@adtl/gateway 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -1
- package/dist/audit.d.ts +3 -0
- package/dist/audit.d.ts.map +1 -1
- package/dist/audit.js.map +1 -1
- package/dist/cli.js +8 -2
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +10 -2
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +6 -0
- package/dist/config.js.map +1 -1
- package/dist/gateway.d.ts +1 -1
- package/dist/gateway.d.ts.map +1 -1
- package/dist/gateway.js +18 -3
- package/dist/gateway.js.map +1 -1
- package/dist/invoker.d.ts +10 -1
- package/dist/invoker.d.ts.map +1 -1
- package/dist/invoker.js +11 -4
- package/dist/invoker.js.map +1 -1
- package/dist/startup.d.ts.map +1 -1
- package/dist/startup.js +6 -3
- package/dist/startup.js.map +1 -1
- package/package.json +3 -3
- package/src/audit.ts +3 -0
- package/src/cli.ts +15 -4
- package/src/config.ts +6 -0
- package/src/gateway.ts +18 -3
- package/src/invoker.ts +14 -3
- package/src/startup.ts +5 -3
package/README.md
CHANGED
|
@@ -71,11 +71,22 @@ Rules match on `session.integrity`, `session.confidentiality`, `tool.egress` and
|
|
|
71
71
|
|---|---|
|
|
72
72
|
| `gateway.upstreams.<id>` | A stdio server (`command`, `args`, `env`, `cwd`) or an HTTP server (`url`, `headers`). The `<id>` must match the key under `servers:`. |
|
|
73
73
|
| `gateway.audit` | Path of a JSONL audit log, relative to the config file |
|
|
74
|
+
| `gateway.mode` | `active` (default) or `audit`. See [Trying a policy safely](#trying-a-policy-safely). |
|
|
74
75
|
| `gateway.interceptorTimeoutMs` | Timeout per interceptor call (default 5000) |
|
|
75
76
|
| `gateway.interceptors` | Custom interceptor server command (default: the bundled `@adtl/interceptors`) |
|
|
76
77
|
|
|
77
78
|
`${VAR}` in commands, args, env, URLs and headers is read from the environment, so secrets stay out of the file.
|
|
78
79
|
|
|
80
|
+
### Trying a policy safely
|
|
81
|
+
|
|
82
|
+
Run in audit mode first to see what your policy would stop, without stopping anything:
|
|
83
|
+
|
|
84
|
+
```sh
|
|
85
|
+
adtl-gateway --config adtl.yaml --audit
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
or set `gateway.mode: audit` in the file. In audit mode every call goes through and results are not changed. Labels are still tracked, so the decisions are the same as in active mode. Each line in the audit log gets `"mode": "audit"`, and a call the policy would have stopped is logged as `"outcome": "forwarded"` with `"decision": "ask"` or `"block"`, the reason and the matching rules. Once the log looks right, remove the flag.
|
|
89
|
+
|
|
79
90
|
## How it works
|
|
80
91
|
|
|
81
92
|
```
|
|
@@ -86,7 +97,7 @@ agent ──▶ adtl-gateway ──▶ upstream MCP servers
|
|
|
86
97
|
adtl.label labels the result after it returns
|
|
87
98
|
```
|
|
88
99
|
|
|
89
|
-
The gateway fails closed. If an interceptor errors or times out, the call is stopped. If a result can't be labeled, it is withheld. If the interceptors are missing, the gateway refuses to start.
|
|
100
|
+
The gateway fails closed. If an interceptor errors or times out, the call is stopped. If a result can't be labeled, it is withheld. If the interceptors are missing, the gateway refuses to start. (In audit mode such failures are logged as warnings instead.)
|
|
90
101
|
|
|
91
102
|
## Limits of this version
|
|
92
103
|
|
package/dist/audit.d.ts
CHANGED
|
@@ -6,7 +6,10 @@ export interface AuditEntry {
|
|
|
6
6
|
tool: string;
|
|
7
7
|
/** Final outcome of the call. */
|
|
8
8
|
outcome: "forwarded" | "blocked" | "upstream_error";
|
|
9
|
+
/** The policy's decision. In audit mode a call can be forwarded with decision "ask" or "block". */
|
|
9
10
|
decision?: string;
|
|
11
|
+
/** Present when the gateway ran in audit mode: nothing was stopped or changed. */
|
|
12
|
+
mode?: "audit";
|
|
10
13
|
reason?: string;
|
|
11
14
|
matched?: unknown;
|
|
12
15
|
callHash?: unknown;
|
package/dist/audit.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,aAAc,YAAW,SAAS;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAIjC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B;AAED,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IACpC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B"}
|
|
1
|
+
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACpD,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,aAAc,YAAW,SAAS;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAIjC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B;AAED,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IACpC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B"}
|
package/dist/audit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2BpC,MAAM,OAAO,aAAa;IACH;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAChB,OAAO,GAAiB,EAAE,CAAC;IACpC,KAAK,CAAC,KAAiB;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF"}
|
package/dist/cli.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* adtl-gateway: an MCP server for your agent that proxies to your real MCP
|
|
4
4
|
* servers through ADTL's interceptors.
|
|
5
5
|
*
|
|
6
|
-
* adtl-gateway --config adtl.yaml
|
|
6
|
+
* adtl-gateway --config adtl.yaml [--audit]
|
|
7
7
|
*
|
|
8
8
|
* Point your MCP client (e.g. Claude Code's .mcp.json) at this command.
|
|
9
9
|
* Logs go to stderr; stdout carries MCP JSON-RPC only.
|
|
@@ -12,13 +12,15 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
|
|
|
12
12
|
import { EnvExpansionError } from "./config.js";
|
|
13
13
|
import { GATEWAY_VERSION } from "./gateway.js";
|
|
14
14
|
import { GatewayConfigError, loadGatewayConfig, startGateway } from "./startup.js";
|
|
15
|
-
const USAGE = `Usage: adtl-gateway --config <adtl.yaml>
|
|
15
|
+
const USAGE = `Usage: adtl-gateway --config <adtl.yaml> [--audit]
|
|
16
16
|
|
|
17
17
|
Runs an MCP server over stdio that forwards tool calls to the upstream
|
|
18
18
|
servers in the config, checking and labeling each call with ADTL.
