Agent skill · security · wshobson
protect-mcp-setup
Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.
Why this skill is useful
Adds executable scripts for policy enforcement and receipt signing that provide cryptographic audit trails and compliance evidence.
What it needs
Requires claude, npx installed locally. About 3k tokens when loaded. Last updated 2026-08-05. 38,570 stars on the source repository.
What this skill does
protect-mcp — Policy Enforcement + Signed Receipts Cryptographic governance for every Claude Code tool call. Each invocation is evaluated against a Cedar policy and produces an Ed25519-signed receipt that anyone can verify offline. Overview Claude Code runs powerful tools: Bash, Edit, Write, WebFetch. By default there is no audit trail, no policy enforcement, and no way to prove what was decided after the fact. protect-mcp closes all three gaps: Cedar policies (AWS's open authorization engine) evaluate every tool call before execution. Cedar deny is authoritative. Ed25519 receipts record each decision with its inputs, the policy that governed it, and the outcome. Receipts are hash-chained. Offline verification via npx @veritasacta/verify. No server, no account, no trust in the operator. Problem AI agents make decisions that affect money, safety, and rights. The Claude Code session log records what happened, but the log is: Mutable — anyone with access can edit it Unsigned — there is no way to prove integrity Operator-bound — verification requires trusting whoever holds the log For compliance contexts (finance, healthcare, regulated research), this is not sufficient. You need tamper-evident evidence that can be verified by third parties without trusting you. Solution Add protect-mcp to your Claude Code project: Hook Configuration Add the following to your project's .claude/settings.json: What each hook does PreToolUse — Runs BEFORE the tool executes. Evaluates the tool call against your Cedar policy file. If Cedar returns deny, the hook exits with code 2 and Claude Code blocks the tool call entirely. PostToolUse — Runs AFTER the tool completes. Signs a receipt containing the tool name, input hash, output hash, decision, policy digest, and timestamp. Writes the receipt to ./receipts/<timestamp>.json. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills wshobson/protect-mcp-setup