@agentwares/agentguard 0.1.5 → 0.1.6

package/dist/index.js

@@ -845,6 +845,7 @@ var ProxyRuntime = class {
   guard;
   agent;
   defaultRunId;
+  configured;
   sessions = /* @__PURE__ */ new Set();
   connections = /* @__PURE__ */ new Map();
   exposed = [];
@@ -861,6 +862,7 @@ var ProxyRuntime = class {
     this.guard = opts.guard;
     this.agent = opts.agent;
     this.defaultRunId = opts.defaultRunId;
+    this.configured = opts.configured ?? true;
     this.log = opts.log ?? ((line) => process.stderr.write(`[agentguard] ${line}
 `));
     this.connectTimeoutMs = opts.connectTimeoutMs ?? 15e3;
@@ -1328,251 +1330,24 @@ async function withTimeout(promise, ms, what) {
 }
 
 // src/proxy/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import {
-  CallToolRequestSchema,
+  CallToolRequestSchema as CallToolRequestSchema2,
   CompleteRequestSchema,
   GetPromptRequestSchema,
   ListPromptsRequestSchema,
   ListResourceTemplatesRequestSchema,
   ListResourcesRequestSchema,
-  ListToolsRequestSchema,
+  ListToolsRequestSchema as ListToolsRequestSchema2,
   ReadResourceRequestSchema,
   SetLevelRequestSchema,
-  SubscribeRequestSchema,
-  UnsubscribeRequestSchema
+  SubscribeRequestSchema as SubscribeRequestSchema2,
+  UnsubscribeRequestSchema as UnsubscribeRequestSchema2
 } from "@modelcontextprotocol/sdk/types.js";
 import {
   keyFromHeaders,
   resolveAgent
 } from "@agentwares/agentguard-core";
-var PROXY_VERSION = version();
-function headerValue(extra, name) {
-  const raw = extra.requestInfo?.headers?.[name] ?? extra.requestInfo?.headers?.[name.toLowerCase()];
-  if (Array.isArray(raw)) return raw[0];
-  return typeof raw === "string" ? raw : void 0;
-}
-function headersOf(extra) {
-  const out = {};
-  for (const [k, v] of Object.entries(extra.requestInfo?.headers ?? {}))
-    out[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
-  return out;
-}
-function runIdFor(extra, meta, fallback) {
-  const header = headerValue(extra, "x-run-id");
-  if (header && header.trim()) return header.trim().slice(0, 128);
-  const fromMeta = meta?.runId ?? meta?.["agentguard/runId"] ?? meta?.run_id;
-  if (typeof fromMeta === "string" && fromMeta.trim()) return fromMeta.trim().slice(0, 128);
-  if (extra.sessionId) return `sess_${extra.sessionId.slice(0, 12)}`;
-  return fallback;
-}
-function toCallToolResult(result, tool) {
-  const meta = {
-    agentguard: {
-      class: result.decision.classification.class,
-      verb: result.decision.classification.verb,
-      mode: result.decision.mode,
-      outcome: result.outcome,
-      dryRun: result.faked,
-      seq: result.entry.seq,
-      run_id: result.entry.run_id
-    }
-  };
-  const hasOutputSchema = Boolean(tool?.tool.outputSchema);
-  if (result.error) {
-    const upstream2 = result.value;
-    if (upstream2 && upstream2.content) {
-      return { ...upstream2, isError: true, _meta: { ...upstream2._meta ?? {}, ...meta } };
-    }
-    const body = result.error;
-    return {
-      isError: true,
-      content: [{ type: "text", text: JSON.stringify(body) }],
-      ...hasOutputSchema ? {} : { structuredContent: body },
-      _meta: { ...meta, httpStatus: httpStatusFor(body.code) }
-    };
-  }
-  if (result.faked) {
-    const value = result.value;
-    const isObject = value !== null && typeof value === "object" && !Array.isArray(value);
-    return {
-      content: [
-        { type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }
-      ],
-      ...isObject ? { structuredContent: value } : {},
-      _meta: meta
-    };
-  }
-  const upstream = result.value;
-  return { ...upstream, _meta: { ...upstream._meta ?? {}, ...meta } };
-}
-function httpStatusFor(code) {
-  switch (code) {
-    case "KILLED":
-    case "TOOL_DENIED":
-    case "APPROVAL_DENIED":
-      return 403;
-    case "APPROVAL_REQUIRED":
-      return 202;
-    case "CAP_EXCEEDED":
-    case "LOOP_DETECTED":
-      return 429;
-    case "UNKNOWN_TOOL":
-      return 404;
-    case "UPSTREAM_ERROR":
-      return 502;
-    default:
-      return 500;
-  }
-}
-function annotateTool(t, mode) {
-  return {
-    ...t.tool,
-    name: t.name,
-    _meta: {
-      ...t.tool._meta ?? {},
-      agentguard: {
-        upstream: t.upstream,
-        class: t.classification.class,
-        verb: t.classification.verb,
-        mode
-      }
-    }
-  };
-}
-function killedError(state) {
-  return Object.assign(
-    new Error(`agentguard kill switch is on (${state.source ?? "?"}: ${state.reason ?? ""})`),
-    { code: -32e3 }
-  );
-}
-function createDownstreamServer(runtime, opts = {}) {
-  const server = new McpServer(
-    { name: "agentguard", version: PROXY_VERSION, title: "agentguard policy proxy" },
-    {
-      capabilities: {
-        tools: { listChanged: true },
-        resources: { subscribe: true, listChanged: true },
-        prompts: { listChanged: true },
-        logging: {},
-        completions: {}
-      },
-      instructions: `Tool calls pass through agentguard (${runtime.policy.mode} mode). Errors carry { code, cause, fix, retryable }; follow "fix". CAP_EXCEEDED, LOOP_DETECTED and KILLED are not retryable: stop and report to the user. APPROVAL_REQUIRED: relay the approval command to the user, then retry the identical call once.`
-    }
-  );
-  const session = {
-    id: crypto.randomUUID(),
-    server,
-    lastActive: Date.now(),
-    inflight: /* @__PURE__ */ new Map()
-  };
-  runtime.attach(session);
-  const previousOnClose = server.server.onclose;
-  server.server.onclose = () => {
-    previousOnClose?.();
-    runtime.detach(session);
-  };
-  const touch = () => {
-    session.lastActive = Date.now();
-  };
-  const agentFor = async (extra) => {
-    const key = keyFromHeaders(headersOf(extra));
-    if (!key) return { agent: void 0 };
-    const resolved = await resolveAgent(runtime.policy, { key });
-    if (resolved.error) {
-      return {
-        agent: null,
-        error: {
-          code: "TOOL_DENIED",
-          cause: "the agent key in Authorization / X-Agentguard-Key is not in agentguard.yaml",
-          fix: "use a key created with `agentguard key create <agent>`, or omit the key to use the global policy",
-          retryable: false
-        }
-      };
-    }
-    return { agent: resolved.agent };
-  };
-  const low = server.server;
-  low.setRequestHandler(ListToolsRequestSchema, async (_req, extra) => {
-    touch();
-    const { agent } = await agentFor(extra);
-    const scope = agent === void 0 ? runtime.agent : agent;
-    return {
-      tools: runtime.listTools(scope).map((t) => annotateTool(t, scope?.mode ?? runtime.policy.mode))
-    };
-  });
-  low.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
-    touch();
-    const { agent, error } = await agentFor(extra);
-    const runId = runIdFor(extra, req.params._meta, opts.defaultRunId ?? runtime.defaultRunId);
-    if (error) {
-      return {
-        isError: true,
-        content: [{ type: "text", text: JSON.stringify(error) }],
-        structuredContent: error,
-        _meta: { httpStatus: 401 }
-      };
-    }
-    const progressToken = req.params._meta?.progressToken;
-    const { result, tool } = await runtime.callTool(req.params.name, req.params.arguments ?? {}, {
-      runId,
-      agent,
-      sessionId: extra.sessionId ?? session.id,
-      session,
-      requestId: extra.requestId,
-      onprogress: progressToken === void 0 ? void 0 : (p) => {
-        void extra.sendNotification({
-          method: "notifications/progress",
-          params: { progressToken, ...p }
-        });
-      }
-    });
-    return toCallToolResult(result, tool);
-  });
-  const guardRead = async () => {
-    const state = await runtime.guard.killState();
