Eclipse Shelfprice
Listing view-to-checkout drift witness over fixture listing/checkout pairs — the price + full view terms are hash-sealed at view time; checkout drift of any term produces a signed drift receipt recomputable from the buyer-held pack. CERTIFIED(local, fixture listing/checkout pairs) — fixture pairs only; no live marketplace is touched, and Shelfprice never blocks or alters a checkout.
status: in-developmentclass: mcpAgent Commerce / ProcurementTrust & Receipts
Vendor: Cyan Eclipse Technologies
What it does
- Novel mechanism (SPEC §2.1, with the §11.2 substitution applied) — the price + terms an agent saw are sealed at view time, so view-to-checkout drift is recomputable from the buyer-held pack by the buyer. (Spec §11.2 fence: in v0.1 surfaces the product claims only drift — 'the checkout differed from the sealed view in these named terms'; drift proves difference, not intent, and admissibility is never claimed.)
- Seal at view time + term-by-term diff — seal_hash = sha256(canonical(view_terms_object)) over the full §4.1 view terms object (price, fees, shipping, taxes as stated, quantity/availability terms, returns terms, subscription terms, and the listing version itself), each field also hashed individually (term_hashes) so drift is located, not just detected; there is no price-only mode — a checkout matching the headline price but drifting any other sealed term is DRIFT. Verification recomputes each sealed term's per-term hash from the presented checkout and returns MATCH, or on any mismatch a signed drift receipt naming each drifted term with its sealed vs presented per-term hashes (hashes only, except unit_price/total_all_in/shipping_as_stated amounts when those terms drift, SPEC §6.3). Verdicts: MATCH · DRIFT · LISTING_SUPERSEDED · EXPIRED_VIEW · SEAL_NOT_FOUND. A listing view never presented at view time can never be sealed retrospectively — a reconstructed view receives only an unsigned UNSEALED_SUMMARY, which the verifier rejects; downgrade law: unverifiable packs downgrade whole to UNWITNESSED_EXPORT, never upgraded.
- Offline verification (SPEC §6.4) — a pure function of the buyer-held pack + pinned fixture keys alone: seal_hash and every term_hash recomputed from the pack's view terms, Herald signature and buyer counter-signature verified against keys pinned out-of-band (never keys carried inside the pack; counter-signature presence/absence must match the seal's face label), record chain walked gapless, drifted_terms + verdict re-derived per verification record including the expiry and superseded-version conditions, value_class 'test' required throughout; any step failing downgrades the whole pack with no partial verdict. Stored paths enforce the same discipline (v0.1.1, delta-bench C1–C3 closures): checkout_verify (fresh + idempotent), view_seal's idempotent return, seal_status, and drift_receipt_get recompute stored seal hashes/term hashes and verify record hashes, Herald signatures, counter-signatures, and receipt hashes before issuing any verdict or serving any stored record — any mismatch is a SEAL_DEFECT refusal, no verdict issued, no record appended, nothing tampered served.
- Decisive fixture F-SP8 — bench-reproduced at v0.1.0 and as a delta regression at v0.1.1: listing view sealed at fixture T=2026-10-27T01:00:00Z (listing v3); checkout drifting in exactly 3 named terms (unit_price, one fee in fees_as_stated, returns_terms_hash); pack exported to a buyer-side holder only and re-verified in a fresh verifier-only subprocess from pack + pinned fixture keys alone (fresh empty data dir): verified True, seal ts == T, version bound = 3, drift re-derived as exactly [unit_price, fees_as_stated, total_all_in, returns_terms_hash] (the 3 named terms + consequential total), and the fresh process wrote no state files.
