v0.9.2: integration cookbook, external audit verifier, compliance docs, MCP manifest, Scorecard CI

- docs/INTEGRATIONS.md: 'use Burnwall with anything' — base-URL recipes for
  coding tools, agent SDKs, and any OpenAI/Anthropic-compatible gateway.
- External audit verification: docs/COMPLIANCE.md (receipt -> ISO 42001 / EU AI
  Act / SOC 2 mapping, as evidence not certification) + tools/verify_receipts.py,
  a standalone Ed25519 chain-verifier over the audit export bundle (no Burnwall
  needed). Verified end-to-end: OK on a real export, TAMPERED on a flipped hash.
- packaging/mcp/server.json + docs/MCP_REGISTRY.md: MCP registry manifest/listing.
- .github/workflows/scorecard.yml: OpenSSF Scorecard supply-chain trust signal.
- README: '100% local, zero telemetry' headline + 'works with' pointer.
- Bump to 0.9.2; CHANGELOG entries for [0.9.1] and [0.9.2].

Author: codehippie1

CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to Burnwall.
 
+## [0.9.2] — 2026-05-28
+
+### Added
+
+- **"Use Burnwall with anything" cookbook** (`docs/INTEGRATIONS.md`) — one-line
+  base-URL recipes to put Burnwall in front of your coding tools, agent SDKs, and
+  any OpenAI-/Anthropic-compatible gateway (e.g. OpenRouter). Burnwall runs *in
+  front of* your existing setup; nothing else changes.
+- **Independent audit verification.** `burnwall audit export --format json` emits a
+  self-contained, signed receipt bundle, and `tools/verify_receipts.py` re-walks the
+  hash chain and verifies every Ed25519 signature **without trusting the Burnwall
+  binary**. `docs/COMPLIANCE.md` maps the receipts to EU AI Act Art. 12 / ISO 42001
+  A.6.2.8 / SOC 2 / NIST AI RMF (as *evidence*, not certification).
+- **MCP registry manifest** (`packaging/mcp/server.json`) + `docs/MCP_REGISTRY.md`
+  so the local MCP firewall can be listed/discovered.
+- **OpenSSF Scorecard CI** (supply-chain trust signal) and a clearer
+  "100% local, zero telemetry" README headline.
+
+## [0.9.1] — 2026-05-28
+
+### Added
+
+- **`burnwall cost-per-pr [--base main] [--json]`** — approximate cost of the
+  current git branch / PR, by attributing local cross-tool session-log spend to the
+  branch's active window (oldest commit on `base..HEAD`). Local + git metadata only;
+  never reads prompt content. Approximate (time-bucketed) and labelled as such.
+- **MCP permission auto-policy** — `[mcp].auto_approve` and `[mcp].auto_deny` glob
+  lists (matched against `"<server>/<tool>"`). Auto-deny always blocks; auto-approve
+  skips the approval gate in enforce mode — cutting approval fatigue. Both opt-in.
+- **VS Code inline panel** — the status-bar item now opens a panel
+  (`Burnwall: Open Panel`) summarising cost-by-model, security blocks, and MCP tools
+  from the local CLI JSON.
+- **Soft budget alert** — `burnwall status` shows a non-blocking heads-up once
+  today's spend crosses the configured warn threshold but is still under the hard
+  daily limit.
+
 ## [0.9.0] — 2026-05-28
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "burnwall"
-version = "0.9.0"
+version = "0.9.2"
 edition = "2021"
 description = "Local proxy for AI coding tools (Claude Code, Codex CLI, Aider): cache-aware cost tracking, path/command security checks, daily budget enforcement. Zero telemetry."
 # FSL-1.1-MIT is not an SPDX identifier; crates.io rejects it as `license`,

Cargo.toml

@@ -2,8 +2,12 @@
 
 **Track what your AI coding agent costs. Block what it shouldn't touch.**
 
+**100% local. Zero telemetry.** No data leaves your machine except the API call you already make. Burnwall is a single binary that runs *in front of* your existing tools — not a hosted gateway your traffic routes through.
+
 Burnwall is a local proxy for AI coding tools — Claude Code, Codex CLI, Aider, OpenCode, Cline. It combines cache-aware cost accounting, path-and-command security checks on every tool call, cross-tool spend aggregation, and zero telemetry — without sending your prompts to a SaaS dashboard.
 