-    if (state.killed) throw killedError(state);
-  };
-  low.setRequestHandler(ListResourcesRequestSchema, async () => {
-    touch();
-    return runtime.listResources();
-  });
-  low.setRequestHandler(ListResourceTemplatesRequestSchema, async () => {
-    touch();
-    return runtime.listResourceTemplates();
-  });
-  low.setRequestHandler(ReadResourceRequestSchema, async (req) => {
-    touch();
-    await guardRead();
-    return runtime.readResource(req.params.uri);
-  });
-  low.setRequestHandler(SubscribeRequestSchema, async (req) => {
-    await runtime.subscribe(req.params.uri, true);
-    return {};
-  });
-  low.setRequestHandler(UnsubscribeRequestSchema, async (req) => {
-    await runtime.subscribe(req.params.uri, false);
-    return {};
-  });
-  low.setRequestHandler(ListPromptsRequestSchema, async () => {
-    touch();
-    return runtime.listPrompts();
-  });
-  low.setRequestHandler(GetPromptRequestSchema, async (req) => {
-    touch();
-    await guardRead();
-    return runtime.getPrompt(req.params.name, req.params.arguments);
-  });
-  low.setRequestHandler(CompleteRequestSchema, async (req) => {
-    touch();
-    return runtime.complete(req.params);
-  });
-  low.setRequestHandler(SetLevelRequestSchema, async (req) => {
-    await runtime.setLevel(req.params.level);
-    return {};
-  });
-  return server;
-}
 
 // ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
 import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
@@ -1580,8 +1355,8 @@ import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import {
   CreateMessageResultSchema,
   ElicitResultSchema,
-  SubscribeRequestSchema as SubscribeRequestSchema2,
-  UnsubscribeRequestSchema as UnsubscribeRequestSchema2
+  SubscribeRequestSchema,
+  UnsubscribeRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 
@@ -1691,11 +1466,11 @@ var StubVerifier = class {
 // ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
-import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import {
-  CallToolRequestSchema as CallToolRequestSchema2,
+  CallToolRequestSchema,
   ErrorCode,
-  ListToolsRequestSchema as ListToolsRequestSchema2,
+  ListToolsRequestSchema,
   McpError
 } from "@modelcontextprotocol/sdk/types.js";
 import { z as z4 } from "zod";
@@ -1798,6 +1573,10 @@ function errorResult(err, opts = {}) {
     _meta: meta
   };
 }
+function createToolContext(init = {}) {
+  const { headers, ...rest } = init;
+  return { headers: headers ?? new Headers(), ...rest };
+}
 var TOOL_NAME_PATTERN = /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/;
 var MIN_NAMESPACE_LENGTH = 3;
 var MIN_DESCRIPTION_LENGTH = 20;
@@ -1824,7 +1603,7 @@ function isCallToolResult(value) {
     (block) => isPlainObject(block) && typeof block.type === "string"
   );
 }
-function toCallToolResult2(value) {
+function toCallToolResult(value) {
   if (isCallToolResult(value)) return value;
   const text = typeof value === "string" ? value : JSON.stringify(value ?? null, null, 2);
   const result = { content: [{ type: "text", text }] };
@@ -1890,9 +1669,9 @@ function defineTool(opts) {
               details: { issues: checked.error.issues }
             });
           }
-          return toCallToolResult2(checked.data);
+          return toCallToolResult(checked.data);
         }
-        return toCallToolResult2(value);
+        return toCallToolResult(value);
       } catch (err) {
         return fail2(err);
       }
@@ -2279,7 +2058,7 @@ function createMcpServer(opts) {
     if (byName.has(tool.name)) throw new Error(`duplicate tool name: ${tool.name}`);
     byName.set(tool.name, tool);
   }
-  const server = new McpServer2(
+  const server = new McpServer(
     { name: opts.name, version: opts.version, title: opts.title, websiteUrl: opts.websiteUrl },
     { instructions: opts.instructions, capabilities: { logging: {}, ...opts.capabilities } }
   );
@@ -2300,7 +2079,7 @@ function createMcpServer(opts) {
     );
   }
   if (byName.size > 0) {
-    server.server.setRequestHandler(ListToolsRequestSchema2, async () => {
+    server.server.setRequestHandler(ListToolsRequestSchema, async () => {
       const enabled = [...byName.values()].filter(
         (tool) => registered.get(tool.name)?.enabled !== false
       );
@@ -2312,7 +2091,7 @@ function createMcpServer(opts) {
         }))
       };
     });
-    server.server.setRequestHandler(CallToolRequestSchema2, async (request, extra) => {
+    server.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
       const name = request.params.name;
       const tool = byName.get(name);
       const entry = registered.get(name);
@@ -2514,152 +2293,667 @@ function createStatefulHandler({ factory, cors, transportBase }, options) {
         previousOnClose?.();
         if (transport.sessionId) sessions.delete(transport.sessionId);
       };
-      const response = withCors(await transport.handleRequest(request), cors);
-      if (!transport.sessionId) server.close().catch(() => void 0);
-      return response;
-    } catch (err) {
-      server.close().catch(() => void 0);
-      return errorResponse(err, cors);
+      const response = withCors(await transport.handleRequest(request), cors);
+      if (!transport.sessionId) server.close().catch(() => void 0);
+      return response;
+    } catch (err) {
+      server.close().catch(() => void 0);
+      return errorResponse(err, cors);
+    }
+  };
+}
+function createHttpHandler(opts, transportOptions = {}) {
+  const { factory, transport: t } = splitOptions(opts, transportOptions);
+  const cors = corsHeaders(t.cors);
+  const sessions = t.sessions ? typeof t.sessions === "object" ? t.sessions : {} : void 0;
+  const context = {
+    factory,
+    cors,
+    transportBase: {
+      enableJsonResponse: t.jsonResponse ?? sessions === void 0,
+      allowedHosts: t.allowedHosts,
+      allowedOrigins: t.allowedOrigins,
+      enableDnsRebindingProtection: t.enableDnsRebindingProtection
+    }
+  };
+  const handler = sessions ? createStatefulHandler(context, sessions) : createStatelessHandler(context);
+  const allow = sessions ? "GET, POST, DELETE, OPTIONS" : "POST, OPTIONS";
+  return async (request) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: { Allow: allow, ...cors } });
+    }
+    return handler(request);
+  };
+}
+function localhostHosts(port) {
+  const hosts = ["localhost", "127.0.0.1", "[::1]"];
+  return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
+}
+function handleHealth(info) {
+  const tools = typeof info.tools === "number" ? info.tools : info.tools.length;
+  return jsonResponse({ ok: true, name: info.name, version: info.version, tools }, 200);
+}
+async function serveNodeHttp(opts) {
+  const http = await import("http");
+  const host = opts.host ?? "127.0.0.1";
+  const path2 = opts.path ?? "/mcp";
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+      let response;
+      if (url.pathname === path2) {
+        const controller = new AbortController();
+        res.on("close", () => {
+          if (!res.writableFinished) controller.abort();
+        });
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(req.headers)) {
+          if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+          else if (typeof value === "string") headers.set(key, value);
+        }
+        const method = req.method ?? "GET";
+        let body;
+        if (method !== "GET" && method !== "HEAD") {
+          const chunks = [];
+          for await (const chunk of req) chunks.push(chunk);
+          body = new Uint8Array(Buffer.concat(chunks));
+        }
+        response = await opts.handler(
+          new Request(url, { method, headers, body, signal: controller.signal })
+        );
