Trust Anchor Core — Capability-Based MCP Server for Supply Chain Defense

Trust_anchor.py is the core MCP server implementing capability-based security for build infrastructure defense. Key Components Cryptographically-enforced state machine (forward-only transitions) Capability store (job-scoped, hash-bound, single-use tokens) Artifact verifier (hash matching, provenance tracking) Signature guard (local-only signing, no HTTP exposure) WORM audit log (hash-chained, append-only) Policy engine (static rules, auditable) Part of the Trust Anchor framework for persistent threat environments.