@cubiczan/chp-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CHP_RECEIPT_KEY | No | HMAC secret used to sign approval receipts. Set CHP_RECEIPT_KEY or AUDIT_LEDGER_KEY; without it the server falls back to an insecure default (not for production). | |
| AUDIT_LEDGER_KEY | No | Alternative HMAC secret used to sign approval receipts and audit ledger entries. Set CHP_RECEIPT_KEY or AUDIT_LEDGER_KEY. | |
| CHP_AUDIT_LEDGER | No | Path to the JSONL audit ledger file, or ':memory:' for tests. | ./data/chp-audit.jsonl |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| evaluate_spend_gateB | Run CHP Profile B capital/spend gate on a proposed action. Returns LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash. Hard policy violations cannot be overridden by a human. BLOCKED is also written as a structured policy_deny to the CHP-signed audit ledger. |
| approve_spendA | Human-in-the-loop approval for a proposal that returned HITL_REQUIRED. Cannot approve BLOCKED / hard-rule failures (spec §6.3 / §6.5). When tool + bound_args are supplied, mints a signed authorization receipt. |
| request_authorizationC | Request a signed authorization receipt for a scoped reference tool (place_equity_order, wire_treasury_transfer, rebalance_portfolio). Auto-lock mints a receipt; HITL_REQUIRED waits for approver; hard fails return a structured deny that is already on the audit ledger. |
| place_equity_orderB | Synthetic equity order (scope trading:equities:place). No live venue. Requires a signed authorization receipt bound to these args. Receipt is optional on the wire so a missing receipt becomes a logged missing_receipt deny. |
| wire_treasury_transferB | Synthetic treasury wire (scope treasury:wire). Default policy always requires a human-issued receipt. No live bank rail. Missing receipt is a logged deny, not a bare MCP error string. |
| rebalance_portfolioB | Synthetic portfolio rebalance (scope portfolio:rebalance). No live desk. Requires a signed authorization receipt; HITL at/above $1,000 notional. |
| inspect_audit_ledgerA | Read the CHP-signed deny / authorize / execute ledger and verify the chain. Also lists the synthetic scoped reference tools. |
| evaluate_tool_approvalA | Evaluate a proposed MCP tool call. A managed allowlist is not a grant — allowlisted tools still return RECEIPT_REQUIRED. Host-injected fields (host_bound / _meta.cubiczan.host_bound) are merged into args_hash; the model cannot override them. Wildcards, missing resource, or unparseable arguments deny on ambiguity. |
| issue_approval_receiptA | Record a human allow/deny and return a signed approval receipt. The MAC covers actor, tool, resource, args hash (host ∪ model), policy version, risk, expiry, decision, and nonce (HMAC-SHA256 over CHP canonical JSON). Signing key from CHP_RECEIPT_KEY / AUDIT_LEDGER_KEY, or the documented insecure default. |
| authorize_tool_callA | Authorize a tool call against a previously issued receipt. Changed arguments (including host-bound tenant/index), expired or replayed receipts, MAC failure, host-bound override, and binding mismatch all deny. Presenting only an allowlist match denies with allowlist_is_not_authorization. |
| chp_content_hashA | SHA-256 over float-aware canonical JSON (CHP §3.1) — matches Python consensus-hardening-protocol digests for the same object. |
| chp_versionA | Report MCP server and CHP Profile B protocol versions. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
Most tools occupy distinct lifecycle stages, but the authorization/receipt cluster—request_authorization, approve_spend, issue_approval_receipt, authorize_tool_call—has enough overlap that an agent could choose the wrong entry point without careful reading. The two evaluate_* tools also require close attention to distinguish spend-gate evaluation from general tool-approval evaluation.
The set is predominantly snake_case verb_noun with a recognizable vocabulary: evaluate_spend_gate, issue_approval_receipt, place_equity_order, and inspect_audit_ledger all follow the pattern. Minor deviations are the noun-style chp_content_hash and chp_version utilities, plus the slightly awkward wire_treasury_transfer.
Twelve tools is within the ideal range and each supports a distinct part of the CHP flow: evaluate, request/approve/issue, authorize, execute, and audit. It is slightly heavy relative to only three reference action tools, but not bloated for a protocol-focused server.
The evaluate-to-approve/deny-to-receipt-to-authorize-to-execute-to-audit lifecycle is well covered, including denial logging and replay/expiry checks. Minor gaps include no receipt revocation or pending-approval listing, but these do not break the stated CHP Profile B scope.