Eclipse Toolprint
Pins MCP tool descriptions/schemas at session start and catches silent mid-session changes: every verified call carries the hash of the exact description the agent saw, and a swapped description is invalidated with a hash-chained proof record. LOCAL scope only — a local verification engine on caller-supplied tool lists + fixtures; it does NOT proxy live MCP traffic, connect to remote servers, or execute described tools.
status: in-developmentclass: mcpAgent InfrastructureTrust & Receipts
Vendor: Cyan Eclipse Technologies
What it does
- Novel mechanism — session-bound fingerprint chain: pin_session canonical-hashes (toolprint-canonical-v1, SPEC §3) every tool's name + description + inputSchema at session start and stores the pin as the genesis of a hash-chained session record; verify_call recomputes the hash of the exact description/schema presented at call time — presented hash == pinned hash = VALID, any difference = INVALIDATED, appended to the chain as a proof record carrying BOTH hashes. A swapped description cannot be quietly un-swapped: swap-back returns VALID again but the INVALIDATED proof record stays in the chain, unaltered. Bench: independent canonicalizer (written from SPEC §3 alone) reproduces all fixture fingerprints + the session fingerprint byte-exact; a 1-character description edit and a schema-only property change both INVALIDATE; bundled swaps give drift CHANGED×2 / SAME×1 / ADDED×0 / REMOVED×0 exactly; list reorder does NOT invalidate (fingerprints are per-tool, session tools sorted by name).
- Session-bound, not a static scan: a tool list fully clean at pin time whose description is swapped AFTER pinning is caught by verify_call — a static pre-flight scanner (e.g. mcp-scan) has no session state to catch a post-pin swap. Controls bench-verified: verify on an unpinned session = UNKNOWN_SESSION (never VALID), on a never-pinned tool = UNKNOWN_TOOL, with a never-pinned description = INVALIDATED; unknown tool names (e.g. proxy_call) = NO_SUCH_TOOL refusal stating it does not proxy live MCP traffic.
- Caller-anchored chain head (v0.1.1 fix for bench defect D1, MEDIUM): a bare hash chain is internally consistent after its LAST record is deleted, so tail truncation — typically deleting the INVALIDATED proof record — was undetectable in v0.1. v0.1.1 returns head_hash + record_count from pin_session, verify_call, and get_session_chain, and get_session_chain accepts them back as expected_head_hash / expected_record_count: anchored tail truncation = chain_valid:false, TAIL_TRUNCATION_SUSPECTED; a same-count forged tail = CHAIN_HEAD_MISMATCH; interior tamper (edit / delete / reorder of any non-tail record) stays self-detecting with no anchor needed (CHAIN_RECOMPUTE_FAILED). Without an anchor the response carries anchored:false and chain_valid asserts internal consistency only — never implied truncation detection (SPEC §10; caller duty: anchor at pin, re-anchor after every verify).
- Independent recompute by design: fingerprint_tool returns the exact canonical JSON preimage of every fingerprint, so any caller can recompute every hash with any SHA-256 implementation; detect_drift reports per-tool SAME / CHANGED / ADDED / REMOVED vs the pin with both fingerprints, read-only (drift checks never append to the chain). Exactly 5 tools on the wire; every envelope carries scope LOCAL + canonicalization toolprint-canonical-v1; clean coded errors with no partial state (a failed pin creates no session, a refused verify appends no record).
- Honest scope: LOCAL only — v0.1.1 operates only on caller-supplied tool lists/descriptions plus the bundled fixtures. It does NOT proxy live MCP traffic, does not connect to remote MCP servers, does not execute any described tool, and makes no network calls. Python 3 standard library only; MCP over stdio; no payment, checkout, metering-enforcement, or billing code — the $0.05/call term is a commercial term for hosted/commercial deployment, not a build feature.
Tools
pin_session · verify_call · get_session_chain · detect_drift · fingerprint_tool
Platforms
- MCP over stdio
Certification
Bench verdict: CERTIFIED (local)
Certified scope: CERTIFIED (local) — Verity independent bench 2026-10-26, REBENCH-1 of the v0.1.1 Bench Fix D1 round (repo @ 240c329): 18/18 PASS, deterministic across 2 runs. Anchored tail-truncation (the v0.1 D1 repro) detected as TAIL_TRUNCATION_SUSPECTED with chain_valid:false; unanchored reads explicitly carry anchored:false / anchor_match:null and assert internal consistency only; a same-count forged tail (independently recomputed record_hash, invisible to bare-chain recompute) is caught as CHAIN_HEAD_MISMATCH by the caller anchor alone; anchor material (head_hash + record_count) present and advancing on pin_session, verify_call, and get_session_chain, with tool_version 0.1.1 on every envelope. Regression spot-checks PASS: verbatim presented description = VALID, swapped-fixture search = INVALIDATED with pinned 332a2771… / presented 6246163e…, and the v1 fixture fingerprint + SPEC §3.1 canonical preimage are byte-exact unchanged by the fix. Prior verdict on v0.1.0 (VERDICT.md): CONDITIONAL (local), 40/40 probes PASS, defect D1 (MEDIUM — tail truncation erased a proof record undetectably, falsifying SPEC §2.3's unqualified tamper claim) — closed by this re-bench via implementation (caller-anchored head) plus the qualified SPEC §10 claim. Scope = LOCAL only: a local verification engine operating on caller-supplied tool lists/descriptions plus bundled fixtures, stdio transport; it does NOT proxy live MCP traffic, does not connect to remote servers, does not execute described tools, and makes no network calls — no live-traffic claim is made by the product or tested here. Claim honesty PASS with 1 non-blocking observation on the record: SPEC §2.3's original unqualified sentence and §8 item 4 remain verbatim in the body, neutralized only by §10's supersession header; the document read whole is accurate. §9.3 signed/external anchoring for cross-party evidence remains open by design and is not claimed.
Not tested:
- Live MCP traffic proxying or interception — not in v0.1.1 by design: the engine never proxies live traffic, connects to remote servers, or executes described tools; a live-traffic scope upgrade requires its own spec + bench
- Hosted or remote serving — v0.1.1 is local stdio only, operating on caller-supplied tool lists + bundled fixtures
- Cross-party evidence use — signed chain heads / external anchoring (SPEC §9.3) remain open by design and are not claimed; unanchored chain reads assert internal consistency only, never truncation detection
- Per-call metering or payment enforcement — none exists in v0.1.1 by design: the $0.05/call (PC-3) term is commercial metadata for hosted/commercial deployment; no payment, checkout, or billing code is in the server
Live state note: Bench evidence: argus-batch-20261026/bench/toolprint/VERDICT.md + REBENCH-1.md (Verity, independent bench over stdio JSON-RPC only, isolated state dirs, own canonicalizer from SPEC §3). This bench issued no test-bench/results scorecard; scorecard_ref is null and no scorecard is claimed or hosted for this product.
Pricing
PRICED — $0.05/call (PC-3) for hosted/commercial deployment, via the Eclipse Bazaar bench-order path only. No checkout, payment, or buy-now link exists for this product; v0.1.1 contains no payment, checkout, metering-enforcement, or billing code. Repository is PRIVATE (priced-product policy).
Install / verify
No install command is published for this product in the catalog or its registry record.
Official MCP Registry name: io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-toolprint-mcp
Registry listing: https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC%2Feclipse-toolprint-mcp/versions/0.1.1
Repository: https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-toolprint-mcp
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).