|
|
19
19
|
|
|
20
20
|
Options:
|
|
21
21
|
-c, --config <path> ADTL config file with a gateway: section. Required.
|
|
22
|
+
--audit Log what would be stopped, but stop nothing
|
|
23
|
+
(same as gateway.mode: audit).
|
|
22
24
|
-v, --version Print the version and exit.
|
|
23
25
|
-h, --help Show this help.`;
|
|
24
26
|
function parseArgs(argv) {
|
|
@@ -33,6 +35,8 @@ function parseArgs(argv) {
|
|
|
33
35
|
out.config = argv[++i];
|
|
34
36
|
else if (a?.startsWith("--config="))
|
|
35
37
|
out.config = a.slice("--config=".length);
|
|
38
|
+
else if (a === "--audit")
|
|
39
|
+
out.audit = true;
|
|
36
40
|
else
|
|
37
41
|
throw new GatewayConfigError(`Unknown argument: ${a}\n\n${USAGE}`);
|
|
38
42
|
}
|
|
@@ -48,6 +52,8 @@ async function main() {
|
|
|
48
52
|
if (!args.config)
|
|
49
53
|
throw new GatewayConfigError(`Missing --config\n\n${USAGE}`);
|
|
50
54
|
const loaded = await loadGatewayConfig(args.config);
|
|
55
|
+
if (args.audit)
|
|
56
|
+
loaded.gateway.mode = "audit";
|
|
51
57
|
const started = await startGateway(loaded);
|
|
52
58
|
const server = started.gateway.createServer();
|
|
53
59
|
let closing = false;
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,KAAK,GAAG
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,KAAK,GAAG;;;;;;;;;;uCAUyB,CAAC;AASxC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;aACzE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;;YACtC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,qFAAqF;IACrF,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAE9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,kBAAkB,eAAe,mBAAmB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,KAAK,GAAG,GAAG,YAAY,kBAAkB,IAAI,GAAG,YAAY,iBAAiB,CAAC;IACpF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
*
|
|
4
4
|
* gateway:
|
|
5
5
|
* audit: ./adtl-audit.jsonl # optional JSONL audit log
|
|
6
|
+
* mode: audit # optional: log what would be stopped, stop nothing
|
|
6
7
|
* upstreams:
|
|
7
8
|
* github: # id must match `servers.github` in the label config
|
|
8
9
|
* command: npx
|
|
@@ -147,6 +148,11 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
147
148
|
}>>;
|
|
148
149
|
/** Path of a JSONL audit log. Relative paths are resolved against the config file's directory. */
|
|
149
150
|
audit: z.ZodOptional<z.ZodString>;
|
|
151
|
+
/**
|
|
152
|
+
* `active` (default) enforces the policy. `audit` stops and changes nothing, and
|
|
153
|
+
* logs what would have been stopped: for trying a policy out safely.
|
|
154
|
+
*/
|
|
155
|
+
mode: z.ZodDefault<z.ZodEnum<["active", "audit"]>>;
|
|
150
156
|
/** Timeout for each interceptor invocation, in milliseconds. */
|
|
151
157
|
interceptorTimeoutMs: z.ZodDefault<z.ZodNumber>;
|
|
152
158
|
}, "strict", z.ZodTypeAny, {
|
|
@@ -159,14 +165,15 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
159
165
|
url: string;
|
|
160
166
|
headers: Record<string, string>;
|
|
161
167
|
}>;
|
|
168
|
+
mode: "audit" | "active";
|
|
162
169
|
interceptorTimeoutMs: number;
|
|
170
|
+
audit?: string | undefined;
|
|
163
171
|
interceptors?: {
|
|
164
172
|
command: string;
|
|
165
173
|
args: string[];
|
|
166
174
|
env: Record<string, string>;
|
|
167
175
|
cwd?: string | undefined;
|
|
168
176
|
} | undefined;
|
|
169
|
-
audit?: string | undefined;
|
|
170
177
|
}, {
|
|
171
178
|
upstreams: Record<string, {
|
|
172
179
|
command: string;
|
|
@@ -177,13 +184,14 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
177
184
|
url: string;
|
|
178
185
|
headers?: Record<string, string> | undefined;
|
|
179
186
|
}>;
|
|
187
|
+
audit?: string | undefined;
|
|
180
188
|
interceptors?: {
|
|
181
189
|
command: string;
|
|
182
190
|
args?: string[] | undefined;
|
|
183
191
|
env?: Record<string, string> | undefined;
|
|
184
192
|
cwd?: string | undefined;
|
|
185
193
|
} | undefined;
|
|
186
|
-
|
|
194
|
+
mode?: "audit" | "active" | undefined;
|
|
187
195
|
interceptorTimeoutMs?: number | undefined;
|
|
188
196
|
}>;
|
|
189
197
|
export type GatewayConfig = z.infer<typeof GatewayConfigSchema>;
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AAEZ,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;IAAqD,CAAC;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ5B,8GAA8G;;;;;;;;;;;;;;;;;IAE9G,kGAAkG;;IAElG;;;OAGG;;IAEH,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGzD,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAIrD;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOtF;AAMD,wBAAgB,cAAc,CAAC,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAY9F;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,YAAY,CAE7D"}
|
package/dist/config.js
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
*
|
|
4
4
|
* gateway:
|
|
5
5
|
* audit: ./adtl-audit.jsonl # optional JSONL audit log
|
|
6
|
+
* mode: audit # optional: log what would be stopped, stop nothing
|
|
6
7
|
* upstreams:
|
|
7
8
|
* github: # id must match `servers.github` in the label config
|
|
8
9
|
* command: npx
|
|
@@ -44,6 +45,11 @@ export const GatewayConfigSchema = z
|
|
|
44
45
|
interceptors: StdioUpstreamSchema.optional(),
|
|
45
46
|
/** Path of a JSONL audit log. Relative paths are resolved against the config file's directory. */
|
|
46
47
|
audit: z.string().min(1).optional(),
|
|
48
|
+
/**
|
|
49
|
+
* `active` (default) enforces the policy. `audit` stops and changes nothing, and
|
|
50
|
+
* logs what would have been stopped: for trying a policy out safely.
