Skip to main content
Glama

@gomission/mcp

Mission MCP Glama score

Mission의 오픈 MCP 인터셉션 어댑터로, 정확한 액션 권한을 위한 도구입니다.

이 어댑터는 하나의 좁은 역할을 수행합니다: 래핑된 MCP 제공자 앞에 위치하여, 제안된 도구 호출을 분류하고, 변경 불가능한 Trust Graduation 액션 바인딩으로 중요한 호출을 보류합니다. 저위험 호출은 통과할 수 있습니다. "승인"이라는 채팅 메시지는 절대 권한으로 취급되지 않습니다.

상태: 실험적 베타. Apache-2.0. 런타임 의존성 없음.

먼저 경계를 증명하세요

요구 사항: Node.js 20 이상.

npx -y @gomission/mcp@beta demo

이 명령은 가짜 이메일 제공자를 사용하며, 하나의 기계 판독 가능한 DEMO_RESULT를 출력합니다. 다음을 증명합니다:

  • 중요한 제공자 함수가 전혀 호출되지 않았음;

  • 보류에 정확한 액션과 입력 해시가 포함되어 있음;

  • 검토된 입력을 변경하면 커밋먼트가 변경됨;

  • 채팅 텍스트는 실행 권한을 부여하지 않음.

이는 인터셉션을 증명할 뿐, 완료된 인증이나 프로덕션 채택을 증명하지 않습니다. 이식 가능한 승인/재생 증명은 @trust-graduation/core에 있습니다:

npx -y @trust-graduation/core@beta demo

Related MCP server: agentpassport

세 가지 프리미티브

프리미티브

책임

이식 가능 객체

Mission Gate

제공자 효과 전에 결정

액션 결정

Trust Profile

주체 및 액션 클래스별로 획득한 권한 추적

증거 프로필

Mission Key

만료 또는 철회까지 하나의 정확한 액션을 승인

일회용 승인

MCP 어댑터는 제공자 전 보류를 구현합니다. 신뢰할 수 있는 Mission Key를 발행하지 않으며, 보류된 호출을 재개할 수 없습니다. 신뢰할 수 있는 승인 호스트와 실행자는 일치하는 키를 검증하고 원자적으로 소비해야 합니다. 실험적 A2A 연속은 다음에 게시됩니다:

https://trustgraduation.org/extensions/a2a/action-authorization/v1

MCP 보류에서 정확한 제공자 실행까지

패키지 루트는 외부 승인 호스트와 실행자가 사용하는 안정적이고 의존성 없는 바인딩 브리지를 노출합니다:

import { providerActionFromMcpBinding } from "@gomission/mcp";
import { createProviderGate } from "@trust-graduation/core";

const gate = createProviderGate({
  store: sharedAtomicGrantStore,
  authenticateGrant: verifyApprovalIssuer,
  provider: existingProviderFunction,
  writeReceipt: durableReceiptSink
});

// Re-read the actual provider input at the final seam; never trust a preview.
const action = providerActionFromMcpBinding(
  heldReceipt.action_binding,
  actualProviderInput
);
const execution = await gate.execute({
  binding: heldReceipt.action_binding,
  approval: authenticatedMissionKey,
  action
});

브리지는 바인딩 무결성을 검증하고, 가로챈 ID, 대상, 제약 조건, 만료 및 논스를 코어 실행자 형태로 매핑합니다. 그런 다음 코어는 실제 제공자 입력을 다시 해싱하고, 키를 인증 및 원자적으로 소비하며, 제공자를 호출하고, 결과와 연결된 증거를 기록합니다. 변형이나 재생은 절대 제공자에 도달하지 않습니다.

생성된 어댑터와 객관적인 제공자 호출 카운터의 경우:

npm install @trust-graduation/core@beta
npx trust-graduation init-adapter
npx trust-graduation conformance ./mission-gate-adapter.mjs --json

두 패키지가 모두 설치된 상태에서 포함된 호환성 증명은 다음과 같습니다:

node node_modules/@trust-graduation/core/examples/mcp-provider-roundtrip.mjs

MCP 프록시는 여전히 채팅에서 "승인"이라고 말했다는 이유만으로 보류된 호출을 재개하지 않습니다. 이 브리지는 별도로 인증된 승인 호스트와 제공자에 바인딩된 실행자를 위한 것입니다.

