Skip to main content
Glama

Cedulon

에이전트 간 지출을 위한 감사 계층: 서명된 거래 매니페스트, 실패 시 폐쇄(fail-closed) 정책, 서명된 지출 영수증(SCITT 앵커 가능).

Cedulon은 결제 레일이 아닙니다. x402와 AP2 위에 있습니다.

패키지는 npm에 있고 MCP 서버는 MCP 레지스트리에 있지만, 여기서 돈을 다루는 것은 없습니다: 실제 지갑도, 네트워크 레일도 없고 오직 목(fixture)뿐입니다. cedulon_spend는 목 레일에서 결제하며 그 자체 설명에 그렇게 명시합니다.

핵심 패키지는 런타임 의존성이 전혀 없습니다. MCP 서버 패키지는 공식 MCP SDK에만 의존합니다.

요구 사항

  • Node.js 22 이상 (라이브러리는 20+; 스크립트는 Node 타입 스트리핑 사용)

  • npm 10 이상

Related MCP server: dingdawg-agent-wallet

설치 및 실행 (클린 클론)

npm install
npx tsc --noEmit
npm run test:all
npm run demo

npm run tamper는 0이 아닌 종료 코드가 예상됩니다 (변조된 바이트는 검증에 실패).

npm run demo:unguarded는 보호되지 않은 구멍을 보여줍니다: 100/100 허용.

npm run audit는 0으로 종료되어야 합니다 (audit: balanced).

npm run demo:bypass는 0이 아닌 종료 코드여야 합니다: audit: 1 settlement without receipt → FAIL.

npm run demo:bypasses는 네 개의 FAIL 줄을 출력합니다 (영수증 누락, 금액 오류, null-ref, 잘못된 체인 헤드) 그리고 모든 우회가 잡힐 때만 0으로 종료합니다; 놓친 우회가 있으면 0이 아닌 종료 코드가 됩니다.

npm run demo:live는 픽스처 대신 실제 Base Sepolia USDC 창을 조정합니다. 읽기 전용입니다: CEDULON_RPC_URL에 RPC URL이 필요하며 지갑, 키, 트랜잭션이 없습니다. 영수증을 보유하지 않은 계정에 대해 체인이 보고하는 모든 결제는 차이(gap)로 나타납니다.

제3자는 우리를 신뢰하지 않고도 이를 재현할 수 있습니다: docs/RUN_AS_VERIFIER.md.

5분 경로 (MCP 호스트 구성 포함): docs/QUICKSTART.md.

MCP 서버

Cedulon은 로컬 stdio MCP 서버로 실행될 수 있습니다. 호스트는 stdin/stdout에서 JSON-RPC로 통신합니다. 다섯 가지 도구는 기존 패키지의 얇은 래퍼입니다. 정책, 영수증, 감사를 다시 구현하지 않습니다.

도구

인수

결과

cedulon_spend

amount (문자열), currency, payee, nonce, 선택적 tool

허용 → 서명된 영수증 JSON. 거부 → { ok: false, reason } (예: limit-amount).

cedulon_audit

선택적 extraSettlements[] (ref, amount, currency, timestampMs)

{ ok, summary, findings }. 균형 잡힌 장부는 audit: balanced를 출력합니다.

cedulon_verify_receipt

receipt 객체, 또는 coseHex + publicKeyPem, 선택적 카운터서명 필드

{ ok, receipt, countersignature }

cedulon_export_ledger

없음

demo:export JSON 형태의 영수증 + 체크포인트 + 추출

cedulon_status

없음

{ version, policy, receiptCount, chainHead }

Claude Desktop / Claude Code / Cursor. 복제할 것도, 빌드할 것도 없습니다:

{
  "mcpServers": {
    "cedulon": {
      "command": "npx",
      "args": ["-y", "@cedulon/mcp-server"]
    }
  }
}

Claude Code에서 해당 구성은 한 줄 명령입니다:

claude mcp add cedulon -- npx -y @cedulon/mcp-server

정책 제한은 환경에서 옵니다: CEDULON_MAX_AMOUNT, CEDULON_MAX_CUMULATIVE, CEDULON_MAX_PAYMENTS, CEDULON_WINDOW_MS, CEDULON_ALLOWED_PAYEES, CEDULON_ALLOWED_CURRENCIES, CEDULON_ALLOWED_TOOLS, CEDULON_PAYER. CEDULON_STATE_PATH를 설정하면 재시작 후에도 영수증 체인을 유지합니다; 설정하지 않으면 원장은 메모리에만 존재합니다.