+**Works with** Claude Code, Cursor, Codex, Aider, OpenRouter, and any OpenAI/Anthropic-compatible gateway — point its base URL at Burnwall. See [`docs/INTEGRATIONS.md`](docs/INTEGRATIONS.md).
+
 If you've ever woken up to a four-figure API bill from an agent loop, or wondered whether your agent has been quietly `cat`-ing `~/.ssh/id_rsa` into the context window: Burnwall is the seatbelt.
 
 ```

README.md

@@ -0,0 +1,67 @@
+# Compliance & audit evidence
+
+Burnwall produces **local, metadata-only, tamper-evident** records of what an AI
+agent did and was blocked from — useful as *evidence* for AI-governance frameworks.
+It is **not** a compliance product and does not make you compliant on its own; it
+furnishes artifacts an auditor or underwriter can verify.
+
+## The artifacts
+
+- **Audit receipts** (`burnwall audit seal` / `verify`) — Ed25519-signed,
+  hash-chained, metadata-only records of every forwarded/blocked action. Each
+  receipt hashes the source row's contents, so `verify` detects edits to the
+  underlying data, and the chain detects insertion/deletion/reordering.
+- **CycloneDX AI-BOM** (`burnwall audit aibom`) — machine-readable session bill of
+  materials (models, MCP servers, security activity).
+- **SARIF** (`burnwall audit sarif`) — security blocks for GitHub code scanning.
+- **OWASP / EU-AI-Act mapping** — see `docs/SECURITY_FRAMEWORKS.md`.
+
+None of these contain prompt content.
+
+## Framework mapping (evidence, not certification)
+
+| Framework / control | What it asks for | Burnwall artifact |
+|---|---|---|
+| **EU AI Act, Art. 12** (record-keeping / automatic logging) | Automatic, traceable logs of system events over the lifecycle | Audit receipts (`seal`) — signed, chained, per-action |
+| **EU AI Act, Art. 19 / 26** (log retention) | Keep logs (≥6 months for deployers) | Retained receipt chain; `audit verify` reports count + oldest sealed date |
+| **ISO/IEC 42001, A.6.2.8** (AI event logging) | Immutable, attributable who/what/when records | Audit receipts + `verify` |
+| **SOC 2** (CC-series: logging, change/integrity) | Tamper-evident activity + control-enforcement evidence | Receipts (forward/block) + SARIF security events |
+| **NIST AI RMF** (Measure/Manage) | Evidence that runtime controls operated | Blocked-action receipts + security events |
+
+Honest caveat: Burnwall is a deployer-side control plane, so it provides
+*proof-of-controls evidence*, not full compliance with any framework.
+
+## Independent verification (no Burnwall required)
+
+`burnwall audit export --format json` emits a self-contained bundle:
+
+```json
+{
+  "public_key": "<hex Ed25519 verifying key>",
+  "count": <n>,
+  "receipts": [
+    {
+      "seq": 1, "sealed_at": "...", "source": "request|security_event",
+      "source_id": 1, "timestamp": "...", "action": "forward|block|security",
+      "provider": "...", "model": "...", "detail": "...",
+      "content_hash": "<sha256 hex of the source row>",
+      "prev_hash": "<hex>", "hash": "<sha256(prev_hash \\n content_hash) hex>",
+      "signature": "<ed25519(hash) hex>"
+    }
+  ]
+}
+```
+
+A third party (auditor/underwriter) can re-walk the chain and verify every
+signature **without trusting the Burnwall binary** using `tools/verify_receipts.py`:
+
+```
+burnwall audit export --format json > receipts.json
+python tools/verify_receipts.py receipts.json
+# → OK — N receipt(s) verified against <pubkey>…   (or TAMPERED at seq X)
+```
+
+The external verifier checks the chain links + signatures from the export alone
+(proving the exported receipts weren't forged, reordered, edited, or deleted after
+export). Re-deriving each `content_hash` from the *live* source rows — proving the
+underlying data hasn't changed — is what `burnwall audit verify` does locally.

docs/COMPLIANCE.md

@@ -0,0 +1,66 @@
