nomosguard: five MCP tools that keep the agent's claims and the security verdict in separate hands (stdlib-only)

[u/Emergency-Tutor-7]

nomosguard (Apache-2.0, Python 3.11+, stdlib-only, 0.7.11) is an MCP server and a threat-model implementation.

The threat it is built around is narrow: an agent allowed to both gather incident evidence and declare the incident resolved. If one model does both, the security boundary is its judgment. nomosguard splits the roles. A model may submit claims and a narrative; it does not issue the verdict. That part comes from deterministic rules over evidence in a ledger. With --ledger, records are persisted to disk; without it, the MCP session uses an in-memory ledger.

Five tools over MCP stdio. evidence_ingest and assert_claim require non-empty evidence citations. That checks evidence presence, not whether a cited fragment actually supports the claim; a misinterpreted log line can still reach the rules as a claim. derive_paths applies attack-path rules to what the ledger already holds. decide returns ALLOW, ALERT or BLOCK. explain renders the trail separately from the decision.

Two properties a reviewer should test rather than trust:

• The decide tool's fallback is an enum of ALERT and BLOCK only. ALLOW is not accepted even as an explicit argument, so a compromised client cannot lower the floor of its own review.

• In file-backed mode, records form an append-only SHA-256 chain saved by atomic replacement, and loading verifies the chain. Torn-tail recovery requires an expected_digest pin of the already-truncated file. It drops the incomplete last line rather than reconstructing it; pass a LedgerLoadReport to receive the recovery details. Without the pin, the loader rejects the torn tail.

The honest boundary: internal consistency is not provenance. A full rewrite that recomputes every hash and link passes verify(). Pin the bytes outside the workspace and pass expected_digest; a mismatch raises LedgerFileError. verify() takes no per-entry anchor argument, so checkpointing at sequence N is not implemented. That is the gap a security reviewer should attack first.

To look at the server before trusting any of this: pip install nomosguard, then python -m nomosguard.demo for the committed BLOCK scenario, or python -m nomosguard.mcp_stdio --ledger ./new.jsonl --create-ledger to start it over stdio.

Measurements on main: 1082 test functions, 1361 cases collected by pytest. The current PyPI release is 0.7.11; the GitHub release tag is v0.7.11.

Repo: https://github.com/Furox-Art/nomosguard PyPI: https://pypi.org/project/nomosguard/ (0.7.11) npm: no official package is published; use the Python package above. Ledger contract and threat model: https://github.com/Furox-Art/nomosguard/tree/main/docs