verify-mcp-allowlist

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "verify-mcp-allowlist",
  "version": "0.4.0",
  "description": "Gate MCP server configuration as protected content. A shell write to .mcp.json is refused unless every mcpServers entry on the line, parsed as JSON, matches a name+source pair on the allowlist -- an unlisted name blocks, and an allowed name whose command/args/url changed blocks too. `claude mcp add|add-json` is checked the same way (add-from-claude-desktop cannot be verified and is refused). The allowlist ships inside this guard's own script, protected like every policy's implementations/ source -- edit only with 'chock: approved-config-change'. The shell guard reads Claude Code's .mcp.json, best-effort (PreToolUse fails open on a crash; a write with no visible content fails closed). A script gate at commit and tool use parses every written MCP config (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, claude_desktop_config.json, .gemini/settings.json, .codex/config.toml) against the same allowlist; only servers the change adds or alters are refused, at commit and tool use. No pragma.",
  "author": {
    "name": "chock-core"
  },
  "repository": "https://github.com/open-coder-ai/chock-catalog",
  "license": "Apache-2.0",
  "keywords": [
    "chock",
    "policy-as-code",
    "rule",
    "advise",
    "{'control': 'asi04', 'coverage': 'partial', 'note': \"blocks an unverified mcp server entering .mcp.json from the shell -- the mechanizable slice of asi04's 'unverified mcp servers' framing; provenance and signature verification beyond allowlist membership stay with the advisory owasp-asi04-agentic-supply-chain policy\"}"
  ],
  "extensions": {
    "io.github.open-coder-ai": {
      "manifest": "manifest.yaml",
      "artifact": "rule",
      "enforcement": "advise",
      "coverage_without_chock": "advisory"
    }
  }
}