Metadata-Version: 2.4
Name: saydo
Version: 0.1.1
Summary: Does the tool do what it says? A conformance harness for MCP servers, and an MCP server that reports what it found.
Author: F-Keys Creative LLC
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/vince-gonzalez/saydo
Project-URL: Source, https://github.com/vince-gonzalez/saydo
Project-URL: Issues, https://github.com/vince-gonzalez/saydo/issues
Keywords: mcp,model-context-protocol,mcp-server,conformance,ai-security,agent-security,supply-chain-security,sandbox
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Testing
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: NOTICE
Requires-Dist: jsonschema>=4
Provides-Extra: mcp
Requires-Dist: mcp>=1.29; extra == "mcp"
Requires-Dist: pydantic>=2; extra == "mcp"
Dynamic: license-file

```
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                                            ║
║                         ███████╗ █████╗ ██╗   ██╗██████╗  ██████╗                          ║
║                         ██╔════╝██╔══██╗╚██╗ ██╔╝██╔══██╗██╔═══██╗                         ║
║                         ███████╗███████║ ╚████╔╝ ██║  ██║██║   ██║                         ║
║                         ╚════██║██╔══██║  ╚██╔╝  ██║  ██║██║   ██║                         ║
║                         ███████║██║  ██║   ██║   ██████╔╝╚██████╔╝                         ║
║                         ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚═════╝  ╚═════╝                          ║
║                                                                                            ║
║                               does the tool do what it says                                ║
║                                                                                            ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
```

<!-- mcp-name: io.github.vince-gonzalez/saydo -->

**Does the tool do what it says?** Not is it safe, not is it good. A publisher
declares what an MCP tool does in a signed contract; SayDo runs the tool in a
sandbox, checks it against that contract, and emits a hash-chained receipt
anyone can verify in a browser with no account and no trust in the issuer.

## The MCP server

    pip install "saydo[mcp]"
    saydo-mcp

Four tools, and the first one is a refusal:

| tool | answers |
|---|---|
| `scope` | what SayDo cannot settle. Call it first. |
| `status` | whether a package has a receipt, and what that receipt establishes |
| `inspect_definition` | the RFC 8785 tool digest, and wording aimed at the model rather than at a reader |
| `check_now` | run a package in a sandbox and report what it did |

Most packages have no receipt, so the usual answer is `unknown`. That keeps
meaning *nobody has looked*. It never softens into *probably fine*.

## What a verdict can be

    pass          the declared behaviour held under the run
    fail          the tool did something it declared it would not
    not-covered   the run established nothing either way

A whole run resolves to CONFORMANT, NOT CONFORMANT, or INCONCLUSIVE.

`INCONCLUSIVE` carries most of the weight. A server that declines every call
makes no network request the way an unplugged machine makes none, and a harness
that scores that as three passes has certified nothing at all. A negative claim
passes here only if the run observed the tool actually doing something.

## What this is not

It is not a safety guarantee and no receipt should be presented as one. It says
what one version of one tool did on one run, against a contract its author
wrote beforehand. Drift detection and hash-chained receipts are not novel; the
repository names the prior art rather than claiming otherwise.

`check_now` needs Docker and the repository, and refuses plainly when it does
not have them rather than running something weaker and reporting it as a
sandboxed result.

Source, specification, the browser verifier, and the seeded fixtures that exist
to prove the harness can fail:
https://github.com/vince-gonzalez/saydo

---

```
╔════════════════════════════════════════════════════════════╗
║                                                            ║
║      ███████╗      ██╗  ██╗███████╗██╗   ██╗███████╗       ║
║      ██╔════╝      ██║ ██╔╝██╔════╝╚██╗ ██╔╝██╔════╝       ║
║      █████╗  █████╗█████╔╝ █████╗   ╚████╔╝ ███████╗       ║
║      ██╔══╝  ╚════╝██╔═██╗ ██╔══╝    ╚██╔╝  ╚════██║       ║
║      ██║           ██║  ██╗███████╗   ██║   ███████║       ║
║      ╚═╝           ╚═╝  ╚═╝╚══════╝   ╚═╝   ╚══════╝       ║
║                                                            ║
║               ·   C  R  E  A  T  I  V  E   ·               ║
║                                                            ║
║          ────────────────────────────────────────          ║
║                                                            ║
║                      Vincent Gonzalez                      ║
║                         f-keys.com                         ║
║                 ORCID 0009-0005-3640-014X                  ║
║                                                            ║
╚════════════════════════════════════════════════════════════╝
```

Part of [F-Keys](https://f-keys.com) — independent hardware, software
and internet products.
