Govern MCP Agent Tool Calls with Cedar Policies

This skill teaches how to govern AI agent tool calls using Cedar policies and Ed25519 signed receipts via the protect-mcp tool. It intercepts MCP tool calls, evaluates them against Cedar policies (the same policy engine used by AWS Verified Permissions, run locally via WASM with no network calls) and signs every decision as a cryptographic Ed25519 receipt proving a specific policy was evaluated against a specific tool call at a specific time. It covers three operating modes - shadow mode (default: logs decisions without blocking, for observing policy behavior before enforcing), enforce mode (blocks tool calls that violate policy), and hooks mode (integrates with Claude Code pre/post tool-call hooks) - plus writing Cedar permit/forbid policies, initializing governance for a project, and verifying signed receipts and audit bundles offline via @veritasacta/verify.

Use it when you need to control which MCP tools an agent can call and under what conditions, when you want a tamper-evident audit trail for agent tool executions, when rolling out governance policies gradually (shadow mode first, then enforce), when authoring Cedar policies for MCP tool access control, or when verifying that a receipt or audit bundle has not been tampered with.

Do not use it for general application security auditing - use a dedicated security-auditor skill instead. Do not use it to scan code for vulnerabilities - use a dedicated security-audit skill instead. Do not use it for compliance framework guidance without agent-specific governance context. Start in shadow mode and observe before enforcing - skipping straight to enforce mode in production is called out as a mistake. Do not trust a claimed_issuer_tier without independent verification, and do not treat a valid signature as proof the signer is trustworthy - it only proves the receipt has not been tampered with since signing, not that the underlying decision was correct.

Input: the MCP tools/agent behavior to govern, or a receipt/audit bundle to verify. Output: a Cedar policy file, a signed receipt per tool-call decision, or a verification result.

// Allow read-only file operations
permit(principal, action == Action::"call_tool", resource)
when { resource.tool_name in ["read_file", "list_directory", "search_files"] };

// Deny destructive operations
forbid(principal, action == Action::"call_tool", resource)
when { resource.tool_name in ["execute_command", "delete_file", "write_file"] };

Built on the Cedar policy language (AWS's open-source authorization engine), integrates with Claude Code hooks for pre/post tool-call governance, and uses @veritasacta/verify (Apache-2.0, works offline) to validate signed receipts against the IETF draft-farley-acta-signed-receipts format. Chains with @security-auditor, @security-audit, and @mcp-development skills for adjacent concerns.

Teams running MCP servers or Claude Code agents in production who need enforceable, auditable tool-call access control - especially for production systems handling customer data where destructive operations must be blocked and every decision cryptographically logged.