Local Setup — yp-mcp

Quick summary

Connect a trusted workspace through the stdio yp-mcp server. Its six tools call the existing yp CLI; the server is not a code sandbox.

Copy the client configuration below, replace absolute paths, and run an inspection tool before allowing any apply action.

yp-mcp (tools/devpay-mcp/, package @yetdapay/mcp) is the local stdio MCP server for the protect workflow. It speaks JSON-RPC 2.0 over line-delimited stdio (protocol 2024-11-05) and wraps the yp CLI — every tool spawns yp <args> --json via execFile (never a shell) and returns the CLI payload verbatim plus cli_exit_code and a receipt. There is no independent MCP-side verdict.

Run

node tools/devpay-mcp/server.mjs --workspace /abs/path/to/project
# or once the bin is linked:
yp-mcp --workspace /abs/path/to/project

Workspace resolution order: --workspace <path> → DEVPAY_MCP_WORKSPACE env → process cwd. The workspace root is canonicalized once at startup; every caller-supplied path argument (project, target, driver, spec, overrides, vectors, license_seed) must realpath inside it — escapes are rejected with -32602.

CLI resolution order: YP_CLI env → in-repo sibling ../devpay-cli/devpay.mjs → co-installed ../cli/devpay.mjs → bare yp on PATH. The PATH fallback is an operator-trust decision — whoever controls PATH controls which CLI executes; set YP_CLI (or run from the repo layout) when that matters.

MCP client config

{
  "mcpServers": {
    "yp": {
      "command": "yp-mcp",
      "args": ["--workspace", "/abs/path"]
    }
  }
}

Without an installed bin:

{
  "mcpServers": {
    "yp": {
      "command": "node",
      "args": [
        "/abs/path/to/nougat-devpay/tools/devpay-mcp/server.mjs",
        "--workspace", "/abs/path"
      ]
    }
  }
}

Trust boundary — read before pointing this at a repo

yetdapay_project_analyze, yetdapay_protection_plan, and yetdapay_protection_verify execute workspace code in this process tree: the analyzer imports the dynamic-analysis driver; verify boots the generated partition server and imports the partitioned client. That is not a sandbox — only point this server at workspaces you trust. apply is the approval-gated write stage on top of that boundary.

Safety mechanisms

• No shell — all spawns use execFile with an argv array.
• Workspace containment — path args are canonicalized (realpath with symlink-aware ancestor checks) and must stay under the workspace root. CLI-returned paths (analysis_path, report_path) get the same check before their contents are embedded in a tool result.
• Env scrub — the spawned CLI inherits an allowlist only: runtime basics, the PARTITION_* prefix (the designed user→partition channel), the exact DEVPAY_* vars the pipeline reads (DEVPAY_ISSUER, DEVPAY_AUDIENCE, YP_CLI, DEVPAY_MCP_WORKSPACE), and tool-path vars (WABT_BIN, REA_BIN, CHROME_EXE). NODE_OPTIONS, YETDAPAY_* (unconsumed — the wildcard once admitted YETDAPAY_MCP_TOKEN into executed project code), and anything with a credential-shaped _TOKEN/_SECRET/_KEY/ _PASSWORD/_CREDENTIAL suffix is dropped before the prefix allow applies.
• Approval gate — yetdapay_protection_apply without approved:true is refused with a UNAUTHORIZED tool error before the CLI is spawned. With it, --approve is forwarded — the CLI's own sha-binding checks still apply and their refusals propagate verbatim. The response carries an approval block (plan_sha256/spec_sha256/target_sha256/ driver_sha256) so the agent can show the user exactly what was approved.
• Timeouts — DEVPAY_MCP_CLI_TIMEOUT_MS (default 600000), 64 MiB stdout buffer; a killed child → CLI_TIMEOUT tool error.

The 6 tools

Full schemas: Tools Reference.

Tool	Wraps	Annotation
yetdapay_project_analyze	yp protect plan (analysis stage; embeds parsed .devpay/*.analysis.json)	executes code
yetdapay_protection_plan	yp protect plan	executes code
yetdapay_protection_review	yp protect review	read-only
yetdapay_protection_apply	yp protect apply --approve	requires approved:true
yetdapay_protection_verify	yp protect verify	executes code
yetdapay_environment_doctor	yp doctor	read-only

Resources & prompt

• yp://docs/quickstart — the doctor → analyze → plan → review → approve → apply → verify workflow and honest status words.
• yp://docs/approval-model — sha-binding semantics, the apply gate, --approve scope, exit codes.
• Prompt protect_project ({project?}) — the full playbook, with the caller-supplied project path sanitized and fenced as data.

Tests

cd tools/devpay-mcp
node --test "tests/**/*.test.mjs"    # or: npm test

Tests spawn the real server and the real in-repo CLI (overridable via YP_CLI — used by the env-scrub/argv-forwarding sentinel tests).