Protect MCP

Claude Code: /plugin marketplace add wshobson/agents → /plugin install protect-mcp@claude-code-workflows

Two hooks wrap each Claude Code tool call. The first evaluates the request against a Cedar policy file — principal, action, resource, context — and a deny exits with code 2, which is how Claude Code is told to block the call before it runs. The second writes a receipt: tool name, hashes of input and output, the decision, the policy digest, and a link to the previous receipt, all signed with Ed25519 over JCS-canonicalised JSON. Chaining is what makes deletion detectable and not only modification, since a removed receipt breaks the link its successor points at. Verification runs offline through a separate CLI returning exit 0 for valid, 1 for tampered and 2 for malformed, so an auditor needs the public key and nothing else: no account, no network, no trust in whoever ran the agent.