# Fronesis-Labs/dcl-webhook [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Fronesis-Labs/dcl-webhook  
**GitHub Stars:** 1  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/fronesis-labs-dcl-webhook

## Description
Deterministic AI audit layer: evaluates LLM/agent outputs against configurable policies (jailbreak, safety, quality, wallet, trade, MEV compliance) and writes every verdict to a tamper-evident SHA-256 hash chain — metadata only, never raw content. 17 tools including a full crypto-trading compliance suite. Pay-per-call via x402 (USDC on Base), from $0.01. mcp.fronesislabs.com/mcp

## Tools
Capabilities this server exposes over MCP:

- **dcl_evaluate_fast** — FAST Pre-Action Audit ($0.01). Runs the response through the server's "default" policy: a substring check against 3 forbidden phrases ("ignore previous instructions", "jailbreak", "bypass safety") with a 0.7 minimum-confidence threshold. Each forbidden match found costs 0.4 confidence; if confidence falls below 0.7, or any match is found, the verdict is NO_COMMIT and `reason` lists which phrase triggered it. Otherwise COMMIT. Use this as the default low-cost first-pass gate before a risky agent action; switch to dcl_evaluate_strict for a broader, higher-bar check, or to dcl_evaluate_jailbreak / dcl_evaluate_safety / dcl_evaluate_quality for a narrower, single-topic check instead of the general-purpose default policy.
- **dcl_evaluate_strict** — STRICT Pre-Action Audit ($0.05). Runs the response against a broader, higher-bar "strict" policy: the union of all forbidden phrases from the default, anti-jailbreak, and safety policies (8 phrases total), with a 0.85 minimum-confidence threshold instead of the default policy's 0.7. Each matched phrase costs 0.4 confidence; if confidence falls below 0.85, or any phrase matches, the verdict is NO_COMMIT with `reason` listing every match found. Use this instead of dcl_evaluate_fast when the cost of a false COMMIT is high — e.g. before an irreversible or high-stakes agent action — since it catches jailbreak- and safety-adjacent phrasing that the plain default policy would miss.
- **dcl_evaluate_jailbreak** — PRE-ACTION Instruction Adherence Check ($0.02). Runs the "anti_jailbreak" policy: a substring check against 6 forbidden phrases ("ignore previous instructions", "jailbreak", "bypass safety", "pretend you are", "act as if", "DAN") with a 0.8 minimum-confidence threshold — each match costs 0.4 confidence. Returns COMMIT if no phrase matches and confidence stays at or above 0.8, otherwise NO_COMMIT with `reason` listing the matched phrase(s). Use this as a targeted, cheaper check when the concern is specifically prompt-injection / persona-hijack risk; use dcl_evaluate_strict instead when you also want safety- and default-policy phrases covered in the same call.
- **dcl_evaluate_safety** — PRE-ACTION Baseline Safety Check ($0.01). Runs the "safety" policy: flags 2 forbidden disclaimers ("I cannot be held responsible", "no guarantees") and additionally REQUIRES the substring "AI" to appear somewhere in the response — missing it costs 0.2 confidence even with no forbidden phrase present. Minimum confidence is 0.75. Returns NO_COMMIT if confidence drops below 0.75, with `reason` naming the forbidden phrase found or the missing required pattern. Use this when you specifically need to confirm an AI-disclosure marker is present and the two disclaimer phrases are absent — not as a general-purpose safety net; for broader coverage use dcl_evaluate_fast or dcl_evaluate_strict instead.
- **dcl_evaluate_quality** — PRE-ACTION Content Quality & Drift Check ($0.03). Runs the "content_quality" policy: flags 12 absolutist or unverifiable-claim phrases (e.g. "guaranteed returns", "100% accurate", "studies show", "without a doubt") with a 0.85 minimum-confidence threshold — the highest bar of any single-policy tool. Returns NO_COMMIT if any phrase matches or confidence falls below 0.85, with `reason` listing the matched phrase(s). Use this to catch overconfident or unsubstantiated claims in generated content — a different concern from jailbreak or safety phrasing — e.g. before publishing agent-written copy or reports.
- **dcl_evaluate_secrets** — POST-ACTION Secret & Credential Leak Scan ($0.02). Regex-based scan across 8 categories (API keys, cloud credentials, tokens/JWTs, private keys, DB URLs, connection strings, env assignments, webhook secrets, internal endpoints with auth). Any finding results in NO_COMMIT.
