
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
@cubiczan/chp-mcp
Advanced tools
Spend approval gate for AI agents — enforce budget limits, per-asset caps and human-in-the-loop thresholds before an agent moves money, with a signed audit hash.
@cubiczan/chp-mcpOne-command MCP install for CHP Profile B spend / capital gates.
Wraps @cubiczan/chp so Cursor,
Claude Code, or any MCP client can call evaluate_spend_gate without vendoring
protocol code. Engine digests match the normative golden vectors
(Profile B 30/30).
MCP client (Cursor / Claude / …)
│ tools/call
▼
┌───────────────────────────┐
│ MCP server (transport) │ ← you are here (@cubiczan/chp-mcp)
│ evaluate_spend_gate │
│ approve_spend │
│ chp_content_hash │
└─────────────┬─────────────┘
│ depends on
▼
┌───────────────────────────┐
│ Published CHP packages │
│ npm: @cubiczan/chp (Profile B)
│ PyPI: consensus-hardening-protocol (Profile A)
└───────────────────────────┘
For AGENTS.md + skills + Profile A decision_gate / decision_adversary, use
agent-conductor instead.
npm install -g @cubiczan/chp-mcp
# or one-shot
npx -y @cubiczan/chp-mcp
{
"mcpServers": {
"chp": {
"command": "npx",
"args": ["-y", "@cubiczan/chp-mcp"]
}
}
}
claude mcp add chp -- npx -y @cubiczan/chp-mcp
| Tool | Maps to | Purpose |
|---|---|---|
evaluate_spend_gate | evaluateGate | LOCKED / HITL_REQUIRED / BLOCKED + claims + content hash |
approve_spend | approveHuman | Human lock when HITL_REQUIRED (cannot override hard fails) |
chp_content_hash | contentHash | Float-aware canonical SHA-256 |
chp_version | — | Server + protocol versions |
// tools/call evaluate_spend_gate
{
"action": { "action": "LONG", "asset": "ETH", "notional": 300, "confidence": 0.9 },
"policy": {
"max_notional": 500,
"daily_cap": 2500,
"hitl_threshold": 250,
"min_confidence": 0.55,
"allowed_actions": ["LONG", "SHORT"]
}
}
| Package / repo | Role |
|---|---|
@cubiczan/chp | Profile B library (this server’s dependency) |
consensus-hardening-protocol | Profile A + normative spec |
@cubiczan/agent-conductor | Full MCP: contracts, skills, Profile A gates |
@cubiczan/governed-mcp-gateway | HTTP MCP control plane |
@cubiczan/codesentinel-mcp | Codebase health MCP |
cubiczan-resilience / @cubiczan/resilience | Shared retry / timeout / audit primitives |
MIT.
FAQs
Spend approval gate for AI agents — enforce budget limits, per-asset caps and human-in-the-loop thresholds before an agent moves money, with a signed audit hash.
We found that @cubiczan/chp-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.