@agentvalet/mcp-server 0.1.0

package/dist/index.js

@@ -0,0 +1,444 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { SignJWT, importPKCS8 } from "jose";
+import { readFileSync } from "fs";
+// ---------------------------------------------------------------------------
+// Startup env validation
+// ---------------------------------------------------------------------------
+// Resolve AGENT_PRIVATE_KEY: accept raw key content or a path via AGENT_PRIVATE_KEY_PATH
+if (!process.env.AGENT_PRIVATE_KEY && process.env.AGENT_PRIVATE_KEY_PATH) {
+    try {
+        process.env.AGENT_PRIVATE_KEY = readFileSync(process.env.AGENT_PRIVATE_KEY_PATH, "utf-8").trim();
+    }
+    catch (err) {
+        process.stderr.write(`[mcp-server] Cannot read AGENT_PRIVATE_KEY_PATH: ${err instanceof Error ? err.message : err}\n`);
+        process.exit(1);
+    }
+}
+const REQUIRED_ENV = ["AGENT_PRIVATE_KEY", "AGENT_ID", "OWNER_ID", "PROXY_URL"];
+for (const key of REQUIRED_ENV) {
+    if (!process.env[key]) {
+        process.stderr.write(`[mcp-server] Missing required environment variable: ${key} (or AGENT_PRIVATE_KEY_PATH)\n`);
+        process.exit(1);
+    }
+}
+const AGENT_PRIVATE_KEY_RAW = process.env.AGENT_PRIVATE_KEY;
+const AGENT_ID = process.env.AGENT_ID;
+const OWNER_ID = process.env.OWNER_ID;
+const PROXY_URL = process.env.PROXY_URL.replace(/\/$/, "");
+// If the key is the sentinel value, defer key import — the guard in each tool
+// handler will return a user-friendly error before any signing attempt.
+let privateKey = null;
+if (AGENT_PRIVATE_KEY_RAW !== "PENDING_FIRST_CALL") {
+    const rawKey = AGENT_PRIVATE_KEY_RAW.trim();
+    const AGENT_PRIVATE_KEY = rawKey.startsWith("-----")
+        ? rawKey.replace(/\\n/g, "\n")
+        : `-----BEGIN PRIVATE KEY-----\n${rawKey}\n-----END PRIVATE KEY-----`;
+    try {
+        privateKey = await importPKCS8(AGENT_PRIVATE_KEY, "RS256");
+    }
+    catch (err) {
+        process.stderr.write(`[mcp-server] Invalid AGENT_PRIVATE_KEY: ${err instanceof Error ? err.message : err}\n`);
+        process.exit(1);
+    }
+}
+// ---------------------------------------------------------------------------
+// JWT signing
+// ---------------------------------------------------------------------------
+async function signJWT() {
+    if (!privateKey)
+        throw new Error("Private key not loaded");
+    return new SignJWT({ agent_id: AGENT_ID, owner_id: OWNER_ID })
+        .setProtectedHeader({ alg: "RS256" })
+        .setIssuedAt()
+        .setExpirationTime("60s")
+        .sign(privateKey);
+}
+async function notifyBindSecret() {
+    try {
+        await fetchWithTimeout(`${PROXY_URL}/v1/bind-secret`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ agent_id: AGENT_ID, owner_id: OWNER_ID }),
+        }, 8_000);
+    }
+    catch {
+        // best-effort — don't block the error response
+    }
+}
+function pendingFirstCallResponse() {
+    return {
+        content: [{
+                type: "text",
+                text: JSON.stringify({
+                    error: "Agent not yet activated — owner confirmation pending. Retry in 60 seconds.",
+                }),
+            }],
+        isError: true,
+    };
+}
+// ---------------------------------------------------------------------------
+// Tool definitions
+// ---------------------------------------------------------------------------
+const ALLOWED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+const LIST_PLATFORMS_TOOL = {
+    name: "list_platforms",
+    description: "list_platforms: List the platforms and permission scopes this agent has access to.\nInput: None.\nReturns: platforms array with platformId, platformName, scopes, requireApproval.\nAuth: Bearer JWT.",
+    inputSchema: { type: "object", properties: {} },
+};
+const USE_PLATFORM_TOOL = {
+    name: "use_platform",
+    description: "use_platform: Call an external platform API (Airtable, GitHub, Slack, etc.) through the AgentValet proxy.\nInput: platform (string), endpoint (string), method (GET|POST|PUT|PATCH|DELETE), scope (string), data (object, optional).\nReturns: upstream API response body.\nAuth: Bearer JWT.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            platform: {
+                type: "string",
+                description: "Platform ID (e.g. airtable, github, slack)",
+            },
+            endpoint: {
+                type: "string",
+                description: "API path on the target platform (e.g. /v0/meta/bases)",
+            },
+            method: {
+                type: "string",
+                enum: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+                description: "HTTP method to use",
+            },
+            scope: {
+                type: "string",
+                description: "Permission scope required for this action (e.g. records:read)",
+            },
+            data: {
+                type: "object",
+                description: "Optional request body for POST/PUT/PATCH requests",
+            },
+        },
+        required: ["platform", "endpoint", "method", "scope"],
+    },
+};
+const AGENT_REGISTER_TOOL = {
+    name: "agent_register",
+    description: "agent_register: Self-register this agent with an owner. No auth required.\nInput: owner_id (string), agent_name (string), requested_scopes (array of {platformId, scopes}).\nReturns: registration_token, poll_url, client_id, scope, expires_in.\nAuth: None.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            owner_id: {
