@agent-native/core 0.47.1 → 0.48.2

package/dist/mcp/build-server.d.ts

@@ -70,6 +70,29 @@ export interface MCPConfig {
      * a constrained / locked-down mount.
      */
     builtinCrossAppTools?: boolean;
+    /**
+     * Curated allow-list of action names served to **external connector** clients
+     * on a hosted multi-tenant deployment.
+     *
+     * When `AGENT_NATIVE_CONNECTOR_CATALOG=1` is set and this list is non-empty,
+     * the MCP server trims both the advertised tool list *and* the callable
+     * surface to exactly these names (plus any builtin cross-app tools such as
+     * `list_apps` / `open_app`). Any tool call for a name **not** in the list is
+     * rejected — it is not merely hidden. This prevents the ~105-tool full
+     * catalog from landing in every external agent's context window and removes
+     * footguns (db-exec, seed-*, extension tools, browser-session tools, etc.)
+     * from multi-tenant hosted connectors.
+     *
+     * Callers who need the full surface can opt up with
+     * `agent-native connect --full-catalog`, which embeds a `catalog_scope: "full"`
+     * claim in their connect-minted JWT. Local/dev deployments without
+     * `AGENT_NATIVE_CONNECTOR_CATALOG=1` are unaffected — they always see the
+     * full surface.
+     *
+     * Declare this in your template's `createAgentChatPlugin` options rather than
+     * setting it on `MCPConfig` directly; the plugin copies it through.
+     */
+    connectorCatalog?: string[];
 }
 /**
  * Identity extracted from a verified MCP bearer token / JWT. Used to wrap
@@ -145,33 +168,33 @@ export declare function createMCPServerForRequest(config: MCPConfig, identity: M
         [x: string]: unknown;
         _meta?: {
             [x: string]: unknown;
-            progressToken?: string | number;
+            progressToken?: string | number | undefined;
             "io.modelcontextprotocol/related-task"?: {
                 taskId: string;
-            };
-        };
-    };
+            } | undefined;
+        } | undefined;
+    } | undefined;
 }, {
     method: string;
     params?: {
         [x: string]: unknown;
         _meta?: {
             [x: string]: unknown;
-            progressToken?: string | number;
+            progressToken?: string | number | undefined;
             "io.modelcontextprotocol/related-task"?: {
                 taskId: string;
-            };
-        };
-    };
+            } | undefined;
+        } | undefined;
+    } | undefined;
 }, {
     [x: string]: unknown;
     _meta?: {
         [x: string]: unknown;
-        progressToken?: string | number;
+        progressToken?: string | number | undefined;
         "io.modelcontextprotocol/related-task"?: {
             taskId: string;
-        };
-    };
+        } | undefined;
+    } | undefined;
 }>>;
 export declare function getAccessTokens(): string[];
 export declare function getBearerToken(authHeader: string | undefined): string | undefined;
@@ -209,6 +232,14 @@ export declare function verifyAuth(authHeader: string | undefined, ownerEmailHea
      * path (no secret, no token, no owner header) is `false`.
      */
     fullSurface?: boolean;
+    /**
+     * The caller explicitly opted up to the full connector catalog by minting
+     * their token with `--full-catalog` (or equivalent). When `true`, the
+     * connector-catalog tier filter is bypassed even when
+     * `AGENT_NATIVE_CONNECTOR_CATALOG=1` is set. Derived from a
+     * `catalog_scope: "full"` claim in the verified A2A/connect JWT.
+     */
+    fullCatalog?: boolean;
 }>;
 export declare function resolveOrgIdFromDomain(orgDomain: string | undefined): Promise<string | undefined>;
 //# sourceMappingURL=build-server.d.ts.map

package/dist/mcp/build-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-server.d.ts","sourceRoot":"","sources":["../../src/mcp/build-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAsChE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAC1B,CAAC,CAAC;IACH,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;kEAGkE;AAClE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2aD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B;IACD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAyBA;AAyeD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,WAAW,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyb7B;AAOD,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAc1C;AAyCD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAIpB;AAwED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CA2HD;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}
+{"version":3,"file":"build-server.d.ts","sourceRoot":"","sources":["../../src/mcp/build-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAsChE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAC1B,CAAC,CAAC;IACH,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;kEAGkE;AAClE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAwbD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B;IACD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAyBA;AAyeD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,WAAW,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAqd7B;AAOD,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAc1C;AAyCD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAIpB;AAwED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAyID;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}

