@adtl/gateway 0.5.1 → 0.7.0

package/src/cedar.ts

@@ -0,0 +1,140 @@
+/**
+ * Attribute-based authorization with Cedar (`gateway.cedar`):
+ *
+ *   cedar:
+ *     policies: ./adtl.cedar         # Cedar policies, relative to adtl.yaml
+ *     entities: ./entities.json      # optional: Cedar entities (groups, attributes)
+ *     timeZone: Europe/Berlin        # optional: for context.time (default: the gateway's)
+ *
+ * Every call becomes a Cedar request:
+ *
+ *   principal  User::"alice", Service::"ci", or Anonymous::"anonymous" without an id
+ *   action     Action::"tools/call", Action::"resources/read" or Action::"prompts/get"
+ *   resource   Tool::"github.add_issue_comment", Prompt::"github.triage" or Resource::"<uri>"
+ *   context    { server, principalId, listing, time: { hour, minute, weekday }, arguments }
+ *
+ * Cedar denies unless a policy permits, and a `forbid` wins over any permit.
+ * Tool lists are filtered with `listing: true` and no `arguments`, so a policy
+ * on arguments should start with `context.listing ||`.
+ *
+ * Needs the optional dependency @cedar-policy/cedar-wasm, loaded only when
+ * `gateway.cedar` is set.
+ */
+import { readFileSync } from "node:fs";
+import type { AuthorizationDecision, AuthorizationRequest, Authorizer } from "./authorizer.js";
+import type { CedarConfig } from "./config.js";
+
+type CedarValue = boolean | number | string | CedarValue[] | { [key: string]: CedarValue };
+
+/** The parts of @cedar-policy/cedar-wasm used here. */
+interface CedarWasm {
+  isAuthorized(call: unknown): CedarAnswer;
+  checkParsePolicySet(policies: unknown): { type: "success" } | { type: "failure"; errors: { message: string }[] };
+  checkParseEntities(call: unknown): { type: "success" } | { type: "failure"; errors: { message: string }[] };
+}
+type CedarAnswer =
+  | { type: "failure"; errors: { message: string }[] }
+  | { type: "success"; response: { decision: "allow" | "deny"; diagnostics: { reason: string[]; errors: { policyId: string; error: { message: string } }[] } } };
+
+export class CedarAuthorizer implements Authorizer {
+  readonly name = "cedar";
+
+  private constructor(
+    private readonly cedar: CedarWasm,
+    private readonly policies: string,
+    private readonly entities: unknown[],
+    private readonly timeZone: string | undefined,
+  ) {}
+
+  /** Load the Cedar engine and the policy files. Throws on a missing package or files that don't parse. */
+  static async load(cfg: CedarConfig, resolvePath: (p: string) => string): Promise<CedarAuthorizer> {
+    let cedar: CedarWasm;
+    try {
+      cedar = (await import("@cedar-policy/cedar-wasm/nodejs")) as unknown as CedarWasm;
+    } catch {
+      throw new Error("gateway.cedar needs the Cedar engine: npm install @cedar-policy/cedar-wasm");
+    }
+    const policies = readFileSync(resolvePath(cfg.policies), "utf8");
+    const parsed = cedar.checkParsePolicySet({ staticPolicies: policies });
+    if (parsed.type === "failure") throw new Error(`gateway.cedar.policies: ${parsed.errors.map((e) => e.message).join("; ")}`);
+
+    let entities: unknown[] = [];
+    if (cfg.entities) {
+      const json: unknown = JSON.parse(readFileSync(resolvePath(cfg.entities), "utf8"));
+      if (!Array.isArray(json)) throw new Error("gateway.cedar.entities: expected a JSON array of Cedar entities");
+      const ok = cedar.checkParseEntities({ entities: json });
