Cyan Eclipse Toolprint — Cyan Eclipse Bazaar

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

Certification scope

CERTIFIED (local) — Verity independent bench 2026-10-26, REBENCH-1 of the v0.1.1 Bench Fix D1 round (repo @ 240c329): 18/18 PASS, deterministic across 2 runs. Anchored tail-truncation (the v0.1 D1 repro) detected as TAIL_TRUNCATION_SUSPECTED with chain_valid:false; unanchored reads explicitly carry anchored:false / anchor_match:null and assert internal consistency only; a same-count forged tail (independently recomputed record_hash, invisible to bare-chain recompute) is caught as CHAIN_HEAD_MISMATCH by the caller anchor alone; anchor material (head_hash + record_count) present and advancing on pin_session, verify_call, and get_session_chain, with tool_version 0.1.1 on every envelope. Regression spot-checks PASS: verbatim presented description = VALID, swapped-fixture search = INVALIDATED with pinned 332a2771… / presented 6246163e…, and the v1 fixture fingerprint + SPEC §3.1 canonical preimage are byte-exact unchanged by the fix. Prior verdict on v0.1.0 (VERDICT.md): CONDITIONAL (local), 40/40 probes PASS, defect D1 (MEDIUM — tail truncation erased a proof record undetectably, falsifying SPEC §2.3's unqualified tamper claim) — closed by this re-bench via implementation (caller-anchored head) plus the qualified SPEC §10 claim. Scope = LOCAL only: a local verification engine operating on caller-supplied tool lists/descriptions plus bundled fixtures, stdio transport; it does NOT proxy live MCP traffic, does not connect to remote servers, does not execute described tools, and makes no network calls — no live-traffic claim is made by the product or tested here. Claim honesty PASS with 1 non-blocking observation on the record: SPEC §2.3's original unqualified sentence and §8 item 4 remain verbatim in the body, neutralized only by §10's supersession header; the document read whole is accurate. §9.3 signed/external anchoring for cross-party evidence remains open by design and is not claimed.

What it does

Novel mechanism — session-bound fingerprint chain: pin_session canonical-hashes (toolprint-canonical-v1, SPEC §3) every tool's name + description + inputSchema at session start and stores the pin as the genesis of a hash-chained session record; verify_call recomputes the hash of the exact description/schema presented at call time — presented hash == pinned hash = VALID, any difference = INVALIDATED, appended to the chain as a proof record carrying BOTH hashes. A swapped description cannot be quietly un-swapped: swap-back returns VALID again but the INVALIDATED proof record stays in the chain, unaltered. Bench: independent canonicalizer (written from SPEC §3 alone) reproduces all fixture fingerprints + the session fingerprint byte-exact; a 1-character description edit and a schema-only property change both INVALIDATE; bundled swaps give drift CHANGED×2 / SAME×1 / ADDED×0 / REMOVED×0 exactly; list reorder does NOT invalidate (fingerprints are per-tool, session tools sorted by name).
Session-bound, not a static scan: a tool list fully clean at pin time whose description is swapped AFTER pinning is caught by verify_call — a static pre-flight scanner (e.g. mcp-scan) has no session state to catch a post-pin swap. Controls bench-verified: verify on an unpinned session = UNKNOWN_SESSION (never VALID), on a never-pinned tool = UNKNOWN_TOOL, with a never-pinned description = INVALIDATED; unknown tool names (e.g. proxy_call) = NO_SUCH_TOOL refusal stating it does not proxy live MCP traffic.
Caller-anchored chain head (v0.1.1 fix for bench defect D1, MEDIUM): a bare hash chain is internally consistent after its LAST record is deleted, so tail truncation — typically deleting the INVALIDATED proof record — was undetectable in v0.1. v0.1.1 returns head_hash + record_count from pin_session, verify_call, and get_session_chain, and get_session_chain accepts them back as expected_head_hash / expected_record_count: anchored tail truncation = chain_valid:false, TAIL_TRUNCATION_SUSPECTED; a same-count forged tail = CHAIN_HEAD_MISMATCH; interior tamper (edit / delete / reorder of any non-tail record) stays self-detecting with no anchor needed (CHAIN_RECOMPUTE_FAILED). Without an anchor the response carries anchored:false and chain_valid asserts internal consistency only — never implied truncation detection (SPEC §10; caller duty: anchor at pin, re-anchor after every verify).
Independent recompute by design: fingerprint_tool returns the exact canonical JSON preimage of every fingerprint, so any caller can recompute every hash with any SHA-256 implementation; detect_drift reports per-tool SAME / CHANGED / ADDED / REMOVED vs the pin with both fingerprints, read-only (drift checks never append to the chain). Exactly 5 tools on the wire; every envelope carries scope LOCAL + canonicalization toolprint-canonical-v1; clean coded errors with no partial state (a failed pin creates no session, a refused verify appends no record).
Honest scope: LOCAL only — v0.1.1 operates only on caller-supplied tool lists/descriptions plus the bundled fixtures. It does NOT proxy live MCP traffic, does not connect to remote MCP servers, does not execute any described tool, and makes no network calls. Python 3 standard library only; MCP over stdio; no payment, checkout, metering-enforcement, or billing code — the $0.05/call term is a commercial term for hosted/commercial deployment, not a build feature.

Tools

pin_sessionverify_callget_session_chaindetect_driftfingerprint_tool

Problems it addresses

An MCP server showed my agent a benign tool description at review time, then silently swapped it mid-session — I need every call bound to the hash of the exact description the agent saw when it decided to call
A static scanner cleared a server once, at rest — I need a session-layer proof that catches a description or schema changed AFTER the pin, with the invalidation recorded so it cannot be quietly un-swapped
If someone deletes the proof record itself from the tail of the record store, I need that loss detected — not a shorter chain that still reports itself valid

Not tested

Live MCP traffic proxying or interception — not in v0.1.1 by design: the engine never proxies live traffic, connects to remote servers, or executes described tools; a live-traffic scope upgrade requires its own spec + bench
Hosted or remote serving — v0.1.1 is local stdio only, operating on caller-supplied tool lists + bundled fixtures
Cross-party evidence use — signed chain heads / external anchoring (SPEC §9.3) remain open by design and are not claimed; unanchored chain reads assert internal consistency only, never truncation detection
Per-call metering or payment enforcement — none exists in v0.1.1 by design: the $0.05/call (PC-3) term is commercial metadata for hosted/commercial deployment; no payment, checkout, or billing code is in the server

Evaluation-intake listing

This listing records the tool's place in the Bazaar's evaluation and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope, and not-tested items included. It is not sold on this site, and its presence in the catalog is not a claim beyond that evidence. The service behind every verdict is the bench: what a bench run buys →