@adtl/gateway 0.2.0 → 0.3.1

package/README.md

@@ -58,7 +58,25 @@ One file holds both the labels and the gateway settings.
 | `confidentiality` | `public`, `private`, `secret` | Who may see the tool's *result*? |
 | `egress` | `none`, `internal`, `external`, `public` | Where *calling* the tool can send data. |
 
-Tools without a rule use the defaults (`untrusted`, `private`, egress `unknown`). That's safe but strict, so describe the tools you use.
+Tools without a rule use the defaults (`untrusted`, `private`, egress `unknown`). That's safe but strict, so describe the tools you use. Resources and prompts use the server's `defaults`.
+
+#### Drafting rules with `init`
+
+List your servers under `gateway.upstreams`, then let `init` draft a rule for every tool:
+
+```sh
+adtl-gateway init -c adtl.yaml           # print the updated config, change nothing
+adtl-gateway init -c adtl.yaml --write   # update the file (original kept as adtl.yaml.bak)
+```
+
+`init` connects to each upstream and lists its tools.
+
+- **Presets** cover the GitHub (`github-mcp-server`), filesystem and fetch servers. A preset says what the server's reads and writes mean; the server's `readOnlyHint` decides which tools are reads, so new tools are covered too.
+- **Other servers** get rules from their MCP tool hints. Hints only set egress, because they are the server's own claims: every result stays `untrusted` and `private` until you change it. These lines are marked `review`.
+- Entries already in the file are never changed, so you can re-run `init` after a server adds tools. Tools the server no longer offers are reported, not removed.
+- Edits keep your comments, but the YAML may be reformatted slightly (e.g. `[a]` becomes `[ a ]`).
+
+Always review the result: a preset is a starting point, not a judgment about your data.
 
 Labels only get stricter as a session goes on. A session that has read anything untrusted stays untrusted until the session ends.
 
@@ -120,6 +138,46 @@ adtl-gateway --config adtl.yaml --audit
 
 or set `gateway.mode: audit` in the file. In audit mode every call goes through and results are not changed. Labels are still tracked, so the decisions are the same as in active mode. Each line in the audit log gets `"mode": "audit"`, and a call the policy would have stopped is logged as `"outcome": "forwarded"` with `"decision": "ask"` or `"block"`, the reason and the matching rules. Once the log looks right, remove the flag.
 
+## Claude Code: cover the built-in tools too
+
+The gateway only sees MCP calls. Claude Code's own tools (`WebFetch`, `WebSearch`, `Bash`, `Read`, ...) don't go through it, so a page fetched with `WebFetch` would not taint the session, and `Bash` could send data anywhere. `adtl-gateway hook` closes that gap. Add it to `.claude/settings.json` (or `~/.claude/settings.json` for every project):
+
+```json
+{
+  "hooks": {
+    "PreToolUse":         [{ "matcher": "*", "hooks": [{ "type": "command", "command": "npx -y @adtl/gateway hook --config /absolute/path/to/adtl.yaml", "timeout": 10, "onFailure": "block" }] }],
+    "PostToolUse":        [{ "matcher": "*", "hooks": [{ "type": "command", "command": "npx -y @adtl/gateway hook --config /absolute/path/to/adtl.yaml", "timeout": 10 }] }],
+    "PostToolUseFailure": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "npx -y @adtl/gateway hook --config /absolute/path/to/adtl.yaml", "timeout": 10 }] }]
+  }
+}
+```
+
+(A global install, `npm i -g @adtl/gateway` and then `adtl-gateway hook ...`, starts faster than `npx`.)
+
+What it does:
+
+- **After each tool runs**, it labels the output and adds it to the session label. Built-in tools are labeled as the server `claude-code`.
+- **Before each tool runs**, it checks the call against the same policy as the gateway. `block` denies the call. `ask` shows Claude Code's own permission prompt, so you approve in the terminal. `allow` gives no answer, so your normal Claude Code permissions still apply. ADTL never approves a call on its own.