package/dist/mcp/build-server.js

@@ -118,6 +118,20 @@ function explicitlyRequestsFullMcpCatalog(requestMeta) {
     }
     return FULL_CATALOG_CLIENT_RE.test(requestMeta?.clientName ?? "");
 }
+/**
+ * Returns true when the given action name is in the template's connector
+ * catalog, OR is a builtin cross-app tool that is always included for
+ * external connector clients. Builtin tool names from
+ * `COMPACT_MCP_APP_CATALOG_BUILTINS` are always allowed since they are the
+ * stable external-agent verb set.
+ */
+function isActionInConnectorCatalog(name, config) {
+    if (COMPACT_MCP_APP_CATALOG_BUILTINS.has(name))
+        return true;
+    if (!Array.isArray(config.connectorCatalog))
+        return false;
+    return config.connectorCatalog.includes(name);
+}
 function shouldUseCompactMcpCatalogByDefault(identity, requestMeta) {
     if (explicitlyRequestsFullMcpCatalog(requestMeta))
         return false;
@@ -836,9 +850,27 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
             hasMcpOAuthScope(effectiveIdentity.oauthScopes, "mcp:apps")) ||
             (await isKnownMcpAppOAuthClient(effectiveIdentity)) ||
             shouldUseCompactMcpCatalogByDefault(effectiveIdentity, requestMeta);
-    const advertisedActions = compactMcpAppCatalog
+    const advertisedActionsBeforeConnector = compactMcpAppCatalog
         ? Object.fromEntries(Object.entries(visibleActions).filter(([name, entry]) => isActionAdvertisedInCompactMcpAppCatalog(name, entry, config)))
         : visibleActions;
+    // Connector-catalog tier: on hosted multi-tenant deployments (signalled by
+    // AGENT_NATIVE_CONNECTOR_CATALOG=1) restrict external callers to the
+    // template-declared allow-list unless the token was minted with
+    // --full-catalog (catalog_scope: "full"). This prevents the ~105-tool full
+    // catalog from bloating every external agent's context window and removes
+    // db-exec / seed-* / extension / browser-session footguns.
+    const connectorCatalogActive = process.env.AGENT_NATIVE_CONNECTOR_CATALOG === "1" &&
+        Array.isArray(config.connectorCatalog) &&
+        config.connectorCatalog.length > 0 &&
+        !explicitlyRequestsFullMcpCatalog(requestMeta);
+    // When the connector catalog is active, filter directly from visibleActions
+    // rather than advertisedActionsBeforeConnector. This ensures the connector
+    // tier is an independent, template-declared surface that doesn't accidentally
+    // narrow to just the compact-catalog builtins when shouldUseCompactMcpCatalogByDefault
+    // would have activated the compact catalog for the same caller.
+    const advertisedActions = connectorCatalogActive
+        ? Object.fromEntries(Object.entries(visibleActions).filter(([name]) => isActionInConnectorCatalog(name, config)))
+        : advertisedActionsBeforeConnector;
     const supportsMcpApps = compactMcpAppCatalog ||
         Object.values(advertisedActions).some((entry) => Boolean(entry.mcpApp?.resource));
     const server = new Server(mcpServerInfo(config, requestMeta), {
@@ -929,6 +961,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                 };
             }));
             if (!compactMcpAppCatalog &&
+                !connectorCatalogActive &&
                 config.askAgent &&
                 hasMcpOAuthScope(effectiveIdentity?.oauthScopes, "mcp:write")) {
                 tools.push({
@@ -963,7 +996,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
         return withCallerContext(async () => {
             const { name, arguments: args } = request.params;
             if (name === "ask-agent" && config.askAgent) {
-                if (compactMcpAppCatalog) {
+                if (compactMcpAppCatalog || connectorCatalogActive) {
                     return {
                         content: [{ type: "text", text: `Unknown tool: ${name}` }],
                         isError: true,
@@ -992,7 +1025,10 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     };
                 }
             }
-            const callableActions = compactMcpAppCatalog
+            // Connector-catalog tier: when active, callableActions === advertisedActions
+            // (the filtered set). Non-listed tools are not callable — mirroring how
+            // compactMcpAppCatalog gates calls on advertisedActions.
+            const callableActions = compactMcpAppCatalog || connectorCatalogActive
                 ? advertisedActions
                 : actions;
             const entry = callableActions[name];
@@ -1312,6 +1348,9 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
                     oauthClientId: oauthIdentity.clientId,
                 },
                 fullSurface: true,
+                // Per-token opt-up: `catalog_scope: "full"` in the OAuth token
+                // bypasses the connector-catalog tier filter on hosted deployments.
+                fullCatalog: oauthIdentity.catalogScope === "full",
             };
         }
     }
@@ -1354,12 +1393,23 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
             authed: true,
             identity: {
                 userEmail: typeof payload.sub === "string" ? payload.sub : undefined,
+                // Org SERVICE tokens (connect-minted, synthetic `svc-*@service.<org>`
+                // subject) carry the org id directly as an `org_id` claim so the
+                // resolved identity is org-scoped even when the org has no domain
+                // mapping. Personal/delegation JWTs don't set the claim — unchanged.
+                ...(typeof payload.org_id === "string" && payload.org_id
+                    ? { orgId: payload.org_id }
+                    : {}),
                 orgDomain: typeof payload.org_domain === "string"
                     ? payload.org_domain
                     : undefined,
             },
             // Verified JWT (connect-minted or A2A delegation) — a real caller.
             fullSurface: true,
+            // Per-token opt-up: `catalog_scope: "full"` embedded at mint time via
+            // `agent-native connect --full-catalog` bypasses the connector-catalog
+            // tier filter on hosted multi-tenant deployments.
+            fullCatalog: payload.catalog_scope === "full",
         };
     }
     if (accessTokens.length === 0 && !hasA2ASecret) {