+      } else if (url.pathname === "/health" && opts.health) {
+        response = opts.health();
+      } else {
+        response = new Response(
+          JSON.stringify({
+            code: "NOT_FOUND",
+            cause: `no route for ${url.pathname}`,
+            fix: `POST JSON-RPC to ${path2}`,
+            retryable: false
+          }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
+      }
+      const outHeaders = {};
+      response.headers.forEach((value, key) => {
+        outHeaders[key] = value;
+      });
+      res.writeHead(response.status, outHeaders);
+      if (!response.body) {
+        res.end();
+        return;
+      }
+      const reader = response.body.getReader();
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          res.write(value);
+        }
+      } catch {
+      }
+      res.end();
+    })().catch((err) => {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          code: "INTERNAL",
+          cause: err instanceof Error ? err.message : String(err),
+          fix: "retry; if it persists, report the request id",
+          retryable: false
+        })
+      );
+    });
+  });
+  await new Promise((resolve5, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port ?? 8765, host, () => resolve5());
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : opts.port ?? 8765;
+  return {
+    port,
+    url: `http://${host}:${port}${path2}`,
+    close: () => new Promise((resolve5, reject) => {
+      server.closeAllConnections();
+      server.close((err) => err ? reject(err) : resolve5());
+    })
+  };
+}
+
+// ../../packages/mcp-kit/dist/index.js
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+async function serveStdio(serverOrOpts) {
+  const server = serverOrOpts instanceof McpServer2 ? serverOrOpts : createMcpServer(serverOrOpts);
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  await new Promise((resolve5) => {
+    const previous = transport.onclose;
+    transport.onclose = () => {
+      previous?.();
+      resolve5();
+    };
+  });
+}
+
+// src/proxy/own-tools.ts
+import {
+  buildReport,
+  latestRunId,
+  listRuns,
+  parseAuditJsonl,
+  renderReportMarkdown,
+  verifyChain
+} from "@agentwares/agentguard-core";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { z as z5 } from "zod";
+var INIT_COMMAND = "npx -y @agentwares/agentguard init";
+var READ_ONLY = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var runIdInput = z5.string().min(1).max(128).optional().describe(
+  "Run to read, as it appears in the audit log (for example run_20261007093015_ab12, or the X-Run-Id an HTTP client sent). Omit it for the most recent run."
+);
+var counters = z5.record(z5.string(), z5.number()).describe(
+  "counter name (tool_calls, writes, deletes, emails, spend_usd or a custom one) \u2192 value"
+);
+function readAudit(path2) {
+  if (!existsSync(path2)) return { exists: false, entries: [] };
+  try {
+    return { exists: true, entries: parseAuditJsonl(readFileSync2(path2, "utf8")) };
+  } catch (err) {
+    return { exists: true, entries: [], error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function unreadable(path2, error) {
+  return toolError({
+    code: "AUDIT_UNREADABLE",
+    cause: `the audit log at ${path2} could not be read: ${error}`,
+    fix: "call agentguard_verify_audit_log to see where it breaks; a hand-edited or truncated line has to be restored from a copy",
+    retryable: false
+  });
+}
+function numbers(caps) {
+  const out = {};
+  for (const [k, v] of Object.entries(caps)) if (typeof v === "number") out[k] = v;
+  return out;
+}
+function nextStep(runtime) {
+  if (!runtime.configured)
+    return `agentguard is guarding nothing: no policy file at ${runtime.loaded.path}. Run \`${INIT_COMMAND}\` in the project directory: it writes agentguard.yaml in dry-run mode and routes the project's MCP servers through agentguard (backup kept, \`--undo\` restores). Then restart the MCP client.`;
+  if (runtime.policy.upstreams.length === 0)
+    return `${runtime.loaded.path} lists no upstream servers, so agentguard is guarding nothing. Add the MCP servers your agent uses under \`upstreams:\` in that file (it has commented examples), then restart the MCP client.`;
+  return "agentguard is running; run your agent, then read agentguard_get_report.";
+}
+var StatusOutput = z5.object({
+  configured: z5.boolean().describe(
+    "true when a policy file was found and loaded; false means agentguard guards nothing"
+  ),
+  policy_path: z5.string().describe("absolute path of the policy file read, or looked for"),
+  mode: z5.enum(["dry-run", "enforce"]).describe("dry-run fakes writes and spends and records them; enforce lets allowed calls run"),
+  upstreams: z5.array(
+    z5.object({
+      name: z5.string().describe("upstream name from the policy"),
+      connected: z5.boolean().describe("whether agentguard is connected to it"),
+      tools: z5.number().int().describe("tools it exposes"),
+      transport: z5.enum(["stdio", "http"]).describe("how agentguard reaches it"),
+      error: z5.string().optional().describe("why it is not connected")
+    })
+  ).describe("the MCP servers this proxy fronts; empty means none are configured"),
+  run_id: z5.string().nullable().describe(
+    "run the usage is for: the requested run_id, else the latest run in the log, else null"
+  ),
+  caps: z5.object({ per_run: counters, per_day: counters }).describe("limits from the policy; a counter that is absent has no cap"),
+  used: z5.object({ per_run: counters, per_day: counters }).describe("what that run, and today, have used against the caps"),
+  remaining: z5.record(
+    z5.string(),
+    z5.object({ per_run: z5.number().optional(), per_day: z5.number().optional() })
+  ).describe("budget left per capped counter, per run and per day"),
+  kill_switch: z5.object({
+    on: z5.boolean().describe("true halts every tool call with KILLED"),
+    reason: z5.string().optional().describe("why it was pulled"),
+    source: z5.string().optional().describe("file, env or memory")
+  }).describe("the kill switch state"),
+  pending_approvals: z5.number().int().describe("destructive calls waiting for a human decision"),
+  audit_log: z5.object({
+    path: z5.string().describe("absolute path of the hash-chained JSONL audit log"),
+    entries: z5.number().int().describe("entries in it; 0 when it does not exist yet")
+  }).describe("where every tool call is recorded"),
+  next_step: z5.string().describe("the one thing to do next, with the command when there is one")
+});
+var ReportOutput = z5.object({
+  configured: z5.boolean().describe("false when no policy file was found (agentguard guards nothing)"),
+  audit_log_path: z5.string().describe("absolute path of the audit log the report was built from"),
+  run_id: z5.string().nullable().describe("the run reported on; null when the log has no runs"),
+  runs_in_log: z5.number().int().describe("how many runs the audit log holds"),
+  tool_calls: z5.number().int().describe("tool calls in this run"),
+  would_have: z5.object({
+    creates: z5.number().int(),
+    updates: z5.number().int(),
+    deletes: z5.number().int(),
+    sends: z5.number().int(),
+    executes: z5.number().int(),
+    spends: z5.number().int(),
+    spend_usd: z5.number()
+  }).describe("what dry-run mode faked: what the run would have done had the calls executed"),
+  did: z5.object({
+    writes: z5.number().int(),
+    deletes: z5.number().int(),
+    sends: z5.number().int(),
+    spend_usd: z5.number()
+  }).describe("what actually executed upstream"),
+  halts: z5.array(
+    z5.object({
+      seq: z5.number().int().describe("audit entry number"),
+      ts: z5.string().describe("ISO time of the call"),
