# mcp-use + EVC authorization example

This standalone example puts a Bolyra External Verifier Contract v1 host boundary behind the existing `mcp-use` TypeScript middleware seam. A gateway proxies `vault_echo`, spawns a single-shot external verifier, validates its closed verdict envelope, and calls `next()` only after an `allow`.

## Run

```bash
npm install
npm test
npm run dev
```

Open the printed URL to use the built-in mcp-use Inspector. Call `vault_echo` with:

```json
{
  "message": "hello",
  "bundle": "demo-valid-bundle",
  "agentName": "research-bot",
  "model": "demo-model"
}
```

Change `bundle` to any other value to see the external verifier deny the call before the upstream server runs.

The host adapter demonstrates the important EVC mechanics: one request on stdin, one bounded verdict on stdout, timeout and process failure handling, strict verdict shapes, reserve-before-dispatch nonce handling, and fail-closed behavior. The verifier is intentionally a tiny external-class demo, not Bolyra's ZK verifier.

EVC is an independent third-party contract and is not part of MCP or mcp-use.