+      if (ok.type === "failure") throw new Error(`gateway.cedar.entities: ${ok.errors.map((e) => e.message).join("; ")}`);
+      entities = json;
+    }
+    return new CedarAuthorizer(cedar, policies, entities, cfg.timeZone);
+  }
+
+  check(req: AuthorizationRequest): AuthorizationDecision {
+    const { principal } = req;
+    const [type, id] =
+      req.event === "tools/call"
+        ? (["Tool", `${req.server}.${req.tool}`] as const)
+        : req.event === "prompts/get"
+          ? (["Prompt", `${req.server}.${req.prompt}`] as const)
+          : (["Resource", req.resource ?? ""] as const);
+    const context: Record<string, CedarValue> = {
+      server: req.server,
+      listing: req.arguments === undefined,
+      time: clock(new Date(), this.timeZone),
+      ...(principal.id !== undefined ? { principalId: principal.id } : {}),
+      ...(req.arguments !== undefined ? { arguments: toCedar(req.arguments) ?? {} } : {}),
+    };
+    const answer = this.cedar.isAuthorized({
+      principal:
+        principal.id === undefined
+          ? { type: "Anonymous", id: "anonymous" }
+          : { type: principal.type === "service" ? "Service" : "User", id: principal.id },
+      action: { type: "Action", id: req.event },
+      resource: { type, id },
+      context,
+      policies: { staticPolicies: this.policies },
+      entities: this.entities,
+    });
+    if (answer.type === "failure") throw new Error(answer.errors.map((e) => e.message).join("; "));
+    const { decision, diagnostics } = answer.response;
+    if (decision === "allow") return { allow: true };
+    const who = principal.id ?? "an anonymous caller";
+    const what = `the ${type.toLowerCase()} ${id}`;
+    return {
+      allow: false,
+      reason: diagnostics.reason.length
+        ? `Cedar policy ${diagnostics.reason.join(", ")} forbids ${who} to use ${what}`
+        : `No Cedar policy permits ${who} to use ${what}`,
+    };
+  }
+}
+
+/** Hour, minute and weekday ("Mon") in `timeZone`, for working-hours rules. */
+export function clock(now: Date, timeZone: string | undefined): Record<string, CedarValue> {
+  const parts = new Intl.DateTimeFormat("en-US", { timeZone, hourCycle: "h23", hour: "numeric", minute: "numeric", weekday: "short" }).formatToParts(now);
+  const part = (t: string) => parts.find((p) => p.type === t)?.value ?? "";
+  return { hour: Number(part("hour")), minute: Number(part("minute")), weekday: part("weekday") };
+}
+
+/**
+ * Tool arguments as Cedar context values. Cedar has no null or fractions, so
+ * nulls are left out and fractions become strings. An object with `__entity`
+ * or `__extn` would be read as an entity or extension value, so the agent
+ * could name any entity; it is passed as a JSON string instead.
+ */
+export function toCedar(v: unknown): CedarValue | undefined {
+  if (v === null || v === undefined) return undefined;
+  if (typeof v === "boolean" || typeof v === "string") return v;
+  if (typeof v === "number") return Number.isSafeInteger(v) ? v : String(v);
+  if (Array.isArray(v)) return v.map(toCedar).filter((x): x is CedarValue => x !== undefined);
+  if (typeof v === "object") {
+    if ("__entity" in v || "__extn" in v) return JSON.stringify(v);
+    const out: Record<string, CedarValue> = {};
+    for (const [k, x] of Object.entries(v)) {
+      const c = toCedar(x);
+      if (c !== undefined) out[k] = c;
+    }
+    return out;
+  }
+  return String(v);
+}

