protect-mcp-setup

Installation
SKILL.md

protect-mcp — Policy Enforcement + Signed Receipts

Cryptographic governance for every Claude Code tool call. Each invocation is evaluated against a Cedar policy and produces an Ed25519-signed receipt that anyone can verify offline.

Overview

Claude Code runs powerful tools: Bash, Edit, Write, WebFetch. By default there is no audit trail, no policy enforcement, and no way to prove what was decided after the fact. protect-mcp closes all three gaps:

  • Cedar policies (AWS's open authorization engine) evaluate every tool call before execution. Cedar deny is authoritative.
  • Ed25519 receipts record each decision with its inputs, the policy that governed it, and the outcome. Receipts are hash-chained.
  • Offline verification via npx @veritasacta/verify. No server, no account, no trust in the operator.
Related skills

More from wshobson/agents

Installs
1.5K
Repository
wshobson/agents
GitHub Stars
35.3K
First Seen
Apr 16, 2026