|
|
51
|
+
*/
|
|
52
|
+
mode: z.enum(["active", "audit"]).default("active"),
|
|
47
53
|
/** Timeout for each interceptor invocation, in milliseconds. */
|
|
48
54
|
interceptorTimeoutMs: z.number().int().positive().default(5000),
|
|
49
55
|
})
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAKjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,0CAA0C,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE;QACjE,OAAO,EAAE,gGAAgG;KAC1G,CAAC;IACJ,8GAA8G;IAC9G,YAAY,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC5C,kGAAkG;IAClG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACnD,gEAAgE;IAChE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChE,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,QAAgB,EAAE,KAAa;QAClD,KAAK,CAAC,wBAAwB,QAAQ,wBAAwB,KAAK,GAAG,CAAC,CAAC;QADrD,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAsB,EAAE,KAAa;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,sCAAsC,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;QACnG,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAA2B,EAAE,GAAsB,EAAE,KAAa;IACtF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,cAAc,CAAqB,EAAU,EAAE,CAAI,EAAE,GAAsB;IACzF,MAAM,KAAK,GAAG,qBAAqB,EAAE,EAAE,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,OAAO;QACL,GAAG,CAAC;QACJ,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC;QACpE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAW;IACxC,OAAO,KAAK,IAAI,CAAC,CAAC;AACpB,CAAC"}
|
package/dist/gateway.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
|
|
|
3
3
|
import { type CallToolResult, type Tool } from "@modelcontextprotocol/sdk/types.js";
|
|
4
4
|
import type { AuditSink } from "./audit.js";
|
|
5
5
|
import type { InterceptorInvoker } from "./invoker.js";
|
|
6
|
-
export declare const GATEWAY_VERSION = "0.1.
|
|
6
|
+
export declare const GATEWAY_VERSION = "0.1.1";
|
|
7
7
|
/** `_meta` key on gateway-generated error results describing why a call was stopped. */
|
|
8
8
|
export declare const GATEWAY_DECISION_KEY = "adtl/gateway";
|
|
9
9
|
export interface GatewayLogger {
|
package/dist/gateway.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,KAAK,EAAyB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAQnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAOD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAoBD,qBAAa,WAAW;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,MAAM,CAA4B;gBAE9B,IAAI,EAAE,kBAAkB;IAQpC,uDAAuD;IACvD,YAAY,IAAI,MAAM;IAehB,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAuB5B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;CA+ErF"}
|
package/dist/gateway.js
CHANGED
|
@@ -9,12 +9,16 @@
|
|
|
9
9
|
* When a call is stopped, the agent receives a normal tool result with
|
|
10
10
|
* `isError: true` explaining why, so the model can tell the user. In v0.1 an
|
|
11
11
|
* "ask" decision is treated as a block; approvals arrive in v0.2.
|
|
12
|
+
*
|
|
13
|
+
* In audit mode (the invoker runs every interceptor with `mode: "audit"`)
|
|
14
|
+
* nothing is stopped or changed: calls the policy would stop are forwarded,
|
|
15
|
+
* and the audit log records what would have happened.
|
|
12
16
|
*/
|
|
13
17
|
import { randomUUID } from "node:crypto";
|
|
14
18
|
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
|
|
15
19
|
import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
|
|
16
20
|
import { TOOL_SEPARATOR } from "./config.js";
|
|
17
|
-
export const GATEWAY_VERSION = "0.1.
|
|
21
|
+
export const GATEWAY_VERSION = "0.1.1";
|
|
18
22
|
/** `_meta` key on gateway-generated error results describing why a call was stopped. */
|
|
19
23
|
export const GATEWAY_DECISION_KEY = "adtl/gateway";
|
|
20
24
|
const stderrLogger = {
|
|
@@ -113,6 +117,14 @@ export class AdtlGateway {
|
|
|
113
117
|
return textError(blockedMessage(req.blocked), { ...req.blocked, callHash: policy.callHash });
|
|
114
118
|
}
|
|
115
119
|
const forwarded = req.payload.params;
|
|
120
|
+
const decision = policy["adtl/decision"];
|
|
121
|
+
const audit = this.invoker.modeOverride === "audit";
|
|
122
|
+
// Only set in audit mode, for calls the policy would have stopped.
|
|
123
|
+
const wouldStop = audit && decision !== undefined && decision !== "allow"
|
|
124
|
+
? { reason: policy.reason, matched: policy.matched }
|
|
125
|
+
: undefined;
|
|
126
|
+
if (wouldStop)
|
|
127
|
+
this.log.info(`audit: would ${decision} ${name}: ${wouldStop.reason}`);
|
|
116
128
|
// 2. Forward to the upstream server.
|
|
117
129
|
let result;
|
|
118
130
|
try {
|
|
@@ -120,7 +132,7 @@ export class AdtlGateway {
|
|
|
120
132
|
}
|
|
121
133
|
catch (err) {
|
|
122
134
|
const reason = err.message;
|
|
123
|
-
finish({ outcome: "upstream_error", decision:
|
|
135
|
+
finish({ outcome: "upstream_error", ...(decision ? { decision } : {}), reason, callHash: policy.callHash, ...(audit ? { mode: "audit" } : {}), warnings: req.warnings });
|
|
124
136
|
return textError(`The ${route.upstream} server returned an error: ${reason}`, { reason: "upstream_error" });
|
|
125
137
|
}
|
|
126
138
|
// 3. Response phase: adtl.label labels the result and records it in the session.
|
|
@@ -139,7 +151,10 @@ export class AdtlGateway {
|
|
|
139
151
|
const label = infoOf(res, "adtl.label");
|
|
140
152
|
finish({
|
|
141
153
|
outcome: "forwarded",
|
|
142
|
-
|
|
154
|
+
// Missing only if adtl.policy failed and was allowed to (audit mode); see warnings.
