signed_safety_report

Instructions

Implementation Reference

• server.py:485-524 (handler)

  Main handler function for the 'signed_safety_report' MCP tool. Takes 'subject', 'findings_json', 'score', 'note', and 'api_key' parameters. Requires Pro or Enterprise tier access. Parses findings_json, calls _sign_via_attestation_api to cryptographically sign the report, and returns a dict with the certificate and verification URL.

  @mcp.tool()
  def signed_safety_report(
      subject: str,
      findings_json: str = "",
      score: int = 0,
      note: str = "",
      api_key: str = "",
  ) -> dict:
      """
      Issue a cryptographically signed safety report for the scanned MCP server.
      Returns a cert with a public verify URL anyone can hit to confirm the audit
      happened on the date claimed.
  
      Pro / Enterprise tier only.
      """
      ok, msg, tier = check_access(api_key)
      if not ok or tier not in ("pro", "enterprise"):
          return {
              "error": "signed reports require Pro tier (£29/mo Starter, £79/mo Pro) or Enterprise £1,499/mo",
              "upgrade_starter": STRIPE_29,
              "upgrade_pro": STRIPE_79,
              "upgrade_enterprise": STRIPE_1499,
          }
      try:
          findings = json.loads(findings_json) if findings_json else []
      except json.JSONDecodeError:
          findings = []
      cert = _sign_via_attestation_api(api_key, {
          "subject": subject,
          "findings": findings,
          "score": score,
          "note": note or f"MEOK MCP Injection Scanner — {len(INJECTION_RULES)} rules applied",
      })
      return {
          "tier": tier,
          "subject": subject,
          "report": cert,
          "verify_at": cert.get("verify_url"),
          "ship_to_ciso": "Forward this cert + verify URL in any procurement / SOC2 / ISO 42001 audit response.",
      }

• server.py:349-371 (helper)

  Helper function '_sign_via_attestation_api' that makes an HTTP POST request to the attestation API to cryptographically sign the safety report payload. Accepts api_key and payload dict, returns a cert dict with a verify_url.

  def _sign_via_attestation_api(api_key: str, payload: dict) -> dict:
      """Best-effort signing call to meok-attestation-api. Returns cert dict."""
      body = {
          "api_key": api_key,
          "regulation": "MCP-SEC-AUDIT-2026",
          "entity": payload.get("subject", "anonymous"),
          "score": payload.get("score", 0),
          "findings": [f"{f.get('rule_id', '')} {f.get('name', '')}" for f in (payload.get("findings") or [])][:30],
          "articles_audited": [r["id"] for r in INJECTION_RULES],
          "auditor_notes": payload.get("note", ""),
      }
      try:
          data = json.dumps(body).encode("utf-8")
          req = urllib.request.Request(
              f"{_ATTESTATION_API}/sign",
              method="POST",
              data=data,
              headers={"Content-Type": "application/json", "User-Agent": "meok-mcp-injection-scan/1.0"},
          )
          with urllib.request.urlopen(req, timeout=8) as r:
              return json.loads(r.read().decode("utf-8"))
      except Exception as e:
          return {"error": f"signing unavailable: {type(e).__name__}: {e}"}

• server.py:68-69 (helper)

  Helper function 'check_access' that delegates to '_shared_check_access' to validate the API key and return the tier (free/pro/enterprise).

  def check_access(api_key: str = ""):
      return _shared_check_access(api_key)

• server.py:485-485 (registration)

  Registration decorator '@mcp.tool()' on line 485 that registers the 'signed_safety_report' function as an MCP tool with the FastMCP server instance 'mcp'.

  @mcp.tool()

• server.py:493-498 (schema)

  Schema/type definition via the docstring and function signature: parameters are 'subject' (str, required), 'findings_json' (str, default ''), 'score' (int, default 0), 'note' (str, default ''), 'api_key' (str, default ''); returns a dict.

  """
  Issue a cryptographically signed safety report for the scanned MCP server.
  Returns a cert with a public verify URL anyone can hit to confirm the audit
  happened on the date claimed.
  
  Pro / Enterprise tier only.