@cubiczan/chp-mcp
Evaluate spend proposals:
evaluate_spend_gateruns the CHP Profile B capital/spend gate on a proposed action (e.g., trade), returning LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash. Policy parameters include max notional, daily cap, HITL threshold, minimum confidence, allowed actions, and per-asset limits.Approve human-in-the-loop spends:
approve_spendlets a human approver approve a proposal that returned HITL_REQUIRED, but cannot override hard policy failures.Compute content hashes:
chp_content_hashgenerates a float-aware canonical SHA-256 hash of a JSON value, matching Python protocol digests.Check versions:
chp_versionreports the MCP server and CHP Profile B protocol versions.
In summary, this MCP server lets an AI agent invoke Profile B spending gates with optional human approval, produce canonical hashes, and verify version compatibility—ideal for integrating governed capital decisions into Cursor, Claude Code, or other MCP clients.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@cubiczan/chp-mcpEvaluate spend gate for a LONG ETH trade with 300 notional."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@cubiczan/chp-mcp
One-command MCP install for CHP Profile B spend / capital gates.
Wraps @cubiczan/chp so Cursor,
Claude Code, or any MCP client can call evaluate_spend_gate without vendoring
protocol code. Engine digests match the normative golden vectors
(Profile B 30/30).
How the pieces fit
MCP client (Cursor / Claude / …)
│ tools/call
▼
┌───────────────────────────┐
│ MCP server (transport) │ ← you are here (@cubiczan/chp-mcp)
│ evaluate_spend_gate │
│ approve_spend │
│ chp_content_hash │
└─────────────┬─────────────┘
│ depends on
▼
┌───────────────────────────┐
│ Published CHP packages │
│ npm: @cubiczan/chp (Profile B)
│ PyPI: consensus-hardening-protocol (Profile A)
└───────────────────────────┘For AGENTS.md + skills + Profile A decision_gate / decision_adversary, use
agent-conductor instead.
Related MCP server: Datashift MCP Server
Install
npm install -g @cubiczan/chp-mcp
# or one-shot
npx -y @cubiczan/chp-mcpCursor / Claude Desktop
{
"mcpServers": {
"chp": {
"command": "npx",
"args": ["-y", "@cubiczan/chp-mcp"]
}
}
}Claude Code
claude mcp add chp -- npx -y @cubiczan/chp-mcpTools
Tool | Maps to | Purpose |
|
| LOCKED / HITL_REQUIRED / BLOCKED + claims + content hash |
|
| Human lock when HITL_REQUIRED (cannot override hard fails) |
|
| Float-aware canonical SHA-256 |
| — | Server + protocol versions |
Example — evaluate a spend
// tools/call evaluate_spend_gate
{
"action": { "action": "LONG", "asset": "ETH", "notional": 300, "confidence": 0.9 },
"policy": {
"max_notional": 500,
"daily_cap": 2500,
"hitl_threshold": 250,
"min_confidence": 0.55,
"allowed_actions": ["LONG", "SHORT"]
}
}Related
Package / repo | Role |
Profile B library (this server’s dependency) | |
Profile A + normative spec | |
Full MCP: contracts, skills, Profile A gates | |
HTTP MCP control plane | |
Codebase health MCP | |
Shared retry / timeout / audit primitives |
Licence
MIT.
Available Tools
4 toolsapprove_spendA
Human-in-the-loop approval for a proposal that returned HITL_REQUIRED. Cannot approve BLOCKED / hard-rule failures (spec §6.3 / §6.5).
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| policy | Yes | ||
| approver | Yes | Human approver identity (email or handle) | |
| committed_today | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the burden of behavioral disclosure. It adds useful constraints: only HITL_REQUIRED proposals are approvable, and BLOCKED / hard-rule failures are not. However, it does not state whether approval executes the spend, what side effects occur, what permissions are required, or what the return behavior is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The key use condition and hard exclusion are stated immediately and clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, nested objects, no annotations, and no output schema, this description is too sparse. It does not explain how to construct the action/policy payload, what a successful approval returns, or how to obtain the HITL_REQUIRED proposal in the first place.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (just the approver field has a description). The tool description does not explain the action object, policy object, or committed_today semantics. Since schema coverage is low, the description needed to compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Human-in-the-loop approval') applied to a specific resource ('a proposal that returned HITL_REQUIRED') and explicitly excludes BLOCKED / hard-rule failures. This clearly distinguishes it from evaluative sibling tools like evaluate_spend_gate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool (proposals that returned HITL_REQUIRED) and when not to use it (BLOCKED / hard-rule failures), with spec section references. It does not explicitly name an alternative tool, but the exclusion criteria provide strong situational guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chp_content_hashA
SHA-256 over float-aware canonical JSON (CHP §3.1) — matches Python consensus-hardening-protocol digests for the same object.
