Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.

protect mcp — Policy Enforcement + Signed Receipts Cryptographic governance for every Claude Code tool call. Each invocation is evaluated against a Cedar policy and produces an Ed25519 signed receipt that anyone can verify offline. Overview Claude Code runs powerful tools: Bash , Edit , Write , WebFetch . By default there is no audit trail, no policy enforcement, and no way to prove what was decided after the fact. protect mcp closes all three gaps: Cedar policies (AWS's open authorization engine) evaluate every tool call before execution. Cedar deny is authoritative. Ed25519 receipts record each decision with its inputs, the policy that governed it, and the outcome. Receipts are hash chained. Offline verification via npx @veritasacta/verify . No server, no account, no trust in the operator. Problem AI agents make decisions that affect money, safety, and rights. The Claude Code session log records what happened, but the log is: Mutable — anyone with access can edit it Unsigned — there is no way to prove integrity Operator bound — verification requires trusting whoever holds the log For compliance contexts (finance, healthcare, regulated research), this is not sufficient. You need tamper evident evidence that can be verified by third parties without trusting you. Solution Add protect mcp to your Claude Code project: Hook Configuration Installing the plugin adds both hooks from hooks/hooks.json . Each hook runs a script bundled with the plugin: Claude Code passes the hook event to the command as JSON on stdin and does not set TOOL NAME or TOOL INPUT variables. evaluate.sh reads tool name and tool input from that payload and passes them to protect mcp as flags; sign.sh reads tool name only, because the 0.7.4 signer records nothing else. Set PROTECT MCP POLICY , PROTECT MCP RECEIPTS , and PROTECT MCP KEY to change the default paths. When the policy file is missing, the PreToolUse hook prints a warning to stderr and allows the call. What each hook does PreToolUse — Runs BEFORE the tool executes. Evaluates the tool call against your Cedar policy file. If Cedar returns deny , the hook exits with code 2 and Claude Code blocks the tool call entirely. PostToolUse — Runs AFTER the tool completes. Signs a receipt containing the tool name, input hash, output hash, decision, policy digest, and timestamp. Writes the receipt to ./receipts/<timestamp .json . Cedar Policy File Create ./protect.cedar at the project root: Verification Verify a single receipt: Verify the entire chain: Use the plugin's slash commands from within Claude Code: Receipt Format Each receipt is a JSON file with this structure: Ed25519 signatures (RFC 8032) JCS canonicalization (RFC 8785) before signing Hash chained to the previous receipt via parent receipt id Offline verifiable — no network call, no vendor lookup Why This Matters Before After "Trust me, the agent only read files" Cryptographically provable: every Read logged and signed "The log shows it happened" The receipt proves it happened, and no one can edit it "You'd have to audit our system" Anyone can verify every receipt offline "Logs might be different by now" Ed25519 signatures lock the record at signing time Standards Ed25519 — RFC 8032 (digital signatures) JCS — RFC 8785 (deterministic JSON canonicalization) Cedar — AWS's open authorization policy language IETF draft — [draft farley acta signed receipts](https://datatracker.ietf.org/doc/draft farley acta signed receipts/) Related npm : [protect mcp](https://www.npmjs.com/package/protect mcp) Verify CLI : [@veritasacta/verify](https://www.npmjs.com/package/@veritasacta/verify) Source : [github.com/ScopeBlind/scopeblind gateway](https://github.com/ScopeBlind/scopeblind gateway) Protocol : [veritasacta.com](https://veritasacta.com) Integrations : Microsoft Agent Governance Toolkit (PR 667), AWS cedar policy/cedar for agents (PR 64)

protect-mcp-setup