{ "schemaVersion": "actionproxy.oss-capabilities.v1", "product": "ActionProxy Community", "artifact": "actionproxy-community-v0.1.0", "reviewedOn": "2026-07-16", "maturity": "ActionProxy Community v0.1.0 is an Apache-2.0 developer preview for local and self-hosted evaluation. It is not a complete production authorization boundary or hosted SaaS control plane.", "capabilities": [ { "id": "ap.license.apache-2.0", "label": "Apache-2.0-licensed repository source", "status": "implemented", "defaultEnabled": true, "publicClaim": "The source in this repository is provided under the Apache License 2.0.", "limitations": [ "Third-party dependencies retain their own licenses; review the runtime license inventory before deployment." ], "implementationEvidence": ["LICENSE"], "testEvidence": ["scripts/verify-public-export.mjs"] }, { "id": "ap.demo.local", "label": "Local Docker and Node demonstration", "status": "implemented", "defaultEnabled": true, "publicClaim": "The repository includes a local demo that exercises an allowed search, an approval-gated mock email, a denied destructive action, and lifecycle audit evidence without SaaS credentials.", "limitations": [ "The demo is intended for loopback-only evaluation, uses deterministic mock tools, and is not a production deployment or proof of native SaaS connector availability." ], "implementationEvidence": [ "README.md", "docker-compose.yml", "examples/local-curl-demo" ], "testEvidence": ["scripts/smoke-community-docker.mjs"] }, { "id": "ap.core.lifecycle", "label": "Allow, deny, approval, and controlled-execution lifecycle", "status": "implemented", "defaultEnabled": true, "publicClaim": "ActionProxy Community evaluates a proposed tool call, allows, denies, or queues it for approval, and crosses the core executor or external-grant boundary only after authorization.", "limitations": [ "The conformance claim applies only to the documented Community HTTP, SDK-over-HTTP, authenticated stdio MCP, and standard Streamable HTTP MCP paths." ], "implementationEvidence": [ "apps/server/src/services/action-gate.ts", "apps/server/src/routes/tool-calls.ts" ], "testEvidence": [ "apps/server/src/services/action-gate.test.ts", "apps/server/src/routes/http-sdk-conformance.test.ts" ] }, { "id": "ap.policy.yaml", "label": "Deterministic YAML policy", "status": "implemented", "defaultEnabled": true, "publicClaim": "The community gateway evaluates deterministic YAML rules with allow, deny, and require-approval outcomes and fails closed when the canonical policy provider fails.", "limitations": [ "The built-in policy language is not an IAM system or a replacement for OPA, Cedar, Cerbos, or an enterprise authorization graph." ], "implementationEvidence": [ "apps/server/src/policy/evaluate-policy.ts", "apps/server/src/policy/policy-provider.ts" ], "testEvidence": [ "apps/server/src/policy/evaluate-policy.test.ts", "apps/server/src/routes/policy.test.ts" ] }, { "id": "ap.request.canonical", "label": "Canonical exact-action request across supported OSS adapters", "status": "implemented", "defaultEnabled": true, "publicClaim": "Canonical HTTP, JavaScript SDK, authenticated stdio MCP, and opt-in Streamable HTTP MCP paths normalize policy-relevant action and adapter context at the server boundary.", "limitations": [ "Adapters outside the documented Community HTTP, SDK, and MCP surfaces are not covered by this production-boundary claim.", "Caller-supplied agent identity remains asserted rather than cryptographically verified." ], "implementationEvidence": [ "apps/server/src/contracts/action-request.ts", "apps/server/src/routes/mcp.ts", "packages/sdk-js/src/client.ts", "packages/mcp-wrapper/src/wrap-server.ts" ], "testEvidence": [ "apps/server/src/contracts/action-request.test.ts", "apps/server/src/routes/http-sdk-conformance.test.ts", "apps/server/src/routes/mcp.test.ts", "packages/mcp-wrapper/src/wrap-server.test.ts" ] }, { "id": "ap.approval.binding", "label": "Exact-action approval authorization", "status": "implemented", "defaultEnabled": true, "publicClaim": "On canonical community paths, approval authorization binds the tenant, requester, action and input hashes, decision, policy, review, eligibility requirements, nonce, and expiry before execution.", "limitations": [ "The guarantee applies only when a caller uses a documented Community adapter and follows the current request contract." ], "implementationEvidence": [ "apps/server/src/contracts/approval-authorization.ts", "apps/server/src/services/action-gate.ts" ], "testEvidence": [ "apps/server/src/contracts/approval-authorization.test.ts", "apps/server/src/services/action-gate.test.ts" ] }, { "id": "ap.approval.edit-revalidation", "label": "Original/edited payload evidence and policy re-evaluation", "status": "implemented", "defaultEnabled": true, "publicClaim": "A single authorized reviewer can approve original input or submit edited input; ActionProxy preserves original and approved identities and re-evaluates policy before authorization.", "limitations": [ "Edited input is rejected when an approval requires more than one decision maker because the current model cannot safely accumulate votes across payload versions." ], "implementationEvidence": [ "apps/server/src/services/action-gate.ts", "apps/server/src/models.ts" ], "testEvidence": [ "apps/server/src/services/action-gate.test.ts", "apps/server/src/routes/approvals.test.ts" ] }, { "id": "ap.approval.channels", "label": "Approval queue and notification channels", "status": "implemented", "defaultEnabled": true, "publicClaim": "The local web queue is canonical; optional Slack, Telegram, and email integrations can notify reviewers, and Slack/Telegram callbacks use the same approval service. Slack approval cards redact common secret-like keys and expose Approve and Reject actions rather than payload editing.", "limitations": [ "Notification delivery never grants authorization by itself.", "Slack cards use the built-in secret-key redaction defaults rather than the policy-specific API/UI redaction field list; edits belong in a supported canonical review flow.", "Only the documented Community review channels are covered." ], "implementationEvidence": [ "apps/server/src/routes/approvals.ts", "apps/server/src/integrations/slack/slack-routes.ts", "apps/server/src/integrations/telegram/telegram-routes.ts", "apps/server/src/integrations/email/email-service.ts" ], "testEvidence": [ "apps/server/src/routes/approvals.test.ts", "apps/server/src/integrations/slack/slack-routes.test.ts", "apps/server/src/integrations/telegram/telegram-routes.test.ts", "apps/server/src/integrations/email/email-service.test.ts" ] }, { "id": "ap.execution.one-use", "label": "One-use execution authorization and external grants", "status": "implemented", "defaultEnabled": true, "publicClaim": "Approved execution is bound to exact action, decision, policy, approval, attempt, and executor identities; external runners consume a signed, expiring, one-use grant before dispatch.", "limitations": [ "The server-side opaque execution authorization is process-local and short-lived; the signed external grant is the network forwarding mechanism.", "The community gateway does not supply provider-side idempotency or automatic safe retry." ], "implementationEvidence": [ "apps/server/src/contracts/execution-authorization.ts", "apps/server/src/security/execution-grants.ts", "apps/server/src/routes/execution-grants.ts" ], "testEvidence": [ "apps/server/src/contracts/execution-authorization.test.ts", "apps/server/src/routes/execution-grants-attempt.test.ts", "packages/sdk-js/src/contracts.test.ts" ] }, { "id": "ap.execution.external", "label": "Controlled real-tool execution through external runners or MCP", "status": "implemented", "defaultEnabled": true, "publicClaim": "Community deployments can authorize real business-tool execution through an external runner or downstream MCP server while the local built-in registry remains a deterministic mock/demo surface.", "limitations": [ "Production native SaaS connector runtimes and OAuth credential custody are not included in the community export.", "External runners remain responsible for provider credentials and must report the execution outcome." ], "implementationEvidence": [ "packages/sdk-js/src/external-runner.ts", "packages/mcp-wrapper/src/wrap-server.ts", "apps/server/src/services/tool-registry.ts" ], "testEvidence": [ "packages/sdk-js/src/contracts.test.ts", "packages/mcp-wrapper/src/wrap-server.test.ts", "apps/server/src/services/tool-registry.test.ts" ] }, { "id": "ap.execution.outcomes", "label": "Execution attempts, outcomes, and no-automatic-retry posture", "status": "implemented", "defaultEnabled": true, "publicClaim": "The canonical lifecycle records a reserved/dispatched attempt and a succeeded, failed, timed-out, cancelled, or