开源MCP工具

Deployment Tiers

Tier 1 is process-level (env-clear isolation, cap-std, command allowlist) — it is not kernel/container isolation and does not prevent kernel escapes or network exfiltration when bash is allowed. The agent PreToolUse-hook variant of Tier 1 (nucleus run --hook, nucleus guard) is not runnable from this repo: it shells out to a nucleus-claude-hook binary that lives in the external private orchestrator, and the in-repo install hint (cargo install --path crates/nucleus-claude-hook) is stale — that crate does not exist here. Tier 2 isolation requires Linux with /dev/kvm; on macOS the node returns an explicit "firecracker requires Linux" error, and the macOS test suite exercises config/allocation logic, not a live VM boot.

---

Quick Start

cargo install --git https://github.com/coproduct-opensource/nucleus nucleus-cli

nucleus audit [PATH]                # Tier 0: scan agent configs, no runtime (CI exit codes)
nucleus run --local "your task"     # Tier 1: run with enforced permissions (process-level, no VM)

Every tool call flows through the permission kernel. nucleus run tracks data provenance and blocks dangerous combinations — like writing code derived from untrusted web content.

Vendor neutrality. The core library and the generic credentials.env / PodSpec interface are intended to be vendor-agnostic, but the surface is not fully clean today. Two things break it: (1) the reference agent runner shipped with nucleus run/shell is coupled to one specific assistant CLI (binary name, default model string, permission-bypass flag), and (2) nucleus-spec still hardcodes specific LLM-vendor hostnames and workload-identity defaults (see Known Gaps). A PreToolUse hook for AI coding assistants lives in the external private orchestrator nucleus-code, built on this runtime. Treat the runner as an integration example, not a vendor-agnostic component.

---

3. Provenance Envelopes & the Public Verifier — signed, portable, independently checkable

Every agent session can be packaged as a provenance bundle — the agent's payload plus a signed lineage envelope proving how it was produced. Each lineage edge (one per tool call, LLM call, or derived artifact) carries a child SPIFFE id encoding its derivation, an Ed25519 signature, and a prev_hash link; the whole log is committed to an RFC 9162 Merkle tree with signed tree heads, inclusion/consistency proofs, and optional external-witness cosignatures (Nucleus + C2SP tlog-witness).

The point is independent verification. verify_bundle re-checks the entire bundle — per-edge signatures, hash chain, session membership, Merkle inclusion, cosignature thresholds, and payload binding — against a trust anchor you supply out-of-band. The bundle's own embedded keys are deliberately ignored. The same audited Rust verifier ships three ways:

A CI-gated adversarial corpus of 8 forged bundles (tampered edges, swapped signatures, truncation, attacker JWKS, unknown kid, foreign parent, non-pod root) must be rejected on every merge — every_corpus_case_is_rejected passes today. This is the security promise, not a slogan. For replication, nucleus-bundle-cas fetches bundles by BLAKE3 root over bao-verified iroh-blobs QUIC so a peer can't substitute or truncate bytes (alpha; single-operator split-trust, no discovery/mesh, pins pre-1.0 iroh).

Honest scope. A green verification proves the lineage is authentic and intact. It does not prove the agent behaved well, that information-flow policy held, or that any computation was correct — those are separate guarantees. Issuing/signing identities is demo-only in this repo (dev-feature-gated LocalIssuer); production needs an external SPIFFE issuer and witness. The public verifier service is not live (no hosted endpoint resolves today); it is self-hostable and deploy-ready. The @coproduct/verify npm package and in-browser tamper demo are publish-gated; the compiled .wasm is a build product, not committed.

---

References

• The Uninhabitable State — Simon Willison
• Lattice-based Access Control — Denning 1976, Sandhu 1993
• SPIFFE — Secure Production Identity Framework for Everyone
• RFC 8693 — OAuth 2.0 Token Exchange
• RFC 9162 — Certificate Transparency Version 2.0
• C2SP — Community Cryptography Specification Project (tlog-witness)
• Aeneas — A Verification Toolchain for Rust
• verify-rust-std — AWS's verification density benchmark