|
|
155
|
+
...(decision ? { decision } : {}),
|
|
156
|
+
...(wouldStop ?? {}),
|
|
157
|
+
...(audit ? { mode: "audit" } : {}),
|
|
143
158
|
callHash: policy.callHash,
|
|
144
159
|
label: label.label,
|
|
145
160
|
sessionLabel: label.sessionLabel,
|
package/dist/gateway.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAanD,MAAM,YAAY,GAAkB;IAClC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC;CAC3D,CAAC;AAWF,SAAS,SAAS,CAAC,IAAY,EAAE,IAA6B;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,CACL,+DAA+D,CAAC,CAAC,MAAM,IAAI;YAC3E,sHAAsH,CACvH,CAAC;IACJ,CAAC;IACD,OAAO,2BAA2B,CAAC,CAAC,MAAM,yBAAyB,CAAC;AACtE,CAAC;AAED,SAAS,MAAM,CAAC,OAAqB,EAAE,WAAmB;IACxD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,OAAO,WAAW;IACb,SAAS,CAAS;IACV,SAAS,CAAsB;IAC/B,OAAO,CAAqB;IAC5B,KAAK,CAAwB;IAC7B,GAAG,CAAgB;IAC5B,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE1C,YAAY,IAAwB;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,YAAY;QACV,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,EAClD;YACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,YAAY,EACV,sGAAsG;gBACtG,gDAAgD;SACnD,CACF,CAAC;QACF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3H,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;QACxC,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChD,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,GAAG,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBAC3B,MAAM,IAAI,GAAG,GAAG,QAAQ,GAAG,cAAc,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBACrD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;wBACvG,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7B,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC3B,CAAC,QAAQ,MAAM,EAAE;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B;QACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC;QACnD,MAAM,OAAO,GAAsB;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;SACjC,CAAC;QACF,MAAM,MAAM,GAA4B;YACtC,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,YAAqB,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACnH,MAAM,MAAM,GAAG,CAAC,KAAgE,EAAE,EAAE,CAClF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAExH,kEAAkE;QAClE,MAAM,cAAc,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1M,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,SAAS,GAAI,GAAG,CAAC,OAAiC,CAAC,MAAM,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAuB,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC;QACpD,mEAAmE;QACnE,MAAM,SAAS,GACb,KAAK,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO;YACrD,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAA4B,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YAC1E,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtF,qCAAqC;QACrC,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAmB,CAAC;QAC/G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAAa,CAAC,OAAO,CAAC;YACtC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClL,OAAO,SAAS,CAAC,OAAO,KAAK,CAAC,QAAQ,8BAA8B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9G,CAAC;QAED,iFAAiF;QACjF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YACzC,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5D,MAAM;YACN,OAAO;SACR,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,6DAA6D;YAC7D,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,cAAc,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,qEAAqE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC;YACL,OAAO,EAAE,WAAW;YACpB,oFAAoF;YACpF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;SAC7C,CAAC,CAAC;QACH,OAAQ,GAAG,CAAC,OAAsC,CAAC,MAAM,CAAC;IAC5D,CAAC;CACF"}
|
package/dist/invoker.d.ts
CHANGED
|
@@ -9,10 +9,14 @@
|
|
|
9
9
|
* Only `severity: "error"` blocks. Audit-mode interceptors never block, and
|
|
10
10
|
* their mutations are not applied. An interceptor that fails (error or
|
|
11
11
|
* timeout) blocks the message unless it declares `failOpen: true`.
|
|
12
|
+
*
|
|
13
|
+
* The invoker may override every interceptor's `mode`, as SEP-2624 allows
|
|
14
|
+
* (e.g. audit in staging, active in production).
|
|
12
15
|
*/
|
|
13
16
|
import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
|
|
14
17
|
import { type InterceptorDefinition, type InterceptorResult, type InvocationContext } from "@adtl/interceptors";
|
|
15
18
|
import type { Decision } from "@adtl/labels";
|
|
19
|
+
export type InterceptorMode = NonNullable<InterceptorDefinition["mode"]>;
|
|
16
20
|
export interface BoundInterceptor {
|
|
17
21
|
client: Client;
|
|
18
22
|
definition: InterceptorDefinition;
|
|
@@ -38,12 +42,17 @@ export interface InvokeOptions {
|
|
|
38
42
|
export declare class InterceptorInvoker {
|
|
39
43
|
private readonly interceptors;
|
|
40
44
|
private readonly timeoutMs;
|
|
41
|
-
|
|
45
|
+
/** Overrides the mode every interceptor declares. */
|
|
46
|
+
readonly modeOverride?: InterceptorMode | undefined;
|
|
47
|
+
constructor(interceptors: BoundInterceptor[], timeoutMs?: number,
|
|
48
|
+
/** Overrides the mode every interceptor declares. */
|
|
49
|
+
modeOverride?: InterceptorMode | undefined);
|
|
42
50
|
/** Discover the interceptors an interceptor server offers. */
|
|
43
51
|
static discover(client: Client): Promise<BoundInterceptor[]>;
|
|
44
52
|
get definitions(): InterceptorDefinition[];
|
|
45
53
|
runRequest(opts: InvokeOptions): Promise<ChainOutcome>;
|
|
46
54
|
runResponse(opts: InvokeOptions): Promise<ChainOutcome>;
|
|
55
|
+
private isAudit;
|
|
47
56
|
private select;
|
|
48
57
|
private invoke;
|
|
49
58
|
/** Handle an interceptor failure. Returns false if the chain must stop. */
|
package/dist/invoker.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAa7C,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,qBAAqB,CAAC;CACnC;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAaD,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe;gBAHtB,YAAY,EAAE,gBAAgB,EAAE,EAChC,SAAS,SAAO;IACjC,qDAAqD;IAC5C,YAAY,CAAC,EAAE,eAAe,YAAA;IAGzC,8DAA8D;WACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAMlE,IAAI,WAAW,IAAI,qBAAqB,EAAE,CAEzC;IAEK,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAOtD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAO7D,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,MAAM;YAIA,MAAM;IAUpB,2EAA2E;IAC3E,OAAO,CAAC,MAAM;IAUd,6EAA6E;YAC/D,MAAM;IAoBpB,0DAA0D;YAC5C,QAAQ;CAsBvB"}