+- **It shares one session label with the gateway.** Claude Code gives the gateway its session id (`CLAUDE_CODE_SESSION_ID`), and both keep the label in `~/.adtl/sessions/<id>.jsonl` (set `ADTL_SESSIONS_DIR` to change the directory). A `WebFetch` taints the session for `github__add_comment`, and a private file read through the gateway counts against a later `Bash` call. Labels last for the whole Claude Code session, including `--resume`.
+- **It covers MCP servers that skip the gateway**, such as connectors added in claude.ai. Their tools are labeled as their server name (`mcp__<server>__<tool>` → server `<server>`), so you can describe them under `servers:` like any upstream. The gateway's own tools (`mcp__adtl__*`) are skipped; pass `--gateway-server <name>` if you registered the gateway under another name.
+- **It fails closed.** If the hook can't decide, it exits with code 2, which stops the call.
+- **It writes to the same audit log** (`gateway.audit`) with `"via": "claude-code-hook"`, and follows `gateway.mode: audit`. The config needs no `gateway:` section if you only use the hooks.
+
+Built-in labels, which you can override under `servers.claude-code.tools`:
+
+| Tools | Result | Egress |
+|---|---|---|
+| `Read`, `Grep`, `Glob` | trusted, private | none |
+| `WebFetch`, `WebSearch` | untrusted, public | external (a URL or query can carry data out) |
+| `Bash`, `Monitor` | unknown, private | unknown |
+| `Agent` / `Task` | unknown, private | none (the sub-agent's own calls are checked too) |
+| `Write`, `Edit`, `TodoWrite`, other bookkeeping tools | trusted, public | none |
+| anything else | your `defaults` | unknown |
+
+With the [example policy](../../examples/adtl.yaml), `Bash` and `WebFetch` run freely in a fresh session, but ask first once the session has read untrusted content, because `no-public-write-after-untrusted` matches `tool.egress: [public, external, unknown]`.
+
+The hook also refuses `Write` and `Edit` on your ADTL config and session files, and asks before shell commands that mention the session directory, so the agent can't simply clear its own taint. This is a speed bump, not a sandbox.
+
 ## How it works
 
 ```
@@ -134,9 +192,11 @@ The gateway fails closed. If an interceptor errors or times out, the call is sto
 
 ## Limits of this version
 
-- Only tools are proxied. Resources and prompts are not passed through yet.
+- Tools, resources and prompts are proxied. Resource subscriptions, `list_changed` notifications and completions are not passed through yet.
+- Resources and prompts are labeled by server defaults (`servers.<id>.defaults`) or the global defaults; there are no per-resource or per-prompt rules yet. A resource URI that two upstreams could serve is refused rather than guessed.
 - Approvals come from one push channel (ntfy). Other channels, approvals inside the MCP client, and approver roles are planned.
-- Labels last for one gateway process, which is one agent session. They are not carried into files, memory or other agents yet; that's planned for v0.4.
+- Labels last for one agent session: one gateway process, or under Claude Code one Claude Code session (shared with the hooks). They are not carried into files, memory or other agents yet; that's planned for v0.4. A file written after reading untrusted content reads back as trusted.
+- The Claude Code hooks label tools by name, not by what they touched: a `Read` of a downloaded file is as trusted as a `Read` of your own code.
 - Labels are set by your config. Servers' own trust claims can only make labels stricter, unless you set `acceptServerClaims: true`.
