@logi-auth/mcp-approval

@logi-auth/mcp-approval

MCP server for the logi Agent Approval Gate. Lets AI agents (Claude Code, Codex, Cursor, custom) request human approval on a user's phone before performing high-risk actions — budget changes, production deploys, payments, mass communications, etc.

The user sees: "Codex wants to change Meta budget from 500K → 50M KRW. Confirm with Face ID and the 6-digit code." They tap [거절] or [승인], the assertion is signed with the device passkey, and the agent receives the verdict.

Setup

• Register an agent in the logi developer console (start.1pass.dev). You'll get a Bearer token and (for signed mode) an Ed25519 private key — both shown once. Save them in a secret manager.

• Configure the MCP host (Claude Code shown):

  {
    "mcpServers": {
      "logi-approval": {
        "command": "npx",
        "args": ["-y", "@logi-auth/mcp-approval"],
        "env": {
          "LOGI_AGENT_TOKEN": "logi_agt_...",
          "LOGI_AGENT_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\n...",
          "LOGI_AGENT_PUBLIC_ID": "agt_xxxxxx",
          "LOGI_API_URL": "https://api.1pass.dev"
        }
      }
    }
  }
  

• Tell the agent the rules (in AGENTS.md, CLAUDE.md, or your system prompt):

  You have the logi__request_approval tool. ALWAYS call it BEFORE:
  - Changing any ads budget by >20% or absolute >1,000,000 KRW
  - Running migrations on production databases
  - Sending more than 100 emails or SMS messages in one batch
  - Spending >100,000 KRW on any external API
  - Deploying to production
  
  If the tool returns status != "approved", ABORT and tell the user.
  NEVER proceed without explicit approval for these categories.
  

Tools

• logi__request_approval — send a prompt; blocks until the user decides or times out. Returns { status, decided_at, ... }.
• logi__check_approval — poll a previously created prompt by id.

Auth modes

• signed (recommended): Bearer + Ed25519 signature on every request. Token theft alone cannot mint approvals — the private key is also required.
• bearer_only: Bearer only. Convenient (one-liner curl) but a leaked token is a full compromise. Disabled in production by default.

How replay / fatigue is prevented

• Every request carries a nonce + timestamp + body digest in the signature; the server rejects nonce reuse within a 5-minute window.
• An in-flight prompt for the same (user, agent, action_type) is reused instead of stacking up — defeats MFA bombing.
• A rejected action_type triggers a 10-minute cool-down before the same prompt can be re-issued.
• The user's phone shows a 6-digit number_match the agent also displays; mismatch → reject.

License

MIT