Claude Desktop에 설치

npx -y @gomission/mcp@beta install-claude

설치 프로그램은 기존 Claude Desktop MCP 구성을 검사합니다:

  • 중요한 MCP 서버를 발견하면 --wrap을 선택합니다;

  • 그렇지 않으면 --local(조언적 정확한 바인딩 데모)을 선택합니다;

  • 호스팅된 읽기 전용 모드를 자동 선택하지 않습니다.

설치 후 Claude Desktop을 다시 시작한 다음 확인하세요:

npx -y @gomission/mcp@beta verify

verify는 최신 MCP를 server/discover 및 tools/list로 프로브하며, 이전 엔드포인트의 경우 초기화 시대 프로토콜로 폴백합니다. 기계 판독 가능한 보고서를 위해 --json을 추가하거나, 구성만 검사하려면 --no-probe를 추가하세요.

모드

모드

적용하는 사항

하지 않는 사항

--wrap

선택된 하위 MCP 서버를 가로챔; 하위 서버를 사용할 수 없으면 높음/심각 또는 낮은 신뢰도의 호출을 보류하고 폐쇄 실패함

보류된 호출을 재개하거나 채팅 승인을 신뢰하지 않음

--local

조언적 정확한 액션 보류 및 로컬 검토 영수증을 기록함

다른 도구와 그 제공자 사이에 위치하지 않음

--remote

호스팅된 읽기 전용 Mission 컨텍스트를 노출함

다른 MCP 서버를 가로채지 않음

필요할 때 명시적으로 선택하세요:

npx -y @gomission/mcp@beta install-claude --wrap
npx -y @gomission/mcp@beta install-claude --local
npx -y @gomission/mcp@beta install-claude --remote

유용한 플래그:

  • --workspace <path> — 기존 워크스페이스에 로컬 영수증을 저장합니다.

  • --dry-run — 구성을 변경하지 않고 출력만 표시합니다.

  • --force — Claude Desktop이 감지되지 않아도 구성을 생성합니다.

  • --remote-url <url> — 호스팅된 엔드포인트를 재정의합니다.

  • MISSION_DONT_WRAP="name1,name2" — 선택된 MCP 하위 항목을 제외합니다.

정확한 보류 계약

중요한 래핑된 호출의 경우, 어댑터는 다음을 포함하는 로컬 영수증을 기록합니다:

  • 액션 클래스;

  • 개인 정보 보호를 위한 로컬 워크스페이스 식별자;

  • 요청한 MCP 하위 항목;

  • 추론 가능한 경우 대상;

  • SHA-256 입력 커밋먼트;

  • 한 번 실행 제약 조건;

  • 만료 및 논스;

  • 전체 바인딩에 대한 SHA-256 커밋먼트.

영수증은 소유자 전용 파일 권한으로 원자적으로 기록됩니다. 어댑터는 바인딩 내에 원시 워크스페이스 경로를 저장하지 않습니다. 로컬 인수 요약은 사람의 검토를 위해 영수증에 남아 있으므로, 영수증 디렉터리를 민감한 워크스페이스 데이터로 취급하세요.

MCP 호환성

선호 프로토콜: 2026-07-28.

  • 클라이언트 기능을 포함한 상태 비저장 요청별 _meta;

  • 필수 server/discover;

  • HTTP POST당 하나의 JSON-RPC 메시지; 최신 배치 및 클라이언트 알림은 폐쇄 실패;

  • MCP-Protocol-Version, Mcp-Method, Mcp-Name에 대한 HTTP 바인딩;

  • 프로토콜 정의 HeaderMismatch 및 지원되지 않는 버전 오류;

  • resultType: "complete" 및 캐시 메타데이터;

  • 2025-11-25 및 2024-11-05에 대한 초기화 시대 호환성.

권한 매니페스트는 실험적 mission-authority/v1 기능으로 MCP 디스커버리를 통해 광고됩니다.

보안 경계

어댑터는 다음을 주장하지 않습니다:

  • 모델이나 채팅 UI가 주체를 인증했다는 것;

  • 검토 영수증이 승인 허가라는 것;

  • 외부 제공자에서 정확히 한 번 동작;

  • 독립적인 적합성 또는 프로덕션 검증;

  • 에이전트에 대한 전역 신뢰.

@trust-graduation/core를 사용하여 정확한 승인을 생성하고 검증하세요. 실행자는 승인 발행자를 인증하고, 실제 제공자 입력을 다시 바인딩하며, 키를 원자적으로 소비하고, 제공자를 최대 한 번 호출하며, 알 수 없는 제공자 결과를 조정해야 합니다.

