# Promptcrafting Mcp

> Security-hardened MCP server for prompt engineering — Cloudflare Workers + Durable Objects

- **Type:** MCP server
- **Install:** `agentstack add mcp-chemically-motivated-solutions-promptcrafting-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Chemically-Motivated-Solutions](https://agentstack.voostack.com/s/chemically-motivated-solutions)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Chemically-Motivated-Solutions](https://github.com/Chemically-Motivated-Solutions)
- **Source:** https://github.com/Chemically-Motivated-Solutions/promptcrafting-mcp

## Install

```sh
agentstack add mcp-chemically-motivated-solutions-promptcrafting-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# promptcrafting-mcp

Security-hardened prompt engineering framework deployed as an MCP server on Cloudflare Workers.

## Architecture

```
┌─────────────────────────────────────────────────────────────────┐
│  B0: Untrusted Zone                                             │
│  Clients, Admin UIs, External IdPs                              │
└──────────────────────────┬──────────────────────────────────────┘
                           │ HTTPS
┌──────────────────────────▼──────────────────────────────────────┐
│  B1: Edge Perimeter (Hono Router on Cloudflare Worker)          │
│  ┌──────────┐ ┌──────────┐ ┌──────────────┐ ┌───────────────┐  │
│  │ CORS     │→│ Rate     │→│ JWT Auth     │→│ RBAC          │  │
│  │ Headers  │ │ Limiter  │ │ (alg pinned) │ │ Enforcement   │  │
│  └──────────┘ └──────────┘ └──────────────┘ └───────────────┘  │
└──────────────────────────┬──────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────────┐
│  B2: Controlled Execution Plane (McpAgent Durable Object)       │
│  ┌─────────────┐ ┌──────────────┐ ┌────────────┐ ┌──────────┐  │
│  │ Input       │→│ Structured   │→│ Sandwich   │→│ Prompt   │  │
│  │ Sanitizer   │ │ Separation   │ │ Defense    │ │ Builder  │  │
│  └─────────────┘ └──────────────┘ └────────────┘ └────┬─────┘  │
│                                                        │        │
│  ┌─────────────┐ ┌──────────────┐ ┌────────────┐      │        │
│  │ HITL Gate   │←│ PII/Toxicity │←│ Output     │←─────┘        │
│  │ (optional)  │ │ Redaction    │ │ Validator  │  ← from B4    │
│  └─────────────┘ └──────────────┘ └────────────┘               │
└──────────────────────────┬──────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────────┐
│  B3: Data Plane                                                 │
│  ┌───────────────────┐ ┌──────────────────┐ ┌────────────────┐  │
│  │ Workers KV        │ │ D1 / SQLite      │ │ Cold Storage   │  │
│  │ Templates+Versions│ │ Audit Logs       │ │ (Optional S3)  │  │
│  │ HMAC-signed       │ │ Guardrail Events │ │ Compliance     │  │
│  └───────────────────┘ └──────────────────┘ └────────────────┘  │
└─────────────────────────────────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────────┐
│  B4: Model Execution (Untrusted)                                │
│  Workers AI / External LLM Providers                            │
│  ⚠️  Treat all outputs as untrusted — validate back in B2       │
└─────────────────────────────────────────────────────────────────┘
```

## Four-Layer Prompt Stack

Every prompt is compiled from four structured layers:

| Layer | Purpose | Security Role |
|-------|---------|---------------|
| **Objective** | Task definition + success criteria | Defines allowed scope |
| **Role** | Persona + domain context | Shifts model vocabulary |
| **Constraints** | Boundaries + forbidden actions | Security policy enforcement |
| **Output Shape** | Format + schema + examples | Enables Zod validation |

## Quick Start

