rosett-ai 1.3.3

data/lib/rosett_ai/mcp/resources/provenance_resource.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    module Resources
+      # MCP resource provider for AI provenance log.
+      #
+      # Exposes the full provenance log as an MCP resource.
+      #
+      # @author hugo
+      # @author claude
+      class ProvenanceResource
+        URI_PREFIX = 'rosett-ai://provenance/'
+        PROVENANCE_FILE = '.ai-provenance.yml'
+
+        # Lists available provenance resources.
+        #
+        # @return [Array<Hash>] resource entries
+        def list
+          path = RosettAi.root.join(PROVENANCE_FILE)
+          return [] unless path.exist?
+
+          [{
+            uri: "#{URI_PREFIX}log",
+            name: 'provenance-log',
+            description: 'Full AI provenance log',
+            mime_type: 'application/x-yaml'
+          }]
+        end
+
+        # Reads the provenance log.
+        #
+        # @param _name [String] resource name (only 'log' supported)
+        # @return [Hash, nil] resource content
+        def read(_name = 'log')
+          path = RosettAi.root.join(PROVENANCE_FILE)
+          return nil unless path.exist?
+
+          {
+            uri: "#{URI_PREFIX}log",
+            content: File.read(path),
+            mime_type: 'application/x-yaml'
+          }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/resources/rules_resource.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    module Resources
+      # MCP resource provider for compiled rule markdown files.
+      #
+      # Exposes compiled rules (output of raictl compile) as MCP
+      # resources with URIs in the format rosett-ai://rules/{name}.
+      #
+      # @author hugo
+      # @author claude
+      class RulesResource
+        URI_PREFIX = 'rosett-ai://rules/'
+
+        # Lists all available compiled rule resources.
+        #
+        # @return [Array<Hash>] resource entries
+        def list
+          dir = RosettAi.paths.rules_dir
+          return [] unless dir.directory?
+
+          dir.glob('*.md').map { |path| resource_entry(path) }
+        end
+
+        # Reads a specific compiled rule.
+        #
+        # @param name [String] rule filename (without .md)
+        # @return [Hash, nil] resource content
+        def read(name)
+          path = RosettAi.paths.rules_dir.join("#{name}.md")
+          return nil unless path.exist?
+
+          {
+            uri: "#{URI_PREFIX}#{name}",
+            content: File.read(path),
+            mime_type: 'text/markdown'
+          }
+        end
+
+        private
+
+        # @param path [Pathname]
+        # @return [Hash]
+        def resource_entry(path)
+          name = path.basename('.md').to_s
+          {
+            uri: "#{URI_PREFIX}#{name}",
+            name: name,
+            description: "Compiled rule: #{name}",
+            mime_type: 'text/markdown'
+          }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/resources/schema_resource.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    module Resources
+      # MCP resource provider for JSON Schema files.
+      #
+      # Exposes validation schemas as MCP resources with
+      # URIs in the format rosett-ai://schema/{name}.
+      #
+      # @author hugo
+      # @author claude
+      class SchemaResource
+        URI_PREFIX = 'rosett-ai://schema/'
+
+        # Lists all available schema resources.
+        #
+        # @return [Array<Hash>] resource entries
+        def list
+          dir = RosettAi.root.join('conf', 'schemas')
+          return [] unless dir.directory?
+
+          dir.glob('*.json').map { |path| resource_entry(path) }
+        end
+
+        # Reads a specific schema resource.
+        #
+        # @param name [String] schema name (without _schema.json)
+        # @return [Hash, nil] resource content
+        def read(name)
+          path = resolve_path(name)
+          return nil unless path&.exist?
+
+          {
+            uri: "#{URI_PREFIX}#{name}",
+            content: File.read(path),
+            mime_type: 'application/json'
+          }
+        end
+
+        private
+
+        # @param name [String]
+        # @return [Pathname, nil]
+        def resolve_path(name)
+          dir = RosettAi.root.join('conf', 'schemas')
+          # Try exact filename first, then with _schema.json suffix
+          exact = dir.join("#{name}.json")
+          return exact if exact.exist?
