Every AI agent action must be independently verifiable.
Inline enforcement proxy for AI agents calling MCP tools. Three-layer cryptographic attestation:
| Layer | What it does |
|---|---|
| L1 Admission | 7-dimension pre-call verification (Structure, Schema, Latency, Cost, Identity, Integrity, Security) |
| L2 Protocol Attestation | Upstream manifest fingerprint, pin & drift detection — no lying tools/list |
| L3 Execution Binding | Ed25519-signed receipt chain (JCS RFC 8785), per-call, third-party verifiable |
- 22/22 tests pass — 17 mock + 5 real NVIDIA NIM integration tests
- Zero runtime dependencies, 53KB signed tarball, GPG-verified release
- Fail-closed — deny on timeout, never silently allow
- 14-day free trial → Download
📄 Read: When the Admin Is the Attacker — CVE-2026-76404 analysis
| Package | Install | Purpose |
|---|---|---|
| ccs-mcp-server | npx ccs-mcp-server |
MCP runtime verification server (Elastic-2.0) |
| ccs-verifier | pip install ccs-verifier |
Python receipt verifier |
| ccs-verifier-action | GitHub Action | CI/CD receipt verification |
| ccs-demo | — | 6-scenario end-to-end demo |
| correctover | npm i correctover |
Node.js core SDK |
Performance: Node P50 ≈ 2.7μs (in-process core) · Python e2e P50 ≈ 27μs
- IETF Internet-Draft — draft-correctover-ccs, advancing to Experimental RFC
- CCS receipt — 22-field Ed25519-signed, JCS-canonicalized, hash-chained
- Zenodo DOI — 10.5281/zenodo.22055351 (archived specification)
Fully offline. No telemetry. No network calls. No data collection.