| Name | Required | Description | Default |
|---|---|---|---|
| value | No | JSON-serializable value to hash |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the algorithm (SHA-256), the canonicalization method, and the consistency with Python digests. It doesn't mention edge cases or determinism, but for a pure hash function, this is reasonable. A minor gap is the lack of explicit side-effect-free declaration.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core operation (SHA-256 over float-aware canonical JSON) and adds the interoperability detail. Every word earns its place, with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one parameter, no output schema, and no annotations. The description fails to specify the return format (e.g., hex string, base64, binary) or error behavior for invalid inputs. An agent cannot be sure how to interpret the result, which is a significant gap for a hash function. Given the simplicity, this should have been included.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the single parameter 'value' with the description 'JSON-serializable value to hash'. The tool description adds no additional semantic meaning beyond that, so the baseline of 3 applies. It doesn't clarify format, size limits, or serialization specifics beyond what's in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a SHA-256 hash over float-aware canonical JSON, referencing CHP §3.1 and matching Python consensus-hardening-protocol digests. This specifies the verb (compute hash), resource (canonical JSON), and the exact algorithm, distinguishing it from unrelated sibling tools like chp_version.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for cross-language consistency (matching Python digests) within the CHP protocol. While it doesn't explicitly list when not to use it, there are no similar sibling tools, so the context is sufficient. It could be more explicit about typical use cases, but the purpose is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chp_versionA
Report MCP server and CHP Profile B protocol versions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description implies a read-only operation via 'Report', but does not explicitly state that no data is modified or that it is safe to call. Since no annotations are provided, the description carries the full burden of transparency and could be more explicit about side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no unnecessary words or repetition. It is well-structured and easy to understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description is complete and sufficient. It fully describes the tool's purpose without leaving any critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters in the input schema, so the description adds no parameter-level information. The baseline score of 3 is appropriate as there is nothing to describe.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports MCP server and CHP Profile B protocol versions, with a specific verb and resource. No ambiguity or missing information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool, such as checking version compatibility before other operations. It simply states what it does without context or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evaluate_spend_gateA
Run CHP Profile B capital/spend gate on a proposed action. Returns LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash. Hard policy violations cannot be overridden by a human.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Proposed trade / spend / mandate action | |
| policy | Yes | Gate policy (limits, HITL threshold, confidence floor) | |
| committed_today | No | Notional already committed today toward daily_cap (default 0) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations were provided, so the description carries the disclosure burden. It does disclose a key behavioral fact: hard policy violations cannot be overridden by a human. However, it does not state whether the tool mutates state, consumes budget/quota, requires authentication, or what happens on error, leaving notable gaps for a policy-evaluation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the core action and outcomes, and avoids filler. Every clause adds useful information: the gate type, the possible return states, the presence of claims plus content hash, and the hard-block caveat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives enough for basic use but lacks some completeness for a nested-parameter tool with no output schema. It does not explain the distinction between LOCKED and BLOCKED, the shape of the claims, or the meaning of the content hash. The behavioral caveat helps, but the description is not richly complete given the complexity of the inputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high: the top-level parameters action, policy, and committed_today each have descriptions. The tool description adds no additional parameter semantics beyond the schema, so the baseline 3 is appropriate. Nested fields like asset, notional, max_notional, and hitl_threshold remain self-describing from names but are not elaborated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Run') and names a clear resource ('CHP Profile B capital/spend gate on a proposed action'). It also lists concrete outputs (LOCKED, HITL_REQUIRED, or BLOCKED with claims and a content hash), which clearly distinguishes this from sibling tools like approve_spend and chp_content_hash.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: to evaluate a proposed action against the CHP Profile B spend gate before approval. However, it does not explicitly mention alternatives, exclusions, or how this tool relates to approve_spend, chp_content_hash, or chp_version, so the guidance is not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
approve_spend - First observed
chp_content_hash - First observed
chp_version - First observed
evaluate_spend_gate
TDQS
Scored across 4 tools
Each tool has a clearly distinct role: evaluate_spend_gate runs the policy check, approve_spend performs HITL approval, chp_content_hash computes hashes, and chp_version reports versions. No two tools overlap in purpose or could be easily confused.
The names are consistent snake_case and mostly follow a verb_noun pattern (evaluate_spend_gate, approve_spend). The chp_ prefixed helpers break that pattern slightly, but the prefix clearly groups utility/version operations, so the overall convention remains predictable.
Four tools is well-scoped for a narrow CHP Profile B protocol surface: gate evaluation, human approval, hashing, and versioning. Each tool earns its place without redundancy or bloat.
The core lifecycle is covered: evaluate → approve, with supporting hash and version utilities. A minor gap is the absence of an explicit tool to inspect proposal details, but the described results from evaluate_spend_gate include claims and content hashes, so agents can proceed without major dead ends.
Maintenance
Related MCP Connectors
Human-in-the-loop review and approval for AI agents. Audit trail, approval policies, native MCP.
Read-only BUY / WAIT / AVOID spend gate for paid APIs, MCP endpoints, and x402 routes.
Paid remote MCP for AI Studio Workspace approval gate MCP, structured receipts, audit logs, and revi
Human-in-the-loop for AI agents over MCP: durable approvals with a hosted review page & audit trail
Related MCP Servers
- FlicenseAqualityAmaintenanceGovernance/control plane for MCP-enabled coding-agent workflows with validation, findings, approvals, budgets, and proof bundles.5511-

Datashift MCP Serverofficial
AlicenseNot gradedqualityDmaintenanceEnables AI agents to submit tasks for human or AI review and receive decisions via MCP tools, adding human review checkpoints to workflows.MIT- AlicenseAqualityAmaintenanceAI-powered codebase health analysis — detects dead code, circular dependencies, coupling issues, and architectural drift. 6 MCP tools for Claude Desktop, Cursor, Windsurf, and Slack.645MIT
- FlicenseNot gradedqualityDmaintenanceA code quality analysis server that detects security vulnerabilities, deceptive patterns, incomplete code, and highlights good practices in source code for MCP-compatible clients like Claude Code.3-