package/src/cli.ts

@@ -8,6 +8,9 @@
  *   adtl-gateway hook --config adtl.yaml [--gateway-server adtl]
  *   adtl-gateway ledger stats|verify|declassify|declassified
  *   adtl-gateway audit verify [<file>]
+ *   adtl-gateway receipt list|<session>|verify <file>
+ *   adtl-gateway key
+ *   adtl-gateway playground [--port 4317] [--no-open]
  *
  * Point your MCP client (e.g. Claude Code's .mcp.json) at this command.
  * Logs go to stderr; stdout carries MCP JSON-RPC only.
@@ -16,6 +19,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { EnvExpansionError } from "./config.js";
 import { GATEWAY_VERSION } from "./gateway.js";
 import { runAuditCommand } from "./auditCli.js";
+import { runKeyCommand, runReceiptCommand } from "./receiptCli.js";
+import { runPlayground } from "./playgroundCli.js";
 import { runHook } from "./hooks/run.js";
 import { runLedgerCommand } from "./ledgerCli.js";
 import { runInit, type InitResult } from "./init/run.js";
@@ -26,6 +31,9 @@ const USAGE = `Usage: adtl-gateway --config <adtl.yaml> [--audit]
        adtl-gateway hook --config <adtl.yaml> [--gateway-server <name>]
        adtl-gateway ledger stats|verify|declassify|declassified  (see: adtl-gateway ledger --help)
        adtl-gateway audit verify [<file>]  (see: adtl-gateway audit --help)
+       adtl-gateway receipt list|<session>|verify <file>  (see: adtl-gateway receipt --help)
+       adtl-gateway key
+       adtl-gateway playground [--port <n>] [--no-open]  (a local web UI with fake servers)
 
 Runs an MCP server over stdio that forwards tool calls to the upstream
 servers in the config, checking and labeling each call with ADTL.
@@ -104,6 +112,13 @@ async function main(): Promise<void> {
     process.exitCode = r.exitCode;
     return;
   }
+  if (process.argv[2] === "playground") return runPlayground(process.argv.slice(3));
+  if (process.argv[2] === "receipt" || process.argv[2] === "key") {
+    const r = process.argv[2] === "key" ? await runKeyCommand() : await runReceiptCommand(process.argv.slice(3));
+    console.log(r.stdout);
+    process.exitCode = r.exitCode;
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   // --help and --version print to stdout and exit; MCP is never served in these modes.
   if (args.help) return void console.log(USAGE);
@@ -190,7 +205,7 @@ async function init(path: string, write: boolean, from?: string): Promise<void>
 }
 
 main().catch((err: unknown) => {
-  const known = err instanceof GatewayConfigError || err instanceof EnvExpansionError || ["ledger", "audit"].includes(process.argv[2] ?? "");
+  const known = err instanceof GatewayConfigError || err instanceof EnvExpansionError || ["ledger", "audit", "receipt", "key", "playground"].includes(process.argv[2] ?? "");
   console.error(known ? `[adtl-gateway] ${(err as Error).message}` : err);
   // For Claude Code hooks only exit code 2 stops the call; any other code lets it run.
   process.exit(process.argv[2] === "hook" ? 2 : 1);

package/src/config.ts

@@ -12,15 +12,22 @@
  *       docs:
  *         url: https://example.com/mcp
  *         headers: { Authorization: "Bearer ${DOCS_TOKEN}" }
+ *     principal: { id: "${USER}" }       # optional: who runs this gateway (default: anonymous)
+ *     roles:                             # optional: who may use which tools (deny by default)
+ *       maintainers: { members: [alice], tools: ["github.*"] }
+ *       readers:     { members: ["*"],   tools: ["github.read_*", "github.get_*"] }
+ *     cedar: { policies: ./adtl.cedar }  # optional: attribute-based rules (see cedar.ts)
  *     approvals:                         # optional: make "ask" really ask
  *       timeoutSeconds: 50
  *       ntfy: { topic: "${ADTL_NTFY_TOPIC}" }
+ *       approvers:                       # optional: each approver's own channel (policy rule `approvers:`)
+ *         alice: { ntfy: { topic: "${ALICE_NTFY_TOPIC}" } }
  *       email:
  *         smtp: { host: smtp.example.com, port: 465, user: "${SMTP_USER}", pass: "${SMTP_PASS}" }
  *         from: adtl@example.com
  *         to: you@example.com
  *
- * `${VAR}` in command, args, env, cwd, url, headers and approval settings is
+ * `${VAR}` in command, args, env, cwd, url, headers, approval settings and principal.id is
  * replaced from the gateway's environment. A missing variable is a config error,
  * unless a default is given: `${VAR:-default}`.
  */
@@ -88,10 +95,73 @@ export const ApprovalsConfigSchema = z
     timeoutSeconds: z.number().int().positive().max(3600).default(50),
     ntfy: NtfyConfigSchema.optional(),
     email: EmailConfigSchema.optional(),
+    /**
+     * Also ask in the MCP client (elicitation), when it supports it. Off by
+     * default: a client that accepts elicitations by itself would approve calls.
+     */
+    elicitation: z.boolean().default(false),
+    /**
+     * Each approver's own channel, by principal id. Policy rules with
+     * `approvers: [role]` ask only these people, so the answer names who approved.
+     */
+    approvers: z.record(z.object({ ntfy: NtfyConfigSchema }).strict()).optional(),
   })
   .strict();
 export type ApprovalsConfig = z.infer<typeof ApprovalsConfigSchema>;
 