|
package/dist/invoker.js
CHANGED
|
@@ -20,9 +20,13 @@ function hooks(def, event, phase) {
|
|
|
20
20
|
export class InterceptorInvoker {
|
|
21
21
|
interceptors;
|
|
22
22
|
timeoutMs;
|
|
23
|
-
|
|
23
|
+
modeOverride;
|
|
24
|
+
constructor(interceptors, timeoutMs = 5000,
|
|
25
|
+
/** Overrides the mode every interceptor declares. */
|
|
26
|
+
modeOverride) {
|
|
24
27
|
this.interceptors = interceptors;
|
|
25
28
|
this.timeoutMs = timeoutMs;
|
|
29
|
+
this.modeOverride = modeOverride;
|
|
26
30
|
}
|
|
27
31
|
/** Discover the interceptors an interceptor server offers. */
|
|
28
32
|
static async discover(client) {
|
|
@@ -47,6 +51,9 @@ export class InterceptorInvoker {
|
|
|
47
51
|
await this.mutate("response", opts, out);
|
|
48
52
|
return out;
|
|
49
53
|
}
|
|
54
|
+
isAudit(i) {
|
|
55
|
+
return (this.modeOverride ?? i.definition.mode) === "audit";
|
|
56
|
+
}
|
|
50
57
|
select(type, event, phase) {
|
|
51
58
|
return this.interceptors.filter((i) => i.definition.type === type && hooks(i.definition, event, phase));
|
|
52
59
|
}
|
|
@@ -57,7 +64,7 @@ export class InterceptorInvoker {
|
|
|
57
64
|
/** Handle an interceptor failure. Returns false if the chain must stop. */
|
|
58
65
|
failed(i, err, out) {
|
|
59
66
|
const msg = `${i.definition.name} failed: ${err instanceof Error ? err.message : String(err)}`;
|
|
60
|
-
if (i
|
|
67
|
+
if (this.isAudit(i) || i.definition.failOpen === true) {
|
|
61
68
|
out.warnings.push(msg);
|
|
62
69
|
return true;
|
|
63
70
|
}
|
|
@@ -79,7 +86,7 @@ export class InterceptorInvoker {
|
|
|
79
86
|
continue;
|
|
80
87
|
}
|
|
81
88
|
out.results.push(r);
|
|
82
|
-
if (i
|
|
89
|
+
if (!this.isAudit(i) && r.modified)
|
|
83
90
|
payload = r.payload;
|
|
84
91
|
}
|
|
85
92
|
out.payload = payload;
|
|
@@ -99,7 +106,7 @@ export class InterceptorInvoker {
|
|
|
99
106
|
}
|
|
100
107
|
const r = s.value;
|
|
101
108
|
out.results.push(r);
|
|
102
|
-
if (r.valid || r.severity !== "error" || i
|
|
109
|
+
if (r.valid || r.severity !== "error" || this.isAudit(i))
|
|
103
110
|
return;
|
|
104
111
|
if (!out.blocked) {
|
|
105
112
|
const decision = r.info?.[DECISION_INFO_KEY] ?? "block";
|
package/dist/invoker.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invoker.js","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"invoker.js","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,WAAW,GAOZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAI7C,wFAAwF;AACxF,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe,EAAE,OAAe;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAsF,CAAC;IACxG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC;AA8BD,SAAS,QAAQ,CAAC,GAA0B,EAAE,KAAY;IACxD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,KAAK,CAAC,GAA0B,EAAE,KAAa,EAAE,KAAY;IACpE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,OAAO,kBAAkB;IAEV;IACA;IAER;IAJX,YACmB,YAAgC,EAChC,YAAY,IAAI;IACjC,qDAAqD;IAC5C,YAA8B;QAHtB,iBAAY,GAAZ,YAAY,CAAoB;QAChC,cAAS,GAAT,SAAS,CAAO;QAExB,iBAAY,GAAZ,YAAY,CAAkB;IACtC,CAAC;IAEJ,8DAA8D;IAC9D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAc;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAmB;QAClC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAmB;QACnC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,CAAmB;QACjC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;IAC9D,CAAC;IAEO,MAAM,CAAC,IAAmC,EAAE,KAAa,EAAE,KAAY;QAC7E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAmB,EAAE,KAAY,EAAE,IAAmB,EAAE,OAAgB;QAC3F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,CAAC,CAAC,MAAM,EACR,aAAa,EACb,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EACrI,IAAI,CAAC,SAAS,CACf,CAAC;QACF,OAAO,GAAmC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,CAAmB,EAAE,GAAY,EAAE,GAAiB;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAC9H,CAAC;QACF,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1D,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAClD,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;YACtB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,EAAE,GAAG,KAAK,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyB,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO;YACjE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAI,CAAC,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAA0B,IAAI,OAAO,CAAC;gBAClF,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC;gBACxG,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrE,CAAC;YACD,EAAE,GAAG,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}
|
package/dist/startup.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAIL,KAAK,aAAa,EAGnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAmB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2B3E;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,IAAI,MAAM,CAI/C;AAsBD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GAC7D,OAAO,CAAC,cAAc,CAAC,
|
|
1
|
+
{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAIL,KAAK,aAAa,EAGnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAmB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2B3E;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,IAAI,MAAM,CAI/C;AAsBD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GAC7D,OAAO,CAAC,cAAc,CAAC,CAyDzB"}
|
package/dist/startup.js
CHANGED
|
@@ -99,8 +99,11 @@ export async function startGateway(loaded, opts = {}) {
|
|
|
99
99
|
throw new GatewayConfigError(`The interceptor server does not offer ${required}; refusing to start without it`);
|
|
100
100
|
}
|
|
101
101
|
}
|
|
102
|
-
const
|
|
102
|
+
const audit = loaded.gateway.mode === "audit";
|
|
103
|
+
const invoker = new InterceptorInvoker(bound, loaded.gateway.interceptorTimeoutMs, audit ? "audit" : undefined);
|
|
103
104
|
log.info(`interceptors: ${names.join(", ")}`);
|
|
105
|
+
if (audit)
|
|
106
|
+
log.warn("audit mode: calls are logged but never stopped or changed");
|
|
104
107
|
// 2. Upstream servers. One failing upstream does not stop the others.
