io.github.coderifts/api-governance

Est-ce que io.github.coderifts/api-governance est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.coderifts/api-governance » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 3 outils

• get_decision_details≈ 2073 tokens

  Retrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint): full report, breaking changes, scores, and linked receipt metadata if stored. Use this when: - You have a decision_id (or fingerprint) from a previous preflight, PR comment, or CI log and need to inspect or explain that past decision. - You are auditing why a prior ALLOW/WARN/BLOCK was issued. - You are NOT requesting a new analysis of current before/after specs. Do not use when: - You need a decision for the CURRENT uncommitted or PR head change set — call coderifts.preflight_change_set with the current artifacts. - You hold a receipt token and only need cryptographic/lifecycle verification — use coderifts.verify_receipt. - You have no identifier — run preflight first to create one. Inputs: exactly one of case_id, decision_id, or fingerprint. {} → INVALID_INPUT; two identifiers → LOOKUP_IDENTIFIER_CONFLICT; case_id → CASE_NOT_FOUND (lookup never opens a case). Returns the stored document or not_found. Scoping — fingerprint lookup returns only YOUR OWN decisions. A fingerprint is derived from content, not from an account, so two callers who preflight byte-identical specs derive the same one; the lookup is therefore constrained to the decisions your credential can prove it owns. A decision that exists but is not yours returns the SAME not_found as one that was never issued. This is deliberate: a distinguishable "exists but forbidden" would confirm to any caller that a given content hash had been decided on by someone, which is the fact the scoping exists to withhold. Do not read not_found as proof that no such decision exists anywhere. Decisions persisted without context.repository cannot currently be attributed to an account, and are not retrievable by fingerprint at all — not by their owner either. Retrieve those by decision_id, which is unchanged and unscoped. This is a limitation of what older stored rows carry, not a property of the lookup: rows written from now on record the account directly, so the gap narrows as older rows age out. If a fingerprint you expect returns not_found, use the decision_id before concluding the decision is missing. When the stored envelope carries control fields, control_envelope.next_agent_step is structured remediation guidance the agent MAY follow for non-CONTINUE execution_action values (null on CONTINUE*). Still branch on execution_action; next_agent_step is a suggestion, not permission.

  Paramètres, retour & exemple (3)

  Paramètres

  • case_id · string · optionnel
    A case identifier. Lookup never opens a case. Until the case store exists this returns CASE_NOT_FOUND.
  • decision_id · string · optionnel
    The decision_id from a prior decision_result envelope. Provide exactly one identifier.
  • fingerprint · string · optionnel
    A verdict fingerprint (sha256:...); returns the latest matching decision you own. Provide exactly one identifier.

  Exemple d'appel

  {"name": "get_decision_details", "arguments": {"case_id": "texte", "decision_id": "texte", "fingerprint": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"meta": {}, "decision": "ALLOW", "evidence": {}, "patterns": [], "operation": "texte", "timestamp": "texte", "risk_score": 1, "receipt_kind": "NONE", "chain_receipt": "texte", "preflight_mode": "analyze", "safe_for_agent": true, "decision_result": {}}}

• preflight_change_set≈ 7251 tokens

  Use this when: a contract artifact (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas) changes before merge, deploy, publish, or tool registration; AND any agent-executed operation with no supported contract type — send type agent_operation. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation. Skipping this call is not permission. Absence of a key is not permission. Inputs: preflight_mode is required: "analyze" (risk only; no receipt, no execution_action) or "authorize" (may mint a receipt; requires context.operation — merge is not deploy is not publish). Supply exactly one artifact source: artifacts[] (1–20 items, each {id, type, before, after} as the FULL spec/schema text, not a path or URL; type is openapi|graphql|grpc|asyncapi|mcp_manifest|agent_tools|agent_operation) XOR derivation="server" (server reads GitHub Compare; needs context.repository + context.base + context.head; sending artifacts[] together is 400). Grant fields sit in one object, execution_grant_request {include_execution_grant, grant_version, tenant_id, executor_id, adapter_id, target_uri, expected_state_token, state_nonce, audience, policy_hash}; analyze ignores it; required is preflight_mode only. previous_receipt is a chain token base64url(body).base64url(signature) to LINK a prior decision — it does not re-verify; use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead. idempotency_key replays authorize only (24h), never analyze.

  Paramètres, retour & exemple (9)

  Paramètres

  • context · object · optionnel
    Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values: merge, deploy, tool_call, publish. The receipt/gate must match this label.
  • artifacts · array · optionnel
    1–20 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array entirely when derivation="server".
  • derivation · string · optionnel · server
    "server" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a proven binding for that repository. Do not send artifacts[] in the same call (400 — one source of truth). Omit this field for the caller-supplied artifacts[] path.
  • preflight_mode · string · requis · analyze | authorize
    REQUIRED. "analyze" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). "authorize" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is INVALID_INPUT. Do not pin 1.0 — that pin retired.
  • idempotency_key · string · optionnel
    Optional client key; in authorize mode, a repeat with the same key + body replays the original decision (24h). Analyze responses are not replayed.
  • response_detail · string · optionnel · control | standard | full
    How much of the response to return. control = the fields an agent branches on; standard = control + the human report and labelled break rows (the MCP default); full = everything (the REST default). Every value is copied from the full response.
  • previous_receipt · string · optionnel
    Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification — a linked token is not re-checked here; use verify_receipt.
  • decision_spec_version · string · optionnel · 2.0
    Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0.
  • execution_grant_request · object · optionnel
    Authorize + include_execution_grant only: the execution-grant request fields. Analyze ignores them. Flat root-level spellings are also accepted; the same field sent both ways with different values is INVALID_INPUT.

