{
  "service": "MarketNow UTA Interceptor",
  "version": "1.1.1",
  "generated_at": "2026-09-17",
  "description": "Pre-execution trust filter for agent tool calls. The enforcing component is @marketnow/cline-trust-plugin (Cline plugin, npm) — this artifact publishes the rule manifest and policy semantics it enforces. The manifest and the plugin are kept in sync; the endpoint makes no claims about rules that do not exist in code.",
  "rules": [
    {
      "id": "R1",
      "rule": "blocked_path",
      "matches": "credential and secret files referenced as path segments: .env, .aws/credentials, .ssh/id_rsa, .npmrc, .git-credentials",
      "semantics": "DENY the call, emit audit receipt",
      "case_insensitive": true,
      "boundary": "path-segment (a '.env' inside 'my.environment' does NOT match)"
    },
    {
      "id": "R2",
      "rule": "blocked_command",
      "matches": "destructive recursive deletes: rm with -r/-f flag combinations in any letter case",
      "semantics": "DENY the call, emit audit receipt",
      "case_insensitive": true
    },
    {
      "id": "R3",
      "rule": "blocked_path",
      "matches": "system files: /etc/passwd, /etc/shadow",
      "semantics": "DENY the call, emit audit receipt",
      "case_insensitive": true
    },
    {
      "id": "R4",
      "rule": "blocked_spawn",
      "matches": "tool names containing spawn/exec/shell",
      "semantics": "DENY the call, emit audit receipt"
    },
    {
      "id": "R5",
      "rule": "secret_exfiltration",
      "matches": "secret material in outbound args (private key blocks, bearer tokens, sk-/ghp_/AKIA/xox-style tokens)",
      "semantics": "DENY the call, emit audit receipt",
      "case_insensitive": true
    },
    {
      "id": "R6",
      "rule": "revocation_gate",
      "matches": "wrapped server ATC card_id or CA kid (UTA_TRUST_CARD_ID / UTA_TRUST_KID env), resolved against /api/ocsp",
      "semantics": "DENY unless status=VALID and recommendation=PERMIT; responder unreachable = DENY (fail-closed)"
    }
  ],
  "rule_count": 6,
  "decision_semantics": {
    "on_match": "DENY — the tool call never reaches the wrapped server; a signed audit receipt is emitted to the Merkle audit log",
    "on_no_match": "PERMIT — call proceeds to the wrapped MCP server",
    "on_error": "DENY (fail-closed)",
    "golden_rule": "UNKNOWN = DENY, ERROR = DENY"
  },
  "audit_log": "Append-only Merkle tree of every decision (DENY + PERMIT) — get_audit_log in the plugin",
  "enforcement": "npm @marketnow/cline-trust-plugin — wrap(externalServer) applies the full filter to every tools/call; check_interceptor() runs it dry",
  "integration_example": "import uta from '@marketnow/cline-trust-plugin'; const wrapped = uta.wrap(server);",
  "endpoints": {
    "manifest": "GET /api/interceptor.json (this file)",
    "manifest_api": "GET /api/interceptor (same manifest, served by /api/trust?_mode=interceptor)"
  }
}