|
|
105
108
|
const upstreams = new Map();
|
|
106
109
|
const ids = Object.keys(loaded.gateway.upstreams);
|
|
@@ -121,8 +124,8 @@ export async function startGateway(loaded, opts = {}) {
|
|
|
121
124
|
if (upstreams.size === 0)
|
|
122
125
|
throw new GatewayConfigError("No upstream server could be connected");
|
|
123
126
|
log.info(`upstreams: ${[...upstreams.keys()].join(", ")}`);
|
|
124
|
-
const
|
|
125
|
-
const gateway = new AdtlGateway({ upstreams, invoker, ...(
|
|
127
|
+
const auditLog = loaded.gateway.audit ? new JsonlAuditLog(resolve(baseDir, loaded.gateway.audit)) : undefined;
|
|
128
|
+
const gateway = new AdtlGateway({ upstreams, invoker, ...(auditLog ? { audit: auditLog } : {}), logger: log });
|
|
126
129
|
return { gateway, close: closeAll };
|
|
127
130
|
}
|
|
128
131
|
catch (err) {
|
package/dist/startup.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEpH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,cAAc,GAIf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAsB,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAQD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC7D,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,GAAG,8EAA8E,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnG,MAAM,IAAI,kBAAkB,CAAC,GAAG,GAAG,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,sBAAsB;IACpC,+FAA+F;IAC/F,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB,EAAE,OAAe;IACvD,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,6FAA6F;QAC7F,GAAG,EAAE,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,EAAU,EAAE,CAAW,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5F,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,OAA4D,EAAE;IAE9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7J,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/F,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,IAAI,GAAkB,MAAM,CAAC,OAAO,CAAC,YAAY;YACrD,CAAC,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;YAClE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACtG,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,sBAAsB,YAAY,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,QAAQ,gCAAgC,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEpH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,cAAc,GAIf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAsB,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAQD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC7D,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,GAAG,8EAA8E,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnG,MAAM,IAAI,kBAAkB,CAAC,GAAG,GAAG,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,sBAAsB;IACpC,+FAA+F;IAC/F,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB,EAAE,OAAe;IACvD,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,6FAA6F;QAC7F,GAAG,EAAE,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,EAAU,EAAE,CAAW,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5F,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,OAA4D,EAAE;IAE9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7J,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/F,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,IAAI,GAAkB,MAAM,CAAC,OAAO,CAAC,YAAY;YACrD,CAAC,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;YAClE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACtG,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,sBAAsB,YAAY,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,QAAQ,gCAAgC,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChH,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAEjF,sEAAsE;QACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAE,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAC9F,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtB,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,sFAAsF,CAAC,CAAC;gBAClH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAO,CAAC,CAAC,MAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;QAChG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@adtl/gateway",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"description": "Experimental: MCP gateway that labels every tool result and blocks risky tool calls using ADTL trust labels",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"mcp",
|
|
@@ -46,8 +46,8 @@
|
|
|
46
46
|
"url": "https://github.com/probita-ai/adtl/issues"
|
|
47
47
|
},
|
|
48
48
|
"dependencies": {
|
|
49
|
-
"@adtl/interceptors": "0.1.
|
|
50
|
-
"@adtl/labels": "0.1.
|
|
49
|
+
"@adtl/interceptors": "0.1.1",
|
|
50
|
+
"@adtl/labels": "0.1.1",
|
|
51
51
|
"@modelcontextprotocol/sdk": "1.31.0",
|
|
52
52
|
"yaml": "2.9.1",
|
|
53
53
|
"zod": "3.25.76"
|
package/src/audit.ts
CHANGED
|
@@ -15,7 +15,10 @@ export interface AuditEntry {
|
|
|
15
15
|
tool: string;
|
|
16
16
|
/** Final outcome of the call. */
|
|
17
17
|
outcome: "forwarded" | "blocked" | "upstream_error";
|
|
18
|
+
/** The policy's decision. In audit mode a call can be forwarded with decision "ask" or "block". */
|
|
18
19
|
decision?: string;
|
|
20
|
+
/** Present when the gateway ran in audit mode: nothing was stopped or changed. */
|
|
21
|
+
mode?: "audit";
|
|
19
22
|
reason?: string;
|
|
20
23
|
matched?: unknown;
|
|
21
24
|
callHash?: unknown;
|
package/src/cli.ts
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* adtl-gateway: an MCP server for your agent that proxies to your real MCP
|
|
4
4
|
* servers through ADTL's interceptors.
|
|
5
5
|
*
|
|
6
|
-
* adtl-gateway --config adtl.yaml
|
|
6
|
+
* adtl-gateway --config adtl.yaml [--audit]
|
|
7
7
|
*
|
|
8
8
|
* Point your MCP client (e.g. Claude Code's .mcp.json) at this command.
|
|
9
9
|
* Logs go to stderr; stdout carries MCP JSON-RPC only.
|
|
@@ -13,24 +13,34 @@ import { EnvExpansionError } from "./config.js";
|
|
|
13
13
|
import { GATEWAY_VERSION } from "./gateway.js";
|
|
14
14
|
import { GatewayConfigError, loadGatewayConfig, startGateway } from "./startup.js";
|
|
15
15
|
|
|
16
|
-
const USAGE = `Usage: adtl-gateway --config <adtl.yaml>
|
|
16
|
+
const USAGE = `Usage: adtl-gateway --config <adtl.yaml> [--audit]
|
|
17
17
|
|
|
18
18
|
Runs an MCP server over stdio that forwards tool calls to the upstream
|
|
19
19
|
servers in the config, checking and labeling each call with ADTL.
|
|
20
20
|
|
|
21
21
|
Options:
|
|
22
22
|
-c, --config <path> ADTL config file with a gateway: section. Required.
|
|
23
|
+
--audit Log what would be stopped, but stop nothing
|
|
24
|
+
(same as gateway.mode: audit).
|
|
23
25
|
-v, --version Print the version and exit.