+/** `server.tool` (or `server.prompt`), with `*` wildcards, as in policy rules. */
+const QualifiedPattern = z
+  .string()
+  .min(1)
+  .refine((p) => /^[^.]+\..+$/.test(p), { message: 'Use "server.name" with optional * wildcards, e.g. "github.read_*" or "github.*"' });
+
+export const PrincipalConfigSchema = z
+  .object({
+    type: z.enum(["user", "service"]).default("user"),
+    id: z.string().min(1),
+    claims: z.record(z.unknown()).optional(),
+  })
+  .strict();
+export type PrincipalConfig = z.infer<typeof PrincipalConfigSchema>;
+
+export const RoleSchema = z
+  .object({
+    /** Principal ids; "*" means everyone, including an anonymous caller. */
+    members: z.array(z.string().min(1)).nonempty("A role needs at least one member (\"*\" for everyone)"),
+    tools: z.array(QualifiedPattern).default([]),
+    prompts: z.array(QualifiedPattern).default([]),
+    /** Resource URI patterns, e.g. "github://acme/*". */
+    resources: z.array(z.string().min(1)).default([]),
+  })
+  .strict()
+  .refine((r) => r.tools.length + r.prompts.length + r.resources.length > 0, {
+    message: "A role must grant at least one of tools, prompts or resources",
+  });
+export type RoleConfig = z.infer<typeof RoleSchema>;
+
+export const CedarConfigSchema = z
+  .object({
+    /** Cedar policy file. Relative paths are resolved against the config file's directory. */
+    policies: z.string().min(1),
+    /** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
+    entities: z.string().min(1).optional(),
+    /** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
+    timeZone: z
+      .string()
+      .min(1)
+      .refine((tz) => {
+        try {
+          new Intl.DateTimeFormat("en-US", { timeZone: tz });
+          return true;
+        } catch {
+          return false;
+        }
+      }, "Unknown time zone")
+      .optional(),
+  })
+  .strict();
+export type CedarConfig = z.infer<typeof CedarConfigSchema>;
+
 export const GatewayConfigSchema = z
   .object({
     upstreams: z
@@ -113,6 +183,15 @@ export const GatewayConfigSchema = z
     approvals: ApprovalsConfigSchema.optional(),
     /** Timeout for each interceptor invocation, in milliseconds. */
     interceptorTimeoutMs: z.number().int().positive().default(5000),
+    /** Who runs this gateway. Passed to the authorizer and the interceptors. Default: anonymous. */
+    principal: PrincipalConfigSchema.optional(),
+    /** Role-based authorization: when present, a call no role grants is denied. */
+    roles: z
+      .record(RoleSchema)
+      .refine((r) => Object.keys(r).length > 0, "roles: needs at least one role (remove it to allow everyone)")
+      .optional(),
+    /** Cedar authorization. With roles as well, both must allow. */
+    cedar: CedarConfigSchema.optional(),
   })
   .strict();
 export type GatewayConfig = z.infer<typeof GatewayConfigSchema>;