unknown outcome; an unknown outcome is not automatically retried.", "limitations": [ "Only one attempt is currently authorized for an action.", "Provider reconciliation, takeover, and explicit retry authorization are not implemented." ], "implementationEvidence": [ "apps/server/src/contracts/execution-attempt.ts", "apps/server/src/services/action-gate.ts", "apps/server/src/security/execution-grants.ts" ], "testEvidence": [ "apps/server/src/contracts/execution-attempt.test.ts", "apps/server/src/storage/execution-attempt-store.test.ts", "packages/mcp-wrapper/src/wrap-server.test.ts" ] }, { "id": "ap.remediation.governed", "label": "Governed remediation submission", "status": "partial", "defaultEnabled": true, "publicClaim": "When an executor supplies a valid remediation descriptor, ActionProxy can render it and submit a new linked action through the ordinary policy, approval, grant, and audit lifecycle.", "limitations": [ "Remediation is available only when the tool or runner supplies a descriptor.", "It is not automatic rollback and cannot guarantee reversal of irreversible provider effects." ], "implementationEvidence": [ "apps/server/src/services/remediation.ts", "apps/server/src/services/action-gate.ts", "apps/server/src/routes/tool-calls.ts" ], "testEvidence": [ "apps/server/src/services/action-gate.test.ts", "apps/server/src/routes/tool-calls.test.ts" ] }, { "id": "ap.evidence.audit", "label": "Audit, receipts, and correlatable execution evidence", "status": "partial", "defaultEnabled": true, "publicClaim": "Community storage correlates proposal, policy, approval, receipt/grant, attempt, and outcome evidence and can verify a local SHA-256 previous-hash audit chain.", "limitations": [ "The chain is not keyed or independently anchored, so an administrator with storage access can rewrite and recompute it.", "Pre-persistence data classification, minimization, retention, and export redaction are incomplete.", "Cross-process audit append serialization is not claimed." ], "implementationEvidence": [ "apps/server/src/routes/audit.ts", "apps/server/src/security/audit-chain.ts", "apps/server/src/storage/audit-store.ts" ], "testEvidence": [ "apps/server/src/routes/audit.test.ts", "apps/server/src/security/audit-chain.test.ts" ] }, { "id": "ap.identity.self-hosted", "label": "Self-hosted API-key/OIDC authentication and scopes", "status": "partial", "defaultEnabled": false, "publicClaim": "Self-hosted deployments can use service-account API keys or OIDC JWTs with scopes; local demo mode intentionally uses an implicit administrator.", "limitations": [ "ActionProxy Community is not an IAM provider and does not include hosted identity, mature multi-tenancy, SAML, SCIM, token introspection, or cryptographically verified agent identity.", "Local disabled-auth mode is not a production security posture." ], "implementationEvidence": [ "apps/server/src/security/auth-service.ts", "apps/server/src/security/scopes.ts" ], "testEvidence": [ "apps/server/src/security/enterprise-security.test.ts", "apps/server/src/routes/system.test.ts" ] }, { "id": "ap.storage.local", "label": "Memory, SQLite, and Postgres storage", "status": "implemented", "defaultEnabled": true, "publicClaim": "The community gateway supports memory, SQLite, and Postgres storage behind shared interfaces.", "limitations": [ "Memory mode is ephemeral.", "Independent-process SQLite contention and a complete ordered migration/rollback system remain open." ], "implementationEvidence": [ "apps/server/src/storage/memory-store.ts", "apps/server/src/storage/sqlite-store.ts", "apps/server/src/storage/postgres-store.ts" ], "testEvidence": [ "apps/server/src/storage/memory-store.test.ts", "apps/server/src/storage/sqlite-store.test.ts", "apps/server/src/storage/postgres-atomicity.test.ts" ] }, { "id": "ap.mcp.stdio", "label": "Authenticated stdio MCP wrapper", "status": "implemented", "defaultEnabled": false, "publicClaim": "The community stdio wrapper can discover configured downstream MCP servers, gate `tools/call`, consume the exact grant, forward the approved call, report its outcome, and establish a verified transport influence scope.", "limitations": [ "Configured downstream commands run with the server process's operating-system privileges and are not sandboxed by ActionProxy.", "Operators must trust and explicitly configure downstream MCP profiles.", "A wrapper process