+                type: "string",
+                description: "The owner ID to register this agent under",
+            },
+            agent_name: {
+                type: "string",
+                description: "Human-readable name for this agent",
+            },
+            requested_scopes: {
+                type: "array",
+                description: "Array of platform scope requests",
+                items: {
+                    type: "object",
+                    properties: {
+                        platformId: { type: "string" },
+                        scopes: { type: "array", items: { type: "string" } },
+                    },
+                    required: ["platformId", "scopes"],
+                },
+            },
+        },
+        required: ["owner_id", "agent_name", "requested_scopes"],
+    },
+};
+const AGENT_STATUS_TOOL = {
+    name: "agent_status",
+    description: "agent_status: Poll registration status using the token from agent_register.\nInput: token (string, required).\nReturns: status (\"pending_approval\"|\"approved\"|\"rejected\"), agent_id (if approved), mcp_config (if approved).\nAuth: None.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            token: {
+                type: "string",
+                description: "Registration token returned by agent_register",
+            },
+        },
+        required: ["token"],
+    },
+};
+const AGENT_PERMISSIONS_TOOL = {
+    name: "agent_permissions",
+    description: "agent_permissions: List all platforms and permission scopes granted to this agent.\nInput: None.\nReturns: platforms array with platformId, platformName, scopes, requireApproval.\nAuth: Bearer JWT.",
+    inputSchema: { type: "object", properties: {} },
+};
+const AUTHZEN_EVALUATE_TOOL = {
+    name: "authzen_evaluate",
+    description: "authzen_evaluate: Evaluate whether this agent has access to a specific platform scope.\nInput: platform_id (string), scope (string).\nReturns: decision (boolean), reason (\"approved\"|\"denied\"|\"revoked\"|\"scope_not_granted\").\nAuth: None.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            platform_id: {
+                type: "string",
+                description: "The platform identifier (e.g. airtable, github)",
+            },
+            scope: {
+                type: "string",
+                description: "The permission scope to evaluate (e.g. records:read)",
+            },
+        },
+        required: ["platform_id", "scope"],
+    },
+};
+const INTENT_RESOLVE_TOOL = {
+    name: "intent_resolve",
+    description: "intent_resolve: Resolve a natural-language intent to the exact AgentValet API action to call.\nInput: intent (string, required), context (object, optional).\nReturns: resolved (boolean), capability object with endpoint, auth_required, example_request, or suggestions array.\nAuth: None.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            intent: {
+                type: "string",
+                description: "Natural-language description of what the agent wants to do",
+            },
+            context: {
+                type: "object",
+                description: "Optional context object to aid resolution",
+            },
+        },
+        required: ["intent"],
+    },
+};
+// ---------------------------------------------------------------------------
+// MCP server setup
+// ---------------------------------------------------------------------------
+const server = new Server({ name: "agentvalet", version: "1.0.0" }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [
+        LIST_PLATFORMS_TOOL,
+        USE_PLATFORM_TOOL,
+        AGENT_REGISTER_TOOL,
+        AGENT_STATUS_TOOL,
+        AGENT_PERMISSIONS_TOOL,
+        AUTHZEN_EVALUATE_TOOL,
+        INTENT_RESOLVE_TOOL,
+    ],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    if (name === "list_platforms") {
+        return await handleListPlatforms();
+    }
+    if (name === "use_platform") {
+        if (!args ||
+            typeof args.platform !== "string" ||
+            typeof args.endpoint !== "string" ||
+            typeof args.method !== "string" ||
+            typeof args.scope !== "string") {
+            return {
+                content: [{ type: "text", text: "Invalid or missing tool arguments" }],
+                isError: true,
+            };
+        }
+        if (!ALLOWED_METHODS.includes(args.method)) {
+            return {
+                content: [{ type: "text", text: `Invalid method: ${args.method}` }],
+                isError: true,
+            };
+        }
+        return await handleUsePlatform({
+            platform: args.platform,
+            endpoint: args.endpoint,
+            method: args.method,
+            scope: args.scope,
+            data: args.data,
+        });
+    }
+    if (name === "agent_register") {
+        if (!args || typeof args.owner_id !== "string" || typeof args.agent_name !== "string" || !Array.isArray(args.requested_scopes)) {
+            return errorContent("Invalid or missing arguments: owner_id, agent_name, requested_scopes are required");
+        }
+        return await handleAgentRegister(args);
+    }
+    if (name === "agent_status") {
+        if (!args || typeof args.token !== "string") {
+            return errorContent("Invalid or missing argument: token is required");
+        }
+        return await handleAgentStatus(args.token);
+    }