 
 ## Links

package/dist/audit.d.ts

@@ -1,11 +1,16 @@
 export interface AuditEntry {
     ts: string;
     sessionId: string;
-    event: "tools/call";
+    event: "tools/call" | "resources/read" | "prompts/get";
     server: string;
-    tool: string;
-    /** Final outcome of the call. */
-    outcome: "forwarded" | "blocked" | "upstream_error";
+    /** Exactly one of tool, resource or prompt is set, matching `event`. */
+    tool?: string;
+    resource?: string;
+    prompt?: string;
+    /** Final outcome of the call. "asked": handed to Claude Code's permission prompt by the hook. */
+    outcome: "forwarded" | "blocked" | "asked" | "upstream_error";
+    /** Present when the entry was written by the Claude Code hook rather than the gateway. */
+    via?: "claude-code-hook";
     /** The policy's decision. In audit mode a call can be forwarded with decision "ask" or "block". */
     decision?: string;
     /** Present when the gateway ran in audit mode: nothing was stopped or changed. */

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACpD,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,aAAc,YAAW,SAAS;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAIjC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B;AAED,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IACpC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,GAAG,gBAAgB,GAAG,aAAa,CAAC;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,CAAC;IAC9D,0FAA0F;IAC1F,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,aAAc,YAAW,SAAS;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAIjC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B;AAED,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IACpC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAG/B"}

package/dist/audit.js

@@ -1,5 +1,5 @@
 /**
- * Append-only JSONL audit log. One line per tool call.
+ * Append-only JSONL audit log. One line per tool call, resource read or prompt get.
  *
  * Arguments and results are never written; the call is identified by its
  * hash, so the log can be shared without leaking the data it describes.

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,MAAM,OAAO,aAAa;IACH;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAChB,OAAO,GAAiB,EAAE,CAAC;IACpC,KAAK,CAAC,KAAiB;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkCpC,MAAM,OAAO,aAAa;IACH;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAChB,OAAO,GAAiB,EAAE,CAAC;IACpC,KAAK,CAAC,KAAiB;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/dist/cli.js

@@ -4,6 +4,8 @@
  * servers through ADTL's interceptors.
  *
  *   adtl-gateway --config adtl.yaml [--audit]
+ *   adtl-gateway init --config adtl.yaml [--write]
+ *   adtl-gateway hook --config adtl.yaml [--gateway-server adtl]
  *
  * Point your MCP client (e.g. Claude Code's .mcp.json) at this command.
  * Logs go to stderr; stdout carries MCP JSON-RPC only.
@@ -11,8 +13,12 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { EnvExpansionError } from "./config.js";
 import { GATEWAY_VERSION } from "./gateway.js";
+import { runHook } from "./hooks/run.js";
+import { runInit } from "./init/run.js";
 import { GatewayConfigError, loadGatewayConfig, startGateway } from "./startup.js";
 const USAGE = `Usage: adtl-gateway --config <adtl.yaml> [--audit]
+       adtl-gateway init --config <adtl.yaml> [--write]
+       adtl-gateway hook --config <adtl.yaml> [--gateway-server <name>]
 
 Runs an MCP server over stdio that forwards tool calls to the upstream
 servers in the config, checking and labeling each call with ADTL.
@@ -22,12 +28,36 @@ Options:
       --audit          Log what would be stopped, but stop nothing
                        (same as gateway.mode: audit).
   -v, --version        Print the version and exit.
+
+init:
+  Connects to every upstream, lists its tools, and drafts a labeling rule
+  for each tool the config doesn't cover yet (presets for GitHub,
+  filesystem and fetch; MCP tool hints otherwise). Existing entries are
+  never changed. Prints the updated config; review it before using it.
+      --write          Update the config file in place (original kept as .bak).
+
+hook:
+  The Claude Code hook for PreToolUse, PostToolUse and PostToolUseFailure.
+  Labels built-in tools (WebFetch, Read, Bash, ...) and MCP servers outside
+  the gateway, and runs the same policy on them, sharing the session label
+  with the gateway. Reads the hook event from stdin.
+      --gateway-server <name>
+                       The gateway's name in Claude Code's MCP config; its
+                       tools are checked by the gateway and skipped here.
+                       Default: adtl.
