@logi-auth/mcp-approval

MCP server for the logi Agent Approval Gate. Lets AI agents (Claude Code, Codex, Cursor, custom) request human approval on a user's phone before performing high-risk actions — budget changes, production deploys, payments, mass communications, etc.

The user sees: "Codex wants to change Meta budget from 500K → 50M KRW. Confirm with Face ID and the 6-digit code." They tap [거절] or [승인], the assertion is signed with the device passkey, and the agent receives the verdict.

Setup

1. Register an agent in the logi developer console (start.1pass.dev). You'll get a Bearer token and (for signed mode) an Ed25519 private key — both shown once. Save them in a secret manager.

2. Configure the MCP host (Claude Code shown):

   {
     "mcpServers": {
       "logi-approval": {
         "command": "npx",
         "args": ["-y", "@logi-auth/mcp-approval"],
         "env": {
           "LOGI_AGENT_TOKEN": "logi_agt_...",
           "LOGI_AGENT_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\n...",
           "LOGI_AGENT_PUBLIC_ID": "agt_xxxxxx",
           "LOGI_API_URL": "https://api.1pass.dev"
         }
       }
     }
   }

3. Tell the agent the rules (in AGENTS.md, CLAUDE.md, or your system prompt):

   You have the logi__request_approval tool. ALWAYS call it BEFORE:
   - Changing any ads budget by >20% or absolute >1,000,000 KRW
   - Running migrations on production databases
   - Sending more than 100 emails or SMS messages in one batch
   - Spending >100,000 KRW on any external API
   - Deploying to production
   
   If the tool returns status != "approved", ABORT and tell the user.
   NEVER proceed without explicit approval for these categories.

Tools

• logi__request_approval — send a prompt; blocks until the user decides or times out. Returns { status, decided_at, ... }.
• logi__check_approval — poll a previously created prompt by id.

Auth modes

• signed (recommended): Bearer + Ed25519 signature on every request. Token theft alone cannot mint approvals — the private key is also required.
• bearer_only: Bearer only. Convenient (one-liner curl) but a leaked token is a full compromise. Disabled in production by default.

How replay / fatigue is prevented

• Every request carries a nonce + timestamp + body digest in the signature; the server rejects nonce reuse within a 5-minute window.
• An in-flight prompt for the same (user, agent, action_type) is reused instead of stacking up — defeats MFA bombing.
• A rejected action_type triggers a 10-minute cool-down before the same prompt can be re-issued.
• The user's phone shows a 6-digit number_match the agent also displays; mismatch → reject.

License

MIT