Skip to content

docs: cmcp verify in CLI table, correct autodetect order, policies/ naming #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 2 commits into from
Jul 23, 2026
Merged

docs: cmcp verify in CLI table, correct autodetect order, policies/ naming #416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
724b6f3
docs: add cmcp verify to CLI table, fix autodetect order, normalize p…
imran-siddique Jul 23, 2026
4b3e38b
docs(configuration): include azure-cvm in the documented autodetect o…
imran-siddique Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,13 +117,13 @@ Agent -> cMCP Runtime -> Cedar Policy Engine (TEE) -> Tool
| `gpu-cc` _(v0.2)_ | NVIDIA H100/H200/Blackwell (CC mode) | High | NVIDIA Remote Attestation Service (NRAS) |
| `opaque` _(opt-in)_ | OPAQUE Confidential Runtime | n/a _(not yet implemented)_ | Placeholder: excluded from auto-detect; selecting it explicitly raises a not-implemented error |

Provider auto-detect probe order: `tpm -> sev-snp -> tdx` — the first provider whose `detect()` succeeds is selected. `opaque` is a not-yet-implemented placeholder: it is excluded from auto-detect, and selecting it explicitly raises `ATTESTATION_PROVIDER_NOT_IMPLEMENTED` rather than falling through silently. If no hardware provider is detected, the gateway starts only under `CMCP_DEV_MODE=1` (a non-attested software-only fallback) and otherwise refuses to start.
Provider auto-detect probe order: `azure-cvm -> tpm -> sev-snp -> tdx` — the first provider whose `detect()` succeeds is selected. `opaque` is a not-yet-implemented placeholder: it is excluded from auto-detect, and selecting it explicitly raises `ATTESTATION_PROVIDER_NOT_IMPLEMENTED` rather than falling through silently. If no hardware provider is detected, the gateway starts only under `CMCP_DEV_MODE=1` (a non-attested software-only fallback) and otherwise refuses to start.

```python
from cmcp_runtime.config import TEEProvider

# Auto-detect (default)
# attestation.provider: auto -> tpm -> sev-snp -> tdx
# attestation.provider: auto -> azure-cvm -> tpm -> sev-snp -> tdx
# (software-only is used only under CMCP_DEV_MODE=1)

# Explicit hardware selection
Expand Down Expand Up @@ -159,7 +159,7 @@ attestation:
staleness_policy: fail_closed # fail_closed | warn_only
expected_measurement: ~ # pin a specific PCR/measurement (optional)

policy_bundle_path: policy/ # directory containing .cedar files and manifest.json
policy_bundle_path: policies/ # directory containing .cedar files and manifest.json
catalog_path: catalog.json # approved tool catalog

listen_addr: "0.0.0.0:8443"
Expand All @@ -184,6 +184,7 @@ Environment variables:
| `cmcp start` | `--config PATH` (required) | Start the gateway |
| `cmcp validate-config` | `--config PATH` (required) | Validate `cmcp-config.yaml` without starting |
| `cmcp validate-bundle` | `--bundle-path PATH` (required), `--expected-hash sha256:<hex>` (required) | Verify a Cedar bundle hash before deployment |
| `cmcp verify` | `CLAIM_FILE` (required); `--policy-hash`, `--catalog-hash`, `--max-age`, `--trusted-key`, `--audit-bundle`, `--agent-manifest`, `--agent-manifest-trust-anchor` | Verify a signed TRACE Claim (signature, schema, freshness, audit chain, and pinned hashes) |

---

Expand Down Expand Up @@ -269,7 +270,7 @@ A TRACE Claim (a `GatewayClaim`) is a signed, hardware-attested artifact produce

### Which TEE providers are supported?

TPM 2.0 / vTPM, AMD SEV-SNP, and Intel TDX, with NVIDIA GPU confidential computing planned for v0.2 and OPAQUE Confidential Runtime available as explicit opt-in. Auto-detection order is SEV-SNP, then TDX, then TPM, then software.
TPM 2.0 / vTPM, AMD SEV-SNP, and Intel TDX, with NVIDIA GPU confidential computing planned for v0.2 and OPAQUE Confidential Runtime available as explicit opt-in. Auto-detection order is Azure confidential VM, then TPM 2.0 / vTPM, then AMD SEV-SNP, then Intel TDX; the software-only provider is used only under CMCP_DEV_MODE=1.