+
   -h, --help           Show this help.`;
 function parseArgs(argv) {
     const out = {};
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
-        if (a === "-h" || a === "--help")
+        if (i === 0 && a === "init")
+            out.init = true;
+        else if (i === 0 && a === "hook")
+            out.hook = true;
+        else if (a === "--gateway-server" && out.hook)
+            out.gatewayServer = argv[++i];
+        else if (a === "-h" || a === "--help")
             out.help = true;
         else if (a === "-v" || a === "--version")
             out.version = true;
@@ -37,6 +67,8 @@ function parseArgs(argv) {
             out.config = a.slice("--config=".length);
         else if (a === "--audit")
             out.audit = true;
+        else if (a === "--write" && out.init)
+            out.write = true;
         else
             throw new GatewayConfigError(`Unknown argument: ${a}\n\n${USAGE}`);
     }
@@ -51,6 +83,10 @@ async function main() {
         return void console.log(GATEWAY_VERSION);
     if (!args.config)
         throw new GatewayConfigError(`Missing --config\n\n${USAGE}`);
+    if (args.init)
+        return init(args.config, args.write === true);
+    if (args.hook)
+        return hook(args.config, args.gatewayServer);
     const loaded = await loadGatewayConfig(args.config);
     if (args.audit)
         loaded.gateway.mode = "audit";
@@ -74,9 +110,53 @@ async function main() {
     await server.connect(new StdioServerTransport());
     console.error(`[adtl-gateway] ${GATEWAY_VERSION} ready (session ${started.gateway.sessionId})`);
 }
+function summarize(r, path, write) {
+    const lines = r.reports.map((s) => {
+        const parts = [`${s.added.length} tools added`];
+        if (s.kept.length)
+            parts.push(`${s.kept.length} kept`);
+        if (s.addedDefaults)
+            parts.push("defaults added");
+        if (s.stale.length)
+            parts.push(`no longer offered: ${s.stale.join(", ")}`);
+        return `  ${s.id} (${s.preset ? `preset ${s.preset}` : "from tool hints, review"}): ${parts.join("; ")}`;
+    });
+    for (const f of r.failed)
+        lines.push(`  ${f.id}: could not connect, skipped (${f.error})`);
+    const changed = r.reports.some((s) => s.added.length || s.addedDefaults);
+    const tail = !changed
+        ? "Nothing to add."
+        : write
+            ? `Updated ${path} (original saved as ${path}.bak). Review every line marked "review".`
+            : "Nothing written. Review the config above, then re-run with --write.";
+    return `${lines.join("\n")}\n${tail}`;
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function hook(config, gatewayServer) {
+    const out = await runHook({ configPath: config, stdin: await readStdin(), ...(gatewayServer ? { gatewayServer } : {}) });
+    if (out.stdout)
+        process.stdout.write(`${JSON.stringify(out.stdout)}\n`);
+    if (out.stderr)
+        process.stderr.write(`${out.stderr}\n`);
+    process.exitCode = out.exitCode;
+}
+async function init(path, write) {
+    const result = await runInit({ path, write });
+    if (!write)
+        process.stdout.write(result.text);
+    console.error(`[adtl-gateway] init\n${summarize(result, path, write)}`);
+    if (result.failed.length && !result.reports.length)
+        process.exitCode = 1;
+}
 main().catch((err) => {
     const known = err instanceof GatewayConfigError || err instanceof EnvExpansionError;
     console.error(known ? `[adtl-gateway] ${err.message}` : err);
-    process.exit(1);
+    // For Claude Code hooks only exit code 2 stops the call; any other code lets it run.
