Get started

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@aroha-sdk/mcp-guard",
               "--name",  "github",
               "--block", "*delete*,*remove*",
               "--gate",  "merge_*,push_*,create_*,update_*",
               "--limit", "*:50",
               "--",
               "npx", "-y", "@modelcontextprotocol/server-github"]
    }
  }
}

import { verifyHttpSpendRequest, enrolledDid, httpRevocationCheck } from "@aroha-sdk/credentials";

const r = await verifyHttpSpendRequest(req.headers["aroha-mandate"], {
  audience: "https://invoices.example.com",
  method: req.method, url: req.url, body: rawBody,      // the exact bytes received
  expectedRoot: await enrolledDid(enrollments, customerId),
  isRevoked: httpRevocationCheck(REGISTRY_URL),
  amountUsd: invoice.amountUsd, currency: "USD",
  nonces, ledger,
});
if (!r.ok) return reply(res, r.status, { error: r.code });   // nothing was charged

from aroha import verify_http_spend_request
from aroha.enrollment import enrolled_did

r = verify_http_spend_request(
    request.headers.get("aroha-mandate"),
    audience="https://api.example.com", method=request.method, url=url, body=raw,
    expected_root=enrolled_did(ENROLLMENTS, invoice["customerId"]),
    is_revoked=None,                      # or a revocation check; you must choose
    amount_usd=invoice["amountUsd"], currency="USD",
    nonces=NONCES, ledger=LEDGER,
)
if not r.ok:
    return JSONResponse({"error": r.code}, status_code=r.status)

import { generateKeyPair, generateDid } from "@aroha-sdk/core";
import { issueIntentMandate, attenuateToPayment } from "@aroha-sdk/credentials";

// The person grants their assistant $500 for airline fares, for one hour.
const intent = await issueIntentMandate(
  personDid, assistantDid,
  { spendLimitUsd: 500, merchantCategory: "4511" },
  person.privateKey, 3_600_000,
);

// The assistant passes $300 of it to the flight agent: any agent can narrow what it was given.
const payment = await attenuateToPayment(
  intent, flightAgentDid,
  { spendLimitUsd: 300, merchantCategory: "4511" },
  assistant.privateKey,
);