- **dcl_evaluate_pii** — POST-ACTION PII Detection Scan ($0.02). Regex-based scan across 8 personal-data categories, with a Luhn checksum on card numbers to reduce false positives. Any finding results in NO_COMMIT.
- **dcl_evaluate_batch** — PRE-ACTION Bulk Processing ($0.10). Evaluates a list of items in one call; each item is a dict shaped {"response": str, "policy"?: str}, where policy defaults to "default" if omitted and may be any built-in policy name (default, strict, anti_jailbreak, safety, content_quality). Each item gets its own independent COMMIT/NO_COMMIT verdict via the same logic as the matching single-item evaluate_* tool; results are returned in input order under `results`, plus a shared `batch_id`. Capped at 200 items per call — oversized batches are rejected. Use this instead of multiple single-item evaluate_* calls when checking several responses — optionally against different policies — in one priced call rather than paying per item separately.
- **dcl_pipeline_start** — SESSION Management ($0.05). Generates a new `pipeline_id` and returns session metadata (scope, expiry, initial drift_mode) for organizing a series of related checks under one identifier. Note: this call does not currently link the returned pipeline_id to later evaluate_* calls — there is no server-side session state that ties subsequent audits back to it; it is an identifier/timestamp issuer, not an active tracking session. Use this to obtain a shared reference ID for your own client-side grouping of a multi-step audit sequence; do not rely on it to automatically aggregate drift across calls.
- **dcl_audit_decode** — POST-ACTION Basic Audit ($0.10). Retrieves a record from the tamper-evident chain by tx_hash.
- **dcl_audit_decode_deep** — POST-ACTION Deep Forensic Audit ($0.50). Extended output with drift_context and full chain integrity verification.
- **dcl_evaluate_jailbreak_crypto** — PRE-ACTION Crypto Jailbreak & Injection Detection ($0.02). Crypto-specialized instruction-override/jailbreak/injection screen: standard role-switch and instruction-override patterns, plus crypto-specific drain-wallet injection (e.g. "transfer all funds to...", fake "test transaction" requesting full balance) and unlimited-approval injection (e.g. type(uint256).max, "approve unlimited allowance", skip-slippage-confirmation framing). Any match returns NO_COMMIT with `reason` and `findings` naming the matched category/categories; run this FIRST in the DCL crypto pipeline, before wallet/trade/MEV checks, since it screens the input itself rather than a decision built on top of it.
- **dcl_evaluate_wallet** — POST-ACTION Wallet Secret Guardian ($0.02). Scans for BIP-39 seed phrases (12 or 24 consecutive wordlist words), raw hex or WIF-format private keys, Ethereum/Bitcoin wallet addresses, and API keys/bearer tokens appearing near wallet/custody/signing terminology. Any finding results in NO_COMMIT — wallet secrets have no safe threshold, unlike other DCL evaluators. Returns a `sanitized_output` with all matches redacted (null if nothing was found) and a masked `redacted_sample` per finding — the real value is never returned or stored server-side.
- **dcl_evaluate_trade** — PRE-ACTION Trade Decision Verifier ($0.02). Screens trade-decision language for guaranteed-return claims, zero-risk/"can't lose" framing, and unqualified "buy/sell X now" directives — any match is NO_COMMIT. If no unsafe language is found, COMMIT additionally requires the word "risk" to appear anywhere in the text as a minimum disclosure marker; its absence alone triggers NO_COMMIT with `reason` noting the missing disclosure. Produces an immutable `trade_receipt` (tx_hash/chain_hash/chain_depth) distinct from the top-level audit hash, for downstream systems that specifically need a trade-shaped receipt object.
- **dcl_evaluate_mev** — POST-ACTION MEV & Market-Abuse Compliance Screen ($0.03). Text-level screen (not a mempool/transaction analyzer) for front-running/sandwich-attack language, wash trading/layering/spoofing, KYC/AML red flags (mixers, structuring, obscuring fund origin), and pump-and-dump/rug-pull language. Any critical-severity finding, or two or more major-severity findings, returns NO_COMMIT; a single major-severity finding is also returned as NO_COMMIT but with a distinctly higher `confidence` (~0.55 vs ~0.05-0.2 for harder violations) so downstream callers can tell a soft single flag apart from a hard multi-finding block. Each finding includes an illustrative `regulatory_reference` tag (MiFID II, FCA, or an EU AI Act article).