+    process.exit(process.argv[2] === "hook" ? 2 : 1);
 });
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,KAAK,GAAG;;;;;;;;;;uCAUyB,CAAC;AASxC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;aACzE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;;YACtC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,qFAAqF;IACrF,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAE9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,kBAAkB,eAAe,mBAAmB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,KAAK,GAAG,GAAG,YAAY,kBAAkB,IAAI,GAAG,YAAY,iBAAiB,CAAC;IACpF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA8ByB,CAAC;AAaxC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aAC7C,IAAI,CAAC,KAAK,kBAAkB,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACxE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aAClD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;aACzE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;aACtC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;;YAClD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,qFAAqF;IACrF,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAE9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,kBAAkB,eAAe,mBAAmB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,CAAa,EAAE,IAAY,EAAE,KAAc;IAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,yBAAyB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3G,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,CAAC,OAAO;QACnB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,WAAW,IAAI,uBAAuB,IAAI,2CAA2C;YACvF,CAAC,CAAC,qEAAqE,CAAC;IAC5E,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,aAAsB;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,KAAc;IAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,CAAC,wBAAwB,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,KAAK,GAAG,GAAG,YAAY,kBAAkB,IAAI,GAAG,YAAY,iBAAiB,CAAC;IACpF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,qFAAqF;IACrF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC"}

package/dist/gateway.d.ts

@@ -1,10 +1,10 @@
 import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { type CallToolResult, type Tool } from "@modelcontextprotocol/sdk/types.js";
+import { type CallToolResult, type GetPromptResult, type Prompt, type ReadResourceResult, type Resource, type ResourceTemplate, type Tool } from "@modelcontextprotocol/sdk/types.js";
 import type { ApprovalBroker } from "./approvals.js";
 import type { AuditSink } from "./audit.js";
 import type { InterceptorInvoker } from "./invoker.js";
-export declare const GATEWAY_VERSION = "0.2.0";
+export declare const GATEWAY_VERSION = "0.3.1";
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export declare const GATEWAY_DECISION_KEY = "adtl/gateway";
 export interface GatewayLogger {
@@ -33,10 +33,30 @@ export declare class AdtlGateway {
     private readonly log;
     private readonly approvals;
     private routes;
+    private promptRoutes;
+    /** Resource URI → the upstreams that list it. */
+    private resourceRoutes;
+    private templateRoutes;
     constructor(opts: AdtlGatewayOptions);
     /** The downstream MCP server the agent connects to. */
     createServer(): Server;
+    /** Every upstream's items from one list method, following cursors. Upstreams that fail are skipped with a warning. */
+    private listAll;
     listTools(): Promise<Tool[]>;
+    listPrompts(): Promise<Prompt[]>;
+    listResources(): Promise<Resource[]>;
+    listResourceTemplates(): Promise<ResourceTemplate[]>;
+    /** The one upstream that serves `uri`: an exact listing wins, then template matches. */
+    private resourceUpstream;
+    readResource(uri: string): Promise<ReadResourceResult>;
+    getPrompt(name: string, args?: Record<string, string>): Promise<GetPromptResult>;
+    /**
+     * Forward a resources/read or prompts/get request through the interceptor
+     * chain: request interceptors → upstream → response interceptors (adtl.label).
+     * These requests have no tool result to carry an error, so a stopped request
+     * becomes a JSON-RPC error.
+     */
+    private forwardLabeled;
     callTool(name: string, args: Record<string, unknown>, opts?: CallOptions): Promise<CallToolResult>;
     /** Run an approval request, reporting progress to the client while it waits. */
     private waitForApproval;

package/dist/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,KAAK,EAAyB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAQnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAOD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAmCD,qBAAa,WAAW;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,IAAI,EAAE,kBAAkB;IASpC,uDAAuD;IACvD,YAAY,IAAI,MAAM;IAuBhB,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAuB5B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IA2G5G,gFAAgF;YAClE,eAAe;CAY9B"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAUL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,KAAK,EAAyB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAuBnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAOD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAmCD,qBAAa,WAAW;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,YAAY,CAAkC;IACtD,iDAAiD;IACjD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,cAAc,CAAuB;gBAEjC,IAAI,EAAE,kBAAkB;IASpC,uDAAuD;IACvD,YAAY,IAAI,MAAM;IAuCtB,sHAAsH;YACxG,OAAO;IAsBf,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAe5B,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAehC,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAkBpC,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAiB1D,wFAAwF;YAC1E,gBAAgB;IAkBxB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQtD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAiBtF;;;;;OAKG;YACW,cAAc;IAwDtB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IA2G5G,gFAAgF;YAClE,eAAe;CAY9B"}

package/dist/gateway.js

@@ -5,6 +5,11 @@
  * tools/list  → every upstream's tools, renamed <upstream>__<tool>
  * tools/call  → request interceptors (adtl.policy) → upstream → response
  *               interceptors (adtl.label) → agent
+ * prompts/*   → like tools: renamed <upstream>__<prompt>, results labeled
+ * resources/* → URIs pass through unchanged and are routed to the upstream
+ *               that lists them (or whose template matches). Results are
+ *               labeled. A URI more than one upstream could serve is refused,
+ *               since ADTL could not tell which server to label it as.
