Occasio MCP server

Occasio

Local-first audit chain and identity gate for AI coding agents. Your prompts, your tool calls, your audit log; all on your machine, cryptographically verifiable later — and an agent may request an identity (ssh / cloud / root), not silently assume one.

Occasio is a local proxy that sits between your AI coding agent (Claude Code, Cline, or anything that talks to the Anthropic API) and whichever LLM endpoint you configured. Every tool call passes through one human-readable policy file you control. You can see what is leaving your machine in real time, block what should not happen, and end up with a tamper-evident hash-chained log that a third party can verify offline months later if you ever need to prove what your agent did.

Nothing about Occasio sends data to a third party. There is no Occasio cloud, no Occasio account, no telemetry. Read docs/WHY-LOCAL.md for the architecture, docs/COMPARE.md for how this differs from cloud-hosted AI observability tools, and docs/SUSTAINABILITY.md for how a local-first product is funded under Apache 2.0.

Screenshot: occasio eyes --demo against synthetic data — no real paths, no real traffic. The "(demo)" badge top-left is always shown in demo mode.

npm install -g @occasiolabs/occasio

occasio demo audit       # Auditor scenario: signed attestation + cross-verifier proof (10s, no API key)
occasio demo attest      # End-to-end attestation pipeline against a synthetic chain
occasio demo anomalies   # Live EDR detection on a synthetic adversarial chain
occasio harness          # Real Claude Code attacking a denied path — defense holds

The first three demos run against synthetic data so you can see the full pipeline in seconds with no external dependencies. The fourth spawns a real Claude Code subordinate under your Anthropic login (bundled auth — no API key required) and proves the defense end-to-end. Start with demo audit — it answers the only question that actually matters: "prove what your AI agent did in CI."

Identity gate — request, don't assume

The incident this was built for: an agent is asked only for a deploy command, but on its own it sshes into the server and reads env. The strict policy stops exactly that — an AI agent may request an identity, it may not silently assume one.

• Exfiltration is denied, tool-agnostically. printenv, cat .env, /proc/self/environ, private-key reads, grep-for-secret-names — blocked no matter which command or tool reads them; the output never reaches the model.
• Identity borrows need a human. ssh / scp, az / the cloud control plane, sudo / systemctl — a fail-closed BLOCK with a "requires human approval" refusal the agent cannot satisfy on its own.
• The handshake distinguishes who is who. The agent requests; you authorize once, out-of-band, from your own terminal:

occasio init --template strict          # the identity-gated posture
# agent runs `ssh deploy@host`  →  BLOCKED, pending apr_…
occasio approvals approve apr_… --once  # you, single-use, short TTL
# the agent's retry passes through once — then it's blocked again

The agent cannot self-approve: the approval control plane is in its deny-zone and the token is HMAC-signed. The chain records actor=aiagent · delegator=you · approvedby=you. A second, non-proxied enforcement point — a PreToolUse hook (occasio hook --install) — covers execution that doesn't pass through the proxy.

Full design, threat model, and the honest residuals (runtime indirection, egress): docs/identity-gate.md.

Two ways to use it

Most people land here for one of these — pick the column that fits and skim accordingly.

Shortened. The full README is on GitHub.