- **dcl_evaluate_signal** — POST-ACTION Market Signal Fabrication Screen ($0.03). Pattern-based heuristic on the output text alone (no source price feed) — flags guaranteed-price-prediction language ("will definitely hit $X"), absolute-certainty claims ("100% certain", "cannot go down"), a fabricated-price flag when a specific dollar figure co-occurs with a guaranteed-outcome claim, and an invented-token flag when a "$TICKER" cashtag doesn't match a small set of well-known symbols (false positives are possible for legitimate lesser-known tickers — this is a heuristic pre-check, not ground truth). For a full claim-by-claim check against an actual price-feed snapshot, use the local grounding workflow instead of this live tool. Verdict/confidence collapsing follows the same rule as dcl_evaluate_mev: any critical finding or 2+ major findings is a hard NO_COMMIT; exactly one major finding is a softer NO_COMMIT at ~0.55 confidence.
- **dcl_evaluate_output_sanitizer** — FINAL-GATE Output Sanitizer ($0.02). Post-processing checkpoint that strips secrets/credentials, PII, crypto material (seed phrases, private keys, wallet addresses), internal network details (private IPs, MAC addresses, .internal/.local/.corp hostnames), and unsafe shell/SQL/path-traversal fragments from a raw model response — plus a narrow, high-precision safety net for direct self-harm-instruction-seeking and targeted-harassment phrasing (not a general toxicity classifier). Returns a single `sanitized_output` with every match replaced by `[REDACTED]`; use that instead of the original whenever verdict is NO_COMMIT. Run this as the LAST gate before a response reaches its destination — after `dcl_evaluate_jailbreak_crypto`/other input-side checks have already run, and immediately before `dcl_commit` seals the final decision. Internally re-uses the same detection tables as `dcl_evaluate_secrets`/`dcl_evaluate_pii` for the secrets/PII categories, so results stay consistent with those tools.
- **dcl_commit** — FINAL-STEP Leibniz Layer Crypto Commit ($0.01). Writes a trading/agent decision to the append-only Leibniz Layer audit chain and returns a Merkle-proof-style receipt: `tx_hash` (proof of this specific commit), `chain_hash` (the previous commit's hash, linking this one into the chain), and `chain_depth` (this commit's position in the chain). Unlike the evaluate_* tools, this call has no pass/fail verdict of its own — it always succeeds and simply seals the decision. Passing `prior_checks` is optional but recommended: it records which earlier pipeline steps (firewall/wallet/trade/MEV) this specific commit is downstream of, in one auditable record. Always run this LAST, after every other crypto-suite check has passed.

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "dcl-webhook": {
    "url": "https://mcp.fronesislabs.com/mcp"
  }
}
```

## Documentation & README

# DCL Trust Oracle

[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
[![MCP](https://img.shields.io/badge/MCP-compatible-green.svg)](https://modelcontextprotocol.io)
[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
[![dcl-webhook MCP server](https://glama.ai/mcp/servers/Fronesis-Labs/dcl-webhook/badges/score.svg)](https://glama.ai/mcp/servers/Fronesis-Labs/dcl-webhook)
[![Smithery](https://img.shields.io/badge/Smithery-listed-orange.svg)](https://smithery.ai/servers/fronesislabs/dcl-trust-oracle)

**Don't trust the agent. Trust the proof.**

Autonomous AI agents now take actions with real consequences — financial,
legal, reputational. Most of them are black boxes: no record of what was
decided, why, or whether that decision was tampered with afterward.

DCL Trust Oracle closes that gap. Every agent output is evaluated against
policy in real time and sealed into a tamper-evident hash chain — a
deterministic, cryptographically verifiable record of what happened and
when. Edit any past entry and the entire chain invalidates. No one — not
even Fronesis Labs — has to be trusted for the record to hold up.

## What It Does

DCL Trust Oracle provides deterministic policy evaluation for LLM outputs
with a tamper-evident audit chain. The system stores only cryptographic
hashes and decision metadata — **never raw content** — enabling verifiable,
post-action forensic analysis across distributed AI agents.