+# Use Burnwall with anything
+
+Burnwall is a **local proxy**: your AI coding agent points its API base URL at
+Burnwall (`http://localhost:4100`), Burnwall enforces security + budget and tracks
+cost, then forwards to the real provider — or to any **OpenAI- or
+Anthropic-compatible** gateway you already use. It runs *in front of* your existing
+setup; nothing else changes, and no data leaves your machine beyond the API call you
+already make.
+
+Start the proxy:
+
+```
+burnwall start            # listens on http://localhost:4100
+```
+
+Routes: `/anthropic/*`, `/openai/*`, `/google/*`. Your agent's `Authorization` /
+`x-api-key` header is forwarded unchanged to the upstream.
+
+## Point an agent or SDK at Burnwall
+
+Most tools and SDKs honour an HTTP base-URL override — usually a single environment
+variable. Set it to the matching Burnwall route:
+
+| Tool / SDK | Set | To |
+|---|---|---|
+| Claude Code / Anthropic SDK / Claude Agent SDK | `ANTHROPIC_BASE_URL` | `http://localhost:4100/anthropic` |
+| Codex CLI / OpenAI SDK / OpenAI Agents SDK | `OPENAI_BASE_URL` (or `OPENAI_API_BASE`) | `http://localhost:4100/openai` |
+| Google Gemini SDK / ADK | Gemini base URL | `http://localhost:4100/google` |
+| LangChain / CrewAI / LlamaIndex | the model's `base_url` | the route for that provider above |
+| Cursor / Windsurf / Aider / OpenCode | the tool's "custom API base / OpenAI-compatible URL" setting | the matching route |
+
+The keys stay yours — Burnwall passes the auth header straight through to the
+upstream and never logs it.
+
+## Put Burnwall in front of a gateway/router
+
+Already routing through an OpenAI-compatible gateway, router, or proxy? Point
+Burnwall's *upstream* at it and keep the local firewall + budget on top:
+
+```
+# OpenRouter (OpenAI-compatible): agent → Burnwall → OpenRouter → models
+burnwall start --upstream-openai https://openrouter.ai/api/v1
+# point the agent at http://localhost:4100/openai with your OpenRouter key
+```
+
+```
+# Any OpenAI-compatible gateway/proxy (self-hosted or hosted):
+burnwall start --upstream-openai https://your-gateway.example/v1
+```
+
+```
+# Any Anthropic-compatible upstream:
+burnwall start --upstream-anthropic https://your-upstream.example
+```
+
+The upstream URL is **your config**, not something a request can change. Burnwall
+forwards your request unchanged and adds, on the local side: blocking dangerous
+file-path / command / secret-exfiltration tool calls before they leave the machine,
+hard daily/monthly budget stops, runaway-loop detection, and one local cost view
+across every tool — none of which a hosted router can do for you.
+
+## Failover to multiple upstreams
+
+If you run more than one base URL for a provider, configure `[resilience]` so
+Burnwall retries the same request against the next endpoint on a connection error
+or 5xx. See `docs/SPEC.md`.

docs/INTEGRATIONS.md

@@ -0,0 +1,26 @@
+# Listing the Burnwall MCP firewall
+
+Burnwall's MCP firewall (`burnwall mcp-watch`) is a local pass-through proxy that
+sits in front of your MCP servers: it detects tool-poisoning and silent
+"rug-pull" definition changes, enforces an approval workflow, and applies the
+path/command/secret denylist to `tools/call` arguments — all locally, never
+modifying responses.
+
+## Run it
+
+```
+burnwall mcp-watch --upstream <your-mcp-server-url> [--port 4101] [--require-approval]
+```
+
+Point your MCP client at the watcher's local address instead of the upstream
+directly. Multiple servers can be fronted via `[[mcp.servers]]` in
+`~/.burnwall/config.toml`; auto-approve/deny globs go under `[mcp]` (see
+`docs/SPEC.md`).
+
+## Registry manifest
+
+`packaging/mcp/server.json` is the [MCP registry](https://registry.modelcontextprotocol.io/)
+manifest. To publish, install the registry CLI and run `mcp-publisher` from this