influence scope is transport-wide and may span conversations; starting a new process does not prove model memory was cleared." ], "implementationEvidence": [ "packages/mcp-wrapper/src/wrap-server.ts", "packages/mcp-wrapper/src/config.ts" ], "testEvidence": [ "packages/mcp-wrapper/src/wrap-server.test.ts", "packages/mcp-wrapper/src/config.test.ts" ] }, { "id": "ap.mcp.tool-plane", "label": "Configured MCP tool-plane verification", "status": "implemented", "defaultEnabled": false, "publicClaim": "The wrapper doctor validates configuration without starting children and can optionally perform bounded MCP initialization plus `tools/list` discovery without calling a tool.", "limitations": [ "The versioned report covers only `configured_mcp_wrapper`; it does not inspect the real agent-host registration.", "Host-native and provider-hosted tools, direct network and shell access, unmediated credentials, conversation identity, server policy, and prompt-injection resistance remain unverified." ], "implementationEvidence": [ "packages/mcp-wrapper/src/doctor.ts", "examples/mcp-hosts/codex.config.toml.example", "examples/mcp-hosts/claude.mcp.json.example", "examples/mcp-hosts/generic.mcp.json.example" ], "testEvidence": [ "packages/mcp-wrapper/src/doctor.test.ts", "examples/mcp-hosts/print-host-configs.test.mjs" ] }, { "id": "ap.content.influence", "label": "Verified MCP content-influence guard", "status": "implemented", "defaultEnabled": true, "publicClaim": "New Community policy defaults can record classified model-visible MCP results in a verified transport scope and deterministically narrow later actions using explicit source-integrity allow sets.", "limitations": [ "This contains consequences after content is read; it does not detect or prevent prompt injection, scan content, or assign hostname reputation. ActionProxy policy and evidence grant no instruction authority; valid child MCP payloads and _meta remain opaque and unchanged, and child assertions cannot authorize actions.", "Existing policy files opt in, and calls through host-native tools, direct networking or shell, unmediated credentials, undocumented adapters, and model-internal memory remain outside the guarantee.", "Exposure rows add no raw-result copy, but existing tool-call, receipt, and audit storage may retain full results and must be protected." ], "implementationEvidence": [ "apps/server/src/contracts/content-influence.ts", "apps/server/src/policy/content-influence.ts", "apps/server/src/security/influence-scope.ts", "apps/server/src/storage/store.ts" ], "testEvidence": [ "apps/server/src/contracts/content-influence.test.ts", "apps/server/src/policy/content-influence.test.ts", "apps/server/src/routes/mcp-real-process-attack.test.ts", "apps/server/src/routes/mcp-stdio-adapter.test.ts", "apps/server/src/storage/forensic-query-store.test.ts" ] }, { "id": "ap.mcp.http", "label": "Standard Streamable HTTP MCP adapter", "status": "partial", "defaultEnabled": false, "publicClaim": "An opt-in Streamable HTTP MCP adapter supports the canonical lifecycle behind OAuth-protected MCP sessions.", "limitations": [ "It requires an external OAuth authorization server and currently advertises bundled governed mock tools rather than production SaaS connectors.", "Streaming GET and session deletion are intentionally unsupported in the current slice." ], "implementationEvidence": [ "apps/server/src/routes/mcp.ts", "apps/server/src/security/mcp-session.ts" ], "testEvidence": [ "apps/server/src/routes/mcp.test.ts", "apps/server/src/security/mcp-oauth.test.ts", "apps/server/src/security/mcp-session.test.ts" ] } ], "globalLimitations": [ "This capability reference covers ActionProxy Community v0.1.0.", "ActionProxy Community is not a complete production authorization boundary or compliance-certified product.", "There is no hosted SaaS control plane, mature multi-tenancy, SAML, SCIM, provider reconciliation, or automatic safe retry.", "Production native SaaS connectors and their credential custody are not included; real effects use external runners or MCP.", "Audit integrity is locally hash-chained but not keyed or independently anchored, and evidence minimization is incomplete." ], "nonGoals": [ "Agent framework", "Generic workflow builder", "Model gateway or token-spend platform", "Connector marketplace", "Enterprise IAM replacement", "Prompt-injection cure", "Hosted SaaS control plane" ] }