  *
  * When a call is stopped, the agent receives a normal tool result with
  * `isError: true` explaining why, so the model can tell the user.
@@ -19,9 +24,10 @@
  */
 import { randomUUID } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { UriTemplate } from "@modelcontextprotocol/sdk/shared/uriTemplate.js";
+import { CallToolRequestSchema, ErrorCode, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { TOOL_SEPARATOR } from "./config.js";
-export const GATEWAY_VERSION = "0.2.0";
+export const GATEWAY_VERSION = "0.3.1";
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export const GATEWAY_DECISION_KEY = "adtl/gateway";
 const stderrLogger = {
@@ -62,6 +68,10 @@ export class AdtlGateway {
     log;
     approvals;
     routes = new Map();
+    promptRoutes = new Map();
+    /** Resource URI → the upstreams that list it. */
+    resourceRoutes = new Map();
+    templateRoutes = [];
     constructor(opts) {
         this.upstreams = opts.upstreams;
         this.invoker = opts.invoker;
@@ -72,8 +82,15 @@ export class AdtlGateway {
     }
     /** The downstream MCP server the agent connects to. */
     createServer() {
+        // Offer resources and prompts only if some upstream does (the SDK refuses handlers for undeclared capabilities).
+        const offers = (c) => [...this.upstreams.values()].some((u) => u.getServerCapabilities()?.[c]);
+        const capabilities = { tools: {} };
+        if (offers("resources"))
+            capabilities.resources = {};
+        if (offers("prompts"))
+            capabilities.prompts = {};
         const server = new Server({ name: "adtl-gateway", version: GATEWAY_VERSION }, {
-            capabilities: { tools: {} },
+            capabilities,
             instructions: "Tools from several MCP servers, named <server>__<tool>. ADTL checks each call against trust labels; " +
                 "if a call is stopped, the result explains why.",
         });
@@ -85,31 +102,189 @@ export class AdtlGateway {
                 : (progress, message) => extra.sendNotification({ method: "notifications/progress", params: { progressToken, progress, message } });
             return this.callTool(req.params.name, req.params.arguments ?? {}, progress ? { progress } : {});
         });
+        if (capabilities.resources) {
+            server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await this.listResources() }));
+            server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
+                resourceTemplates: await this.listResourceTemplates(),
+            }));
+            server.setRequestHandler(ReadResourceRequestSchema, async (req) => this.readResource(req.params.uri));
+        }
+        if (capabilities.prompts) {
+            server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await this.listPrompts() }));
+            server.setRequestHandler(GetPromptRequestSchema, async (req) => this.getPrompt(req.params.name, req.params.arguments));
+        }
         return server;
     }
-    async listTools() {
-        const routes = new Map();
-        const tools = [];
+    /** Every upstream's items from one list method, following cursors. Upstreams that fail are skipped with a warning. */
+    async listAll(method, capability, page) {
+        const out = [];
         for (const [upstream, client] of this.upstreams) {
+            if (capability !== "tools" && !client.getServerCapabilities()?.[capability])
+                continue;
             let cursor;
             try {
                 do {
-                    const page = await client.listTools(cursor ? { cursor } : {});
-                    for (const t of page.tools) {
-                        const name = `${upstream}${TOOL_SEPARATOR}${t.name}`;
-                        routes.set(name, { upstream, tool: t.name, ...(t.annotations ? { annotations: t.annotations } : {}) });
-                        tools.push({ ...t, name });
-                    }
-                    cursor = page.nextCursor;
+                    const p = await page(client, cursor);
