assay-cli 5.4.0

Policy-as-code gate for MCP agent tool calls, with verifiable evidence and Linux kernel enforcement.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

[package]
name = "assay-cli"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
readme.workspace = true
description = "Policy-as-code gate for MCP agent tool calls, with verifiable evidence and Linux kernel enforcement."
keywords = ["mcp", "ai-agents", "agent-security", "policy-as-code", "evidence"]
categories = ["command-line-utilities", "development-tools::testing"]
# Kept out of the published tarball because it reaches outside this package: it includes
# `crates/assay-mcp-server/tests/jsonrpc_conn/mod.rs` by `#[path]`, and `cargo package` copies only
# this package's files. Shipping it would put a test target in the crate that cannot compile at all
# — `couldn't read tests/../../assay-mcp-server/...` — which is worse than its absence for anyone
# running `cargo test` on the crates.io source (distro packagers, `cargo vendor` consumers). It
# could never run from a tarball anyway: it shells out to `cargo build -p assay-mcp-server`, which
# needs the workspace. `cargo publish`'s own verification builds lib and bins only, so this was not
# a release blocker either way — it is the downstream `cargo test` that this protects.
exclude = [
    "tests/e2e_mcp_wrap_assert_cmd.rs",
    # Workspace-only contract: reads generated docs and shared test support outside this package.
    "tests/agent_golden_path_contract.rs",
    # Workspace-only contract: imports shared test support outside this package.
    "tests/agent_plugin_package_contract.rs",
    # Workspace-only contracts: use the shared bounded-process helper outside this package.
    "tests/policy_validate_machine_contract.rs",
    "tests/config_recovery_argv_contract.rs",
    "tests/explicit_config_class_contract.rs",
    "tests/doctor_config_check_contract.rs",
    "tests/init_stdout_contract.rs",
    "tests/doctor_exit_class_contract.rs",
    "tests/doctor_argument_contract.rs",
    "tests/doctor_text_render_contract.rs",
    "tests/stdout_json_write_contract.rs",
    "tests/mcp_preflight_contract.rs",
    "tests/recovery_argv_publisher_parity.rs",
]

[lints]
workspace = true

[[bin]]
name = "assay"
path = "src/main.rs"

[features]
default = ["tui", "sim", "runner"]
experimental = ["assay-core/experimental"]
profile-test-hook = []
tui = ["dep:ratatui", "dep:crossterm"]
sim = ["dep:assay-sim"]
# Internal Assay-Runner Phase 1 spike command (`assay runner-spike`).
# Gated behind a feature because the underlying `assay-runner-{core,schema,linux}`
# crates are `publish = false`; cargo publish of `assay-cli` must therefore use
# `--no-default-features --features tui,sim` so the optional runner deps are not
# required to resolve from crates.io. Workspace builds and binary releases keep
# the default features (`runner` included) so behaviour for repo/CI consumers is
# unchanged from v3.11.0.
runner = [
    "dep:assay-runner-core",
    "dep:assay-runner-schema",
    "dep:assay-runner-linux",
]

[dependencies]
anyhow.workspace = true
async-trait.workspace = true
serde = { workspace = true, features = ["std"] }
serde_json = { workspace = true, features = ["std"] }
jsonschema = { workspace = true }
clap.workspace = true
tracing.workspace = true
env_logger = "0.11"
tokio.workspace = true

# Internal (Inherited from workspace)
assay-canonical = { workspace = true }
assay-core.workspace = true
assay-monitor.workspace = true
assay-common = { workspace = true, features = ["std"] }
assay-policy = { workspace = true }
assay-metrics = { workspace = true }
assay-evidence = { workspace = true }
assay-registry = { workspace = true }
assay-mcp-server = { workspace = true }
assay-runner-core = { workspace = true, optional = true }
assay-runner-schema = { workspace = true, optional = true }
assay-runner-linux = { workspace = true, optional = true }
assay-sim = { workspace = true, optional = true }

dialoguer = "0.12"
similar = "3"
serde_yaml.workspace = true
chrono = { workspace = true, features = ["std", "clock"] }
sha2 = { workspace = true }
hex = { workspace = true }
dirs = "6.0"

# Tool signing
ed25519-dalek = { version = "3.0", features = ["pkcs8", "pem", "rand_core"] }
getrandom = { version = "0.4", features = ["sys_rng"] }
rand = "0.8"
pkcs8 = { version = "0.11", features = ["pem"] }
base64 = "0.22"
sysinfo = "0.30"
humantime = "2"
tokio-stream = "0.1"
futures = "0.3"
globset = "0.4"
libc = "0.2"
semver = "1"
once_cell = "1.21"
nix = { version = "0.27", features = ["signal", "process", "fs", "ioctl"] }
ratatui = { workspace = true, optional = true }
crossterm = { workspace = true, optional = true }

[target.'cfg(target_os = "linux")'.dependencies]
landlock = "=0.4.7"



[[bench]]
name = "suite_run_worstcase"
path = "benches/suite_run_worstcase.rs"
harness = false

[[bench]]
name = "profile_store_harness"
path = "benches/profile_store_harness.rs"
harness = false

[dev-dependencies]
tempfile = "3"
regex = "1"
assert_cmd = "2.2.2"
predicates = "3.1.4"
proptest = "1.10"
serial_test = "3.5.0"
criterion = "0.8"

[target.'cfg(unix)'.dev-dependencies]
process-wrap = { workspace = true, features = ["process-group", "std"] }

[target.'cfg(windows)'.dev-dependencies]
process-wrap = { workspace = true, features = ["job-object", "std"] }