Contract Ops Mcp

io.github.DrBaher由 GitHub 帳號 DrBaher 發布v0.3.0更新於 Oct 24, 2026

One MCP server for the contract-ops suite: all nine local-first CLIs as agent tools.

已驗證STDIO僅桌面效率與工作流檔案與儲存

概覽

AI 產生的概覽

本機 MCP 伺服器，把九個 contract-ops 命令列工具當成工具提供給助理，用於合約擷取、檢查、比對、起草與審閱。

可以做什麼
把合約檔案（.md、.txt、.html、.docx、.pdf）擷取成結構化 JSON，包含當事人、日期與條款，並檢查佔位符、失效參照、編號與日期缺陷。依條款比對兩個合約版本，標出實質性、表面性或位置變動。以具型別參數填入範本佔位符，並把 DOCX 轉成 PDF。依內部審閱手冊為 NDA 評分並附上依據。搜尋與解析具版本的範本，查詢已簽署合約登記簿的續約、通知期限與續約風險。驗證已簽章 PDF 與回執包、檢視稽核日誌、列出已安裝的 CLI，並透過目錄與原始參數介面執行套件中的任一 CLI。
適用情境
適合在助理內處理合約、需要擷取、一致性檢查、版本比對、NDA 審閱或範本填寫的情境。也適合已在使用 contract-ops 命令列工具、希望由助理來驅動的團隊。
執行需求
透過 stdio 在本機執行，通常以 npx 啟動。電腦上需先安裝九個 contract-ops 命令列工具，因為伺服器會呼叫它們。PDF 轉換需要 PDF 後端，例如 LibreOffice。檔案路徑被限制在 CONTRACT_OPS_MCP_BASE_DIR 內，預設為工作目錄。
安裝前請注意
原始參數執行工具可執行套件中的 CLI，但簽章類子命令會被白名單拒絕，簽章仍由人工把關。檔案路徑參數被限制在 CONTRACT_OPS_MCP_BASE_DIR 內，除非你放寬範圍。README 建議用 curl 管線腳本安裝 CLI，這會執行遠端程式碼，請先審查。部分工具會寫出 PDF 等檔案。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Contract Ops Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

contract-ops-mcp

One MCP server for the whole contract-ops CLI suite — wire it up once and an agent (Claude, Cursor, Codex, …) gets all nine local-first CLIs as tools: extract, draft, lint, compare, convert, review, and the template + signed-contract vaults. Signing stays human-gated.

Run this

jsonc
// e.g. Claude Desktop / Cursor MCP config{  "mcpServers": {    "contract-ops": { "command": "npx", "args": ["-y", "contract-ops-mcp"] }  }}

The CLIs themselves must be installed (the server shells out to them). Fastest way to get all nine:

bash
curl -fsSL https://cli.drbaher.com/install.sh | sh     # local# …or run the server + CLIs in one container: ghcr.io/drbaher/contract-ops

Call suite_status any time to see which CLIs are present and how to install any that aren't.

Prefer a ready-made agent? contract-ops-agent is a terminal agent that already wraps this server in an enclosure — the model's only tools are the contract-ops tools, no shell/filesystem/signing by construction. Bring your own model (Claude, OpenAI, or any OpenAI-compatible endpoint): npm i -g contract-ops-agent.

Tools

Curated, ergonomic tools (typed inputs, JSON out) for the common operations, plus two escape hatches for the long tail:

ToolWhat it does
extract_contractAny contract (.md/.txt/.html/.docx/.pdf) → structured JSON (parties, dates, clauses, …)
lint_contractInternal-consistency findings (placeholders, broken refs, defined-term/numbering/date defects)
compare_versionsClause-aware drift between two versions (exit 0 clean · 2 substantive · 3 cosmetic · 4 moved)
fill_templateFill a template's placeholders with typed params (deterministic)
convert_to_pdfDOCX → PDF (needs a PDF backend, e.g. LibreOffice)
review_ndaScore an NDA against a house playbook, with evidence
template_vault_find / template_vault_getSearch / resolve versioned templates (read-only)
contract_vault_query / contract_vault_due / contract_vault_riskQuery the signed-contract register; project renewal/notice deadlines; renewal-exposure (read-only)
verify_signature / verify_receipt / audit_showVerify a signed PDF / a receipt bundle / walk the audit log (read-only)
catalog(cli)Return any CLI's full --catalog json — discover the long tail
run(cli, args)Escape hatch: run any suite CLI with raw args (no shell)
suite_statusWhich CLIs are installed (+ versions) and how to install the rest

The curated set and catalog/run are discovery-driven — they ride the suite's uniform --catalog json contract, so they stay in sync as the CLIs evolve.

Safety

  • Signing is human-gated. Only sign-cli's read/verify operations are exposed (verify_signature, verify_receipt, audit_show) — never request-create or sign. This is enforced: the run/catalog escape hatches reject any sign subcommand outside a read-only allowlist, so request-create/send/sign/approve can't be reached here. Those stay behind sign-cli's own MCP server with its per-signer approval tokens, so this server can't become an unguarded signing path.
  • Filesystem lockdown. File-path arguments to the curated tools are confined to CONTRACT_OPS_MCP_BASE_DIR (default: the working directory). Set it to widen the sandbox.
  • No shell. CLIs are invoked with execFile (no shell interpolation).

License

MIT. Part of the contract-ops CLI suite. See AGENTS.md for the agent contract.

來源：README.md，提交 c1817d1

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.3.0最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分