@securestamp/execution-guardian-mcp

@securestamp/execution-guardian-mcp

Credential-free stdio bridge for the customer-controlled SecureStamp Execution Guardian daemon.

Public Beta — sandbox/test environments only. SecureStamp proves operations executed through the customer-controlled Guardian; it cannot prevent out-of-band provider actions. Do not use production credentials.

The bridge accepts exactly three namespaced tools and connects only to the Unix socket configured by GUARDIAN_SOCKET_PATH. It contains no provider adapters, provider SDKs, cloud connection token, approval token, quorum request identifier, outcome token, signing key, or provider credential. If the daemon is absent it fails closed with GUARDIAN_DAEMON_UNAVAILABLE.

The socket directory must be mode 0700 and the daemon creates the socket with mode 0600. The public beta tools are Stripe test refunds, an inert AWS staging role-policy fixture, and an Okta test-group membership fixture.