Documentation
¶
Overview ¶
Command mcpaudit is the entrypoint for the VRFY-05 proxying MCP capture shim. See proxy.go's package doc for the measurement contract this binary implements; this file owns only flag parsing and process exit codes.
Package main implements tools/mcpaudit, the VRFY-05 proxying MCP capture shim: a standalone program a developer's real agent client (Claude Code, Codex CLI, opencode, ...) launches in place of `codegraph serve --mcp`. It observes — but never terminates or alters — the bidirectional JSON-RPC exchange between the agent and the real `codegraph` binary, so the dated 8-agent negotiation audit (docs/MCP-8-AGENT-AUDIT.md) can measure which protocolVersion each client actually negotiates on the wire, rather than reading it from documentation (D-09).
Design constraints, carried over verbatim from CONTEXT.md and the phase threat model:
- The shim proxies, never terminates: the agent must keep working for the whole audit (D-09, T-02-04). A parse failure is recorded in the Observation's ParseError field and the proxy loop continues unconditionally; aborting here would break the developer's live agent session.
- Every byte is forwarded exactly as read in both directions — including CRLF line endings and a final frame with no trailing newline — via a byte-preserving bufio.Reader, never bufio.Scanner (which strips terminators and would silently rewrite the wire, T-02-03).
- Decoding never goes through an MCP SDK type (VRFY-01's discipline applies to every measurement instrument in this milestone) — only generic structs local to this package.
- A raw frame is never stored verbatim on parse failure (T-02-01): only a SHA-256 digest plus a short, non-printable-escaped prefix.
Source Files