INDEPENDENT / LOCAL-ONLY / PUBLIC-SAFE

MCP authorization proofs, with the limits left in.

Public reference fixtures for inspecting resource, audience, scope, session, token-handling, and selected signed-agent boundaries around synthetic MCP-shaped tool calls — plus a plug-in runtime gate for tool execution.

CLAIM BOUNDARYControlled fixture mechanics and a library-level tool gate. This is not complete MCP or OAuth conformance, a production SOC, an external-server assessment, independent certification, or a guarantee about unknown defects.

ORIGINAL LOCAL TESTS42

ORIGINAL MCP TESTS9

ORIGINAL SCENARIOS8

ORIGINAL MUTATIONS CAUGHT13/13

DEMO REEL · HOST RECEIPT

Closed loop on film — not a mock.

Same energy as the X closed-loop posts: run the gate, show PASS/REFUSE, leave a receipt. Live film uses a host-captured mcp-assure check transcript (0.3.2) — re-run yourself.

Open the mcp-assure demo reel → · raw log mcp-assure-check.txt

RUNTIME CONTROL PLANE (LIBRARY)

mcp-assure — the model proposes; the gate decides.

mcp-assure is an open-source security CLI and runtime for MCP-style tool calls: policy packs, argument constraints, optional resource/audience binding checks, velocity and blast limits, freeze mode, hash-chained decision receipts, and a local mcp-assure check control-plane health command. Middleware does not execute a tool handler on DENY or DRY_RUN. Zero runtime dependencies for the core package. Optional FastMCP middleware and a proactive campaign watch address agentic tool-plane abuse shapes. It is a runtime gate, not a hosted code vulnerability scanner.

CORE PROPERTY TESTSP1–P12

CLAIMED CONTROL SETP1–P12

PURPLE FIXTURES6

POLICY PACKS4

allowlisted tool executes

unknown tool

forbidden / extra args

lab-only without lab_mode

resource / audience mismatch

velocity ceiling

receipt tamper detected

model note cannot force ALLOW

FastMCP on_call_tool DENY (optional)

proactive path/template block

campaign swarm escalate/freeze

CLAIM BOUNDARYThis is a plug-in library for tool authorization and audit, not a full SOC, not a scanner replacement, and not a complete OAuth authorization server. Adaptive campaign scoring does not claim to stop frontier agent breakouts end-to-end (data-plane RCE, K8s, mesh remain host-owned). Effectiveness requires the host to route tool execution through the gate. CI and local pytest / python -m mcp_assure purple are the re-runnable proofs — not production-at-scale evidence.

pip install mcp-assure
mcp-assure status
mcp-assure check              # purple + campaign detector (CI)
mcp-assure evaluate --tool echo --args-json '{"text":"hi"}'
python examples/host_demo.py
# optional FastMCP: pip install "mcp-assure[fastmcp]"

github.com/StellarRequiem/mcp-assure threat model claim gate CI

THE BOUNDARY

Make the allowed path boring. Make the denied path explicit.

The fixture holds one synthetic clean control beside negative paths. It records what is allowed, what is refused, and which assumptions the verifier itself is challenged to catch.

01 / ALLOW

Minimal read

A synthetic subject with the exact resource and records:read scope can initialize and read fixture data.

02 / DENY

Binding failures

Missing bearer, wrong resource, and wrong audience refuse before a tool result is returned.

03 / DENY

Authority failures

Insufficient scope, session replay by another subject, and downstream-token passthrough are refused.

04 / VERIFY

Evidence challenge

Known-bad mutations such as scope bypass and audience bypass must fail the verifier rather than become a pass.

OBSERVED FIXTURE OUTCOMES

clean minimally scoped read

missing bearer

resource mismatch

audience mismatch

insufficient scope

session replay

token passthrough

external host preflight

SECOND IMPLEMENTATION BOUNDARY

FastMCP native middleware, under the same narrow contract.

A separate operator-owned FastMCP 3.4.4 fixture carries a synthetic Ed25519 signed-agent envelope through native on_call_tool middleware on stateless JSON Streamable HTTP. It initializes, discovers one static read-only tool, and records a clean control beside explicit refusals.

FASTMCP TESTS7

FASTMCP SCENARIOS6

LOCAL GATE TESTS31

SEEDED MUTATIONS CAUGHT40/40

clean signed read and discovery

missing signed envelope

forged agent signature

replayed operation

revoked key

non-loopback host before fetch

REPRODUCTION BOUNDARYThe source below reproduces the seven FastMCP integration tests and six-scenario contract. The evidence snapshot also records a broader local suite of 114 passing tests, including 107 Node tests and 7 FastMCP Python tests. It does not establish cross-framework interoperability, FastMCP-wide security, an MCP identity standard, or HTTP authorization-status behavior: denied FastMCP tool calls are MCP tool errors, and report statuses are fixture-policy classifications.

run the FastMCP fixture scenario receipt evidence snapshot source

RECOVERY-BOUNDARY REFERENCE

Replay state must fail closed when it cannot be trusted.

A small local filesystem fixture records a SHA-256 operation digest in an exclusively created JSON file. A valid existing record is a replay; a malformed record is not silently forgiven. Both paths refuse the synthetic operation without calling an external service.

PUBLIC REPLAY TESTS6

LOCAL PROCESS CONTROLS3

IDENTITY SCENARIOS16

SEEDED MUTATIONS CAUGHT48/48

first digest-only claim

valid persisted replay

twelve-process contention

fresh-process replay

malformed marker

interrupted marker

REPRODUCTION BOUNDARYThe source below reproduces six replay-record tests, including local child-process checks. The evidence snapshot separately records the broader local signed-agent fixture: 25 identity/replay tests, a 16-scenario contract, 38 evidence-gate tests, and 48 planted mutations detected. Neither result establishes forced process-kill or power-loss recovery, distributed coordination, replication, backup/retention behavior, or production replay safety.

run the replay-record fixture direct test source sanitized scenario receipt evidence snapshot source

ENGAGEMENT MODEL

Start with the boundary, then leave a testable handoff.

This work is scoped as an authorization-control assessment and reproducible test-fixture engagement. It is not presented as certification, a complete audit, or a guarantee about a production system.

01 / SCOPE

Map the allowed surface

Agree the owned system, authorization questions, safe test method, out-of-bounds areas, and the decision-maker for external action.

02 / REPRODUCE

Build the smallest useful proof

Turn the agreed boundary into clean controls, negative paths, and a local receipt a team can run again.

03 / VERIFY

Challenge the evidence

Test the verifier with known-bad mutations, record limitations, and separate a lead from a supported result.

04 / HAND OFF

Leave usable artifacts

Deliver the reproduction command, evidence notes, limitations, and a prioritized next-control plan for the owner.

ENGAGEMENT BOUNDARYNo client credentials, live production access, external scanning, deployment, or publication is assumed. Those require explicit written scope and a separate approval gate.

CLIENT-READABLE SAMPLE

See the review format, not just the method.

The public synthetic sample turns two operator-owned local fixture receipts into an authority map, boundary table, evidence summary, engagement shape, and downloadable six-page report.

SAMPLE BOUNDARYIt is a synthetic demonstration, not a client result, production assessment, MCP or OAuth conformance result, certification, or independent validation.

open the review sample download the PDF inspect evidence.json

RUN THE REFERENCE

One self-contained local test file.

node --test mcp-assurance/lab/mcp-authz-reference.test.mjs

The public reference fixture binds only to an ephemeral localhost server and uses synthetic labels. See the evidence snapshot and source before drawing a stronger conclusion.

evidence.json README reference test FastMCP #4401 FastMCP #4402