Supply chain at the client side layer

# ABOUTME: Workflow step shipping truncated lockfile diff to SIEM on every PR. Add to lockfile-integrity.yml.
# ABOUTME: Diff is truncated to first 200 lines so a huge PR does not flood the SIEM payload; full diff is in CI artifacts.
- name: Ship lockfile diff to SIEM
  if: always() && github.event_name == 'pull_request'
  env:
    SIEM_TOKEN: ${{ secrets.SIEM_TOKEN }}
    SIEM_URL: ${{ vars.SIEM_URL }}
  run: |
    DIFF=$(git diff origin/${{ github.base_ref }} -- \
      package-lock.json requirements.txt requirements*.txt \
      Pipfile.lock poetry.lock go.sum Cargo.lock 2>/dev/null \
      | head -200)
    if [[ -n "$DIFF" ]]; then
      DIFF_JSON=$(printf '%s' "$DIFF" | jq -R -s .)
      curl -sS -X POST "$SIEM_URL/agent-sentinel-ci/_doc" \
        -H "Authorization: Bearer $SIEM_TOKEN" \
        -H "Content-Type: application/json" \
        -d "{
          \"event\": \"lockfile_diff\",
          \"repo\": \"${{ github.repository }}\",
          \"pr\": ${{ github.event.pull_request.number }},
          \"actor\": \"${{ github.actor }}\",
          \"diff\": $DIFF_JSON,
          \"ts\": \"$(date -Iseconds)\"
        }"
    fi

#!/usr/bin/env bash
# ABOUTME: Snippet that the mcp-launch wrapper sources to emit a structured per-connection event with status and hash.
# ABOUTME: Source from controls/supply-chain/client-side/mcp-launch immediately after the hash check.

emit_mcp_connect() {
  # Args:
  #   $1 = server name
  #   $2 = status (ok | hash_mismatch | not_in_allowlist | signature_failed)
  #   $3 = actual sha256 (or "" if not computed)
  local name="$1" status="$2" sha="${3:-}"

  local event
  event="$(jq -n \
    --arg server "$name" \
    --arg status "$status" \
    --arg sha "$sha" \
    --arg ts "$(date -Iseconds)" \
    '{event: "mcp_connect", server: $server, status: $status, hash: $sha, ts: $ts}')"
  logger -t agent-sentinel -p user.info "$event"
}

# Usage in mcp-launch:
#
#   . /etc/agents/hooks/mcp-launch-emit.sh
#
#   if [[ -z "$EXPECTED_SHA" || ... ]]; then
#     emit_mcp_connect "$SERVER_NAME" "not_in_allowlist" ""
#     exit 2
#   fi
#   if [[ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]]; then
#     emit_mcp_connect "$SERVER_NAME" "hash_mismatch" "$ACTUAL_SHA"
#     exit 2
#   fi
#   emit_mcp_connect "$SERVER_NAME" "ok" "$ACTUAL_SHA"

# ABOUTME: Patch fragment for mcp-verify-tools.py that emits a structured event when the tool-description hash mismatches.
# ABOUTME: This is the rug-pull alert. Add the import + call inside the existing mismatch branch.

import json
import syslog


def _emit_tool_desc_mismatch(server_name: str, expected_hash: str, actual_hash: str) -> None:
    """Emit a structured rug-pull event to local syslog tagged agent-sentinel.

    Call this from `mcp-verify-tools.py` inside the `if expected and actual != expected:`
    branch, before `sys.exit(2)`.
    """
    syslog.openlog("agent-sentinel")
    syslog.syslog(
        syslog.LOG_WARNING,
        json.dumps(
            {
                "event": "mcp_tool_desc_mismatch",
                "server": server_name,
                "expected_hash": expected_hash,
                "actual_hash": actual_hash,
            }
        ),
    )


# Patch fragment to apply in mcp-verify-tools.py:
#
#     if expected and actual != expected:
#         _emit_tool_desc_mismatch(server_name, expected, actual)
#         print(f"BLOCKED: {server_name} tool descriptions changed", file=sys.stderr)
#         ...