|
|
24
26
|
-h, --help Show this help.`;
|
|
25
27
|
|
|
26
|
-
|
|
27
|
-
|
|
28
|
+
interface Args {
|
|
29
|
+
config?: string;
|
|
30
|
+
audit?: boolean;
|
|
31
|
+
help?: boolean;
|
|
32
|
+
version?: boolean;
|
|
33
|
+
}
|
|
34
|
+
|
|
35
|
+
function parseArgs(argv: string[]): Args {
|
|
36
|
+
const out: Args = {};
|
|
28
37
|
for (let i = 0; i < argv.length; i++) {
|
|
29
38
|
const a = argv[i];
|
|
30
39
|
if (a === "-h" || a === "--help") out.help = true;
|
|
31
40
|
else if (a === "-v" || a === "--version") out.version = true;
|
|
32
41
|
else if (a === "-c" || a === "--config") out.config = argv[++i];
|
|
33
42
|
else if (a?.startsWith("--config=")) out.config = a.slice("--config=".length);
|
|
43
|
+
else if (a === "--audit") out.audit = true;
|
|
34
44
|
else throw new GatewayConfigError(`Unknown argument: ${a}\n\n${USAGE}`);
|
|
35
45
|
}
|
|
36
46
|
return out;
|
|
@@ -44,6 +54,7 @@ async function main(): Promise<void> {
|
|
|
44
54
|
if (!args.config) throw new GatewayConfigError(`Missing --config\n\n${USAGE}`);
|
|
45
55
|
|
|
46
56
|
const loaded = await loadGatewayConfig(args.config);
|
|
57
|
+
if (args.audit) loaded.gateway.mode = "audit";
|
|
47
58
|
const started = await startGateway(loaded);
|
|
48
59
|
const server = started.gateway.createServer();
|
|
49
60
|
|
package/src/config.ts
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
*
|
|
4
4
|
* gateway:
|
|
5
5
|
* audit: ./adtl-audit.jsonl # optional JSONL audit log
|
|
6
|
+
* mode: audit # optional: log what would be stopped, stop nothing
|
|
6
7
|
* upstreams:
|
|
7
8
|
* github: # id must match `servers.github` in the label config
|
|
8
9
|
* command: npx
|
|
@@ -52,6 +53,11 @@ export const GatewayConfigSchema = z
|
|
|
52
53
|
interceptors: StdioUpstreamSchema.optional(),
|
|
53
54
|
/** Path of a JSONL audit log. Relative paths are resolved against the config file's directory. */
|
|
54
55
|
audit: z.string().min(1).optional(),
|
|
56
|
+
/**
|
|
57
|
+
* `active` (default) enforces the policy. `audit` stops and changes nothing, and
|
|
58
|
+
* logs what would have been stopped: for trying a policy out safely.
|
|
59
|
+
*/
|
|
60
|
+
mode: z.enum(["active", "audit"]).default("active"),
|
|
55
61
|
/** Timeout for each interceptor invocation, in milliseconds. */
|
|
56
62
|
interceptorTimeoutMs: z.number().int().positive().default(5000),
|
|
57
63
|
})
|
package/src/gateway.ts
CHANGED
|
@@ -9,6 +9,10 @@
|
|
|
9
9
|
* When a call is stopped, the agent receives a normal tool result with
|
|
10
10
|
* `isError: true` explaining why, so the model can tell the user. In v0.1 an
|
|
11
11
|
* "ask" decision is treated as a block; approvals arrive in v0.2.
|
|
12
|
+
*
|
|
13
|
+
* In audit mode (the invoker runs every interceptor with `mode: "audit"`)
|
|
14
|
+
* nothing is stopped or changed: calls the policy would stop are forwarded,
|
|
15
|
+
* and the audit log records what would have happened.
|
|
12
16
|
*/
|
|
13
17
|
import { randomUUID } from "node:crypto";
|
|
14
18
|
import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
|
|
@@ -24,7 +28,7 @@ import type { AuditEntry, AuditSink } from "./audit.js";
|
|
|
24
28
|
import { TOOL_SEPARATOR } from "./config.js";
|
|
25
29
|
import type { Blocked, ChainOutcome, InterceptorInvoker } from "./invoker.js";
|
|
26
30
|
|
|
27
|
-
export const GATEWAY_VERSION = "0.1.
|
|
31
|
+
export const GATEWAY_VERSION = "0.1.1";
|
|
28
32
|
|
|
29
33
|
/** `_meta` key on gateway-generated error results describing why a call was stopped. */
|
|
30
34
|
export const GATEWAY_DECISION_KEY = "adtl/gateway";
|
|
@@ -160,6 +164,14 @@ export class AdtlGateway {
|
|
|
160
164
|
return textError(blockedMessage(req.blocked), { ...req.blocked, callHash: policy.callHash });
|
|
161
165
|
}
|
|
162
166
|
const forwarded = (req.payload as typeof requestPayload).params;
|
|
167
|
+
const decision = policy["adtl/decision"] as string | undefined;
|
|
168
|
+
const audit = this.invoker.modeOverride === "audit";
|
|
169
|
+
// Only set in audit mode, for calls the policy would have stopped.
|
|
170
|
+
const wouldStop =
|
|
171
|
+
audit && decision !== undefined && decision !== "allow"
|
|
172
|
+
? { reason: policy.reason as string | undefined, matched: policy.matched }
|
|
173
|
+
: undefined;
|
|
174
|
+
if (wouldStop) this.log.info(`audit: would ${decision} ${name}: ${wouldStop.reason}`);
|
|
163
175
|
|
|
164
176
|
// 2. Forward to the upstream server.
|
|
165
177
|
let result: CallToolResult;
|
|
@@ -167,7 +179,7 @@ export class AdtlGateway {
|
|
|
167
179
|
result = (await client.callTool({ name: forwarded.name, arguments: forwarded.arguments })) as CallToolResult;
|
|
168
180
|
} catch (err) {
|
|
169
181
|
const reason = (err as Error).message;
|
|
170
|
-
finish({ outcome: "upstream_error", decision:
|
|
182
|
+
finish({ outcome: "upstream_error", ...(decision ? { decision } : {}), reason, callHash: policy.callHash, ...(audit ? { mode: "audit" as const } : {}), warnings: req.warnings });
|
|
171
183
|
return textError(`The ${route.upstream} server returned an error: ${reason}`, { reason: "upstream_error" });
|
|
172
184
|
}
|
|
173
185
|
|
|
@@ -187,7 +199,10 @@ export class AdtlGateway {
|
|
|
187
199
|
const label = infoOf(res, "adtl.label");
|
|
188
200
|
finish({
|
|
189
201
|
outcome: "forwarded",
|
|
190
|
-
|
|
202
|
+
// Missing only if adtl.policy failed and was allowed to (audit mode); see warnings.