package/src/elicitation.ts

@@ -0,0 +1,69 @@
+/**
+ * Approvals inside the MCP client, through `elicitation/create`: the person
+ * using the client (for example Claude Code) sees the request and answers
+ * Allow or Deny there, no phone needed.
+ *
+ * The answer is turned into the same signed token a push button would send,
+ * so it answers only the one pending call it was asked about. Declining or
+ * dismissing the prompt counts as Deny. The gateway uses this channel only
+ * when `gateway.approvals.elicitation` is on and the client declares the
+ * elicitation capability, and never for rules with named approvers: the
+ * client can't say who answered.
+ */
+import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { ElicitResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import type { AnswerFn, ApprovalEvent, ApprovalRequest, Notifier } from "./approvals.js";
+
+interface Listening {
+  answer: AnswerFn;
+  signal: AbortSignal;
+}
+
+/** True if the connected client can answer elicitation requests. */
+export function supportsElicitation(server: Server): boolean {
+  return server.getClientCapabilities()?.elicitation !== undefined;
+}
+
+function message(request: ApprovalRequest): string {
+  const rule = request.matched.join(", ") || "default";
+  return `ADTL: allow ${request.server}.${request.tool}?\n\n${request.reason}\n\nRule: ${rule}. Allow runs this one call; Deny or no answer stops it.`;
+}
+
+export class ElicitationChannel implements Notifier {
+  readonly name = "elicitation";
+  private readonly listening = new Map<string, Listening>();
+
+  constructor(private readonly server: Server) {}
+
+  async listen(request: ApprovalRequest, answer: AnswerFn, signal: AbortSignal): Promise<void> {
+    this.listening.set(request.id, { answer, signal });
+    await new Promise<void>((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
+    this.listening.delete(request.id);
+  }
+
+  async notify(event: ApprovalEvent): Promise<void> {
+    if (event.kind !== "pending") return; // the client sees the call's result; no other notices
+    const l = this.listening.get(event.request.id);
+    if (!l) throw new Error("not listening for this request");
+    // A plain request, not Server.elicitInput(): clients that declare only `elicitation: {}` support forms too.
+    const result = await this.server.request(
+      {
+        method: "elicitation/create",
+        params: {
+          message: message(event.request),
+          requestedSchema: {
+            type: "object",
+            properties: {
+              decision: { type: "string", title: "Decision", enum: ["allow", "deny"], description: "allow runs this one call; deny stops it" },
+            },
+            required: ["decision"],
+          },
+        },
+      },
+      ElicitResultSchema,
+      { signal: l.signal, timeout: Math.max(1, event.request.expiresAt.getTime() - Date.now()) },
+    );
+    const allow = result.action === "accept" && result.content?.decision === "allow";
+    l.answer(allow ? event.tokens.allow : event.tokens.deny);
+  }
+}

package/src/gateway.ts

@@ -21,8 +21,10 @@
  * unanswered or undeliverable calls are stopped. Without an approval channel,
  * "ask" blocks.
  *
- * An optional Authorizer decides first whether the caller may use the tool,
- * resource or prompt at all; a denial stops the call before the policy runs.
+ * Optional Authorizers decide first whether the caller may use the tool,
+ * resource or prompt at all; any denial stops the call before the policy runs.
+ * The lists the agent sees leave out what an authorizer would deny, so the
+ * agent doesn't try it; hiding is a convenience, and every call is still checked.
  *
  * In audit mode (the invoker runs every interceptor with `mode: "audit"`)
  * nothing is stopped or changed: calls the policy would stop are forwarded,
@@ -54,12 +56,13 @@ import {
 import type { InvocationContext } from "@adtl/interceptors";
 import { callBindingHash } from "@adtl/labels";
 import type { ApprovalBroker, ApprovalResult } from "./approvals.js";
+import { ElicitationChannel, supportsElicitation } from "./elicitation.js";
 import type { AuditEntry, AuditSink } from "./audit.js";
 import { authorize, type AuthorizationRequest, type Authorizer, type Denial, type Principal } from "./authorizer.js";
 import { TOOL_SEPARATOR } from "./config.js";
-import type { Blocked, PhaseOutcome, InterceptorInvoker } from "./invoker.js";
+import type { Blocked, InterceptorInvoker, InterceptorRun, PhaseOutcome } from "./invoker.js";
 
-export const GATEWAY_VERSION = "0.5.1";
+export const GATEWAY_VERSION = "0.7.0";
 