대신 이 저장소 내부에서 소스에 대해 작업하려면:

npm run mcp

서버는 MCP 레지스트리에 io.github.dogrucanemek-alt/cedulon으로 등록되어 있습니다. server.json이 게시되는 항목입니다.

npm run mcpb.mcpb 번들을 빌드합니다 — 서버와 그 의존성을 담은 zip으로, 데스크톱 호스트가 한 번의 클릭으로 설치하며, 정책 상한이 설정으로 노출됩니다. 작업 트리를 패킹하는 대신 릴리스된 npm 패키지를 설치하므로, 번들은 npm이 제공했을 내용을 담고 있으며 버전은 이미 릴리스되어 있어야 합니다. 결과는 build/에 생성되며 릴리스 아티팩트이지 소스가 아닙니다.

smithery.yaml은 더 오래된 생태계 형식이며 제출되지 않습니다. Smithery의 현재 지침은 HTTPS 엔드포인트 또는 .mcpb 번들을 사용합니다.

레이아웃

packages/core           policy engine + Decision Token (workspace dep on @cedulon/cose)
packages/cose           deterministic CBOR + COSE_Sign1 (Ed25519)
packages/manifest       signed trade manifest
packages/receipts       spend receipt (COSE default, JSON legacy)
packages/checkpoint     epoch checkpoints + in-process transparency log
packages/audit          rail-extract completeness checker
packages/mcp-guard      MCP tools/call wrapper (mock)
packages/mcp-server     stdio MCP server (official SDK)
packages/x402-adapter   HTTP 402 adapter + mock rail extract
packages/base-extract   read-only Base Sepolia USDC → RailExtract
examples/demo           runaway, dispute, bypass, audit CLI
spec/                   draft-dogru-cedulon-01 (current), -00, plus the
                        reattestation and streaming drafts
THREAT_MODEL.md
docs/RUN_AS_VERIFIER.md

브랜드 이름은 packages/core/src/brand.ts에서만 가져옵니다.

인용 방법

인용 메타데이터는 CITATION.cff에 있습니다. 아카이브된 -00 릴리스는 https://doi.org/10.5281/zenodo.22099792로 게시됩니다.

라이선스

Apache-2.0

Available Tools

5 tools
cedulon_auditA
Read-only

Reconcile the in-process receipt chain and checkpoint against the rail extract. Returns audit: balanced or findings.

ParametersJSON Schema
NameRequiredDescriptionDefault
trustNoRail key you hold out of band: { publicKeyPem, accountId?, railId?, windowStartMs?, windowEndMs? }
manifestNoA Trade Manifest you were presented with. Omit for a no-manifest deployment. Present without manifestTrust is unauthenticated-manifest.
payeeTrustNoPayee keys you hold out of band, keyed by payee: { "payee-1": publicKeyPem }
issuerTrustNoIssuer key(s) you hold out of band: { publicKeyPem: string | string[] }. Without it the audit checks this server's records against this server's own key.
witnessTrustNoTransparency log key you hold out of band: { publicKeyPem: string | string[] }
manifestTrustNoManifest publisher key(s) you hold out of band: { publicKeyPem: string | string[] }
extraSettlementsNoOptional extra extract rows, used to inject a bypass settlement in tests