+      code: z5.string().describe("CAP_EXCEEDED, LOOP_DETECTED, KILLED, APPROVAL_REQUIRED, \u2026"),
+      tool: z5.string().describe("the tool that was stopped"),
+      cause: z5.string().describe("why")
+    })
+  ).describe("every call agentguard stopped, in order"),
+  top_tools: z5.array(z5.object({ tool: z5.string(), calls: z5.number().int(), class: z5.string() })).describe("the most-called tools with their class (read, write, spend)"),
+  markdown: z5.string().describe("the same report `agentguard report` prints, as Markdown")
+});
+var VerifyOutput = z5.object({
+  configured: z5.boolean().describe("false when no policy file was found (agentguard guards nothing)"),
+  path: z5.string().describe("absolute path of the audit log checked"),
+  exists: z5.boolean().describe("false when no call has been recorded yet; an absent log verifies"),
+  ok: z5.boolean().describe("true when every entry's hash and prev_hash recompute"),
+  entries: z5.number().int().describe("entries checked"),
+  head_hash: z5.string().nullable().describe(
+    "hash of the last entry; record it with the count to detect entries cut from the end"
+  ),
+  broken_at: z5.number().int().nullable().describe("seq of the first entry that does not verify"),
+  reason: z5.string().nullable().describe("why verification failed")
+});
+function createOwnTools(runtime) {
+  const status = defineTool({
+    name: "agentguard_get_status",
+    title: "agentguard status",
+    description: "Report what agentguard is guarding right now: the policy file it loaded (or that none was found), dry-run or enforce mode, each upstream MCP server and whether it connected, a run's cap usage and remaining budget, the kill switch, and pending approvals. Call it first to learn whether agentguard is set up; next_step says what to do when it is not. For what a run did, use agentguard_get_report; to check the log was not edited, agentguard_verify_audit_log. Reads local files only and changes nothing.",
+    input: z5.strictObject({ run_id: runIdInput }),
+    output: StatusOutput,
+    annotations: { title: "agentguard status", ...READ_ONLY },
+    async handler({ run_id }) {
+      const { loaded, guard } = runtime;
+      const audit = readAudit(loaded.auditPath);
+      if (audit.error) throw unreadable(loaded.auditPath, audit.error);
+      const runId = run_id ?? latestRunId(audit.entries) ?? null;
+      const state = await guard.status(runId ?? "(none yet)");
+      const pending = await guard.approvals.list("pending");
+      return {
+        configured: runtime.configured,
+        policy_path: loaded.path,
+        mode: runtime.policy.mode,
+        upstreams: runtime.upstreamStatus(),
+        run_id: runId,
+        caps: { per_run: numbers(state.caps.per_run), per_day: numbers(state.caps.per_day) },
+        used: state.usage,
+        remaining: state.remaining,
+        kill_switch: {
+          on: state.killed.killed,
+          ...state.killed.reason ? { reason: state.killed.reason } : {},
+          ...state.killed.source ? { source: state.killed.source } : {}
+        },
+        pending_approvals: pending.length,
+        audit_log: { path: loaded.auditPath, entries: audit.entries.length },
+        next_step: nextStep(runtime)
+      };
+    }
+  });
+  const report = defineTool({
+    name: "agentguard_get_report",
+    title: "agentguard run report",
+    description: "Summarize one run from agentguard's audit log: how many tool calls, what dry-run mode faked (records it would have created, updated or deleted, messages sent, dollars spent), what really ran upstream, and every call agentguard halted with its code and cause. Defaults to the most recent run. Use it after an agent run, before switching a policy from dry-run to enforce; for live caps and the kill switch use agentguard_get_status. Read-only: reads the audit file and does not record this call.",
+    input: z5.strictObject({ run_id: runIdInput }),
+    output: ReportOutput,
+    annotations: { title: "agentguard run report", ...READ_ONLY },
+    handler({ run_id }) {
+      const { loaded } = runtime;
+      const audit = readAudit(loaded.auditPath);
+      if (audit.error) throw unreadable(loaded.auditPath, audit.error);
+      const runs = listRuns(audit.entries);
+      if (run_id && !runs.some((r) => r.runId === run_id)) {
+        throw toolError({
+          code: "NOT_FOUND",
+          cause: `no run "${run_id}" in the audit log at ${loaded.auditPath}`,
+          fix: `call again without run_id for the latest run${runs.length ? `; runs in the log: ${runs.slice(0, 5).map((r) => r.runId).join(", ")}` : "; the log has no runs yet"}`,
+          retryable: false
+        });
+      }
+      const runId = run_id ?? latestRunId(audit.entries) ?? null;
+      const built = buildReport(audit.entries, { runId: runId ?? void 0 });
+      const markdown = runId ? renderReportMarkdown(built) : `# agentguard report
+
+No runs recorded in ${loaded.auditPath} yet. ${nextStep(runtime)}`;
+      return {
+        configured: runtime.configured,
+        audit_log_path: loaded.auditPath,
+        run_id: runId,
+        runs_in_log: runs.length,
+        tool_calls: runId ? audit.entries.filter((e) => e.run_id === runId).length : 0,
+        would_have: {
+          creates: built.wouldHave.creates,
+          updates: built.wouldHave.updates,
+          deletes: built.wouldHave.deletes,
+          sends: built.wouldHave.sends,
+          executes: built.wouldHave.executes,
+          spends: built.wouldHave.spends,
+          spend_usd: built.wouldHave.spendUsd
+        },
+        did: {
+          writes: built.did.writes,
+          deletes: built.did.deletes,
+          sends: built.did.sends,
+          spend_usd: built.did.spendUsd
+        },
+        halts: built.halts,
+        top_tools: built.topTools,
+        markdown
+      };
+    }
+  });
+  const verify = defineTool({
+    name: "agentguard_verify_audit_log",
+    title: "Verify agentguard audit log",
+    description: "Recompute the hash chain of agentguard's audit log (JSONL, one entry per tool call) and say whether any entry was edited, removed from the middle or reordered, naming the first broken entry. Returns the entry count and head hash; record both elsewhere, because entries cut from the end of the file still verify. Use it before trusting agentguard_get_report. Takes no arguments: it checks the log the loaded policy names. Read-only; a log that does not exist yet verifies as empty.",
+    input: z5.strictObject({}),
+    output: VerifyOutput,
+    annotations: { title: "Verify agentguard audit log", ...READ_ONLY },
+    async handler() {
+      const { loaded } = runtime;
+      const audit = readAudit(loaded.auditPath);
+      if (audit.error) {
+        return {
+          configured: runtime.configured,
+          path: loaded.auditPath,
+          exists: true,
+          ok: false,
+          entries: 0,
+          head_hash: null,
+          broken_at: null,
+          reason: audit.error
+        };
+      }
+      const result = await verifyChain(audit.entries);
+      return {
+        configured: runtime.configured,
+        path: loaded.auditPath,
+        exists: audit.exists,
+        ok: result.ok,
+        entries: result.entries,
+        // an empty chain's head is the genesis hash, which is not an entry anyone can record
+        head_hash: result.entries > 0 ? result.head ?? null : null,
+        broken_at: result.brokenAt ?? null,
+        reason: result.reason ?? null
+      };
+    }
+  });
+  return [status, report, verify];
+}
+function ownToolsActive(runtime) {
+  return runtime.upstreamStatus().length === 0;
+}
+function ownToolList(tools) {
+  return listToolManifest(tools);