+    if (name === "agent_permissions") {
+        return await handleAgentPermissions();
+    }
+    if (name === "authzen_evaluate") {
+        if (!args || typeof args.platform_id !== "string" || typeof args.scope !== "string") {
+            return errorContent("Invalid or missing arguments: platform_id and scope are required");
+        }
+        return await handleAuthzenEvaluate(args.platform_id, args.scope);
+    }
+    if (name === "intent_resolve") {
+        if (!args || typeof args.intent !== "string") {
+            return errorContent("Invalid or missing argument: intent is required");
+        }
+        return await handleIntentResolve(args.intent, args.context);
+    }
+    return {
+        content: [{ type: "text", text: `Unknown tool: ${name}` }],
+        isError: true,
+    };
+});
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function fetchWithTimeout(url, init, timeoutMs = 15_000) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    return fetch(url, { ...init, signal: ac.signal }).finally(() => clearTimeout(timer));
+}
+async function bearerFetch(url, init) {
+    const token = await signJWT();
+    return fetchWithTimeout(url, {
+        ...init,
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...init.headers },
+    });
+}
+function errorContent(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+// ---------------------------------------------------------------------------
+// Tool handlers
+// ---------------------------------------------------------------------------
+async function handleListPlatforms() {
+    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
+        await notifyBindSecret();
+        return pendingFirstCallResponse();
+    }
+    let response;
+    try {
+        response = await bearerFetch(`${PROXY_URL}/v1/agent/permissions`, { method: "GET", headers: {} });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+async function handleUsePlatform(params) {
+    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
+        await notifyBindSecret();
+        return pendingFirstCallResponse();
+    }
+    const requestBody = {
+        platform: params.platform,
+        endpoint: params.endpoint,
+        method: params.method,
+        scope: params.scope,
+        ...(params.data !== undefined && { data: params.data }),
+    };
+    let response;
+    try {
+        response = await bearerFetch(`${PROXY_URL}/v1/actions`, {
+            method: "POST",
+            body: JSON.stringify(requestBody),
+        });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+async function handleAgentRegister(args) {
+    let response;
+    try {
+        response = await fetchWithTimeout(`${PROXY_URL}/v1/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(args),
+        });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+async function handleAgentStatus(token) {
+    let response;
+    try {
+        response = await fetchWithTimeout(`${PROXY_URL}/v1/register/status/${encodeURIComponent(token)}`, {
+            method: "GET",
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+async function handleAgentPermissions() {
+    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
+        await notifyBindSecret();
+        return pendingFirstCallResponse();
+    }
+    let response;
+    try {
+        response = await bearerFetch(`${PROXY_URL}/v1/agent/permissions`, { method: "GET", headers: {} });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+async function handleAuthzenEvaluate(platformId, scope) {
+    const authzenBody = {
+        subject: { type: "agent", id: AGENT_ID },
+        action: { name: "tool_call" },
+        resource: { type: "platform_scope", id: `${platformId}:${scope}` },
+    };
+    let response;
+    try {
+        response = await fetchWithTimeout(`${PROXY_URL}/v1/authzen/access`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(authzenBody),
+        });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+async function handleIntentResolve(intent, context) {
+    const requestBody = { intent };
+    if (context !== undefined)
+        requestBody.context = context;
+    let response;
+    try {
+        response = await fetchWithTimeout(`${PROXY_URL}/v1/intent/resolve`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(requestBody),
+        });
+    }
+    catch (err) {
+        return errorContent(`Network error: ${err instanceof Error ? err.message : err}`);
+    }
+    const body = await response.text();
+    if (!response.ok)
+        return errorContent(`Proxy error ${response.status}: ${body}`);
+    return { content: [{ type: "text", text: body }] };
+}
+// ---------------------------------------------------------------------------
+// Connect transport
+// ---------------------------------------------------------------------------
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@agentvalet/mcp-server",
+  "version": "0.1.0",
+  "description": "AgentValet MCP server — lets AI agents call approved platforms via the AgentValet proxy",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "agentvalet-mcp-server": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "jose": "^5.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsx": "^4.7.0",
+    "typescript": "^5.4.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MCSEdwin/agentvalet.git",
+    "directory": "apps/mcp-server"
+  },
+  "keywords": [
+    "ai",
+    "agents",
+    "mcp",
+    "agentvalet"
+  ],
+  "license": "MIT"
+}