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true and openWorldHint=false, the annotations already cover the safety profile and closed-world assumption. The description adds the outcome contract ('balanced or findings') and names the comparison sources, but it does not explain what findings contain, how failures are expressed, or any other behavioral caveats. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: the purpose is front-loaded ('Reconcile...') and the outcome is stated in the second sentence. Every phrase earns its place, and the description is appropriately sized for an audit tool whose parameters are documented in the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter nested-object tool with no output schema, the description is a bit thin: it gives the high-level result ('balanced or findings') but not the shape of findings or any guidance on how trust/manifest inputs affect the audit. The rich schema compensates for parameter coverage, but the return contract remains under-specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description does not need to repeat parameter details. The description itself adds no parameter-level semantics, but the schema already explains trust, manifest, payee/issuer/witness/manifest trust, and extraSettlements in enough detail. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Reconcile') and identifies the exact resources involved: the in-process receipt chain and checkpoint are compared against the rail extract. It also says the result is either 'balanced or findings,' which distinguishes this audit/reconciliation tool from siblings like spend, verify_receipt, export_ledger, and status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for reconciliation and audit-style checks, so an agent can infer it is not for spending, single-receipt verification, exporting, or status. However, it never explicitly says when to use this tool instead of a sibling, nor does it mention any conditions or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_export_ledgerA
Read-only

Export receipts, checkpoint, and rail extract in the same JSON shape as npm run demo:export.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety and world-scope behavior. The description adds the useful detail that output matches npm run demo:export, but it does not disclose any other behavioral traits such as output size, asynchronous behavior, or prerequisites, so it only partially contributes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no redundant words. It clearly communicates the operation, the target data, and the output format without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool, the description is mostly sufficient: it names the data kinds and the output shape. It relies on familiarity with 'npm run demo:export' and leaves terms like 'checkpoint' and 'rail extract' undefined, but in a project context this is likely enough for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters and coverage is effectively 100%, so no parameter documentation is needed. The description's mention of the three export categories adds context about what the tool operates on, but since there are no configurable inputs, there is little parameter semantics to add.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Export') and the exact resources ('receipts, checkpoint, and rail extract'), making the tool's function immediately clear. It also distinguishes itself from siblings by being the export operation, as opposed to spend, audit, verify, or status actions. The reference to the demo:export JSON shape further pins down intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: any time an export of receipts, checkpoint, or rail extract data is needed in the demo:export shape. However, it does not explicitly mention alternatives or state when not to use it, leaving routing to siblings to be inferred rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_spendA

Policy-gated spend on the mock rail. Allow returns a signed COSE receipt JSON. Deny returns the fail-closed reason.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolNoCalling tool name recorded on the request
nonceYes
payeeYes
amountYesInteger amount as a decimal string
currencyYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses both possible outcomes—an allow path returning a signed COSE receipt JSON and a deny path returning the fail-closed reason. This goes beyond the annotations, which only indicate hints like readOnly false and idempotent false. It doesn't explain the policy itself, but it clearly communicates the behavioral contract.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two short sentences, front-loaded with the primary action, and each sentence adds distinct value. There is no filler, redundancy, or unnecessary background.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description explains return variants, it does not cover policy prerequisites, parameter formats, or the meaning of nonce, payee, and currency. With no output scheme and only 40% schema description coverage, these omissions make it difficult for an agent to invoke the tool correctly the first time.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 40%, yet the description adds no parameter-level meaning for nonce, payee, or currency, and does not even mention 'amount' or 'tool'. With most parameters undocumented in both schema and description, the agent has little guidance on how to set valid inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('spend'), the resource ('mock rail'), and the policy-gating nature of the operation. It also distinguishes the tool from siblings like cedulon_verify_receipt and cedulon_audit by describing the spend-specific outcome.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used when a policy-gated spend should be attempted, and sibling names suggest the other tools serve different purposes. However, it does not explicitly state when to use this tool over alternatives, nor does it provide exclusions or condition-based routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_statusA
Read-only