+}
+async function callOwnTool(tools, name, args, requestId) {
+  const tool = tools.find((t) => t.name === name);
+  if (!tool) return void 0;
+  return tool.invoke(args, createToolContext({ requestId }));
+}
+
+// src/proxy/server.ts
+var PROXY_VERSION = version();
+function headerValue(extra, name) {
+  const raw = extra.requestInfo?.headers?.[name] ?? extra.requestInfo?.headers?.[name.toLowerCase()];
+  if (Array.isArray(raw)) return raw[0];
+  return typeof raw === "string" ? raw : void 0;
+}
+function headersOf(extra) {
+  const out = {};
+  for (const [k, v] of Object.entries(extra.requestInfo?.headers ?? {}))
+    out[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
+  return out;
+}
+function runIdFor(extra, meta, fallback) {
+  const header = headerValue(extra, "x-run-id");
+  if (header && header.trim()) return header.trim().slice(0, 128);
+  const fromMeta = meta?.runId ?? meta?.["agentguard/runId"] ?? meta?.run_id;
+  if (typeof fromMeta === "string" && fromMeta.trim()) return fromMeta.trim().slice(0, 128);
+  if (extra.sessionId) return `sess_${extra.sessionId.slice(0, 12)}`;
+  return fallback;
+}
+function toCallToolResult2(result, tool) {
+  const meta = {
+    agentguard: {
+      class: result.decision.classification.class,
+      verb: result.decision.classification.verb,
+      mode: result.decision.mode,
+      outcome: result.outcome,
+      dryRun: result.faked,
+      seq: result.entry.seq,
+      run_id: result.entry.run_id
+    }
+  };
+  const hasOutputSchema = Boolean(tool?.tool.outputSchema);
+  if (result.error) {
+    const upstream2 = result.value;
+    if (upstream2 && upstream2.content) {
+      return { ...upstream2, isError: true, _meta: { ...upstream2._meta ?? {}, ...meta } };
+    }
+    const body = result.error;
+    return {
+      isError: true,
+      content: [{ type: "text", text: JSON.stringify(body) }],
+      ...hasOutputSchema ? {} : { structuredContent: body },
+      _meta: { ...meta, httpStatus: httpStatusFor(body.code) }
+    };
+  }
+  if (result.faked) {
+    const value = result.value;
+    const isObject = value !== null && typeof value === "object" && !Array.isArray(value);
+    return {
+      content: [
+        { type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }
+      ],
+      ...isObject ? { structuredContent: value } : {},
+      _meta: meta
+    };
+  }
+  const upstream = result.value;
+  return { ...upstream, _meta: { ...upstream._meta ?? {}, ...meta } };
+}
+function httpStatusFor(code) {
+  switch (code) {
+    case "KILLED":
+    case "TOOL_DENIED":
+    case "APPROVAL_DENIED":
+      return 403;
+    case "APPROVAL_REQUIRED":
+      return 202;
+    case "CAP_EXCEEDED":
+    case "LOOP_DETECTED":
+      return 429;
+    case "UNKNOWN_TOOL":
+      return 404;
+    case "UPSTREAM_ERROR":
+      return 502;
+    default:
+      return 500;
+  }
+}
+function annotateTool(t, mode) {
+  return {
+    ...t.tool,
+    name: t.name,
+    _meta: {
+      ...t.tool._meta ?? {},
+      agentguard: {
+        upstream: t.upstream,
+        class: t.classification.class,
+        verb: t.classification.verb,
+        mode
+      }
+    }
+  };
+}
+function killedError(state) {
+  return Object.assign(
+    new Error(`agentguard kill switch is on (${state.source ?? "?"}: ${state.reason ?? ""})`),
+    { code: -32e3 }
+  );
+}
+function serverInstructions(runtime) {
+  if (ownToolsActive(runtime))
+    return `agentguard is an MCP policy proxy, and this one fronts no upstream MCP servers${runtime.configured ? "" : ` (no policy file at ${runtime.loaded.path})`}, so it serves only its own read-only tools: agentguard_get_status (what it guards, caps, kill switch), agentguard_get_report (what a run did or would have done) and agentguard_verify_audit_log. To guard the user's MCP servers, run \`${INIT_COMMAND}\` in the project directory and restart the client.`;
+  return `Tool calls pass through agentguard (${runtime.policy.mode} mode). Errors carry { code, cause, fix, retryable }; follow "fix". CAP_EXCEEDED, LOOP_DETECTED and KILLED are not retryable: stop and report to the user. APPROVAL_REQUIRED: relay the approval command to the user, then retry the identical call once.`;
+}
+function createDownstreamServer(runtime, opts = {}) {
+  const server = new McpServer3(
+    { name: "agentguard", version: PROXY_VERSION, title: "agentguard policy proxy" },
+    {
+      capabilities: {
+        tools: { listChanged: true },
+        resources: { subscribe: true, listChanged: true },
+        prompts: { listChanged: true },
+        logging: {},
+        completions: {}
+      },
+      instructions: serverInstructions(runtime)
+    }
+  );
+  const ownTools = createOwnTools(runtime);
+  const session = {
+    id: crypto.randomUUID(),
+    server,
+    lastActive: Date.now(),
+    inflight: /* @__PURE__ */ new Map()
+  };
+  runtime.attach(session);
+  const previousOnClose = server.server.onclose;
+  server.server.onclose = () => {
+    previousOnClose?.();
+    runtime.detach(session);
+  };
+  const touch = () => {
+    session.lastActive = Date.now();
+  };
+  const agentFor = async (extra) => {
+    const key = keyFromHeaders(headersOf(extra));
+    if (!key) return { agent: void 0 };
+    const resolved = await resolveAgent(runtime.policy, { key });
+    if (resolved.error) {
+      return {
+        agent: null,
+        error: {
+          code: "TOOL_DENIED",
+          cause: "the agent key in Authorization / X-Agentguard-Key is not in agentguard.yaml",
+          fix: "use a key created with `agentguard key create <agent>`, or omit the key to use the global policy",
+          retryable: false
+        }
+      };
     }
+    return { agent: resolved.agent };
   };
-}
-function createHttpHandler(opts, transportOptions = {}) {
-  const { factory, transport: t } = splitOptions(opts, transportOptions);
-  const cors = corsHeaders(t.cors);
-  const sessions = t.sessions ? typeof t.sessions === "object" ? t.sessions : {} : void 0;
-  const context = {
-    factory,
-    cors,
-    transportBase: {
-      enableJsonResponse: t.jsonResponse ?? sessions === void 0,
-      allowedHosts: t.allowedHosts,
-      allowedOrigins: t.allowedOrigins,
-      enableDnsRebindingProtection: t.enableDnsRebindingProtection
+  const low = server.server;
+  low.setRequestHandler(ListToolsRequestSchema2, async (_req, extra) => {
+    touch();
+    const { agent } = await agentFor(extra);
+    const scope = agent === void 0 ? runtime.agent : agent;
+    if (ownToolsActive(runtime)) return { tools: ownToolList(ownTools) };
+    return {
+      tools: runtime.listTools(scope).map((t) => annotateTool(t, scope?.mode ?? runtime.policy.mode))
+    };
+  });
+  low.setRequestHandler(CallToolRequestSchema2, async (req, extra) => {
+    touch();
+    if (ownToolsActive(runtime)) {
+      const own = await callOwnTool(
+        ownTools,
+        req.params.name,
+        req.params.arguments ?? {},
+        String(extra.requestId)
+      );
+      if (own) return own;
     }
-  };
-  const handler = sessions ? createStatefulHandler(context, sessions) : createStatelessHandler(context);
-  const allow = sessions ? "GET, POST, DELETE, OPTIONS" : "POST, OPTIONS";
-  return async (request) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, { status: 204, headers: { Allow: allow, ...cors } });
+    const { agent, error } = await agentFor(extra);
+    const runId = runIdFor(extra, req.params._meta, opts.defaultRunId ?? runtime.defaultRunId);
+    if (error) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: JSON.stringify(error) }],
+        structuredContent: error,
+        _meta: { httpStatus: 401 }
+      };
     }
-    return handler(request);
-  };
