Cubiczan/governed-mcp-gateway

Identity, money, and evidence for agents that actually ship.
Three SKUs, one workspace. MCP clients keep a Bearer principal through tools/call and SSE. Spend cannot settle without a mandate and, over cap, a human second key. Board claims cannot seal without an agent, a CHP lock, and a hashed document.
| SKU | Port | Source | Job |
|---|---|---|---|
| Governed MCP Gateway | :7474 | Cubiczan/governed-mcp-gateway | Principal on every tool call and SSE frame. Vaulted credential rotation. Tool allowlists. Schema token-tax ledger and pack / allow-by-need tools/list. |
| Agent Spend & Mandate Plane | :7475 | this workspace | Propose → mandate → countersign → settle. Stripe by default; x402 is a rail. |
| Auditable CFO Agent Mesh | :7476 | this workspace | Claim → agent → lock → document. ASC 842 / 606 / 718 engines. HMAC-chained evidence pack. |
Shared primitives (packages/shared): CHP gate, HMAC ledger, HTTP/SSE helpers. Zero runtime npm dependencies. Stripe and x402 are rails — tests never call live networks.
Quickstart
Demo Bearer keys (also in .env.example):
| Role | Key |
|---|---|
| Gateway agent | mcp_agt_payops_demo |
| Gateway human | mcp_human_controller_demo |
| Gateway research (no stripe.charge) | mcp_agt_research_demo |
| Spend agent | spend_agt_payops_demo |
| Spend human | spend_human_controller_demo |
| CFO agent | cfo_agt_lease_demo |
| CFO human | cfo_human_controller_demo |
Regenerate the README cards from live local APIs:
---
1. Governed MCP Gateway
Production MCP drops identity. listTools runs on the request thread; tools/call and SSE run somewhere else. This gateway resolves a Bearer credential to a **Principal**, injects it on every JSON-RPC call, and repeats it on **every SSE frame**. Named vault inputs rotate in place — github_token stays github_token.
| Method | Path | What |
|---|---|---|
| GET | /health /healthz | Liveness ({ ok, service, transport, mode }). No auth. |
| POST | /mcp | Streamable HTTP JSON-RPC initialize, tools/list (default: session pack), tools/call |
| GET | /mcp/sse?once=1 | Local SSE notification with _meta.cubiczan.principal (not the Vercel path) |
| GET | /v1/context/tax | Schema token-tax estate + session report |
| POST | /v1/context/need | Admit allowlisted tools into the session pack |
| POST | /v1/credentials/:name/rotate | Human-only vault rotate; old hash dies |
| POST | /v1/credentials/verify | Check a secret against the current hash |
Glama remote connector
Glama can health-check a **stateless Streamable HTTP** remote at https://$VERCEL_URL/mcp with Bearer auth. This is the hosted HTTPS path. Stdio (npm run mcp / Dockerfile CMD) remains the Glama Docker build path.
**Vercel project settings** (import this GitHub repo; do not invent a hostname):
| Setting | Value |
|---|---|
| Root Directory | . (repository root — vercel.json + api/) |
| Framework Preset | Other (vercel.json sets "framework": null) |
| Fluid Compute | On ("fluid": true) |
| Node.js | 20 or later |
| Install Command | npm ci && npm run build (vercel.json already sets this) |
| Build Command | npm run build (esbuild → dist/web.mjs; do **not** run tsc) |
| Output Directory | public (empty static dir for the Other preset; Fluid still serves /api) |