+                    for (const item of p.items)
+                        out.push({ upstream, item });
+                    cursor = p.nextCursor;
                 } while (cursor);
             }
             catch (err) {
-                this.log.warn(`tools/list failed for ${upstream}: ${err.message}`);
+                this.log.warn(`${method} failed for ${upstream}: ${err.message}`);
             }
         }
+        return out;
+    }
+    async listTools() {
+        const all = await this.listAll("tools/list", "tools", async (c, cursor) => {
+            const p = await c.listTools(cursor ? { cursor } : {});
+            return { items: p.tools, nextCursor: p.nextCursor };
+        });
+        const routes = new Map();
+        const tools = all.map(({ upstream, item: t }) => {
+            const name = `${upstream}${TOOL_SEPARATOR}${t.name}`;
+            routes.set(name, { upstream, tool: t.name, ...(t.annotations ? { annotations: t.annotations } : {}) });
+            return { ...t, name };
+        });
         this.routes = routes;
         return tools;
     }
+    async listPrompts() {
+        const all = await this.listAll("prompts/list", "prompts", async (c, cursor) => {
+            const p = await c.listPrompts(cursor ? { cursor } : {});
+            return { items: p.prompts, nextCursor: p.nextCursor };
+        });
+        const routes = new Map();
+        const prompts = all.map(({ upstream, item: p }) => {
+            const name = `${upstream}${TOOL_SEPARATOR}${p.name}`;
+            routes.set(name, { upstream, prompt: p.name });
+            return { ...p, name };
+        });
+        this.promptRoutes = routes;
+        return prompts;
+    }
+    async listResources() {
+        const all = await this.listAll("resources/list", "resources", async (c, cursor) => {
+            const p = await c.listResources(cursor ? { cursor } : {});
+            return { items: p.resources, nextCursor: p.nextCursor };
+        });
+        const routes = new Map();
+        for (const { upstream, item } of all) {
+            const ups = routes.get(item.uri) ?? new Set();
+            ups.add(upstream);
+            routes.set(item.uri, ups);
+        }
+        for (const [uri, ups] of routes) {
+            if (ups.size > 1)
+                this.log.warn(`resource ${uri} is offered by ${[...ups].join(", ")}; reading it will be refused`);
+        }
+        this.resourceRoutes = routes;
+        return all.map((a) => a.item);
+    }
+    async listResourceTemplates() {
+        const all = await this.listAll("resources/templates/list", "resources", async (c, cursor) => {
+            const p = await c.listResourceTemplates(cursor ? { cursor } : {});
+            return { items: p.resourceTemplates, nextCursor: p.nextCursor };
+        });
+        const routes = [];
+        for (const { upstream, item } of all) {
+            try {
+                routes.push({ upstream, template: new UriTemplate(item.uriTemplate) });
+            }
+            catch (err) {
+                this.log.warn(`ignoring resource template ${item.uriTemplate} from ${upstream}: ${err.message}`);
+            }
+        }
+        this.templateRoutes = routes;
+        return all.map((a) => a.item);
+    }
+    /** The one upstream that serves `uri`: an exact listing wins, then template matches. */
+    async resourceUpstream(uri) {
+        if (!this.resourceRoutes.has(uri))
+            await this.listResources();
+        let candidates = [...(this.resourceRoutes.get(uri) ?? [])];
+        if (candidates.length === 0) {
+            if (this.templateRoutes.length === 0)
+                await this.listResourceTemplates();
+            candidates = [...new Set(this.templateRoutes.filter((t) => t.template.match(uri) !== null).map((t) => t.upstream))];
+        }
+        if (candidates.length === 0)
+            throw new McpError(ErrorCode.InvalidParams, `Unknown resource: ${uri}`);
+        if (candidates.length > 1) {