+repo against `packaging/mcp/server.json` (per the registry's current docs). The
+firewall is a security/observability proxy, not a tool server — the manifest
+points users at the `burnwall mcp-watch` invocation above.

docs/MCP_REGISTRY.md

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
+  "name": "io.github.intbot/burnwall-mcp-firewall",
+  "description": "Local MCP firewall: tool-poisoning + rug-pull detection, an approval workflow, and a path/command/secret denylist on tool-call arguments. Runs in front of your MCP servers; nothing leaves your machine.",
+  "repository": {
+    "url": "https://github.com/intbot/burnwall",
+    "source": "github"
+  },
+  "version": "0.9.2",
+  "packages": [
+    {
+      "registryType": "oci",
+      "identifier": "burnwall",
+      "transport": { "type": "stdio" },
+      "comment": "Install the burnwall CLI (brew/cargo/npm/curl — see the repo). The firewall is a passthrough HTTP proxy started with `burnwall mcp-watch --upstream <your-mcp-server-url>`; point your MCP client at the watcher's local address. See docs/MCP_REGISTRY.md."
+    }
+  ]
+}

packaging/mcp/server.json

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Independently verify a Burnwall audit-receipt export — no Burnwall required.
+
+    burnwall audit export --format json > receipts.json
+    python tools/verify_receipts.py receipts.json
+
+Re-walks the Ed25519 hash chain in the export and verifies every signature
+against the embedded public key. This proves the exported receipts were not
+forged, reordered, edited, or deleted after export — without trusting the
+burnwall binary. (Re-deriving each content_hash from the live source rows —
+proving the underlying data is unchanged — is `burnwall audit verify`'s job.)
+
+Chain definition (must match src/audit/mod.rs):
+    hash = SHA-256( prev_hash_hex || "\\n" || content_hash_hex )   # ASCII bytes
+    signature = Ed25519(hash_hex_bytes)                            # over the hex string
+    genesis prev_hash = 64 zeros
+
+Requires: pip install cryptography
+Exit code: 0 = intact, 1 = tampered, 2 = usage/format error.
+"""
+
+import hashlib
+import json
+import sys
+
+try:
+    from cryptography.exceptions import InvalidSignature
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+except ImportError:
+    sys.exit("error: needs `pip install cryptography`")
+
+GENESIS = "0" * 64
+
+
+def fail(seq, why):
+    print(f"TAMPERED at seq {seq}: {why}", file=sys.stderr)
+    sys.exit(1)
+
+
+def main():
+    if len(sys.argv) != 2:
+        print("usage: verify_receipts.py <export.json>", file=sys.stderr)
+        sys.exit(2)
+
+    with open(sys.argv[1], encoding="utf-8") as fh:
+        data = json.load(fh)
+
+    pub_hex = data.get("public_key")
+    if not pub_hex:
+        print("error: export has no public_key", file=sys.stderr)
+        sys.exit(2)
+    pub = Ed25519PublicKey.from_public_bytes(bytes.fromhex(pub_hex))
+
+    receipts = sorted(data.get("receipts", []), key=lambda r: r["seq"])
+    prev = GENESIS
+    for r in receipts:
+        if r["prev_hash"] != prev:
+            fail(r.get("seq"), "broken chain link (a receipt was inserted, deleted, or reordered)")
+        digest = hashlib.sha256()
+        digest.update(prev.encode("ascii"))
+        digest.update(b"\n")
+        digest.update(r["content_hash"].encode("ascii"))
+        if digest.hexdigest() != r["hash"]:
+            fail(r.get("seq"), "hash does not match its contents")
+        try:
+            pub.verify(bytes.fromhex(r["signature"]), r["hash"].encode("ascii"))
+        except InvalidSignature:
+            fail(r.get("seq"), "signature does not verify (forged or wrong key)")
+        prev = r["hash"]
+
+    print(f"OK — {len(receipts)} receipt(s) verified against {pub_hex[:16]}…")
+
+
+if __name__ == "__main__":
+    main()