mcp-use + EVC authorization example

This standalone example puts a Bolyra External Verifier Contract v1 host boundary behind the existing mcp-use TypeScript middleware seam. A gateway proxies vault_echo, spawns a single-shot external verifier, validates its closed verdict envelope, and calls next() only after an allow.

Run

npm install
npm test
npm run dev

Open the printed URL to use the built-in mcp-use Inspector. Call vault_echo with:

{
  "message": "hello",
  "bundle": "demo-valid-bundle",
  "agentName": "research-bot",
  "model": "demo-model"
}

Change bundle to any other value to see the external verifier deny the call before the upstream server runs.

The host adapter demonstrates the important EVC mechanics: one request on stdin, one bounded verdict on stdout, timeout and process failure handling, strict verdict shapes, reserve-before-dispatch nonce handling, and fail-closed behavior. The verifier is intentionally a tiny external-class demo, not Bolyra's ZK verifier.

EVC is an independent third-party contract and is not part of MCP or mcp-use.