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export const GATEWAY_DECISION_KEY = "adtl/gateway";
@@ -104,10 +107,24 @@ export interface AdtlGatewayOptions {
   logger?: GatewayLogger;
   /** Asks humans about "ask" decisions and sends notices. */
   approvals?: ApprovalBroker;
-  /** Decides whether the caller may use a tool, resource or prompt at all, before the policy. */
-  authorizer?: Authorizer;
+  /** Decides whether the caller may use a tool, resource or prompt at all, before the policy. Several must all allow. */
+  authorizer?: Authorizer | Authorizer[];
   /** The caller, passed to the authorizer and the interceptors. Default: anonymous. */
   principal?: Principal;
+  /** Members of each role that policy rules name as `approvers:`. */
+  approverRoles?: Map<string, string[]>;
+  /** Also ask for approval in the MCP client, when it supports elicitation. */
+  elicitApprovals?: boolean;
+}
+
+/**
+ * Who may answer an "ask" whose rules name approver roles: someone in one of
+ * the roles of every list. Sorted, for stable notifications and tests.
+ */
+export function eligibleApprovers(lists: string[][], roles: Map<string, string[]>): string[] {
+  const sets = lists.map((list) => new Set(list.flatMap((role) => roles.get(role) ?? [])));
+  const [first, ...rest] = sets;
+  return [...(first ?? [])].filter((id) => id !== "*" && rest.every((s) => s.has(id))).sort();
 }
 
 export interface CallOptions {
@@ -155,8 +172,12 @@ export class AdtlGateway {
   private readonly audit: AuditSink | undefined;
   private readonly log: GatewayLogger;
   private readonly approvals: ApprovalBroker | undefined;
-  private readonly authorizer: Authorizer | undefined;
+  private readonly authorizers: Authorizer[];
   private readonly principal: Principal;
+  private readonly approverRoles: Map<string, string[]>;
+  private readonly elicitApprovals: boolean;
+  /** The server the agent is connected to, for elicitation. */
+  private server: Server | undefined;
   private routes = new Map<string, Route>();
   private promptRoutes = new Map<string, PromptRoute>();
   /** Resource URI → the upstreams that list it. */
@@ -170,13 +191,19 @@ export class AdtlGateway {
     this.audit = opts.audit;
     this.log = opts.logger ?? stderrLogger;
     this.approvals = opts.approvals;
-    this.authorizer = opts.authorizer;
+    this.authorizers = opts.authorizer === undefined ? [] : [opts.authorizer].flat();
     this.principal = opts.principal ?? { type: "anonymous" };
+    this.approverRoles = opts.approverRoles ?? new Map();
+    this.elicitApprovals = opts.elicitApprovals === true;
   }
 
-  /** Ask the authorizer, if any. Returns the denial; in audit mode the caller logs it and carries on. */
+  /** Ask each authorizer in turn. Returns the first denial; in audit mode the caller logs it and carries on. */
   private async authorize(request: Omit<AuthorizationRequest, "principal">): Promise<Denial | undefined> {
-    return this.authorizer ? authorize(this.authorizer, { principal: this.principal, ...request }) : undefined;
+    for (const a of this.authorizers) {
+      const denied = await authorize(a, { principal: this.principal, ...request });
+      if (denied) return denied;
+    }
+    return undefined;
   }
 
   /** The downstream MCP server the agent connects to. */
@@ -195,7 +222,7 @@ export class AdtlGateway {
           "if a call is stopped, the result explains why.",
       },
     );
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: await this.listTools() }));
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: await this.visibleTools() }));
     server.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
       const progressToken = req.params._meta?.progressToken;
       const progress =
@@ -206,16 +233,17 @@ export class AdtlGateway {
       return this.callTool(req.params.name, req.params.arguments ?? {}, progress ? { progress } : {});
     });
     if (capabilities.resources) {
-      server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await this.listResources() }));
+      server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await this.visibleResources() }));
       server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
         resourceTemplates: await this.listResourceTemplates(),
       }));
       server.setRequestHandler(ReadResourceRequestSchema, async (req) => this.readResource(req.params.uri));
     }
     if (capabilities.prompts) {
-      server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await this.listPrompts() }));
+      server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await this.visiblePrompts() }));
       server.setRequestHandler(GetPromptRequestSchema, async (req) => this.getPrompt(req.params.name, req.params.arguments));
     }
+    this.server = server;
     return server;
   }
 
