feat: Local HTTP eval server for non-Go callers

[dpup]

Summary

A lightweight sidecar binary that exposes the Keep engine over a local HTTP API. Enables Python, TypeScript, and other language agents to evaluate policy without the MCP relay or LLM gateway.

Motivation

The Go library API (keep.Load, engine.Evaluate) is the canonical interface, but agents written in other languages can't import it directly. The MCP relay and LLM gateway solve specific protocol-shaped problems. A generic eval server fills the gap for library-style usage from any language.

Proposed API

POST /evaluate
{
  "scope": "gmail-agent",
  "call": {
    "operation": "send_email",
    "params": {"to": ["ext@example.com"], "body": "..."},
    "context": {"agent_id": "email-bot"}
  }
}

→ 200 OK
{
  "decision": "deny",
  "rule": "business-hours-external",
  "message": "External emails blocked outside 9am-6pm PT.",
  "mutations": null,
  "audit": { ... }
}

Additional endpoints:

• GET /scopes — list loaded scopes
• POST /reload — trigger hot-reload
• GET /health — liveness check

Binary

cmd/keep-eval-server/ — loads rules, listens on localhost, evaluates calls. Config:

listen: "127.0.0.1:8091"
rules_dir: "./rules"

Localhost-only by default. No auth (it's a local sidecar). No TLS.

Priority

Lower priority — the LLM gateway and MCP relay cover most deployment patterns. Build when non-Go library demand materializes.

References

• PRD open question #10 (library distribution)
• PRD: "Go module only [for M0]. The sidecar binary is a fast follow if Python/TypeScript demand materializes."