+
+          suffixed = dir.join("#{name}_schema.json")
+          suffixed.exist? ? suffixed : nil
+        end
+
+        # @param path [Pathname]
+        # @return [Hash]
+        def resource_entry(path)
+          name = path.basename('.json').to_s
+          {
+            uri: "#{URI_PREFIX}#{name}",
+            name: name,
+            description: "JSON Schema: #{name}",
+            mime_type: 'application/json'
+          }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/response_helper.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    # Standardized MCP tool response formatting.
+    #
+    # Provides consistent response structure for all MCP tools
+    # with success, finding, and error states.
+    #
+    # @author hugo
+    # @author claude
+    module ResponseHelper
+      module_function
+
+      # Build a success response hash.
+      #
+      # @param message [String] human-readable message
+      # @param data [Hash] additional response data
+      # @return [Hash] response with success: true
+      def success(message, data = {})
+        { success: true, message: message }.merge(data)
+      end
+
+      # Build a finding response hash (not an error, but notable).
+      #
+      # @param message [String] human-readable message
+      # @param data [Hash] additional response data
+      # @return [Hash] response with finding: true
+      def finding(message, data = {})
+        { finding: true, message: message }.merge(data)
+      end
+
+      # Build an error response hash.
+      #
+      # @param message [String] human-readable error message
+      # @param data [Hash] additional response data
+      # @return [Hash] response with error: true
+      def error(message, data = {})
+        { error: true, message: message }.merge(data)
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/security_logger.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    # Security event logger for MCP server.
+    #
+    # Logs authentication, rate limiting, and origin validation
+    # events to stderr in structured format.
+    #
+    # @author hugo
+    # @author claude
+    module SecurityLogger
+      module_function
+
+      # Log a successful authentication event.
+      #
+      # @param client_id [String] authenticated client identifier
+      # @return [void]
+      def auth_success(client_id)
+        log(:info, 'auth_success', client_id: client_id)
+      end
+
+      # Log a failed authentication attempt.
+      #
+      # @param reason [String] failure reason
+      # @return [void]
+      def auth_failure(reason)
+        log(:warn, 'auth_failure', reason: reason)
+      end
+
+      # Log a rate-limited request.
+      #
+      # @param key [String] bucket key that was limited
+      # @return [void]
+      def rate_limited(key)
+        log(:warn, 'rate_limited', bucket_key: key)
+      end
+
+      # Log a rejected origin.
+      #
+      # @param origin [String] the rejected origin
+      # @return [void]
+      def origin_rejected(origin)
+        log(:warn, 'origin_rejected', origin: origin)
+      end
+
+      # @param level [Symbol] log level
+      # @param event [String] event name
+      # @param data [Hash] event data
+      # @return [void]
+      def log(level, event, **data)
+        timestamp = Time.now.utc.strftime('%Y-%m-%dT%H:%M:%SZ')
+        warn "[rai-mcp] #{timestamp} #{level} #{event} #{data.map { |k, v| "#{k}=#{v}" }.join(' ')}"
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/server.rb

@@ -0,0 +1,212 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    # MCP server for Rosett-AI — exposes validation, compilation, and
+    # configuration management as MCP tools, resources, and prompts.
+    #
+    # Supports stdio (default) and HTTP (Puma) transports with a
+    # 6-layer Rack middleware stack for security.
+    #
+    # Requires the `mcp` gem (optional dependency, :mcp group).
+    #
+    # @author hugo
+    # @author claude
+    class Server
+      MCP_SPEC_VERSION = '2025-03-26'
+      DEFAULT_PORT = 8484
+      DEFAULT_HOST = 'localhost'
+
+      attr_reader :security_config
+
+      # @param config_path [String, nil] path to server config YAML
+      # @param plugins [Array<String>] explicit plugin names to load
+      def initialize(config_path: nil, plugins: [])
+        @config_path = config_path
+        @plugin_names = plugins
+        @security_config = load_security_config(config_path)
+      end
+
+      # @return [Boolean] true if the mcp gem is available
+      def self.available?
+        require 'mcp'
+        true
+      rescue LoadError
+        false
+      end
+
+      # Starts the MCP server on stdio transport.
