gomission/mcp

Mission’s open MCP interception adapter for exact-action authority.
It has one narrow job: sit before a wrapped MCP provider, classify a proposed
tool call, and hold consequential calls with an immutable Trust Graduation
action binding. Low-risk calls may pass through. A chat message saying
“approve” is never treated as authority.
Status: experimental beta. Apache-2.0. Zero runtime dependencies.
Prove the boundary first
Requirements: Node.js 20 or newer.
The command uses a fake email provider and prints one machine-readable
DEMO_RESULT. It proves that:
- the consequential provider function was called zero times;
- the hold contains an exact action and input hash;
- changing the reviewed input changes the commitment;
- chat text grants no execution authority.
This proves interception, not completed authorization or production adoption.
The portable grant/replay proof lives in @trust-graduation/core:
The three primitives
| Primitive | Responsibility | Portable object |
| --- | --- | --- |
| Mission Gate | Decide before a provider effect | action decision |
| Trust Profile | Track earned authority per principal and action class | evidence profile |
| Mission Key | Authorize one exact action until expiry or revocation | single-use grant |
The MCP adapter implements the pre-provider hold. It does not mint a trusted
Mission Key and it cannot resume a held call. A trusted approval host and
executor must validate and atomically consume the matching key. The
experimental A2A continuation is published at:
https://trustgraduation.org/extensions/a2a/action-authorization/v1
MCP Hold to Exact Provider Execution
The package root exposes the stable, zero-dependency binding bridge used by an
external approval host and executor:
The bridge verifies binding integrity and maps the intercepted identities,
target, constraints, expiry, and nonce into the core executor shape. The core
then re-hashes the actual provider input, authenticates and atomically consumes
the Key, calls the provider, and writes result-linked evidence. Mutation or
replay never reaches the provider.
For a generated adapter and objective provider-call counters:
With both packages installed, the included compatibility proof is:
The MCP proxy still never resumes a held call merely because chat says
"approve". This bridge is for the separately authenticated approval host and
provider-bound executor.
Install for Claude Desktop
The installer inspects the existing Claude Desktop MCP configuration:
- if it finds consequential MCP servers, it selects --wrap;
- otherwise it selects --local, an advisory exact-binding demonstration;
- it never auto-selects the hosted read-only mode.
Restart Claude Desktop after installation, then verify:
verify probes modern MCP with server/discover and tools/list, falling back
to the initialize-era protocol for older endpoints. Add --json for a
machine-readable report or --no-probe to inspect configuration only.
Modes
| Mode | What it enforces | What it does not do |
| --- | --- | --- |
| --wrap | Intercepts selected child MCP servers; holds high/critical or low-confidence calls before the child; fails closed if a child is unavailable | Does not resume a held call or trust chat approval |
| --local | Records an advisory exact-action hold and local review receipt | Is not between another tool and its provider |
| --remote | Requires an explicitly configured, authenticated remote service | The old public PHP endpoint is retired; no hosted service is advertised by this release |