Bounded Tools MCP server

@bounded-systems/bounded-tools-mcp

A local, read-only MCP server (and a matching CLI) over bounded.tools' signed static API.

It exposes the parts of the site that are served as verifiable, content-addressed JSON — the Web-Build Conformance report and the SPDX SBOM — to any MCP client (Claude Desktop, Claude Code, etc.), and verifies every response byte-for-byte against the site's Sigstore-signed sha256 manifest before handing it back. If the bytes a client would receive don't match the signed manifest, it refuses to return them.

It runs locally over stdio — the client spawns it as a subprocess. There is no hosted server and no network listener, which preserves the site's static / no-attack-surface posture.

A thin implementation of a generic core

This package is thin. All of the reusable machinery — the verifying fetch client, the sha256 manifest + Sigstore checks, and the VerbSpec → MCP (tools + resources) / VerbSpec → CLI projection — lives in @bounded-systems/static-mcp. bounded-tools-mcp supplies only:

get_sbom, each authored once as a @bounded-systems/verbspec VerbSpec;

• the verbs (src/verbs.ts) — get_conformance,

tools://… resources;

• the resource catalog (src/catalog.ts) — the

expected signer identity; and

• the config values (src/config.ts) — the origin and

hands the spec to the core.

• the entry (src/index.ts) — which picks a surface and

src/verbs.ts ─┐
src/catalog.ts ├─▶ buildToolsSpec(config) ─▶ @bounded-systems/static-mcp
src/config.ts ─┘        serveVerifiedStaticMcp(spec, config)   (MCP, stdio)
                        runStaticCli(spec, config, argv)        (CLI)

Two surfaces, one definition. verbspec projects each verb to both an

MCP tool and a CLI subcommand. The exact same verb set backs the MCP tools and

the CLI commands — no second definition, no drift.

What's exposed (and what isn't)

bounded.tools is a static site whose verifiable surface is intentionally small. Only artifacts the site serves as signed, content-addressed JSON are exposed here — each is fetched and verified byte-for-byte against the signed manifest:

Honesty over surface area. The blog is covered by the signed manifest,

but it is served as HTML + Markdown, not as a JSON feed or per-post JSON

documents. The verified-static core fetches-and-JSON-parses each artifact, so

exposing the blog as a "tool" would mean fabricating a JSON shape the site does

not actually serve. It is therefore left out rather than faked. If bounded.tools

later publishes a signed posts.json (and per-post JSON), list_posts /

get_post verbs drop straight in, exactly as in

site-mcp.

Install / run

Requires Node ≥ 18.17. The verbspec dependency is published to JSR, so installs resolve it through JSR's npm bridge — the included .npmrc sets @jsr:registry=https://npm.jsr.io. (Consuming from a fresh environment, add that one line to your npm config.)

# MCP server over stdio (what an MCP client launches):
npx -y @bounded-systems/bounded-tools-mcp

# CLI — the SAME verbs, printing the verified JSON:
npx -y @bounded-systems/bounded-tools-mcp get_conformance
npx -y @bounded-systems/bounded-tools-mcp get_sbom

Shortened. The full README is on GitHub.