+      #
+      # @return [void]
+      # @raise [RosettAi::McpError] if mcp gem is not available
+      def serve
+        ensure_mcp_available!
+        server = build_server
+        transport = ::MCP::Server::Transports::StdioTransport.new(server)
+        transport.open
+      end
+
+      # Starts the MCP server on HTTP transport via Puma.
+      #
+      # @param options [Hash] HTTP transport options
+      # @option options [Integer] :port HTTP port (default 8484)
+      # @option options [String] :host bind address (default localhost)
+      # @option options [String, nil] :tls_cert path to TLS certificate
+      # @option options [String, nil] :tls_key path to TLS private key
+      # @option options [Boolean] :allow_remote allow non-localhost binding
+      # @return [void]
+      # @raise [RosettAi::McpError] if puma/rackup gems are not available
+      def serve_http(**options)
+        ensure_mcp_available!
+        ensure_http_available!
+
+        port = options.fetch(:port, DEFAULT_PORT)
+        host = options.fetch(:host, DEFAULT_HOST)
+        tls_cert = options[:tls_cert]
+        tls_key = options[:tls_key]
+
+        validate_host_binding(host, options.fetch(:allow_remote, false))
+
+        rack_app = build_rack_app
+        start_puma(rack_app, port: port, host: host,
+                             tls_cert: tls_cert, tls_key: tls_key)
+      end
+
+      # Build the Rack application for HTTP transport.
+      #
+      # @return [Proc] Rack application
+      def http_app
+        ensure_mcp_available!
+        ensure_http_available!
+        build_rack_app
+      end
+
+      # Returns the tool registry for listing available tools.
+      #
+      # @return [Array<Hash>] tool descriptors
+      def tools
+        Governance::TOOL_CLASSES.map do |klass|
+          {
+            name: klass::TOOL_NAME,
+            description: klass::DESCRIPTION,
+            annotations: klass::ANNOTATIONS
+          }
+        end
+      end
+
+      private
+
+      def ensure_mcp_available!
+        return if self.class.available?
+
+        raise RosettAi::McpError,
+              'MCP gem not available. Install with: bundle install --with mcp'
+      end
+
+      def ensure_http_available!
+        require 'puma'
+        require 'rackup'
+      rescue LoadError => e
+        raise RosettAi::McpError,
+              "HTTP transport requires puma and rackup gems: #{e.message}"
+      end
+
+      def build_server
+        server = ::MCP::Server.new(
+          name: 'rosett-ai',
+          version: RosettAi::VERSION,
+          instructions: Instructions.generate
+        )
+
+        Governance.register(server)
+        Plugins.load_all(server, @plugin_names)
+        server
+      end
+
+      def build_rack_app
+        server = build_server
+        transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(server)
+        app = transport.method(:call)
+        security = @security_config
+
+        Rack::Builder.new do
+          use Middleware::RequestSize, max_size: security.max_request_size
+          use Middleware::ContentType if security.content_type_enforcement
+          use Middleware::OriginValidation, config: security.origin
+          use Middleware::Cors, config: security.cors if security.cors.enabled
+          use Middleware::Authentication, config: security.authentication
+          use Middleware::RateLimit, config: security.rate_limiting if security.rate_limiting.enabled
+          run app
+        end.to_app
+      end
+
+      def start_puma(rack_app, port:, host:, tls_cert:, tls_key:)
+        puma_config = Puma::Configuration.new do |conf|
+          conf.app rack_app
+          if tls_cert && tls_key
+            conf.bind "ssl://#{host}:#{port}?cert=#{tls_cert}&key=#{tls_key}"
+          else
+            conf.bind "tcp://#{host}:#{port}"
+          end
+          conf.quiet
+        end
+
+        launcher = Puma::Launcher.new(puma_config)
+        launcher.run
+      end
+
+      def validate_host_binding(host, allow_remote)
+        return if allow_remote
+        return if ['localhost', '127.0.0.1', '::1'].include?(host)
+
+        raise RosettAi::McpError,
+              "Binding to #{host} requires --allow-remote flag for security"
+      end
+
+      def load_security_config(config_path)
+        config = HttpSecurityConfig.new
+        yaml = load_config_yaml(config_path)
+        config.apply(yaml['http']) if yaml&.dig('http')
+        config
+      end
+
+      def load_config_yaml(config_path)
+        path = config_path || find_config_file
+        return nil unless path && File.exist?(path)
+
+        YAML.safe_load_file(path, permitted_classes: [Symbol])
+      rescue Psych::SyntaxError
+        nil
+      end
+
+      def find_config_file
+        candidates = [
+          ENV.fetch('RAI_MCP_CONFIG', nil),
+          find_upward('.rosett-ai-mcp.yml'),
+          File.expand_path('~/.config/rosett-ai/mcp/server.yml'),
+          '/etc/rosett-ai/mcp/server.yml',
+          RosettAi.root.join('conf', 'mcp', 'server_defaults.yml').to_s
+        ].compact
+
+        candidates.find { |path| File.exist?(path) }
+      end
+
+      def find_upward(filename)
+        dir = Dir.pwd
+        loop do
+          candidate = File.join(dir, filename)
+          return candidate if File.exist?(candidate)
+
+          parent = File.dirname(dir)
+          break if parent == dir
+
+          dir = parent
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/settings/server_installer.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    module Settings
+      # Installs MCP servers with trust-first validation.