-}
-function localhostHosts(port) {
-  const hosts = ["localhost", "127.0.0.1", "[::1]"];
-  return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
-}
-function handleHealth(info) {
-  const tools = typeof info.tools === "number" ? info.tools : info.tools.length;
-  return jsonResponse({ ok: true, name: info.name, version: info.version, tools }, 200);
-}
-async function serveNodeHttp(opts) {
-  const http = await import("http");
-  const host = opts.host ?? "127.0.0.1";
-  const path2 = opts.path ?? "/mcp";
-  const server = http.createServer((req, res) => {
-    void (async () => {
-      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
-      let response;
-      if (url.pathname === path2) {
-        const controller = new AbortController();
-        res.on("close", () => {
-          if (!res.writableFinished) controller.abort();
+    const progressToken = req.params._meta?.progressToken;
+    const { result, tool } = await runtime.callTool(req.params.name, req.params.arguments ?? {}, {
+      runId,
+      agent,
+      sessionId: extra.sessionId ?? session.id,
+      session,
+      requestId: extra.requestId,
+      onprogress: progressToken === void 0 ? void 0 : (p) => {
+        void extra.sendNotification({
+          method: "notifications/progress",
+          params: { progressToken, ...p }
         });
-        const headers = new Headers();
-        for (const [key, value] of Object.entries(req.headers)) {
-          if (Array.isArray(value)) for (const item of value) headers.append(key, item);
-          else if (typeof value === "string") headers.set(key, value);
-        }
-        const method = req.method ?? "GET";
-        let body;
-        if (method !== "GET" && method !== "HEAD") {
-          const chunks = [];
-          for await (const chunk of req) chunks.push(chunk);
-          body = new Uint8Array(Buffer.concat(chunks));
-        }
-        response = await opts.handler(
-          new Request(url, { method, headers, body, signal: controller.signal })
-        );
-      } else if (url.pathname === "/health" && opts.health) {
-        response = opts.health();
-      } else {
-        response = new Response(
-          JSON.stringify({
-            code: "NOT_FOUND",
-            cause: `no route for ${url.pathname}`,
-            fix: `POST JSON-RPC to ${path2}`,
-            retryable: false
-          }),
-          { status: 404, headers: { "Content-Type": "application/json" } }
-        );
-      }
-      const outHeaders = {};
-      response.headers.forEach((value, key) => {
-        outHeaders[key] = value;
-      });
-      res.writeHead(response.status, outHeaders);
-      if (!response.body) {
-        res.end();
-        return;
-      }
-      const reader = response.body.getReader();
-      try {
-        for (; ; ) {
-          const { done, value } = await reader.read();
-          if (done) break;
-          res.write(value);
-        }
-      } catch {
       }
-      res.end();
-    })().catch((err) => {
-      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({
-          code: "INTERNAL",
-          cause: err instanceof Error ? err.message : String(err),
-          fix: "retry; if it persists, report the request id",
-          retryable: false
-        })
-      );
     });
+    return toCallToolResult2(result, tool);
   });
-  await new Promise((resolve5, reject) => {
-    server.once("error", reject);
-    server.listen(opts.port ?? 8765, host, () => resolve5());
-  });
-  const address = server.address();
-  const port = typeof address === "object" && address ? address.port : opts.port ?? 8765;
-  return {
-    port,
-    url: `http://${host}:${port}${path2}`,
-    close: () => new Promise((resolve5, reject) => {
-      server.closeAllConnections();
-      server.close((err) => err ? reject(err) : resolve5());
-    })
+  const guardRead = async () => {
+    const state = await runtime.guard.killState();
+    if (state.killed) throw killedError(state);
   };
-}
-
-// ../../packages/mcp-kit/dist/index.js
-import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
-async function serveStdio(serverOrOpts) {
-  const server = serverOrOpts instanceof McpServer3 ? serverOrOpts : createMcpServer(serverOrOpts);
-  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  await new Promise((resolve5) => {
-    const previous = transport.onclose;
-    transport.onclose = () => {
-      previous?.();
-      resolve5();
-    };
+  low.setRequestHandler(ListResourcesRequestSchema, async () => {
+    touch();
+    return runtime.listResources();
+  });
+  low.setRequestHandler(ListResourceTemplatesRequestSchema, async () => {
+    touch();
+    return runtime.listResourceTemplates();
+  });
+  low.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+    touch();
+    await guardRead();
+    return runtime.readResource(req.params.uri);
+  });
+  low.setRequestHandler(SubscribeRequestSchema2, async (req) => {
+    await runtime.subscribe(req.params.uri, true);
+    return {};
+  });
+  low.setRequestHandler(UnsubscribeRequestSchema2, async (req) => {
+    await runtime.subscribe(req.params.uri, false);
+    return {};
+  });
+  low.setRequestHandler(ListPromptsRequestSchema, async () => {
+    touch();
+    return runtime.listPrompts();
+  });
+  low.setRequestHandler(GetPromptRequestSchema, async (req) => {
+    touch();
+    await guardRead();
+    return runtime.getPrompt(req.params.name, req.params.arguments);
+  });
+  low.setRequestHandler(CompleteRequestSchema, async (req) => {
+    touch();
+    return runtime.complete(req.params);
+  });
+  low.setRequestHandler(SetLevelRequestSchema, async (req) => {
+    await runtime.setLevel(req.params.level);
+    return {};
   });
+  return server;
 }
 
 // src/proxy/http.ts
-import { writeFileSync, unlinkSync, existsSync, mkdirSync } from "fs";
+import { writeFileSync, unlinkSync, existsSync as existsSync2, mkdirSync } from "fs";
 import { createServer } from "http";
 import { join } from "path";
 import { FileKillSwitch } from "@agentwares/agentguard-core/node";
@@ -2857,7 +3151,7 @@ async function startHttpProxy(opts) {
     port,
     token,
     close: () => new Promise((resolve5, reject) => {
-      if (opts.registerFile !== false && existsSync(regFile)) {
+      if (opts.registerFile !== false && existsSync2(regFile)) {
         try {
           unlinkSync(regFile);
         } catch {
@@ -2878,7 +3172,7 @@ function unauthorized() {
 }
 
 // src/context.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { resolve } from "path";
 import { Guard } from "@agentwares/agentguard-core";
 import {
@@ -2888,7 +3182,7 @@ import {
   FileStateStore,
   loadPolicyFile
 } from "@agentwares/agentguard-core/node";
-import { existsSync as exists, readFileSync as readFileSync2 } from "fs";
+import { existsSync as exists, readFileSync as readFileSync3 } from "fs";
 
 // ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/decode-strings.js
 var textEncoder = new TextEncoder();
@@ -3272,7 +3566,7 @@ function readRegistration(loaded) {
   const file = registrationPath(loaded.stateDir);
   if (!exists(file)) return void 0;
   try {
-    const reg = JSON.parse(readFileSync2(file, "utf8"));
+    const reg = JSON.parse(readFileSync3(file, "utf8"));
     return reg;
   } catch {
     return void 0;
@@ -3288,7 +3582,7 @@ function describeError(err) {
 }
 
 // src/configs.ts
-import { copyFileSync, existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
 import { join as join2, resolve as resolve2 } from "path";
 function candidateConfigs(cwd = process.cwd(), home = homedir2(), env = process.env) {
@@ -3321,6 +3615,12 @@ function candidateConfigs(cwd = process.cwd(), home = homedir2(), env = process.
