Decrypt BIS Value

Decrypt exactly one supplied value by calling the running ColdFusion application helper:

application.fwDummy.uDecrypt(str = value)

Prefer the local MCP tool when it is available:

bis_decrypt_value(value: string)

Use the bundled wrapper as the fallback path:

/home/bisdev/.codex/skills/decrypt-bis-value/scripts/decrypt_bis_value.sh <encrypted-value>

Fast Path

1. Treat the supplied encrypted value as sensitive. Do not write it to committed files, logs, tickets, or final prose beyond the minimum needed to answer.
2. Verify the user supplied exactly one token. If multiple values are present, ask which one to decrypt first.
3. If the bis_decrypt_value MCP tool is available, call it with the token and report the returned plaintext.
4. If the MCP tool is unavailable or fails because the local MCP server is not configured, run the wrapper with sandbox_permissions: "require_escalated" because the sandbox network namespace cannot reach the host-local ColdFusion vhost.
5. Use the narrow approval prefix ["/home/bisdev/.codex/skills/decrypt-bis-value/scripts/decrypt_bis_value.sh"] for wrapper fallback.
6. Report the decrypted value plainly. If the helper returns the original encrypted value, say that decryption did not change the input.

The MCP tool and wrapper validate that the argument looks like one BIS encrypted token and post only to the fixed local helper endpoint. Do not call raw curl on the normal path.

Fallbacks

If the wrapper is missing, not executable, or reports that the local helper is unavailable, read references/fallback.md and follow only the relevant recovery steps.

Use strict = 1 or a custom encryption key only when the user explicitly asks for that behavior.