Available two ways:

- **REST API** (`webhook_server.py`) — direct HTTP integration.
- **MCP Server** (`mcp_server.py`) — native Model Context Protocol
  integration for AI agents. Live at `https://mcp.fronesislabs.com/mcp`
  (streamable-http). Also listed on [Smithery](https://smithery.ai/servers/fronesislabs/dcl-trust-oracle)
  (remote URL → same production endpoint; see `smithery.yaml`) and the
  [official MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=com.fronesislabs%2Fdcl-trust-oracle).

Both servers share the same evaluation logic and tamper-evident chain
(`dcl_core.py`), and are priced identically.

## Quick Start

### REST API
```
pip install -r requirements.txt
python webhook_server.py
```
Server runs on `http://localhost:8080`

### MCP Server

**Production (hosted):**
```
https://mcp.fronesislabs.com/mcp
```
Streamable HTTP transport — point any MCP client here directly, no setup required.

**Local development:**
```
pip install -r requirements.txt
python mcp_server.py
```
Server runs on `http://localhost:8081` (streamable-http transport)

## Tools & Endpoints

### Pre-Action Evaluation

Catch a bad output *before* it reaches a user, a wallet, or downstream
system.

| REST Endpoint | MCP Tool | Price | Description |
| --- | --- | --- | --- |
| `POST /evaluate/fast` | `dcl_evaluate_fast` | $0.01 | Fast policy check for low-risk outputs. Returns tamper-evident `tx_hash`. |
| `POST /evaluate/strict` | `dcl_evaluate_strict` | $0.05 | Deep analysis for high-stakes outputs with higher confidence thresholds. |
| `POST /evaluate/jailbreak` | `dcl_evaluate_jailbreak` | $0.02 | Instruction adherence check — detects prompt injection patterns and role-hijacking attempts. |
| `POST /evaluate/safety` | `dcl_evaluate_safety` | $0.01 | Baseline screening for known harmful text patterns. Optimized for high throughput. |
| `POST /evaluate/quality` | `dcl_evaluate_quality` | $0.03 | Content quality & drift check — evaluates format adherence and contextual drift. |
| `POST /evaluate/batch` | `dcl_evaluate_batch` | $0.10 | Bulk processing — up to 200 items per MCP call (REST default `max_items`: 20). Cost-effective for multi-turn history. |

### Session Management

| REST Endpoint | MCP Tool | Price | Description |
| --- | --- | --- | --- |
| `POST /pipeline/start` | `dcl_pipeline_start` | $0.05 | Initializes a long-running audit session for continuous drift tracking. Returns `pipeline_id`. |

### Post-Action Forensics

When something *did* go wrong, reconstruct exactly what happened.

| REST Endpoint | MCP Tool | Price | Description |
| --- | --- | --- | --- |
| `GET /audit/{tx_hash}` | `dcl_audit_decode` | $0.10 | Basic post-action audit — returns verdict, confidence, agent_id, reason by `tx_hash`. |
| `GET /audit/{tx_hash}/deep` | `dcl_audit_decode_deep` | $0.50 | Deep forensic audit — includes drift context, tamper-evidence indices, environmental metadata. |

### Post-Action Scans

| REST Endpoint | MCP Tool | Price | Description |
| --- | --- | --- | --- |
| `POST /evaluate/secrets` | `dcl_evaluate_secrets` | $0.02 | Secret & credential leak scan. |
| `POST /evaluate/pii` | `dcl_evaluate_pii` | $0.02 | PII detection scan. |

### DCL Update Sentinel (Continuous Skill Monitoring)

Continuous security auditing and release verification for AI Agent Skills and GitHub repositories. Sentinel monitors code updates via GitHub Webhooks, blocks regressions against your security baseline, and automatically recovers skill status upon clean rescans.

