Add invinoveritas plugin: independent pre-action review via remote MCP

.cursor-plugin/marketplace.json

@@ -169,6 +169,11 @@
       "name": "juicebox",
       "source": "third_party/juicebox",
       "description": "Connect to Juicebox — query recruiting analytics, search shortlists, look up projects, and create or manage sourcing agents — via Juicebox's official remote MCP server."
+    },
+    {
+      "name": "invinoveritas",
+      "source": "third_party/invinoveritas",
+      "description": "Independent, signed pre-action verdicts for agent tool calls and merges — a neutral second opinion before an irreversible action, with a recomputable proof after, via invinoveritas's official remote MCP server."
     }
   ]
 }

third_party/invinoveritas/.cursor-plugin/plugin.json

@@ -0,0 +1,46 @@
+{
+  "name": "invinoveritas",
+  "displayName": "invinoveritas",
+  "version": "1.0.0",
+  "description": "Independent, signed pre-action verdicts for agent tool calls and merges — a neutral second opinion before an irreversible action, with a recomputable proof after, via invinoveritas's official remote MCP server.",
+  "author": {
+    "name": "invinoveritas",
+    "email": "contact@agents.babyblueviper.com"
+  },
+  "homepage": "https://api.babyblueviper.com",
+  "repository": "https://github.com/babyblueviper1/invinoveritas",
+  "license": "MIT",
+  "logo": "assets/logo.png",
+  "keywords": [
+    "verification",
+    "review",
+    "safety",
+    "guardrail",
+    "mcp",
+    "agent",
+    "merge",
+    "irreversible-actions"
+  ],
+  "category": "developer-tools",
+  "tags": [
+    "review",
+    "verification",
+    "safety",
+    "mcp"
+  ],
+  "variables": {
+    "type": "object",
+    "properties": {
+      "IVV_API_KEY": {
+        "type": "string",
+        "title": "invinoveritas API key",
+        "description": "Free, instant Bearer token — register with a single POST to https://api.babyblueviper.com/register (no payment required; paid tools bill per call once you fund the account)."
+      }
+    },
+    "required": [
+      "IVV_API_KEY"
+    ]
+  },
+  "mcpServers": "./mcp.json",
+  "skills": "./skills/"
+}

third_party/invinoveritas/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+All notable changes to this plugin will be documented here.
+
+## 1.0.0 — initial release
+
+- Added the `invinoveritas` MCP server pointing at `https://api.babyblueviper.com/mcp`, verified
+  live against the production `review`/`verify_proof` tools before release.
+- Declared `IVV_API_KEY` plugin variable and forwarded it through the Authorization header.
+- Added the `pre-action-review` skill: teaches the agent to call `review` before an irreversible
+  or high-consequence action (destructive commands, merges, deploys, migrations) and how to act
+  on the returned verdict.

third_party/invinoveritas/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 invinoveritas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

third_party/invinoveritas/README.md

@@ -0,0 +1,73 @@
+# invinoveritas
+
+Cursor plugin that connects agents to [invinoveritas](https://api.babyblueviper.com) through its
+official remote [Model Context Protocol](https://modelcontextprotocol.io/) server — an
+independent, signed pre-action verdict before an irreversible action (a destructive command, a
+production deploy, a merge to `main`), and a recomputable proof after.
+
+Built for the class of workflow this ecosystem is moving toward: many agents branching, resolving
+conflicts, and merging with little or no human review per action. A verdict from a party that
+isn't the one being judged is a real, checkable second opinion on that path — not a human gate,
+an independent one, and it never blocks: it's advisory, you stay fully autonomous and decide.
+
+## Install
+
+1. Open **Cursor Settings → Plugins**.
+2. Search for **invinoveritas**.
+3. Click **Install**, then set your invinoveritas API key (below).
+
+Or run `/add-plugin invinoveritas` in chat.
+
+## MCP
+
+```json
+{
+  "mcpServers": {
+    "invinoveritas": {
+      "type": "http",
+      "url": "https://api.babyblueviper.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ${IVV_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+## Setup
+
+invinoveritas authenticates with a **Bearer API key** — free, instant, no payment required to
+register.
+
+### 1. Get an API key
+
+```bash
+curl -s -X POST https://api.babyblueviper.com/register \
+  -H "Content-Type: application/json" \
+  -d '{"label": "cursor-agent"}'
+```
+
+Returns an `api_key`. Free try-it calls work immediately; fund the account (Lightning, x402/USDC,
+or card) before high-volume or paid-tier use.
+
+### 2. Configure the plugin
+
+In **Dashboard → Plugins → Configure**, set **invinoveritas API key** to the value you just
+generated.
+
+## What the skill does
+
+The bundled `pre-action-review` skill teaches the agent when to call the `review` tool — before a
+destructive shell command, a merge, a deploy, a migration, or any action that would be hard to
+cleanly undo — and how to act on a `reject`/`approve_with_concerns`/`approve` verdict without
+silently swallowing concerns. See `skills/pre-action-review/SKILL.md` for the full guidance.
+
+## Docs
+
+- Live tool list + schemas: https://api.babyblueviper.com/.well-known/mcp/server-card.json
+- Free proof verification (no auth, no account): `POST https://api.babyblueviper.com/verify-proof`
+- Public, signed verdict track record: https://api.babyblueviper.com/ledger
+
+## License
+
+MIT