  Exemple d'appel

  {"name": "preflight_change_set", "arguments": {"preflight_mode": "analyze"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_receipt≈ 2601 tokens

  Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic authenticity (signature + key id), body binding, and — when lifecycle indices are available — whether it is currently valid authorization (not expired, superseded, or revoked) for a stated operation/target. Use this when: - You already obtained a chain_receipt / receipt token from a prior preflight (or CI artifact) and are about to act (merge/deploy) under that receipt. - A contract-gate or policy requires offline/online proof that the receipt is authentic for this change before proceeding. - You must distinguish "signature ok" from "currently authorized" (stale or superseded receipts must not be treated as live approval). Do not use when: - You do not have a receipt yet — call coderifts.preflight_change_set first. - You need a NEW decision for a changed base→head set — preflight again; verify_receipt does not re-diff specs. - The receipt you hold binds a different operation or target than the one you are about to perform — call coderifts.preflight_change_set with context.operation set to that operation (a merge receipt does not authorize a deploy); verify_receipt cannot re-scope or re-issue a decision. - You only need human-readable history of an old decision_id without a receipt token — use coderifts.get_decision_details. - The change set itself is unknown or incomplete — fix the change set and preflight; do not "verify" a placeholder. Inputs: receipt token (required); target_id = decision_result.artifact_digest — required for an authorization verdict; omitted → target_not_stated. Optional intended context (operation, environment, fingerprint, audience, repository/branch/pull_request, base/head) and the body_hash-bound decision_result envelope. 30s clock-skew leeway on expiry. A 0s grace for declared destructive production operations is defined in the policy but is unreachable today: the intended-context schema has no destructive field, so nothing can declare one and the 30s leeway always applies. Returns { valid, status, currently_authorized (bool|null), reason, payload, authz_* }. Branch on currently_authorized; null = not evaluated. When a decision envelope is also in hand (e.g. from a prior preflight), its control_envelope.next_agent_step (if present) is structured remediation guidance the agent MAY follow after a non-CONTINUE decision — still branch on execution_action; next_agent_step is suggestion, not permission.

  Paramètres, retour & exemple (12)

  Paramètres

  • base · string · optionnel
    Intended base commit/ref SHA the receipt must match (signed-wins vs envelope.base)
  • head · string · optionnel
    Intended head commit/ref SHA the receipt must match (signed-wins vs envelope.head)
  • token · string · requis
    The chain receipt token (base64url(body).base64url(signature))
  • branch · string · optionnel
    Intended branch the receipt must bind (place binding; optional)
  • audience · string · optionnel
    Intended audience — must match the receipt
  • operation · string · optionnel
    Intended operation the receipt must authorize (conventional: merge|deploy|tool_call|publish). Triggers authorization evaluation when non-empty; supply decision_result for full scope binding.
  • target_id · string · optionnel
    REQUIRED to authorize under a held receipt. Set it to decision_result.artifact_digest — the digest of the artifact the receipt was issued for, which you already hold in the decision_result you are passing. The server does NOT derive it for you: it carries YOUR intended apply-site, and taking it from the envelope would compare that document against itself. Omit it and the answer is currently_authorized false with authz_reason target_not_stated and authz_status VERIFIED_TARGET_NOT_STATED — a missing input, distinct from target_mismatch, which means the receipt covers a different target.
  • repository · string · optionnel
    Intended repository the receipt must bind (place binding; optional)
  • environment · string · optionnel
    Intended environment (e.g. production) — must match the receipt
  • fingerprint · string · optionnel
    Intended change fingerprint — must equal the receipt fp
  • pull_request · ? · optionnel
    Intended pull-request id the receipt must bind (place binding; optional)
  • decision_result · object · optionnel
    The body_hash-bound decision envelope (carries operation/target/decision). Required for a meaningful AUTHORIZATION evaluation of scope; without it, intended context alone fails closed on authorization (currently_authorized false) while signature status remains independent. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json.

  Exemple d'appel

  {"name": "verify_receipt", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"valid": true, "reason": "texte", "status": "VERIFIED_CURRENT", "payload": {}, "authz_note": "texte", "authz_state": "texte", "authz_reason": "texte", "authz_status": "texte", "caller_value": "texte", "signed_value": "texte", "authz_reasons": [], "binding_level": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://app.coderifts.com/mcp