protect-mcp-setup

Cryptographic governance for every Claude Code tool call. Each invocation is evaluated against a Cedar policy and produces an Ed25519-signed receipt that anyone can verify offline. Claude Code runs powerful tools: Bash , Edit , Write , WebFetch . By default there is no audit trail, no policy enforcement, and no way to prove what was decided after the fact. protect-mcp closes all three gaps: AI agents make decisions that affect money, safety, and rights. The Claude Code session log records what happened, but the log is: For compliance contexts (finance, healthcare, regulated research), this is not sufficient. You need tamper-evident evidence that can be verified by third parties without trusting you. Add protect-mcp to your Claude Code project: Add the following to your project's .claude/settings.json : PreToolUse — Runs BEFORE the tool executes. Evaluates the tool call against your Cedar policy file.