|
|
203
|
+
...(decision ? { decision } : {}),
|
|
204
|
+
...(wouldStop ?? {}),
|
|
205
|
+
...(audit ? { mode: "audit" as const } : {}),
|
|
191
206
|
callHash: policy.callHash,
|
|
192
207
|
label: label.label,
|
|
193
208
|
sessionLabel: label.sessionLabel,
|
package/src/invoker.ts
CHANGED
|
@@ -9,6 +9,9 @@
|
|
|
9
9
|
* Only `severity: "error"` blocks. Audit-mode interceptors never block, and
|
|
10
10
|
* their mutations are not applied. An interceptor that fails (error or
|
|
11
11
|
* timeout) blocks the message unless it declares `failOpen: true`.
|
|
12
|
+
*
|
|
13
|
+
* The invoker may override every interceptor's `mode`, as SEP-2624 allows
|
|
14
|
+
* (e.g. audit in staging, active in production).
|
|
12
15
|
*/
|
|
13
16
|
import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
|
|
14
17
|
import {
|
|
@@ -35,6 +38,8 @@ function request(client: Client, method: string, params: unknown, timeout: numbe
|
|
|
35
38
|
return r.call(client, { method, params }, AnyResult, { timeout });
|
|
36
39
|
}
|
|
37
40
|
|
|
41
|
+
export type InterceptorMode = NonNullable<InterceptorDefinition["mode"]>;
|
|
42
|
+
|
|
38
43
|
export interface BoundInterceptor {
|
|
39
44
|
client: Client;
|
|
40
45
|
definition: InterceptorDefinition;
|
|
@@ -76,6 +81,8 @@ export class InterceptorInvoker {
|
|
|
76
81
|
constructor(
|
|
77
82
|
private readonly interceptors: BoundInterceptor[],
|
|
78
83
|
private readonly timeoutMs = 5000,
|
|
84
|
+
/** Overrides the mode every interceptor declares. */
|
|
85
|
+
readonly modeOverride?: InterceptorMode,
|
|
79
86
|
) {}
|
|
80
87
|
|
|
81
88
|
/** Discover the interceptors an interceptor server offers. */
|
|
@@ -103,6 +110,10 @@ export class InterceptorInvoker {
|
|
|
103
110
|
return out;
|
|
104
111
|
}
|
|
105
112
|
|
|
113
|
+
private isAudit(i: BoundInterceptor): boolean {
|
|
114
|
+
return (this.modeOverride ?? i.definition.mode) === "audit";
|
|
115
|
+
}
|
|
116
|
+
|
|
106
117
|
private select(type: InterceptorDefinition["type"], event: string, phase: Phase): BoundInterceptor[] {
|
|
107
118
|
return this.interceptors.filter((i) => i.definition.type === type && hooks(i.definition, event, phase));
|
|
108
119
|
}
|
|
@@ -120,7 +131,7 @@ export class InterceptorInvoker {
|
|
|
120
131
|
/** Handle an interceptor failure. Returns false if the chain must stop. */
|
|
121
132
|
private failed(i: BoundInterceptor, err: unknown, out: ChainOutcome): boolean {
|
|
122
133
|
const msg = `${i.definition.name} failed: ${err instanceof Error ? err.message : String(err)}`;
|
|
123
|
-
if (i
|
|
134
|
+
if (this.isAudit(i) || i.definition.failOpen === true) {
|
|
124
135
|
out.warnings.push(msg);
|
|
125
136
|
return true;
|
|
126
137
|
}
|
|
@@ -143,7 +154,7 @@ export class InterceptorInvoker {
|
|
|
143
154
|
continue;
|
|
144
155
|
}
|
|
145
156
|
out.results.push(r);
|
|
146
|
-
if (i
|
|
157
|
+
if (!this.isAudit(i) && r.modified) payload = r.payload;
|
|
147
158
|
}
|
|
148
159
|
out.payload = payload;
|
|
149
160
|
return true;
|
|
@@ -162,7 +173,7 @@ export class InterceptorInvoker {
|
|
|
162
173
|
}
|
|
163
174
|
const r = s.value as ValidationResult;
|
|
164
175
|
out.results.push(r);
|
|
165
|
-
if (r.valid || r.severity !== "error" || i
|
|
176
|
+
if (r.valid || r.severity !== "error" || this.isAudit(i)) return;
|
|
166
177
|
if (!out.blocked) {
|
|
167
178
|
const decision = (r.info?.[DECISION_INFO_KEY] as Decision | undefined) ?? "block";
|
|
168
179
|
const reason = r.messages?.map((m) => m.message).join("; ") || `${i.definition.name} rejected the call`;
|
package/src/startup.ts
CHANGED
|
@@ -125,8 +125,10 @@ export async function startGateway(
|
|
|
125
125
|
throw new GatewayConfigError(`The interceptor server does not offer ${required}; refusing to start without it`);
|
|
126
126
|
}
|
|
127
127
|
}
|
|
128
|
-
const
|
|
128
|
+
const audit = loaded.gateway.mode === "audit";
|
|
129
|
+
const invoker = new InterceptorInvoker(bound, loaded.gateway.interceptorTimeoutMs, audit ? "audit" : undefined);
|
|
129
130
|
log.info(`interceptors: ${names.join(", ")}`);
|
|
131
|
+
if (audit) log.warn("audit mode: calls are logged but never stopped or changed");
|
|
130
132
|
|
|
131
133
|
// 2. Upstream servers. One failing upstream does not stop the others.
|
|
132
134
|
const upstreams = new Map<string, Client>();
|
|
@@ -149,8 +151,8 @@ export async function startGateway(
|
|
|
149
151
|
if (upstreams.size === 0) throw new GatewayConfigError("No upstream server could be connected");
|
|
150
152
|
log.info(`upstreams: ${[...upstreams.keys()].join(", ")}`);
|
|
151
153
|
|
|
152
|
-
const
|
|
153
|
-
const gateway = new AdtlGateway({ upstreams, invoker, ...(
|
|
154
|
+
const auditLog = loaded.gateway.audit ? new JsonlAuditLog(resolve(baseDir, loaded.gateway.audit)) : undefined;
|
|
155
|
+
const gateway = new AdtlGateway({ upstreams, invoker, ...(auditLog ? { audit: auditLog } : {}), logger: log });
|
|
154
156
|
return { gateway, close: closeAll };
|
|
155
157
|
} catch (err) {
|
|
156
158
|
await closeAll();
|