오픈 코어 경계

무료 및 오픈:

  • 이 MCP 어댑터;

  • @trust-graduation/core 및 그 스키마;

  • @gomission/mission-schemas 적합성 어휘;

  • A2A 정확한 액션 승인 확장;

  • Mission Lite의 로컬 포커스 앱.

상업용 Mission은 관리형 정책, 신뢰할 수 있는 승인 표면, 호스팅된 감사/영수증 작업, 조직 제어, 지원 및 제공자 통합을 제공할 수 있습니다. 제품 권한은 절대 액션 권한을 부여하지 않습니다.

링크

라이선스

Apache-2.0. Mission 이름과 로고는 상표입니다; 코드 라이선스는 보증을 암시할 권한을 부여하지 않습니다.

Available Tools

5 tools
get_receiptBInspect

Fetch a Mission receipt by id.

ParametersJSON Schema
NameRequiredDescriptionDefault
receipt_idYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only states a basic fetch operation without disclosing any behavioral traits such as read-only nature, error handling, or performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no waste, but it could benefit from a bit more detail without losing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (one parameter, no output schema, no annotations), the description is minimally adequate but lacks information on return format, error conditions, or how receipt_id is obtained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter (receipt_id) with no description, and the tool description only mentions 'by id' without explaining format, examples, or how to obtain the id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Fetch a Mission receipt by id' uses a specific verb and resource, clearly distinguishing it from sibling tools like log_action or mission_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, and no exclusions or context are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_actionBInspect

Log a safe internal action with Mission. Returns a receipt id. Use for non-external actions that still benefit from a permanent receipt.

ParametersJSON Schema
NameRequiredDescriptionDefault
summaryYes
evidenceNo
action_classYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It only states 'safe internal action' and output, but omits details about authentication, side effects, or error conditions. The term 'safe' is vague and insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very concise: two sentences, no filler. Key information is front-loaded. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, no output schema, and no annotations, the description is too sparse. It provides no parameter guidance, no return value details beyond receipt id, and no error handling. The complexity is not matched by the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no parameter descriptions in schema). The description does not mention any parameters, their purpose, or constraints. It fails to compensate for the lack of schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states action 'log a safe internal action' and output 'returns a receipt id'. It gives a specific verb and resource, but does not explicitly differentiate from siblings like 'get_receipt' or 'request_approval', though the internal purpose is implied.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance on when to use: 'Use for non-external actions that still benefit from a permanent receipt.' This gives a clear context, but lacks explicit exclusions or alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mission_askAInspect

Check the explicitly selected local Mission workspace for chat availability. Requires MISSION_WORKSPACE and an explicit loopback MISSION_LOCAL_URL or MISSION_LOCAL_PORT. Chat is currently unavailable until a workspace-scoped authentication handoff is supported; this tool does not forward queries or prepare actions.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesA natural-language question or instruction for Mission. Examples: 'what should I approve today?', 'who am I dropping?', 'prepare a reply to Sandro', 'show me my weekly proof', 'what did I just learn?'

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and delivers unusually candid behavior: it discloses required environment variables and, critically, that chat is currently unavailable pending a workspace-scoped authentication handoff. It also states the tool has no side effects (no query forwarding, no action preparation). It falls short of a 5 only because it does not describe what the call actually returns in its unavailable state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with the core purpose front-loaded and no obvious padding. It is dense but efficient; minor jargon ('loopback', 'workspace-scoped authentication handoff') slightly slows comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is a non-functional availability probe with no output schema, the description is largely complete: it covers required env configuration, the blocked state, and the absence of side effects. It would be fully complete if it pointed the agent at mission_status or otherwise told it what to do instead.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single required 'query' parameter is fully documented with examples in the schema, so the baseline is 3. The line 'does not forward queries' does tell the agent the parameter is effectively inert, which is useful, but otherwise the description adds no syntax or format detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and scope: checking the explicitly selected local Mission workspace for chat availability, and explicitly narrows it by saying it 'does not forward queries or prepare actions.' This distinguishes it from request_approval and log_action. It loses a point because the name 'mission_ask' implies a working Q&A tool, creating tension the description only partially resolves, and it never contrasts itself with mission_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Preconditions are stated clearly (MISSION_WORKSPACE plus an explicit loopback MISSION_LOCAL_URL or MISSION_LOCAL_PORT), which is real context. However, there is no explicit when-to-use vs when-not-to-use guidance relative to siblings like mission_status, and the reader must infer that this tool is effectively a no-op probe.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mission_statusAInspect