third_party/invinoveritas/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "invinoveritas": {
+      "type": "http",
+      "url": "https://api.babyblueviper.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ${IVV_API_KEY}"
+      }
+    }
+  }
+}

third_party/invinoveritas/skills/pre-action-review/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: pre-action-review
+description: "Get an independent, signed verdict from invinoveritas before an irreversible or high-consequence action — a force-push, a merge to main, a production deploy, a destructive shell command, a schema migration, a fund transfer, or any action a hidden agent flaw could make hard to undo. Use before executing, not after."
+---
+
+# Pre-action review
+
+Before you execute an action that would be hard or impossible to cleanly undo, call the
+`review` tool (via the `invinoveritas` MCP connection) and pass a plain-text description of
+exactly what you're about to do. It returns an independent `approve` / `approve_with_concerns` /
+`reject` verdict with a confidence score and, on reject, specific blocking issues.
+
+## When to use this
+
+Call it before, not after, whenever the action fits any of these:
+
+- **Destructive or hard-to-reverse shell commands** — `rm -rf`, dropping a database/table,
+  force-pushing over history, deleting a cloud resource, revoking credentials.
+- **Merges and branch operations at scale** — this matters more than usual on Origin-style
+  workflows where many agents branch, resolve conflicts, and merge with little or no human in
+  the loop per merge. A signed pre-merge verdict is a real, checkable second opinion on a merge
+  that might otherwise go straight to `main` unreviewed.
+- **Production deploys and migrations** — anything that changes live infrastructure, schema, or
+  configuration in a way a rollback might not cleanly reverse.
+- **Financial or irreversible-by-nature actions** — a payment, a transfer, a trade, deleting a
+  user's data, sending an external communication on someone's behalf.
+- **Anything you're not fully confident about** — if you'd want a second pair of eyes on this
+  before running it yourself, that's the signal to call `review`.
+
+Do NOT call it for routine, easily-reversible edits (a normal code change on a feature branch, a
+local test run, reading a file) — that's noise, not signal, and burns the user's call budget.
+
+## How to call it
+
+```
+review(
+  artifact="<plain description of the exact action: what command/merge/deploy, on what target,
+             with what data at stake>",
+  artifact_type="general"   # or "trade" / "onchain_action" for financial actions
+)
+```
+
+Be concrete: name the actual command, the actual branch/target, and any stated safeguards (a
+tested backup, a dry-run result) — a vague artifact gets a vague, less useful verdict.
+
+## What to do with the verdict
+
+- **`reject`** — do not proceed. Surface the verdict's `summary` and `issues` to the user
+  plainly, and ask before doing anything the verdict flagged as a blocker. Don't retry the same
+  action hoping for a different verdict; if the user overrides it, that's their call to make
+  explicitly, not yours to route around.
+- **`approve_with_concerns`** — proceed only after surfacing the specific concerns to the user;
+  don't silently swallow them.
+- **`approve`** — proceed normally.
+
+## Honest scope
+
+This is an independent judgment call on the action described, not a guarantee. It doesn't
+execute anything itself, doesn't have access to your repo or environment beyond what you put in
+`artifact`, and a vague or incomplete description produces a correspondingly less reliable
+verdict. Optional `sign=true` on the call returns a portable, cryptographically verifiable proof (check it
+independently via the `verify_proof` tool on this same MCP connection, free, no auth) if you want
+a durable, checkable record that this review happened before the action — useful for audit trails
+on agent-driven merges specifically.
+
+Free to register (`POST https://api.babyblueviper.com/register`, no payment), free try-it calls,
+pay-per-use after. See this MCP connection's own tool list for `verify_proof` and other available
+tools.