skills.rest
SanketAdlak
SanketAdlakCOMMUNITY
Explore all skills by this author →
Website𝕏@devsanket14GitHub

protect-mcp-setup

Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls.

Updated Apr 23, 2026
Search Tags:#claude code#compliance#audit trail#policy enforcement#ed25519#cedar policy#signed receipts
One-click install
npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill protect-mcp-setup-sanketadlak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: protect-mcp-setup
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/protect-mcp-setup
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill protect-mcp-setup-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires protect-mcp, @veritasacta/verify.

What problem does it solve? Claude Code tool calls have no audit trail, no policy enforcement, and no way to prove what was decided after the fact. Session logs are mutable, unsigned, and require trusting the operator, which fails compliance requirements in finance, healthcare, and regulated research. ## Core Features & Use Cases - Cedar Policy Enforcement: A PreToolUse hook evaluates every tool call against a Cedar policy file and blocks execution when Cedar returns deny. - Ed25519 Signed Receipts: A PostToolUse hook signs a hash-chained JSON receipt for each tool call, recording inputs, outputs, decision, and policy digest. - Offline Verification: Receipts can be verified by third parties with npx @veritasacta/verify without any server, account, or trust in the operator. - Use Case: A regulated research team needs tamper-evident evidence of every agent action. After setup, each Bash, Edit, or Write call is policy-gated and produces a signed receipt in ./receipts/ that auditors can verify offline. ## Quick Start Ask the agent to install the protect-mcp plugin, add the PreToolUse and PostToolUse hooks to .claude/settings.json, create a protect.cedar policy file, and start the local receipt-signing server with npx protect-mcp serve --enforce.

Frequently Asked Questions about protect-mcp-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce policies on Claude Code tool calls?▼

Add a PreToolUse hook in .claude/settings.json that runs npx protect-mcp evaluate against a Cedar policy file. If Cedar returns deny, the hook exits with code 2 and Claude Code blocks the tool call before execution.

How do I create a signed audit trail for AI agent actions?▼

Add a PostToolUse hook that runs npx protect-mcp sign after each tool call. It writes an Ed25519-signed JSON receipt to ./receipts/ containing the tool name, input and output hashes, decision, policy digest, and a hash chain to the previous receipt.

Can signed receipts be verified without a server or account?▼

Yes, receipts are verified offline using npx @veritasacta/verify with no network calls or vendor lookup. Exit code 0 means valid, 1 means tampered, and 2 means malformed, and you can verify an entire chain by passing multiple receipt files.

What is Cedar and how does it gate tool execution?▼

Cedar is AWS's open authorization policy language used to define permit and forbid rules for tool actions. The PreToolUse hook evaluates each call against your protect.cedar file, and Cedar deny is authoritative, blocking the tool entirely.

What are the limitations of signed receipts for compliance?▼

Receipts prove what was decided and executed but require the local signing server to be running via npx protect-mcp serve --enforce. They record tool-level events only, so they do not capture reasoning or context outside the hook inputs and outputs.

Related Skills

Explore More Software Engineering Skills→
haxlyshaxlys

protect-mcp-setup

Enforce Cedar policies and generate Ed25519-signed receipts for Claude Code tool calls.

Community
Advanced
HeadyAIHeadyAI
1

heady-oracle-chain

Sign AI decision receipts and link them into a verifiable hash chain.

Official
Advanced
ArogyaReddyArogyaReddy

protect-mcp-setup

Enforce Cedar policies and generate Ed25519-signed receipts for Claude Code tool calls.

Community
Advanced
JhabbigJhabbig

signed-audit-trails-recipe

Sign Claude Code tool calls with Ed25519 receipts and hash chaining.

Community
Advanced