- Honest scope — LOCAL stdio, fixture listing/checkout pairs ONLY: no live marketplace, listing page, storefront, cart, or seller system is touched, scraped, or judged, no real listing or checkout is sealed or judged, and every emitted artifact carries value_class 'test'. Shelfprice never blocks a checkout, alters a price, contacts a seller or marketplace, or executes or refunds any payment. Closed surface of exactly 7 tools (5 caller + 2 operator, disjoint); no retrospective-seal, seal-edit, verification-delete, checkout-block/alter, seller/marketplace-contact, scrape, or unsealed-view-receipt verb exists on either surface. Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on a live-key string, a marketplace/listing endpoint or scraping or network-client config, a caller-supplied-witness-timestamp mode flag, or value_class other than 'test'. Signing is an HMAC-SHA256 fixture stand-in for the Herald pattern (disclosed on every record's face); C4 (standing scope condition): scope stays local/fixture until signing is real Herald RS256; no surface may describe v0.1 verification as public-key verification — 'pinned fixture keys' wording only. Verification uses pinned fixture keys only (fixture HMAC stand-in; not public-key verification); the pinned key file holds a shared HMAC secret, not a public key, any holder can forge seals, and no public-key or third-party verifiability is claimed.
Tools
view_seal · checkout_verify · seal_status · drift_receipt_get · seal_verify · seal_pack_export · anomaly_queue_read
Platforms
- MCP over stdio
Certification
Bench verdict: CERTIFIED(local, fixture listing/checkout pairs)
Certified scope: CERTIFIED(local, fixture listing/checkout pairs) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave2/bench-shelfprice.md) PASS-CONDITIONAL(local, fixture listing/checkout pairs) with conditions C1–C4 and a stored-path carve-out, plus delta re-bench of v0.1.1 in the same record (stored paths only): C1 CLOSED, C2 CLOSED, C3 CLOSED at scope — the carve-out is LIFTED and no new findings were raised. Builder suite 33/33 at v0.1.0 and 43/43 at v0.1.1 (33 prior + 10 new TestStoredPathIntegrity) re-run clean-state by the bencher both times; decisive fixture F-SP8 independently reproduced in a fresh process at both benches — seal at fixture T=2026-10-27T01:00:00Z (listing v3), checkout drifting exactly price + one fee + returns terms, pack re-verified in a verifier-only subprocess from pack + pinned fixture keys alone (fresh empty data dir, no state files written): verified True, verdict DRIFT re-derived, drifted exactly [unit_price, fees_as_stated, total_all_in, returns_terms_hash]. Delta probes 26/26 PASS: stored term_hashes rewritten to the drifted checkout's hashes and Herald signature zeroed both meet SEAL_DEFECT with no verdict issued and no record appended (the DRIFT-to-signed-MATCH laundering is dead); tampered stored verdict, backdated stored seal, forged seal_hash/2030 expiry, and tampered drift receipt all refuse SEAL_DEFECT and are never served, while intact controls serve normally on every path. Scope is exactly: local stdio MCP, fixture listing/checkout pairs only, value_class 'test' throughout — now including the online stored-read paths (checkout_verify fresh + idempotent, view_seal idempotent return, seal_status, drift_receipt_get), which recompute and signature-verify stored seals, verdicts, and receipts before serving; no live marketplace, listing page, storefront, cart, or seller system is touched, scraped, or judged, and Shelfprice never blocks or alters a checkout; no counsel-gate (SPEC §10) live phase built or claimed. Novel mechanism (SPEC §2.1, with the §11.2 substitution applied): the price + terms an agent saw are sealed at view time, so view-to-checkout drift is recomputable from the buyer-held pack by the buyer. Accepted limitation F6 (on the face of the bench): a pack truncated to a prefix of the record chain verifies over the presented records only — the format has no completeness anchor; nothing presented can be forged or upgraded. C4 (standing scope condition): scope stays local/fixture until signing is real Herald RS256; no surface may describe v0.1 verification as public-key verification — 'pinned fixture keys' wording only. Verification uses pinned fixture keys only (fixture HMAC stand-in; not public-key verification); the pinned key file holds a shared HMAC secret, not a public key, any holder can forge seals, and no public-key or third-party verifiability is claimed.