```bash
# 1. Install dependencies
npm install

# 2. Create Cloudflare resources
wrangler kv namespace create PROMPT_TEMPLATES
wrangler d1 create promptcrafting-audit

# 3. Update wrangler.jsonc with the IDs from step 2

# 4. Set secrets
wrangler secret put JWT_SECRET
wrangler secret put TEMPLATE_HMAC_KEY

# 5. Run D1 migrations
npm run db:migrate

# 6. Deploy
npm run deploy
```

## Security Controls

| Boundary | Threat | Mitigation | Status |
|----------|--------|------------|--------|
| B0→B1 | Spoofing | JWT with algorithm pinning (HS256 only) | ✅ |
| B0→B1 | DoS | Identity-keyed rate limiting (not IP) | ✅ |
| B1→B2 | Privilege escalation | RBAC with permission checks | ✅ |
| B2 | Direct prompt injection | NFKC + regex + entropy analysis | ✅ |
| B2 | Indirect injection | Structured separation + sandwich defense | ✅ |
| B2 | Token smuggling | Invisible char stripping + normalization | ✅ |
| B3 | Template poisoning | HMAC-SHA256 content signing | ✅ |
| B3 | Repudiation | Immutable D1 audit logs | ✅ |
| B4 | Prompt extraction | Canary tokens in system prompt | ✅ |
| B4→B2 | Schema drift | Zod fail-closed output validation | ✅ |
| B4→B2 | PII leakage | Regex PII detection + redaction | ✅ |
| B4→B2 | Prompt leakage | System instruction pattern detection | ✅ |
| B1 | JWT confusion | Algorithm pinning, claim validation | ✅ |
| B2 | HITL timeout/DoS | Configurable timeout (`HITL_TIMEOUT_MS`), dead-letter on expiry | ✅ |
| B4 | Response integrity | TLS cert pinning (planned) | 🔲 |

## Endpoints

| Path | Method | Auth | Description |
|------|--------|------|-------------|
| `/health` | GET | No | Health check |
| `/mcp/*` | ALL | JWT | MCP protocol (Streamable HTTP) |
| `/api/v1/templates` | GET | JWT + `template:read` | List templates |
| `/api/v1/templates/:id` | GET | JWT + `template:read` | Get template |
| `/api/v1/templates/:id` | DELETE | JWT + `template:delete` | Delete template |
| `/api/v1/audit` | GET | JWT + `audit:read` | Query audit logs |
| `/api/v1/hitl` | GET | JWT + `hitl:resolve` | List pending HITL approvals |
| `/api/v1/hitl/:requestId` | GET | JWT + `hitl:resolve` | Get HITL approval status |
| `/api/v1/hitl/:requestId/resolve` | POST | JWT + `hitl:resolve` | Approve or reject HITL request |

## MCP Tools

| Tool | Description | Annotations |
|------|-------------|-------------|
| `promptcraft_create_template` | Create HMAC-signed four-layer template | write |
| `promptcraft_get_template` | Retrieve + verify template integrity | read-only |
| `promptcraft_list_templates` | List templates with pagination | read-only |
| `promptcraft_delete_template` | Soft-delete (versions retained) | destructive |
| `promptcraft_execute_prompt` | Full pipeline: sanitize → compile → infer → validate | write |
| `promptcraft_validate_input` | Dry-run validation (no inference) | read-only |
| `promptcraft_query_audit` | Query audit trail with filters | read-only |

## Project Structure

```
promptcrafting-mcp/
├── wrangler.jsonc            # Cloudflare config (all bindings)
├── package.json
├── tsconfig.json
├── migrations/
│   └── 0001_init.sql         # D1 schema
└── src/
    ├── index.ts              # Hono router (B1 perimeter)
    ├── mcp-agent.ts          # McpAgent Durable Object (B2)
    ├── types.ts              # Shared type definitions
    ├── schemas/
    │   └── index.ts          # Zod input schemas
    ├── middleware/
    │   └── auth.ts           # JWT, RBAC, rate limiting
    ├── guardrails/
    │   ├── index.ts          # Barrel export
    │   ├── input-sanitizer.ts  # NFKC, injection detection, separation, sandwich
    │   └── output-validator.ts # Schema, PII, leakage, canary
    ├── services/
    │   ├── prompt-builder.ts # Four-layer compiler, HMAC signing
    │   └── audit.ts          # D1 audit trail operations
    └── tools/
        └── prompt-tools.ts   # MCP tool registrations
```

## Next Steps

- [ ] STRIDE threat model diagram per boundary
- [x] HITL gate with configurable timeout + dead-letter path
- [ ] TLS certificate pinning for external model providers
- [ ] Integration tests with MCP Inspector
- [ ] Prompt A/B testing via KV version routing
- [ ] Cloudflare Firewall for AI integration (semantic input/output scanning)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Chemically-Motivated-Solutions](https://github.com/Chemically-Motivated-Solutions)
- **Source:** [Chemically-Motivated-Solutions/promptcrafting-mcp](https://github.com/Chemically-Motivated-Solutions/promptcrafting-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-chemically-motivated-solutions-promptcrafting-mcp
- Seller: https://agentstack.voostack.com/s/chemically-motivated-solutions
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.