Metadata-Version: 2.4
Name: mcp-tool-approval-change-card-mcp
Version: 0.2.0
Summary: Licensed local MCP server for deterministic review cards from supplied MCP tools/list snapshots.
Author: PracticalBizToolsUS
License-Expression: LicenseRef-Proprietary
Project-URL: Documentation, https://pypi.org/project/mcp-tool-approval-change-card-mcp/
Requires-Python: <3.15,>=3.11
Description-Content-Type: text/markdown
License-File: LICENSE.txt
Requires-Dist: mcp==2.2.0
Requires-Dist: mcp-marketplace-license==1.1.0
Provides-Extra: dev
Requires-Dist: pytest<10,>=8.4; extra == "dev"
Dynamic: license-file

# MCP Tool Approval Change Card

Compare two user-supplied local MCP `tools/list` JSON snapshots and create
deterministic review cards. The tool reports advertised descriptor changes; it
does not connect to a server, call listed tools, approve access, or prove that
runtime behavior stayed the same.

## Requirements

- Windows 11 with Python 3.11–3.14
- An MCP-compatible client that can launch a local stdio server
- `MCP_LICENSE_KEY` from this MCP Marketplace purchase
- Internet access for initial and periodic license verification

The marketplace license check transmits only the buyer's license key and this
product's public slug. Buyer snapshots, paths, and generated reports remain
local. Apart from license verification, the package performs no network call
or telemetry. The license SDK may use a previously verified local cache if
its service is unavailable; revocation may therefore take effect later.

## Install

```powershell
python -m pip install mcp-tool-approval-change-card-mcp==0.2.0
mcp-approval-card --json doctor
```

Place `MCP_LICENSE_KEY` in your MCP client's environment configuration.
For a client using `mcpServers`:

```json
{
  "mcpServers": {
    "mcp-tool-approval-card": {
      "command": "mcp-approval-card-mcp",
      "env": {"MCP_LICENSE_KEY": "PASTE_THE_KEY_FROM_YOUR_PURCHASE"}
    }
  }
}
```

Launch the client with its working directory set to the folder containing the
two buyer-authorized JSON snapshots. The one MCP tool is
`make_change_cards(previous, current, output_directory)`. Use relative paths
and a **new** output directory. Do not place real credentials in snapshots.

For a first local check, save these two synthetic files in the client's
working directory:

`previous.json`

```json
{"tools":[{"name":"lookup","description":"Search local index","inputSchema":{"type":"object"}}]}
```

`current.json`

```json
{"tools":[{"name":"lookup","description":"Search updated local index","inputSchema":{"type":"object"}}]}
```

Then pass `previous.json`, `current.json`, and a new `packet` output
directory to the tool or CLI. This example demonstrates a changed advertised
description; it does not prove any runtime behavior changed.

The packet contains `change-cards.json`, `change-queue.csv`,
`APPROVAL_REVIEW.md`, and `evidence-receipt.json`. A changed or added
descriptor calls for human review. `UNCHANGED` means only that the supplied
advertised descriptors match. Annotation hints are self-declared.

The same protected core is available from the CLI:

```powershell
mcp-approval-card --json analyze --previous examples/previous.json --current examples/current.json --out packet
mcp-approval-card --json verify packet/evidence-receipt.json
```

`doctor` does not check a license. Analyze, verify, and the MCP tool check
entitlement before reading buyer files. No existing output directory is
overwritten.