Not tested:
- Real listings, real checkouts, or any live marketplace use — fixture listing/checkout pairs only; the SPEC §10 counsel gate is unbuilt by design, named, with no dormant live mode: (a) sealing real listing views / verifying real checkouts on live marketplaces (integration, scraping, and platform-terms review), (b) any characterization language beyond 'drift' in a live listing, pack, or sales material, (c) any integration that blocks or alters a live checkout on a DRIFT verdict, (d) retention/handling of real buyers' view/checkout data (privacy review), (e) any claim that a drift receipt is admissible or binding — each requires counsel clearance, a scope edit in code, and a Verity re-bench at the new scope
- Any checkout blocked or altered, price altered, seller or marketplace contacted, or payment executed or refunded — Shelfprice is evidence-only: a DRIFT verdict is information for the buyer and evidence for a later dispute, nothing more; drift proves difference, not intent. Never claimed for v0.1.1 are price accuracy, best-price, seller/marketplace endorsement or partnership, live monitoring of any marketplace, or that a MATCH means the price was fair (SPEC §11.3 strings are named here only as never claimed); a MATCH means only that the presented checkout matched the sealed view in every term; no wording implies a verdict can be bought or a drift finding suppressed (SPEC §11.4 — metering attaches to the seal, identical regardless of later verdicts)
- Production signing / public-key verification — v0.1.1 signing is an HMAC-SHA256 fixture stand-in for the Herald pattern (local fixture keys, keys/ gitignored, mode 600, never committed; signer face: herald-fixture (fixture HMAC stand-in)); C4 (standing scope condition): scope stays local/fixture until signing is real Herald RS256; no surface may describe v0.1 verification as public-key verification — 'pinned fixture keys' wording only. Verification uses pinned fixture keys only (fixture HMAC stand-in; not public-key verification); the pinned key file holds a shared HMAC secret, not a public key, any holder can forge seals, and no public-key or third-party verifiability is claimed. A fresh clone generates its own fixture keys to run the full suite
- Hosted or live operation — local stdio only; metering point only per SPEC §9.1 (exactly one Meter record per completed view_seal; verifications, drift receipts, status, and exports never meter), the $0.001/seal or $99/mo shape is a book reference with no charge path built and no live Meter ingest
Live state note: Bench evidence: argus101-program-20261027/wave2/bench-shelfprice.md (Verity bench of v0.1.0, 2026-10-27, PASS-CONDITIONAL(local, fixture listing/checkout pairs) C1–C4 with stored-path carve-out; builder suite re-run clean 33/33, also under a socket-denied harness, F-SP8 reproduced independently in a fresh process, pack-path adversarial 19/19 tampers downgraded to UNWITNESSED_EXPORT, stored-path tampers F1–F5 documented, §5.3 refusals, malformed-args battery, 120-op fuzz, surface disjointness, Trueprice cross-verification excluded both ways) + delta re-bench of v0.1.1 in the same record (suite 43/43 clean-state, bencher's own tampered-store probes 26/26, F-SP8 regression PASS, C4 wording audit PASS on README + server.json + source surfaces; C1–C3 CLOSED, carve-out lifted). Fix record: argus101-program-20261027/wave2/fix-shelfprice.md. No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).
Pricing
PRICED — $0.001/seal or $99/mo, via the Eclipse Bazaar bench-order/intake path only. No checkout, payment, or buy-now link exists for this product, and no Stripe object exists for it in this pass: intake orders are reviewed and confirmed by the operator before any payment link is sent. Metering shape per SPEC §9 (metering point only in v0.1.1, no charge path built): exactly one Meter record per completed view_seal — the seal is the priced unit; verifications, drift receipts, status, and exports emit no metering record (a drift finding is never a chargeable event); idempotent re-seal returns the recorded seal with no double metering; the $99/mo shape is a subscription pattern reference only, with no subscription enforcement built. The local package is the reference implementation. Repository is PRIVATE (priced-product policy).
Install / verify
No install command is published for this product in the catalog or its registry record.
Official MCP Registry name: io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-shelfprice-mcp
Registry listing: https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC%2Feclipse-shelfprice-mcp/versions/0.1.1
Repository: https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-shelfprice-mcp
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).