Return Mission gate status, version, and the current Trust Graduation action classes. Call this first in any session to introduce the permission layer.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the return values but does not explicitly state that it has no side effects or that it is read-only. However, the nature of returning status information implies safety, so it is adequate but not exceptional.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: the first states what it returns, the second gives usage guidance. No unnecessary words, highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately lists the three return categories (gate status, version, action classes). It could provide more detail on the format, but it is sufficient for a simple tool with no parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so baseline is 4. The description does not need to add parameter meaning; it correctly omits parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns 'Mission gate status, version, and the current Trust Graduation action classes'. It distinguishes itself from siblings by instructing to call it first in any session to introduce the permission layer, making its unique role obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use: 'Call this first in any session'. This implies it is a prerequisite for other tools, though it does not explicitly state when not to use it or provide alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

request_approvalAInspect

Legacy-named advisory hold. Call before a consequential action to produce an exact action binding and local review receipt. This tool does not grant authority or resume execution; the executor must validate a matching single-use Mission Key.

ParametersJSON Schema
NameRequiredDescriptionDefault
summaryYesOne-line plain-English summary of the action.
evidenceNoOptional evidence supporting the action.
action_classYesOne of: send_email, post_public, send_dm, schedule_meeting, spend_money, publish_artifact, modify_external_record, change_trust_policy

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and discharges much of it: it discloses that the call is advisory-only, non-authoritative, does not resume execution, and that the executor must validate a matching single-use Mission Key. It omits auth requirements and what the receipt actually contains, which are notable gaps for a zero-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler, and the most consequential caveat (legacy name, advisory-only) is front-loaded before the invocation condition. Every sentence changes how an agent would behave.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter, no-annotation, no-output-schema tool, the description covers the critical semantics: advisory scope, non-authority, and the Mission Key handoff. It does not describe the receipt's contents or the full Mission Key flow, which leaves a small but real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so action_class, summary, and evidence are already documented with their allowed values. The description adds no syntax or format guidance beyond the schema, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete deliverable (an exact action binding and a local review receipt) for a consequential-action workflow, and flags that the tool name 'request_approval' is legacy and misleading. It does not, however, position itself against siblings like mission_ask or get_receipt, so the agent gets the function but not the sibling routing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear positive timing ('Call before a consequential action') and an explicit negative boundary ('does not grant authority or resume execution'). It stops short of naming which sibling to use instead when the agent actually needs authority or status, so the alternative-routing half of the guidance is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedget_receipt
    • First observedlog_action
    • First observedmission_ask
    • First observedmission_status
    • First observedrequest_approval

TDQS

B3.4/5.0

Scored across 5 tools

Disambiguation4/5

Each tool targets a distinct action: request_approval for consequential holds, log_action for internal receipts, get_receipt for retrieval, mission_status for gate status, and mission_ask for chat availability. The overlap between request_approval and log_action (both producing receipts) is clarified by descriptions, but the legacy advisory nature of request_approval could still cause confusion.

Naming Consistency3/5

Most tools use a verb_noun pattern (request_approval, get_receipt, log_action), but mission_ask and mission_status use a noun-prefix convention, and request_approval is explicitly labeled legacy-named. The mix is readable but not fully consistent.

Tool Count4/5

Five tools is a reasonable size for a focused permission-layer server. However, mission_ask is currently non-functional and request_approval is legacy, so one tool does not fully earn its place, making the count slightly heavy rather than ideal.

Completeness3/5

The core lifecycle of status, approval request, action logging, and receipt retrieval is covered, but there are notable gaps: no way to list or search receipts, no tool to validate the single-use Mission Key that request_approval requires the executor to check, and mission_ask only checks unavailable chat functionality.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    The accountability layer for AI agents — a named human's signed yes before an agent does anything irreversible (payment, record change, deploy), then an offline-verifiable Trust Receipt. Apache-2.0, formally verified.
    3
    611
    Apache 2.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    Cryptographically verifiable, scope-narrowing delegation chains for AI agents, enabling human-anchored authorization across multiple hops.
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Mission MCP is a Trust Graduation gate for AI agents, with visible approval ceremonies and receipt-backed boundaries for consequential actions.
    MIT