       serversKey: "servers"
     },
     { kind: "generic", label: "mcp.json", path: join2(cwd, "mcp.json"), serversKey: "mcpServers" },
+    {
+      kind: "gemini-project",
+      label: "Gemini CLI (project .gemini/settings.json)",
+      path: join2(cwd, ".gemini", "settings.json"),
+      serversKey: "mcpServers"
+    },
     { kind: "claude-desktop", label: "Claude Desktop", path: desktop, serversKey: "mcpServers" },
     {
       kind: "cursor-user",
@@ -3339,11 +3639,20 @@ function candidateConfigs(cwd = process.cwd(), home = homedir2(), env = process.
       label: "Claude Code (user ~/.claude.json)",
       path: join2(home, ".claude.json"),
       serversKey: "mcpServers"
+    },
+    {
+      kind: "gemini-user",
+      label: "Gemini CLI (user ~/.gemini/settings.json)",
+      path: join2(home, ".gemini", "settings.json"),
+      serversKey: "mcpServers"
     }
   ];
 }
+function isGeminiConfig(file) {
+  return file.kind === "gemini-project" || file.kind === "gemini-user" || /[/\\]\.gemini[/\\]settings\.json$/.test(file.path);
+}
 function detectClientConfigs(cwd, home, env) {
-  return candidateConfigs(cwd, home, env).filter((c) => existsSync3(c.path));
+  return candidateConfigs(cwd, home, env).filter((c) => existsSync4(c.path));
 }
 function describeConfigPath(path2) {
   const abs = resolve2(path2);
@@ -3351,7 +3660,7 @@ function describeConfigPath(path2) {
   if (known) return known;
   let serversKey = "mcpServers";
   try {
-    const parsed = JSON.parse(readFileSync3(abs, "utf8"));
+    const parsed = JSON.parse(readFileSync4(abs, "utf8"));
     if (parsed.servers && !parsed.mcpServers) serversKey = "servers";
   } catch {
   }
@@ -3363,7 +3672,7 @@ function describeConfigPath(path2) {
   };
 }
 function readServers(file) {
-  const raw = JSON.parse(readFileSync3(file.path, "utf8"));
+  const raw = JSON.parse(readFileSync4(file.path, "utf8"));
   const servers = raw[file.serversKey];
   if (!servers || typeof servers !== "object") return {};
   return servers;
@@ -3382,10 +3691,11 @@ function serversToUpstreams(servers) {
       continue;
     }
     const name = rawName.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/^[^a-zA-Z0-9]+/, "") || "upstream";
-    if (entry.url) {
+    const url = typeof entry.httpUrl === "string" ? entry.httpUrl : entry.url;
+    if (url) {
       upstreams.push({
         name,
-        url: entry.url,
+        url,
         headers: entry.headers ?? {},
         args: [],
         env: {},
@@ -3420,34 +3730,34 @@ function proxyEntry(file, policyPath, opts = {}) {
   return entry;
 }
 function rewriteClientConfig(file, policyPath, opts = {}) {
-  const raw = JSON.parse(readFileSync3(file.path, "utf8"));
+  const raw = JSON.parse(readFileSync4(file.path, "utf8"));
   const servers = raw[file.serversKey] ?? {};
   const replaced = Object.keys(servers).filter((n) => !isProxyEntry(servers[n]));
   const backup = backupPath(file);
-  if (!existsSync3(backup)) copyFileSync(file.path, backup);
+  if (!existsSync4(backup)) copyFileSync(file.path, backup);
   raw[file.serversKey] = { [PROXY_SERVER_NAME]: proxyEntry(file, policyPath, opts) };
   writeFileSync2(file.path, JSON.stringify(raw, null, 2) + "\n");
   return { backup, replaced };
 }
 function restoreClientConfig(file) {
   const backup = backupPath(file);
-  if (!existsSync3(backup)) return false;
+  if (!existsSync4(backup)) return false;
   copyFileSync(backup, file.path);
   return true;
 }
 function mergeServerIntoConfig(file, name, entry) {
-  const raw = JSON.parse(readFileSync3(file.path, "utf8"));
+  const raw = JSON.parse(readFileSync4(file.path, "utf8"));
   const servers = raw[file.serversKey] ?? {};
   const replaced = name in servers;
   const backup = backupPath(file);
-  if (!existsSync3(backup)) copyFileSync(file.path, backup);
+  if (!existsSync4(backup)) copyFileSync(file.path, backup);
   raw[file.serversKey] = { ...servers, [name]: entry };
   writeFileSync2(file.path, JSON.stringify(raw, null, 2) + "\n");
   return { backup, replaced };
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, writeFileSync as writeFileSync3 } from "fs";
 import { relative, resolve as resolve3 } from "path";
 import YAML from "yaml";
 
@@ -3534,6 +3844,10 @@ async function toolsCommand(args, io) {
     io.err(
       `${u.connected ? "ok  " : "down"} ${u.name}: ${u.connected ? `${u.tools} tools` : u.error}`
     );
+  if (result.upstreams.length === 0)
+    io.err(
+      "no upstreams in the policy: an MCP client sees agentguard's own read-only tools instead (agentguard_get_status, agentguard_get_report, agentguard_verify_audit_log)"
+    );
   for (const line of formatToolTable(result.tools)) io.out(line);
   const counts = result.tools.reduce(
     (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
@@ -3701,7 +4015,7 @@ async function initCommand(args, io) {
         `found   ${c.path} (${c.label}, user-level) \u2014 not touched; pass --client ${JSON.stringify(c.path)} to route it through agentguard`
       );
   }
-  if (!chosen.every((c) => existsSync4(c.path))) {
+  if (!chosen.every((c) => existsSync5(c.path))) {
     io.err(`no MCP config at ${chosen.map((c) => c.path).join(", ")}`);
     return 1;
   }
@@ -3716,11 +4030,11 @@ async function initCommand(args, io) {
   }
   if (chosen.length === 0)
     io.out(
-      "found   no MCP config (Claude Code .mcp.json, Cursor, VS Code, Claude Desktop, Windsurf) \u2014 writing a policy with no upstreams"
+      "found   no MCP config (Claude Code .mcp.json, Cursor, VS Code, Claude Desktop, Windsurf, Gemini CLI) \u2014 writing a policy with no upstreams"
     );
   const { upstreams, skipped } = serversToUpstreams(servers);
   for (const s of skipped) io.err(`skipped ${s.name}: ${s.reason}`);
-  if (skipped.some((s) => s.reason.includes("already")) && upstreams.length === 0 && existsSync4(policyPath)) {
+  if (skipped.some((s) => s.reason.includes("already")) && upstreams.length === 0 && existsSync5(policyPath)) {
     io.out(
       `already initialized: ${rel(policyPath)} exists and ${chosen.map((c) => rel(c.path)).join(", ")} already points at agentguard`
     );
@@ -3747,7 +4061,7 @@ async function initCommand(args, io) {
     }
   }
   const mode = flagString(args, "mode") ?? "dry-run";
-  if (existsSync4(policyPath) && !flagBool(args, "force")) {
+  if (existsSync5(policyPath) && !flagBool(args, "force")) {
     io.out(`kept    ${rel(policyPath)} (exists; pass --force to regenerate)`);
   } else {
