@agentvalet/mcp-server 1.8.0 → 1.10.0

package/README.md

@@ -59,6 +59,18 @@ Add to your `.mcp.json` or equivalent:
 | `report_self_diagnostic` | JWT | Lodge a self-report (error/warning/info) with the owner |
 | `agent_register` | None | Self-register a new agent with an owner |
 | `agent_status` | None | Poll registration approval status |
+| `issue_child_agent` | JWT | Mint a short-lived child identity for a subagent: its own agent id, an attenuated scope slice (child ⊆ parent), its own audit trail, individually revocable. Returns a bearer token for the subagent's `Authorization` header. |
+
+## Session attribution
+
+Every assertion this server signs carries a stable per-process `session_id`
+claim, which the proxy stamps on each audit row. It distinguishes *runs* of
+the server, not subagents: hosts that share one server process (for example
+Claude Code Task-tool subagents) share the id. HTTP callers without this
+server can supply the same discriminator via an `X-AV-Session` header
+(`[A-Za-z0-9._:-]{1,128}`). Both are caller-asserted forensics — the proxy
+never makes an authorization decision on them. For verified per-subagent
+identity, mint a child with `issue_child_agent` instead.
 
 ## Transports
 

package/dist/auth.js

@@ -9,7 +9,7 @@ import { fetchWithTimeout } from "./net.js";
 export async function signJWT(ctx) {
     if (!ctx.privateKey)
         throw new Error("Private key not loaded");
-    return new SignJWT({ agent_id: ctx.AGENT_ID, owner_id: ctx.OWNER_ID })
+    return new SignJWT({ agent_id: ctx.AGENT_ID, owner_id: ctx.OWNER_ID, session_id: ctx.SESSION_ID })
         .setProtectedHeader({ alg: "RS256" })
         .setIssuedAt()
         .setExpirationTime("60s")

package/dist/index.js

@@ -15,6 +15,7 @@ process.on("unhandledRejection", (err) => {
     process.stderr.write(`[mcp-server] FATAL unhandledRejection: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
     process.exit(1);
 });
+import { randomBytes } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
@@ -22,7 +23,7 @@ import { validateConfig } from "./config.js";
 import { renderInstructions } from "./instructions.js";
 import { signJWT } from "./auth.js";
 import { ALLOWED_METHODS, ALL_TOOLS } from "./tools/schemas.js";
-import { handleListPlatforms, handleUsePlatform, handleAgentRegister, handleAgentStatus, handleAuthzenEvaluate, handleListMyPendingActions, handleReportSelfDiagnostic, handleRequestPlatformAccess, } from "./tools/handlers.js";
+import { handleListPlatforms, handleUsePlatform, handleAgentRegister, handleAgentStatus, handleAuthzenEvaluate, handleListMyPendingActions, handleReportSelfDiagnostic, handleRequestPlatformAccess, handleIssueChildAgent, } from "./tools/handlers.js";
 import { errorContent } from "./net.js";
 import { getPermissionsVersion, recordPermissionsVersion, startPermissionsWatcher, } from "./permissions-watcher.js";
 // ---------------------------------------------------------------------------
@@ -47,12 +48,18 @@ const server = new Server({ name: "agentvalet", version: "1.0.0" },
 // permissions-watcher.ts). Declaring the capability is what makes the SDK
 // allow that notification.
 { capabilities: { tools: { listChanged: true } }, instructions: renderInstructions(undefined) });
+// One id per server process. Discriminates runs in audit_log.session_id;
+// forensics only — the proxy never branches enforcement on it. Note: Claude
+// Code Task-tool subagents share the parent process, so this discriminates
+// processes/runs, not subagents.
+const SESSION_ID = "sess_" + randomBytes(8).toString("hex");
 // The config + server bundle threaded into auth + handlers (see context.ts) —
 // keeps those modules free of globals.
 const ctx = {
     AGENT_ID,
     OWNER_ID,
     PROXY_URL,
+    SESSION_ID,
     AGENT_PRIVATE_KEY_RAW,
     privateKey,
     server,
@@ -213,6 +220,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
         return await handleRequestPlatformAccess(ctx, args);
     }
+    if (name === "issue_child_agent") {
+        if (!args || !Array.isArray(args.grants)) {
+            return errorContent("Invalid or missing argument: grants is required");
+        }
+        return await handleIssueChildAgent(ctx, args);
+    }
     return {
         content: [{ type: "text", text: `Unknown tool: ${name}` }],
         isError: true,

package/dist/tools/handlers.js

@@ -347,6 +347,17 @@ export async function handleRequestPlatformAccess(ctx, args) {
         message: "Request submitted and awaiting admin approval. Retry your call later.",
     }));
 }
+export async function handleIssueChildAgent(ctx, args) {
+    const gate = await requireCredentials(ctx);
+    if (gate)
+        return gate;
+    const resp = await fetchWithAuth(ctx, `${ctx.PROXY_URL}/v1/agents/children`, {
+        method: "POST",
+        body: JSON.stringify(args ?? {}),
+    });
+    const json = await resp.json().catch(() => ({ error: `HTTP ${resp.status}` }));
+    return { content: [{ type: "text", text: JSON.stringify(json) }], isError: !resp.ok };
+}
 export async function handleReportSelfDiagnostic(ctx, args) {
     const gate = await requireCredentials(ctx);
     if (gate)

package/dist/tools/schemas.js

@@ -375,6 +375,34 @@ export const REQUEST_PLATFORM_ACCESS_TOOL = {
         required: ["status"],
     },
 };
+export const ISSUE_CHILD_AGENT_TOOL = {
+    name: "issue_child_agent",
+    description: "Issue a short-lived child agent identity for a subagent you are about to spawn. The child gets its own agent id, its own attenuated permission slice (child scopes must be a subset of yours), and its own audit trail; it can be revoked alone without touching you or its siblings. Returns a bearer token the subagent must send as its Authorization header. TTL 60-3600s (default 900). Inject ONLY the bearer_token into the subagent's context — never your own credentials.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            name: { type: "string", description: "Optional human-readable name for the child agent (1-200 chars)." },
+            ttl_seconds: {
+                type: "number",
+                description: "Optional lifetime in seconds for the child's bearer token. 60-3600, default 900.",
+            },
+            grants: {
+                type: "array",
+                description: "Array of platform grants to attenuate onto the child. Each scope must be a subset of your own granted scopes.",
+                items: {
+                    type: "object",
+                    properties: {
+                        platform: { type: "string", description: "Platform ID (e.g. github, slack)" },
+                        scopes: { type: "array", items: { type: "string" }, description: "Scopes to grant the child for this platform." },
+                        connection_id: { type: "string", description: "Optional. Target a specific connection when a platform has more than one connected." },
+                    },
+                    required: ["platform", "scopes"],
+                },
+            },
+        },
+        required: ["grants"],
+    },
+};
 export const ALL_TOOLS = [
     LIST_PLATFORMS_TOOL,
     USE_PLATFORM_TOOL,
@@ -387,4 +415,5 @@ export const ALL_TOOLS = [
     REPORT_SELF_DIAGNOSTIC_TOOL,
     LIST_MY_PENDING_ACTIONS_TOOL,
     REQUEST_PLATFORM_ACCESS_TOOL,
+    ISSUE_CHILD_AGENT_TOOL,
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvalet/mcp-server",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "AgentValet MCP server — lets AI agents call approved platforms via the AgentValet proxy",
   "mcpName": "io.github.agentvalet/mcp-server",
   "type": "module",