASE_SERVICE_ROLE_KEY": ""
      }
    }
  }
}

Restart Windsurf. The DLX7 AZT tools appear in the agent tool list automatically.

No GitHub required. Do not click "Authorize Exafunction" — the MCP server runs locally and does not need repository access.

---

Cursor

Open Cursor Settings (Cmd+,) → search MCP → click Add MCP Server:

{
  "dlx7-azt-interceptor": {
    "command": "node",
    "args": ["/path/to/dlx7-azt-mcp/server.js"],
    "env": {
      "SUPABASE_URL": "",
      "SUPABASE_SERVICE_ROLE_KEY": ""
    }
  }
}

Restart Cursor.

---

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "dlx7-azt-interceptor": {
      "command": "node",
      "args": ["/path/to/dlx7-azt-mcp/server.js"],
      "env": {
        "SUPABASE_URL": "",
        "SUPABASE_SERVICE_ROLE_KEY": ""
      }
    }
  }
}

Restart Claude Desktop.

---

Agent Instructions

Add this to your IDE's global rules file so any AI agent activates AZT automatically:

Windsurf: ~/.codeium/windsurf/global_rules.md
Cursor: .cursorrules in your project root
VS Code: .github/copilot-instructions.md in your project root

## DLX7 AZT Governance — Required for every session

You are governed by the DLX7 Agent Zero Trust (AZT) runtime.

MANDATORY workflow on every turn:
1. Before any file edit or shell command, call `dlx7_declare_intent` with the
   user's exact request and a one-sentence plan. Save the returned sessionId.
2. Before EVERY individual action, call `dlx7_validate_action` with sessionId,
   actionType, and a one-sentence description. Only proceed if verdict is APPROVED.
3. If verdict is FLAGGED, show the flags to the user and ask for explicit
   confirmation before continuing.
4. If verdict is BLOCKED, stop permanently for that action and explain what
   was blocked.
5. At the end of every turn, call `dlx7_clear_intent` with the sessionId.

If the dlx7_ tools are not available, respond with:
"The DLX7 AZT MCP Interceptor is not running. Please restart your IDE after
verifying the MCP config file is correct."

Never skip this workflow. Never treat it as optional.

---

Environment Variables (Optional — for audit logging)

Variable	Purpose
SUPABASE_URL	Enables persistent audit logging to ShieldNet
SUPABASE_SERVICE_ROLE_KEY	Required alongside SUPABASE_URL
DLX7_WORKSPACE_ROOT	For monorepo users — path to repo root containing .env.local

Leave both Supabase vars blank for Community Preview mode (local governance, no cloud logging).

To get your Supabase credentials, log in at shieldnet.app and copy them from your admin center profile.

---

Tools Provided

Tool	Purpose
dlx7_declare_intent	Register the user request and agent plan at the start of each turn
dlx7_validate_action	Validate a specific file edit or shell command before execution
dlx7_clear_intent	Close the session evidence record at the end of each turn
dlx7_get_session	Read current session state for audit or debugging
dlx7_validate_tool_description	Detect MCP tool poisoning, shadowing, and rugpull attacks

---

Requirements

• Node.js 18 or later
• No GitHub account required
• No build step

---

License

MIT — shieldnet.app

---

Kiro Power (No MCP required)

If your IDE or workplace doesn't allow interceptor MCP servers, the DLX7 ShieldNet Secure Development Power delivers the same governance as a pure Kiro Knowledge Base Power — no running server, no tool calls, no network traffic.

kiro-power/
├── POWER.md                         # Frontmatter, workflow steps, quick reference
└── steering/
    ├── preflight.md                 # Pre-flight checklist (replaces dlx7_validate_action)
    ├── risk-scoring.md              # Numeric risk engine (0–100 → LOW/MEDIUM/HIGH/CRITICAL)
    ├── hard-blocks.md               # Absolute stop conditions + DLX7 sensitivity map
    └── dlx7-coding-standards.md    # API / auth / CORS / Supabase / Stripe patterns

How it maps to AZT

AZT MCP Tool	Kiro Power Equivalent
dlx7_declare_intent	Step 1 Scope Declaration (POWER.md mandatory workflow)
dlx7_validate_action	steering/preflight.md checklist
BLOCKED verdict	steering/hard-blocks.md HB-1 / HB-2 / HB-3
FLAGGED verdict	B1–B10 flags in preflight.md — confirmation required
dlx7_clear_intent	Step 5 verification-gap reminder at turn end
Engines #6–#18	Mapped to B1–B10 flag conditions

Install in Kiro

1. Open Kiro → Powers panel → Add power from GitHub
2. Paste: https://github.com/everybitcounts/dlx7shieldnet/tree/main/kiro-power
3. Kiro activates it automatically when your conversation mentions dlx7, shieldnet, arena, AZT, or api/

Install locally

1. Clone this repo
2. Open Kiro → Powers panel → Add power from Local Path
3. Select the kiro-power/ directory