@cubiczan/chp-mcp

One-command MCP install for CHP Profile B spend / capital gates and tool-approval receipts (an allowlist is not authorization), plus a structured deny ledger and receipt-gated finance tools.

Wraps @cubiczan/chp so Cursor, Claude Code, or any MCP client can call evaluate_spend_gate without vendoring protocol code. Engine digests match the normative golden vectors (Profile B 30/30).

How the pieces fit

MCP client (Cursor / Claude / …)
        │  tools/call
        ▼
┌───────────────────────────┐
│  MCP server (transport)   │  ← you are here (@cubiczan/chp-mcp)
│  evaluate_spend_gate      │
│  approve_spend            │
│  evaluate_tool_approval   │  allowlist ≠ authorization
│  issue_approval_receipt   │
│  authorize_tool_call      │
│  request_authorization    │  finance-tool receipt / HITL / deny
│  place_equity_order       │  scoped + receipt-gated (synthetic)
│  wire_treasury_transfer   │
│  rebalance_portfolio      │
│  inspect_audit_ledger     │  CHP-signed deny / authorize / execute
│  chp_content_hash         │
└─────────────┬─────────────┘
              │ depends on
              ▼
┌───────────────────────────┐
│  Published CHP packages   │
│  npm:  @cubiczan/chp                 (Profile B)
│  PyPI: consensus-hardening-protocol  (Profile A)
└───────────────────────────┘

For AGENTS.md + skills + Profile A decision_gate / decision_adversary, use agent-conductor instead.

Install

npm install -g @cubiczan/chp-mcp
# or one-shot
npx -y @cubiczan/chp-mcp

Cursor / Claude Desktop

{
  "mcpServers": {
    "chp": {
      "command": "npx",
      "args": ["-y", "@cubiczan/chp-mcp"]
    }
  }
}

Claude Code

claude mcp add chp -- npx -y @cubiczan/chp-mcp

Tools

Example — evaluate a spend

// tools/call evaluate_spend_gate
{
  "action": { "action": "LONG", "asset": "ETH", "notional": 300, "confidence": 0.9 },
  "policy": {
    "max_notional": 500,
    "daily_cap": 2500,
    "hitl_threshold": 250,
    "min_confidence": 0.55,
    "allowed_actions": ["LONG", "SHORT"]
  }
}

Cookbook — Claude / Cursor tool approval

Managed MCP allowlists (Cursor mcpServers, Claude Desktop, Claude Code) only answer “is this tool name installed?”. They do not bind tenant, arguments, risk, or a human decision. This server treats that gap as a hard deny unless a signed approval receipt still matches the call that is about to run.

Receipts are HMAC-SHA256 over CHP canonical JSON (the same payload discipline as Profile B contentHash / audit-ledger sig). The MAC covers:

Set CHP_RECEIPT_KEY (or AUDIT_LEDGER_KEY) in the MCP server env. Without it the process falls back to a documented insecure default — fine for the local cookbook, not for production.

Example policy: examples/tool-approval-policy.json. stripe.create_charge is on the allowlist and still cannot run without a receipt bound to acct_live_acme and the exact charge args. Host-injected tenant/index bindings use examples/host-injected-policy.json (see the host-injected args cookbook below).

{
  "mcpServers": {
    "chp": {
      "command": "npx",
      "args": ["-y", "@cubiczan/chp-mcp"],
      "env": { "CHP_RECEIPT_KEY": "replace-me" }
    }
  }
}

1. Allowlist alone — denied

Claude/Cursor has stripe.create_charge enabled. That is not a grant.

// tools/call evaluate_tool_approval
{
  "call": {
    "tool": "stripe.create_charge",
    "resource": "acct_live_acme",
    "arguments": { "amount": 2500, "currency": "usd", "customer": "cus_123" }
  },
  "policy": { "$ref": "examples/tool-approval-policy.json" }
}

Result: RECEIPT_REQUIRED, deny_code: "allowlist_is_not_authorization".

Calling authorize_tool_call with the same payload and no receipt returns DENIED / allowlist_is_not_authorization.

2. Human allow — then authorize

// tools/call issue_approval_receipt
{
  "actor": "cfo@acme.example",
  "decision": "allow",
  "reason": "invoice INV-104 matches amount",
  "ttl_seconds": 120,
  "call": { /* same as above */ },
  "policy": { /* same as above */ }
}

The response includes receipt (take the whole object) and decision_log (actor, decision, args hash, nonce). Pass that receipt into authorize_tool_call with the same call. Result: AUTHORIZED.

3. Human deny

Issue with "decision": "deny". The decision is logged. Authorizing with that receipt returns DENIED / human_denied. A deny receipt cannot be flipped to allow by editing decision — the MAC breaks.

4. Changed arguments after approval — denied

Approve { "amount": 2500, ... }, then authorize with { "amount": 2500000, ... }. Result: DENIED / changed_arguments. Key order does not matter; the hash is CHP canonical. The original receipt remains valid for the args that were approved (until expiry or a successful consume).

5. Expired receipt — denied

Issue with ttl_seconds: 30. After the expiry instant, authorize_tool_call returns DENIED / expired_receipt. The nonce is consumed so a clock rewind cannot resurrect it.

6. Replayed receipt — denied

A successful AUTHORIZED consume burns the nonce. Presenting the same receipt again returns DENIED / replayed_receipt.

7. Ambiguity — denied

These never produce a usable allow receipt:

• resource: "*", any, all, or an empty string
• missing arguments
• policy without a concrete version
• actor / tool wildcards
• extra keys on a receipt (strict parse)

Fail-closed: deny_on_ambiguity cannot be turned off.

Cookbook — host-injected args + gateway _meta

Semantic Kernel and other hosts need to pass index, key, and tenant without letting the model choose them (SO-style routing). Putting those fields on the tool schema so the LLM can “decide” is the bug. An MCP allowlist does not fix it: the tool name can stay allowlisted while the model swaps index_name to another tenant.

The host (or a gateway in front of this server) injects bound fields. This package hashes host ∪ model arguments into the receipt and denies when the model overrides a host-bound field. The allowlist is still only a pre-filter.

Contract — _meta.cubiczan (no hard dependency)

@cubiczan/governed-mcp-gateway already injects identity on every tools/call and SSE frame:

{
  "_meta": {
    "cubiczan": {
      "principal": {
        "id": "agt_search",
        "kind": "agent",
        "orgId": "org_acme",
        "displayName": "Search Runner"
      }
    }
  }
}

This server does not import that package. It reads the same envelope. Hosts MAY add host_bound next to principal. A trusted gateway should overwrite _meta.cubiczan so the model cannot self-attest.

{
  "_meta": {
    "cubiczan": {
      "principal": { "id": "agt_search", "kind": "agent", "orgId": "org_acme" },
      "host_bound": { "tenant_id": "acme", "index_name": "prod-docs" }
    }
  }
}