+      #
+      # All server installations must originate from a trusted source.
+      # Untrusted sources are rejected with actionable error messages.
+      #
+      # @author hugo
+      # @author claude
+      class ServerInstaller
+        # @param trust_manager [TrustManager] trust validation
+        # @param registry [Admin::Registry] server registry
+        # @param schema_validator [Admin::SchemaValidator] config validator
+        def initialize(trust_manager:, registry:, schema_validator:)
+          @trust_manager = trust_manager
+          @registry = registry
+          @schema_validator = schema_validator
+        end
+
+        # Installs an MCP server from a URI with trust validation.
+        #
+        # @param name [String] server name
+        # @param uri [String] server URI or command
+        # @param transport [String] transport type (stdio, http)
+        # @return [Hash] result with :success, :message, :server
+        def install(name:, uri:, transport: 'stdio')
+          trust_result = validate_trust(uri, transport)
+          return trust_result unless trust_result[:trusted]
+
+          config = build_config(name, uri, transport)
+          validation = @schema_validator.validate(config)
+          return validation_failure(validation) unless validation[:valid]
+
+          path = @registry.add(config)
+          {
+            success: true,
+            message: "Server '#{name}' installed from #{trust_result[:source_type]} source",
+            server: config,
+            path: path.to_s
+          }
+        end
+
+        # Removes an MCP server by name.
+        #
+        # @param name [String] server name
+        # @param force [Boolean] skip confirmation for enterprise-managed servers
+        # @return [Hash] result with :success, :message
+        def remove(name:, force: false)
+          server = @registry.find(name)
+          return { success: false, message: "Server '#{name}' not found" } unless server
+
+          if managed_server?(server) && !force
+            return {
+              success: false,
+              message: "Server '#{name}' is enterprise-managed. Use --force to override."
+            }
+          end
+
+          @registry.remove(name)
+          { success: true, message: "Server '#{name}' removed" }
+        end
+
+        private
+
+        def validate_trust(uri, transport)
+          return { trusted: true, source_type: 'local' } if local_transport?(transport)
+
+          result = @trust_manager.validate_uri(uri)
+          return result if result[:trusted]
+
+          {
+            trusted: false,
+            success: false,
+            message: "Untrusted source: #{result[:domain]}. " \
+                     'Add trust with: rai mcp trust-sources add DOMAIN'
+          }
+        end
+
+        def local_transport?(transport)
+          transport == 'stdio'
+        end
+
+        def build_config(name, uri, transport)
+          config = { name: name, transport: transport }
+          if transport == 'stdio'
+            config[:command] = uri
+          else
+            config[:url] = uri
+          end
+          config
+        end
+
+        def validation_failure(validation)
+          {
+            success: false,
+            message: "Validation failed: #{validation[:errors].join(', ')}"
+          }
+        end
+
+        def managed_server?(server)
+          server[:source_file].to_s.include?('managed')
+        end
+      end
+    end
+  end
+end