@@ -242,6 +270,49 @@ export class AdtlGateway {
     return out;
   }
 
+  /** tools/list as the caller sees it: without the tools the authorizer would deny. */
+  async visibleTools(): Promise<Tool[]> {
+    const tools = await this.listTools();
+    return this.hideDenied(tools, (t) => {
+      const r = this.routes.get(t.name)!;
+      return { event: "tools/call", server: r.upstream, tool: r.tool };
+    });
+  }
+
+  /** prompts/list as the caller sees it. */
+  async visiblePrompts(): Promise<Prompt[]> {
+    const prompts = await this.listPrompts();
+    return this.hideDenied(prompts, (p) => {
+      const r = this.promptRoutes.get(p.name)!;
+      return { event: "prompts/get", server: r.upstream, prompt: r.prompt };
+    });
+  }
+
+  /** resources/list as the caller sees it. A URI several upstreams offer is listed as before (reading it is refused). */
+  async visibleResources(): Promise<Resource[]> {
+    const resources = await this.listResources();
+    return this.hideDenied(resources, (r) => {
+      const ups = this.resourceRoutes.get(r.uri);
+      return ups?.size === 1 ? { event: "resources/read", server: [...ups][0]!, resource: r.uri } : undefined;
+    });
+  }
+
+  /**
+   * Leave out items the authorizer would deny, asked without arguments. Not in
+   * audit mode, which changes nothing. Hiding only saves the agent a denied
+   * call: routes are kept, and a call to a hidden item is still authorized.
+   */
+  private async hideDenied<T>(items: T[], request: (item: T) => Omit<AuthorizationRequest, "principal"> | undefined): Promise<T[]> {
+    if (!this.authorizers.length || this.invoker.modeOverride === "audit") return items;
+    const shown = await Promise.all(
+      items.map(async (item) => {
+        const r = request(item);
+        return r === undefined || (await this.authorize(r)) === undefined;
+      }),
+    );
+    return items.filter((_, i) => shown[i]);
+  }
+
   async listTools(): Promise<Tool[]> {
     const all = await this.listAll("tools/list", "tools", async (c, cursor) => {
       const p = await c.listTools(cursor ? { cursor } : {});
@@ -374,6 +445,7 @@ export class AdtlGateway {
     const config = { server: upstream };
     const audit = this.invoker.modeOverride === "audit" ? { mode: "audit" as const } : {};
     let denied: Denial | undefined;
+    const ran: InterceptorRun[] = [];
     const finish = (entry: Pick<AuditEntry, "outcome"> & Partial<AuditEntry>) =>
       this.audit?.write({
         ts: context.timestamp!,
@@ -383,6 +455,7 @@ export class AdtlGateway {
         ...target,
         ...(denied ? { denied } : {}),
         ...entry,
+        ...(ran.length ? { interceptors: [...ran] } : {}),
         durationMs: Math.round(performance.now() - started),
       });
     const what = "resource" in target ? `resource ${target.resource}` : `prompt ${upstream}${TOOL_SEPARATOR}${target.prompt}`;
@@ -401,6 +474,7 @@ export class AdtlGateway {
     if (denied) this.log.info(`audit: would deny ${what}: ${denied.reason}`);
 
     const req = await this.invoker.runRequest({ event, payload: { method: event, params }, config, context });
+    ran.push(...req.ran);
     if (req.blocked) {
       finish({ outcome: "blocked", decision: req.blocked.decision, reason: req.blocked.reason, warnings: req.warnings });
       this.log.info(`${req.blocked.decision} ${what}: ${req.blocked.reason}`);
@@ -417,6 +491,7 @@ export class AdtlGateway {
     }
 