### What license is cMCP under?

Expand Down Expand Up @@ -303,7 +304,7 @@ MIT.
{
"@type": "Question",
"name": "Which TEE providers does cMCP support?",
"acceptedAnswer": { "@type": "Answer", "text": "TPM 2.0 / vTPM, AMD SEV-SNP, and Intel TDX, with NVIDIA GPU confidential computing planned for v0.2 and OPAQUE Confidential Runtime available as explicit opt-in. Auto-detection order is SEV-SNP, then TDX, then TPM, then software." }
"acceptedAnswer": { "@type": "Answer", "text": "TPM 2.0 / vTPM, AMD SEV-SNP, and Intel TDX, with NVIDIA GPU confidential computing planned for v0.2 and OPAQUE Confidential Runtime available as explicit opt-in. Auto-detection order is Azure confidential VM, then TPM 2.0 / vTPM, then AMD SEV-SNP, then Intel TDX; the software-only provider is used only under CMCP_DEV_MODE=1." }
},
{
"@type": "Question",
Expand Down
10 changes: 5 additions & 5 deletions docs/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
# cmcp-config.yaml - annotated full example

attestation:
# TEE provider. auto detects in order: tpm -> sev-snp -> tdx.
# TEE provider. auto detects in order: azure-cvm -> tpm -> sev-snp -> tdx.
# opaque requires explicit opt-in via OPAQUE_ATTESTATION_URL env var.
# Use software-only only with CMCP_DEV_MODE=1.
provider: auto
Expand Down Expand Up @@ -48,7 +48,7 @@ agent_manifest:
# Path to the directory containing .cedar policy files and manifest.json.
# Must not contain '..' components. Relative paths are resolved from the
# working directory at startup.
policy_bundle_path: policy/
policy_bundle_path: policies/

# Path to the JSON tool catalog file.
# Must not contain '..' components.
Expand Down Expand Up @@ -76,7 +76,7 @@ policy_reload_interval_seconds: 0

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| `provider` | string | `auto` | TEE provider. Valid values: `auto`, `tpm`, `sev-snp`, `tdx`, `opaque`, `software-only`. `auto` detects in order: tpm then sev-snp then tdx. `opaque` requires `OPAQUE_ATTESTATION_URL` to be set. `software-only` requires `CMCP_DEV_MODE=1`. |
| `provider` | string | `auto` | TEE provider. Valid values: `auto`, `tpm`, `sev-snp`, `tdx`, `opaque`, `software-only`. `auto` detects in order: azure-cvm, then tpm, then sev-snp, then tdx. `opaque` requires `OPAQUE_ATTESTATION_URL` to be set. `software-only` requires `CMCP_DEV_MODE=1`. |
| `enforcement_mode` | string | `enforcing` | Policy enforcement mode. Valid values: `enforcing`, `advisory`, `silent`. |
| `validity_seconds` | integer | `86400` | Attestation report validity period in seconds. Must be a positive integer. At expiry, behavior is controlled by `staleness_policy`. |
| `staleness_policy` | string | `fail_closed` | Action when attestation validity expires. Valid values: `fail_closed` (terminate sessions), `warn_only` (allow sessions, mark claims as stale). |
Expand All @@ -96,7 +96,7 @@ All fields are optional as a group. If `path` is set, `trust_anchor_path` must a

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| `policy_bundle_path` | string | `policy/` | Path to the Cedar policy bundle directory. Must contain `.cedar` files and a `manifest.json`. Path traversal (`..` components) is rejected. |
| `policy_bundle_path` | string | `policies/` | Path to the Cedar policy bundle directory. Must contain `.cedar` files and a `manifest.json`. Path traversal (`..` components) is rejected. |
| `catalog_path` | string | `catalog.json` | Path to the JSON tool catalog. Path traversal (`..` components) is rejected. |
| `listen_addr` | string | `0.0.0.0:8443` | Address and port the gateway binds to. |
| `max_response_size_bytes` | integer | `2097152` | Maximum tool response size in bytes (2MB). Must be a positive integer. Responses exceeding this limit are rejected before inspection. |
Expand Down Expand Up @@ -132,7 +132,7 @@ Environment variables control secrets and mode flags that must not appear in con
attestation:
provider: auto
enforcement_mode: enforcing
policy_bundle_path: policy/
policy_bundle_path: policies/
catalog_path: catalog.json
```

Expand Down