| REST Endpoint | Price | Description |
| --- | --- | --- |
| `POST /sentinel/register` | $49.00 / 30d | Register a skill/repo for continuous monitoring. Requires passing initial baseline audit (`score >= 0.80`; returns `HTTP 422` if failed). Issues `webhook_secret`. |
| `POST /sentinel/webhook/{webhook_secret}` | Free | GitHub Webhook receiver. Audits new release tags, blocks regressions, and logs tamper-evident events. |
| `POST /sentinel/scan` | $0.05–$0.50 | Pay-per-call repository audit (`update_rescan`, `deep_scan`, `forensic_audit`). |
| `GET /sentinel/status/{repo_full_name}` | Free | Query skill security status (`active`, `blocked`, `unregistered`) and last known good version. |
| `POST /sentinel/renew` | $49.00 / 30d | Extend 30-day monitoring entitlement for a registered skill (owner-verified). |
| `GET /sentinel/prices` | Free | Returns current price breakdown for Sentinel services. |

#### Key Features of Sentinel:
- **Idempotent Webhook Processing:** Built-in protection against duplicate GitHub delivery retries (`X-GitHub-Delivery` tracking).
- **Auto-Recovery:** Skills blocked due to security regressions (`status: blocked`) are automatically restored to `active` once a clean, policy-compliant release is published.
- **Strict Owner Verification:** Subscription renewals require cryptographic signature match with the registered owner's wallet (`owner_payer_ref`).
- **Baseline Policy Gate:** Registration requires a passing initial audit (`score >= 0.80`). Compromised or failing repositories are rejected immediately (`HTTP 422`) to prevent invalid entitlement setup.

### Crypto & Trading Compliance (MCP only)

These tools are exposed on the live MCP server only (no REST routes in `webhook_server.py`).

| MCP Tool | Price | Description |
| --- | --- | --- |
| `dcl_evaluate_jailbreak_crypto` | $0.02 | Crypto-specific jailbreak & injection detection. |
| `dcl_evaluate_wallet` | $0.02 | Wallet secret guardian. |
| `dcl_evaluate_trade` | $0.02 | Trade decision verifier. |
| `dcl_evaluate_mev` | $0.03 | MEV & market-abuse compliance screen. |
| `dcl_evaluate_signal` | $0.03 | Market signal fabrication screen. |
| `dcl_evaluate_output_sanitizer` | $0.02 | Output sanitizer — final gate. |
| `dcl_commit` | $0.01 | Leibniz Layer crypto commit — seal a decision to the audit chain. |

### Utility (free, REST only)

| Endpoint | Description |
| --- | --- |
| `GET /health` | Service status and chain length |
| `GET /policies` | List of built-in policy names |
| `GET /chain/status` | Chain integrity, drift mode, drift score |
| `GET /chain/export` | Full chain export with integrity verification |

## Example Response

```json
{
  "verdict": "COMMIT",
  "confidence": 0.95,
  "reason": "All policy checks passed",
  "tx_hash": "0x7a8f3b2c...",
  "chain_index": 42,
  "input_hash": "0x9d4e1f...",
  "policy_version": "1.0.0",
  "timestamp": 1721635200.123,
  "pipeline_id": "abc123",
  "drift_mode": "NORMAL",
  "drift_score": 0.15
}
```

## Verifying the Chain Yourself

You don't have to take the server's word for it. `tx_hash` is recomputed
from the record's own fields, not just linked to the previous row — so
anyone can independently confirm a record wasn't edited after the fact,
without calling back into this server. See
[`@fronesis-labs/dcl-sdk`](https://github.com/Fronesis-Labs/dcl-sdk) (TS/JS)
or [`dcl-core`](https://github.com/Fronesis-Labs/dcl-core) (Python) for the
free, offline verification libraries.


## Metering & Settlement

Every paid call above is metered and settled automatically via the
[x402 protocol](https://x402.org) (USDC on Base).

We support two payment models:
- **Per-Call Micropayments** ($0.01 – $0.50) for instant, on-demand evaluations.
- **30-Day Recurring Entitlements** ($49.00) for continuous skill monitoring via DCL Update Sentinel.

This design eliminates API-key provisioning and invoicing overhead.
Per-call pricing makes large-scale agent operations practical
(an autonomous system can make thousands of evaluation calls a day).

The REST API is x402-gated via `fastapi-x402`; the MCP server uses
`paymcp` in `Mode.X402`, paying automatically for x402-aware clients and
falling back to a guided payment link for clients without a configured wallet.
Both settle to the same wallet, and neither has a bypass path —
an unpaid call simply receives no verdict.

## License

Apache License 2.0 — see [LICENSE](https://github.com/Fronesis-Labs/dcl-webhook/blob/HEAD/LICENSE).