     const res = await this.invoker.runResponse({ event, payload: { method: event, params: forwarded, result }, config, context });
+    ran.push(...res.ran);
     const warnings = [...req.warnings, ...res.warnings];
     if (res.blocked) {
       // Fail closed: unlabeled content must not reach the agent.
@@ -452,8 +527,16 @@ export class AdtlGateway {
     };
     const base = { sessionId: this.sessionId, event: "tools/call" as const, server: route.upstream, tool: route.tool };
     let denied: Denial | undefined;
+    const ran: InterceptorRun[] = [];
     const finish = (entry: Omit<AuditEntry, keyof typeof base | "ts" | "durationMs">) =>
-      this.audit?.write({ ts: context.timestamp!, ...base, ...(denied ? { denied } : {}), ...entry, durationMs: Math.round(performance.now() - started) });
+      this.audit?.write({
+        ts: context.timestamp!,
+        ...base,
+        ...(denied ? { denied } : {}),
+        ...entry,
+        ...(ran.length ? { interceptors: [...ran] } : {}),
+        durationMs: Math.round(performance.now() - started),
+      });
 
     // 0. Authorization: may this caller use this tool at all? A denial wins over any policy decision.
     denied = await this.authorize({ event: "tools/call", server: route.upstream, tool: route.tool, arguments: args });
@@ -472,6 +555,7 @@ export class AdtlGateway {
     // 1. Request phase: adtl.policy decides whether the call may run.
     const requestPayload = { method: "tools/call", params: { name: route.tool, arguments: args } };
     let req = await this.invoker.runRequest({ event: "tools/call", payload: requestPayload, config, context });
+    ran.push(...req.ran);
     const policy = infoOf(req, "adtl.policy");
     let approval: ApprovalResult | undefined;
     if (req.blocked) {
@@ -481,8 +565,12 @@ export class AdtlGateway {
       const stopped = { decision: b.decision, reason: b.reason, matched: policy.matched, callHash: policy.callHash, sessionLabel: policy.sessionLabel };
       const matched = Array.isArray(policy.matched) ? (policy.matched as string[]) : [];
       const hash = b.confirmation?.callHash ?? policy.callHash;
-      if (b.decision === "ask" && this.approvals?.canApprove && typeof hash === "string") {
-        this.log.info(`ask ${name}: waiting for approval (${b.reason})`);
+      const lists = Array.isArray(policy.approvers) ? (policy.approvers as string[][]) : undefined;
+      const approvers = lists ? eligibleApprovers(lists, this.approverRoles) : undefined;
+      // The client's own prompt, if enabled and supported; never for named approvers (it can't say who answered).
+      const elicit = this.elicitApprovals && !approvers && this.server && supportsElicitation(this.server) ? [new ElicitationChannel(this.server)] : [];
+      if (b.decision === "ask" && this.approvals && (this.approvals.canApprove || elicit.length > 0) && typeof hash === "string") {
+        this.log.info(`ask ${name}: waiting for approval${approvers ? ` from ${approvers.join(", ") || "nobody"}` : ""} (${b.reason})`);
         approval = await this.waitForApproval(opts, () =>
           this.approvals!.request({
             sessionId: this.sessionId,
@@ -492,7 +580,8 @@ export class AdtlGateway {
             reason: b.reason,
             matched,
             ...(policy.sessionLabel !== undefined ? { sessionLabel: policy.sessionLabel } : {}),
-          }),
+            ...(approvers ? { approvers } : {}),
+          }, elicit),
         );
         this.log.info(`ask ${name}: ${approval.outcome}`);
         if (approval.outcome !== "approved") {
@@ -511,6 +600,7 @@ export class AdtlGateway {
             ...(approval.approver ? { principal: { type: "user" as const, id: approval.approver } } : {}),
           }];
           req = await this.invoker.runRequest({ event: "tools/call", payload: requestPayload, config, context: { ...context, confirmations } });
+          ran.push(...req.ran);
           const sent = callBindingHash({ event: "tools/call", phase: "request", target: route.upstream, payload: req.payload });
           const recheck = req.blocked?.reason ?? (sent !== c.callHash ? "the call changed after it was approved" : undefined);
           if (recheck !== undefined) {
@@ -554,6 +644,7 @@ export class AdtlGateway {
       config,
       context,
     });
+    ran.push(...res.ran);
     if (res.blocked) {
       // Fail closed: an unlabeled result must not reach the agent.
       finish({ outcome: "blocked", decision: res.blocked.decision, reason: res.blocked.reason, callHash: policy.callHash, warnings: [...req.warnings, ...res.warnings] });