Server version, policy summary, receipt count, and chain head hash.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful context about the specific data fields exposed, but does not disclose any further behavioral details such as response format, freshness, or failure modes. This is comparable to a straightforward status read where the annotations carry the main burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that front-loads the most important information: it enumerates exactly what the status tool exposes. Every word earns its place and there is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless status endpoint with read-only annotations, the description is largely sufficient: it names the key result fields. There is no output schema to supplement the return values, but the listed fields are concrete enough for an agent to understand what this tool offers in the context of its siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is empty, so there are no parameter semantics to document. With 0 params, the baseline of 4 applies, and the description does not need to compensate for any parameter coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title 'Server status' plus the description's list of returned data ('Server version, policy summary, receipt count, and chain head hash') clearly identifies this as a read-only status tool. It is distinct from the sibling tools (spend, audit, verify_receipt, export_ledger), though it lacks an explicit verb such as 'returns' or 'gets'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to choose this tool versus its siblings such as cedulon_audit or cedulon_export_ledger. There is no stated condition, exclusion, or mention of alternatives; usage is only weakly implied by the word 'status' in the title.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cedulon_verify_receiptA
Read-only

Verify a spend receipt COSE_Sign1 (and payee countersignature when present). Supply expectIssuerKeyPem to check it against a key you already hold; without one the receipt is only checked against the key it carries, which any key satisfies.

ParametersJSON Schema
NameRequiredDescriptionDefault
coseHexNo
receiptNoFull SignedReceipt object from cedulon_spend
publicKeyPemNo
counterCoseHexNo
expectPayeeKeyPemNoPayee key you hold out of band, for the countersignature.
payeePublicKeyPemNo
expectIssuerKeyPemNoIssuer key you hold out of band. Omit and the check is self-referential.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint, so the description carries the burden of behavioral caveats. It adds the important warning that omitting expectIssuerKeyPem makes verification self-referential and 'any key satisfies' it, which prevents an agent from over-trusting a nominally verified receipt.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense sentences with no filler. It front-loads the primary purpose and then delivers the single most important usage caveat, making every word earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 optional parameters, no required fields, no output schema, and no guidance on which parameter combinations are valid, the description is not complete enough for reliable invocation. It explains the issuer-key pitfall but leaves the receipt/countersignature input representations and the verification result unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 43%, and the free-text description explains only expectIssuerKeyPem behaviorally. The relationship between coseHex, receipt, counterCoseHex, publicKeyPem, and payeePublicKeyPem is left unstated, so an agent cannot confidently choose among the seven optional input modes from the description alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the verb 'Verify' and names the specific resource: a spend receipt COSE_Sign1 plus the optional payee countersignature. This clearly separates it from spend/audit/export/status siblings and makes the tool's operation unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete conditional guidance: supply expectIssuerKeyPem when you want to check against a key you already hold, and omit it when you accept the receipt's self-carried key. It does not name alternative tools, but the parameter-level when/how instructions are clear enough for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.9/5.0
Disambiguation5/5

Each tool has a clearly distinct role: spend creates a receipt, audit reconciles, verify_receipt validates a receipt, export_ledger exports data, and status reports server state. There is no overlap or ambiguity between tool purposes.

Naming Consistency4/5

All tools share the cedulon_ prefix and lowercase snake_case style, which is predictable. Minor inconsistency exists between single-word action names (spend, audit) and verb_noun names (verify_receipt, export_ledger), plus status is a noun rather than an action.

Tool Count5/5

Five tools is well-scoped for a focused server handling spend, verification, audit, export, and status. Each tool contributes a distinct capability without redundancy or bloat.

Completeness4/5

The tool surface covers the core lifecycle of creating, verifying, auditing, exporting, and monitoring receipts. Minor gaps exist such as no explicit receipt lookup by ID or cancellation/refund flow, but for a mock rail server the set appears functionally complete.

Maintenance

ActivityMaintained
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Dual-rail MCP server for initiating and verifying MPP and x402 payments, plus MPP-attested identity claims, enabling agent-native financial settlement.
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Post-quantum, tamper-evident receipts for consequential agent actions. Provides tools for auditing, gating decisions, and egress classification with quantum-hardened security.
    7
    Apache 2.0
  • F
    license
    Not graded
    quality
    B
    maintenance
    Provides policy-driven runtime authorization and security evaluation for MCP-based agents, including MCP streaming HTTP gateway, mock MCP servers, deterministic agent demos, and audited tool invocation with redacted PostgreSQL audit chains.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/dogrucanemek-alt/cedulon'

If you have feedback or need assistance with the MCP directory API, please join our Discord server