wireforge-core

SR2026 address check in 30 seconds

CBPR+ SR2026 makes structured debtor/creditor postal addresses (TwnNm + Ctry in dedicated fields) mandatory on 2026-11-14. Batch-scan your outbound pacs.008 / pacs.004 / pacs.003 / pain.001 store before the deadline:

bash

Copy

cargo install --git https://github.com/hanmahong5-arch/wireforge-core wf-cli
wf xform address-check outbox/     # exit 0 = compliant, 1 = gaps, 2 = unreadable

Runs entirely on your machine — no message ever leaves it. CI-ready exit codes. This is a structural presence DETECTOR for the cited SR2026 rule, not a full CBPR+ validation and not a certification; details below.

What is this?

Wireforge is a local-first toolkit for financial wire messages — a CLI (wf), an AI-agent server (wf-mcp, 13 read-only MCP tools), and the Rust crates underneath. It exists because four problems keep landing on payment teams' desks:

Who it's for: payment/integration engineers wiring compliance gates into CI, compliance teams sizing their SR2026 backlog, migration teams needing regression evidence, and AI-agent users who want a safe read-only tool for message forensics.

Start here → User Guide — task-oriented manual for every command, CI recipes included. No Rust knowledge required.

For developers: the crates

Apache-2.0 Rust crates for parsing, building, and reasoning about financial wire messages. Today covers ISO 8583 (three on-the-wire dialects + runtime-loadable field specs), SWIFT MT (structural + tag-level semantic decoders, plus a typed facade), ISO 20022 / MX (inbound parse via a typed facade), MT↔MX truncation diffing, EBCDIC (CP037 / CP500), China GM/T crypto (SM3 / SM4 / SM2, functional — not 密评-certified), and the .wf flat-file format for capturing message specs under Git.

Scope & honesty (wf-xform): it compares pacs.008.001.08 against MT103 over five core roles and is SYNTHETIC-validated only (no real production samples yet); it is a DETECTOR, not a converter, and makes no certification, conformance, or equivalence claim.

tools/sample-sanitize/ is a standalone (out-of-workspace) binary that redacts PAN / track data from real ISO 8583 hex samples; see docs/sample-policy.md for the redaction contract.

5-minute try

No clone needed — install wf straight from the repo and parse one sample ISO 8583 frame:

cargo install --git https://github.com/hanmahong5-arch/wireforge-core wf-cli
echo "303230302000000000000000303030303030" | wf parse -

You should see a tree with MTI = 0200, the bitmap, and field 3 ("Processing Code") decoded. If something looks off — wrong field, a crash, anything — please file an issue using the feedback template. Honest reports beat polished stars.

Prebuilt binaries for Linux / macOS / Windows are attached to each GitHub release.

Quick start (CLI from source)

cargo install --path crates/wf-cli
echo "303230302000000000000000303030303030" | wf parse -

Output: a tree showing MTI, bitmap, and decoded fields. ISO 8583 auto-sniffs across HybridAscii / FullAscii / FullBinary dialects; pass --dialect <name> to force one.

Add -v / -vv / -vvv for info / debug / trace logging on stderr (stdout stays machine-clean); at trace, the raw input buffer is hex-dumped. RUST_LOG overrides the level. Logs are local-only — no telemetry.

SR2026 address-compliance gate (CLI)

CBPR+ SR2026 makes a structured debtor/creditor postal address (TwnNm + Ctry in dedicated PstlAdr fields) mandatory on 2026-11-14. Scan your outbound message store before the deadline:

wf xform address-check outbox/             # scan a directory of *.xml
wf xform address-check a.xml b.xml c.xml   # one or more explicit files
cat msg.xml | wf xform address-check -     # one envelope from stdin

The message type (pacs.008.001.08 / pacs.004.001.09 / pacs.003.001.08 / pain.001.001.09) is auto-detected per file, and the process exits with a diff-style code so the check drops straight into CI:

• 0 — every input is compliant
• 1 — ran cleanly, but at least one input is non-compliant
• 2 — at least one input could not be checked (unreadable / unparseable / unsupported message type)

One unreadable file does not abort the batch — it is reported and folded into the exit code. A directory scan is one level, *.xml only, sorted (recursive scan is not yet built). This is a structural presence DETECTOR for the one cited SR2026 rule — not a full CBPR+ validation and not a certification; all fixtures are SYNTHETIC.

--format text|json|csv selects the output shape: text (default, human- readable), json (machine-readable, carries a schema_version field for CI pipelines), or csv (RFC-4180, one row per file/party, for spreadsheets and data pipelines). Each per-party row also carries a remediation field — actionable fix guidance naming the missing structured field(s) — a DETECTOR hint, not an auto-fix.

Quick start (MCP, for AI agents)

Claude Desktop: download wireforge.mcpb and open it (Settings → Extensions) — the bundle carries macOS (Apple Silicon) and Windows binaries. The server is on the MCP Registry as io.github.hanmahong5-arch/wireforge.

Other stdio clients: install the binary —

cargo install --path crates/wf-mcp

— then wire it into your MCP-aware client. For Claude Code, add to ~/.claude/settings.json:

{
  "mcpServers": {
    "wireforge": { "command": "wf-mcp" }
  }
}

The agent can now call 13 tools: