@cubiczan/chp-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CHP_RECEIPT_KEY | No | HMAC key used to sign approval receipts. If not set, the server falls back to a documented insecure default (acceptable for local use only). | |
| AUDIT_LEDGER_KEY | No | Alternative HMAC key for signing approval receipts. May be used in place of CHP_RECEIPT_KEY. | |
| CHP_AUDIT_LEDGER | No | Path to the JSONL audit ledger file, or ':memory:' to use an in-memory ledger for tests. | ./data/chp-audit.jsonl |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| evaluate_spend_gateB | Run CHP Profile B capital/spend gate on a proposed action. Returns LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash. Hard policy violations cannot be overridden by a human. BLOCKED is also written as a structured policy_deny to the CHP-signed audit ledger. |
| approve_spendA | Human-in-the-loop approval for a proposal that returned HITL_REQUIRED. Cannot approve BLOCKED / hard-rule failures (spec §6.3 / §6.5). When tool + bound_args are supplied, mints a signed authorization receipt. |
| request_authorizationC | Request a signed authorization receipt for a scoped reference tool (place_equity_order, wire_treasury_transfer, rebalance_portfolio). Auto-lock mints a receipt; HITL_REQUIRED waits for approver; hard fails return a structured deny that is already on the audit ledger. |
| place_equity_orderB | Synthetic equity order (scope trading:equities:place). No live venue. Requires a signed authorization receipt bound to these args. Receipt is optional on the wire so a missing receipt becomes a logged missing_receipt deny. |
| wire_treasury_transferB | Synthetic treasury wire (scope treasury:wire). Default policy always requires a human-issued receipt. No live bank rail. Missing receipt is a logged deny, not a bare MCP error string. |
| rebalance_portfolioB | Synthetic portfolio rebalance (scope portfolio:rebalance). No live desk. Requires a signed authorization receipt; HITL at/above $1,000 notional. |
| inspect_audit_ledgerA | Read the CHP-signed deny / authorize / execute ledger and verify the chain. Also lists the synthetic scoped reference tools. |
| evaluate_tool_approvalA | Evaluate a proposed MCP tool call. A managed allowlist is not a grant — allowlisted tools still return RECEIPT_REQUIRED. Host-injected fields (host_bound / _meta.cubiczan.host_bound) are merged into args_hash; the model cannot override them. Wildcards, missing resource, or unparseable arguments deny on ambiguity. |
| issue_approval_receiptA | Record a human allow/deny and return a signed approval receipt. The MAC covers actor, tool, resource, args hash (host ∪ model), policy version, risk, expiry, decision, and nonce (HMAC-SHA256 over CHP canonical JSON). Signing key from CHP_RECEIPT_KEY / AUDIT_LEDGER_KEY, or the documented insecure default. |
| authorize_tool_callA | Authorize a tool call against a previously issued receipt. Changed arguments (including host-bound tenant/index), expired or replayed receipts, MAC failure, host-bound override, and binding mismatch all deny. Presenting only an allowlist match denies with allowlist_is_not_authorization. |
| chp_content_hashA | SHA-256 over float-aware canonical JSON (CHP §3.1) — matches Python consensus-hardening-protocol digests for the same object. |
| chp_versionA | Report MCP server and CHP Profile B protocol versions. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
The authorization lifecycle is split across several tools with fuzzy boundaries: evaluate_spend_gate and evaluate_tool_approval both evaluate proposed actions, while approve_spend, issue_approval_receipt, and request_authorization can all produce signed receipts. Detailed descriptions help, but an agent selecting by name alone will struggle to identify the correct phase.
Most tools follow a clear lowercase verb_noun pattern such as evaluate_spend_gate, place_equity_order, inspect_audit_ledger, and authorize_tool_call. The only deviations are the two chp_* utility tools, chp_content_hash and chp_version, which are consistently prefixed but not verb-led.
Twelve tools is within the ideal range for a policy/authorization MCP and the count is not bloated. However, there is some redundancy in the approval and receipt-issuance tools, so a couple of tools could be consolidated without losing functionality.
The core flow is covered end-to-end: evaluate policy, request/approve authorization, issue and verify receipts, execute scoped reference tools, and inspect the audit ledger. Missing pieces are mostly non-critical, such as explicit receipt revocation or allowlist management, but agents can work around these.