+            throw new McpError(ErrorCode.InvalidParams, `Resource ${uri} could come from more than one server (${candidates.join(", ")}). ` +
+                `ADTL can't tell which server to label it as, so it was not read.`);
+        }
+        return candidates[0];
+    }
+    async readResource(uri) {
+        const upstream = await this.resourceUpstream(uri);
+        const client = this.upstreams.get(upstream);
+        return this.forwardLabeled("resources/read", upstream, { resource: uri }, { uri }, (params) => client.readResource(params));
+    }
+    async getPrompt(name, args) {
+        let route = this.promptRoutes.get(name);
+        if (!route) {
+            await this.listPrompts();
+            route = this.promptRoutes.get(name);
+        }
+        if (!route)
+            throw new McpError(ErrorCode.InvalidParams, `Unknown prompt: ${name}`);
+        const client = this.upstreams.get(route.upstream);
+        return this.forwardLabeled("prompts/get", route.upstream, { prompt: route.prompt }, { name: route.prompt, ...(args ? { arguments: args } : {}) }, (params) => client.getPrompt(params));
+    }
+    /**
+     * Forward a resources/read or prompts/get request through the interceptor
+     * chain: request interceptors → upstream → response interceptors (adtl.label).
+     * These requests have no tool result to carry an error, so a stopped request
+     * becomes a JSON-RPC error.
+     */
+    async forwardLabeled(event, upstream, target, params, send) {
+        const started = performance.now();
+        const context = {
+            sessionId: this.sessionId,
+            timestamp: new Date().toISOString(),
+            principal: { type: "anonymous" },
+        };
+        const config = { server: upstream };
+        const audit = this.invoker.modeOverride === "audit" ? { mode: "audit" } : {};
+        const finish = (entry) => this.audit?.write({
+            ts: context.timestamp,
+            sessionId: this.sessionId,
+            event,
+            server: upstream,
+            ...target,
+            ...entry,
+            durationMs: Math.round(performance.now() - started),
+        });
+        const what = "resource" in target ? `resource ${target.resource}` : `prompt ${upstream}${TOOL_SEPARATOR}${target.prompt}`;
+        const req = await this.invoker.runRequest({ event, payload: { method: event, params }, config, context });
+        if (req.blocked) {
+            finish({ outcome: "blocked", decision: req.blocked.decision, reason: req.blocked.reason, warnings: req.warnings });
+            this.log.info(`${req.blocked.decision} ${what}: ${req.blocked.reason}`);
+            throw new McpError(ErrorCode.InvalidRequest, `ADTL blocked this request: ${req.blocked.reason}`);
+        }
+        const forwarded = req.payload.params;
+        let result;
+        try {
+            result = await send(forwarded);
+        }
+        catch (err) {
+            finish({ outcome: "upstream_error", reason: err.message, ...audit, warnings: req.warnings });
+            throw err;
+        }
+        const res = await this.invoker.runResponse({ event, payload: { method: event, params: forwarded, result }, config, context });
+        const warnings = [...req.warnings, ...res.warnings];
+        if (res.blocked) {
+            // Fail closed: unlabeled content must not reach the agent.
+            finish({ outcome: "blocked", decision: res.blocked.decision, reason: res.blocked.reason, warnings });
+            this.log.warn(`${what} withheld: ${res.blocked.reason}`);
+            throw new McpError(ErrorCode.InternalError, `ADTL could not label this content, so it was withheld: ${res.blocked.reason}`);
+        }
+        const label = infoOf(res, "adtl.label");
+        finish({ outcome: "forwarded", ...audit, label: label.label, sessionLabel: label.sessionLabel, warnings });
+        return res.payload.result;
+    }
     async callTool(name, args, opts = {}) {
         const started = performance.now();
         let route = this.routes.get(name);