Rul1an/assay

The open, recomputable evidence profile for privileged MCP tool actions.
Assay records what a privileged tool call decided, what was observed, and what stays unproven, so a reviewer can replay the claim offline instead of trusting the agent's account of itself. In enforcement mode, the proxy gate for routed MCP tools/call requests is deterministic and fail-closed, and the enforcing proxy is the reference producer rather than the contract itself. Optional eBPF/LSM instrumentation on supported Linux hosts adds kernel-level observations. CI-native, no backend, bounded by design.
Quickstart ·
How it works ·
See it work ·
MCP example ·
OWASP MCP Top 10 ·
Discussions
---
Agents got real tool access through MCP — and tool poisoning, rug pulls, and confused-deputy OAuth came with it. Assay sits at the tool-call boundary and does three things, in order.
**One golden path:** the release-pinned agent journey records the nine driven CLI/MCP steps and their exit/stdout contracts. Its protected-action fixture lives in examples/privileged-action-gate/.
Enforce, prove, stay honest
- **Enforce.** In enforcement mode, the gate decides tools/call requests routed through it before forwarding, with the precise reason for each allow or deny. Separate controls on supported Linux hosts include cgroup eBPF IPv4/TCP connect filtering (whose hook error path allows connections) and Landlock TCP-connect port allowlisting. assay sandbox --enforce refuses an unavailable backend or conflicting filesystem policy unless --allow-audit-fallback is explicit. --enforce-net requires --enforce; active Landlock network enforcement rejects policies it cannot express as TCP-port allowlists, even with audit fallback enabled.
- **Prove.** Configured producers can record decisions and bounded observations for export into offline-verifiable, tamper-evident evidence bundles. The privileged-action flow carries the verdict, pre-call establish journey, and declared-vs-observed conformance for CI review without a hosted backend. Basic assay mcp wrap does not automatically create a bundle; enable the required recording and export steps.
- **Stay honest.** Trust Basis classifies supported claims as verified, self_reported, inferred, or absent; its gates check the declared claim boundaries. A tool returning "success" is the provider's assertion, never proof. Assay ships no single safety score; read each artifact’s source, coverage and non-claims before relying on it.
Quickstart
For v6.13.0, run the last command from a source checkout or an extracted published CLI archive.
The installer is binary-only and does not carry the bounded quickstart assets. The live
getassay.dev installer verifies the selected archive against its published SHA-256 sidecar before
extraction. Set ASSAY_REQUIRE_PROVENANCE=1 to additionally require GitHub artifact provenance;
the default reports provenance_not_requested and strict success reports provenance_verified.
A checksum proves byte equality with the published sidecar, not producer identity. Provenance
identifies the source and build, not runtime safety or semantic correctness.
Captured runner output (the bundled local mock performs no external action):
Released surfaces:
- Static project manifests are shipped for Claude Code and Cursor; Codex uses the equivalent TOML entry documented in the editor MCP recipe. Manifest presence is not host-discovery proof. assay mcp config-path supports Claude Desktop and Cursor only.
- Published v6.13.0 CLI archives cover Linux x86_64/arm64, macOS x86_64/arm64, and Windows x86_64. The Python wheels cover CPython 3.12, 3.13, and 3.14 on macOS x86_64/arm64 and Linux x86_64; other interpreters and platforms are not claimed.
- Published assay-mcp-server archives cover Linux x86_64/arm64. MCPB and server.json package descriptors are also published; their presence is not host-discovery proof.