     writeFileSync3(policyPath, renderStarterPolicy({ upstreams, tools: probed, mode, probeErrors }));
@@ -3875,7 +4189,7 @@ async function permissionDiffCommand(args, io) {
 }
 
 // src/fixtures/crm-server.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function seedState() {
   const contacts = /* @__PURE__ */ new Map();
   for (const [id, name, email] of [
@@ -3890,18 +4204,18 @@ function seedState() {
 var counter = 0;
 var nextId = (prefix) => `${prefix}_${(++counter).toString(36).padStart(4, "0")}`;
 function crmTools(state) {
-  const contactSchema = z5.object({
-    id: z5.string(),
-    name: z5.string(),
-    email: z5.string(),
-    updated_at: z5.string()
+  const contactSchema = z6.object({
+    id: z6.string(),
+    name: z6.string(),
+    email: z6.string(),
+    updated_at: z6.string()
   });
   return [
     defineTool({
       name: "crm_list_contacts",
       description: "List every contact in the CRM. Read-only; returns id, name, email and updated_at.",
-      input: z5.object({ limit: z5.number().int().min(1).max(500).default(100) }),
-      output: z5.object({ contacts: z5.array(contactSchema), total: z5.number() }),
+      input: z6.object({ limit: z6.number().int().min(1).max(500).default(100) }),
+      output: z6.object({ contacts: z6.array(contactSchema), total: z6.number() }),
       annotations: { readOnlyHint: true },
       handler: ({ limit }) => ({
         contacts: [...state.contacts.values()].slice(0, limit),
@@ -3911,7 +4225,7 @@ function crmTools(state) {
     defineTool({
       name: "crm_get_contact",
       description: "Fetch one contact by id. Read-only; NOT_FOUND when the id does not exist.",
-      input: z5.object({ id: z5.string() }),
+      input: z6.object({ id: z6.string() }),
       output: contactSchema,
       annotations: { readOnlyHint: true },
       handler: ({ id }) => {
@@ -3928,7 +4242,7 @@ function crmTools(state) {
     defineTool({
       name: "crm_search",
       description: "Search contacts by name or email substring. Returns matching contacts (no annotations on purpose).",
-      input: z5.object({ query: z5.string() }),
+      input: z6.object({ query: z6.string() }),
       handler: ({ query }) => ({
         contacts: [...state.contacts.values()].filter(
           (c) => `${c.name} ${c.email}`.toLowerCase().includes(query.toLowerCase())
@@ -3938,8 +4252,8 @@ function crmTools(state) {
     defineTool({
       name: "crm_create_contact",
       description: "Create a contact. Returns the new id and created_at timestamp.",
-      input: z5.object({ name: z5.string(), email: z5.string() }),
-      output: z5.object({ id: z5.string(), created_at: z5.string() }),
+      input: z6.object({ name: z6.string(), email: z6.string() }),
+      output: z6.object({ id: z6.string(), created_at: z6.string() }),
       annotations: { readOnlyHint: false, destructiveHint: false },
       handler: ({ name, email }) => {
         const id = nextId("c");
@@ -3952,11 +4266,11 @@ function crmTools(state) {
     defineTool({
       name: "crm_update_contact",
       description: "Update fields on a contact. Returns the id and updated_at; NOT_FOUND for unknown ids.",
-      input: z5.object({
-        id: z5.string(),
-        fields: z5.object({ name: z5.string().optional(), email: z5.string().optional() })
+      input: z6.object({
+        id: z6.string(),
+        fields: z6.object({ name: z6.string().optional(), email: z6.string().optional() })
       }),
-      output: z5.object({ id: z5.string(), updated_at: z5.string() }),
+      output: z6.object({ id: z6.string(), updated_at: z6.string() }),
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true },
       handler: ({ id, fields }) => {
         const c = state.contacts.get(id);
@@ -3974,8 +4288,8 @@ function crmTools(state) {
     defineTool({
       name: "crm_delete_contact",
       description: "Permanently delete a contact. Irreversible. Returns { deleted, id }.",
-      input: z5.object({ id: z5.string() }),
-      output: z5.object({ deleted: z5.boolean(), id: z5.string() }),
+      input: z6.object({ id: z6.string() }),
+      output: z6.object({ deleted: z6.boolean(), id: z6.string() }),
       annotations: { readOnlyHint: false, destructiveHint: true },
       handler: ({ id }) => {
         const existed = state.contacts.delete(id);
@@ -3986,8 +4300,8 @@ function crmTools(state) {
     defineTool({
       name: "crm_send_email",
       description: "Send an email to a contact through the CRM. Returns the message id and sent_at.",
-      input: z5.object({ to: z5.string(), subject: z5.string(), body: z5.string() }),
-      output: z5.object({ message_id: z5.string(), sent_at: z5.string() }),
+      input: z6.object({ to: z6.string(), subject: z6.string(), body: z6.string() }),
+      output: z6.object({ message_id: z6.string(), sent_at: z6.string() }),
       handler: ({ to, subject }) => {
         state.emails.push({ to, subject });
         state.mutations.push({ tool: "crm_send_email", args: { to, subject } });
@@ -3997,12 +4311,12 @@ function crmTools(state) {
     defineTool({
       name: "crm_charge_card",
       description: "Charge a customer's card on file (amount in cents). Returns the charge id and amount_usd.",
-      input: z5.object({
-        customer_id: z5.string(),
-        amount_cents: z5.number().int().positive(),
-        currency: z5.string().default("usd")
+      input: z6.object({
+        customer_id: z6.string(),
+        amount_cents: z6.number().int().positive(),
+        currency: z6.string().default("usd")
       }),
-      output: z5.object({ charge_id: z5.string(), amount_usd: z5.number() }),
+      output: z6.object({ charge_id: z6.string(), amount_usd: z6.number() }),
       handler: ({ customer_id, amount_cents }) => {
         const amount_usd = amount_cents / 100;
         state.charges.push({ customer_id, amount_usd });
@@ -4013,7 +4327,7 @@ function crmTools(state) {
     defineTool({
       name: "crm_frobnicate",
       description: "A tool with no annotations and no recognizable verb \u2014 exists to test `unknown` handling.",
-      input: z5.object({}),
+      input: z6.object({}),
       handler: () => {
         state.mutations.push({ tool: "crm_frobnicate", args: {} });
         return { frobnicated: true };
@@ -4022,7 +4336,7 @@ function crmTools(state) {
     defineTool({
       name: "crm_fail",
       description: "Always returns a structured UPSTREAM_ERROR result, for error-path tests.",
-      input: z5.object({}),
+      input: z6.object({}),
       annotations: { readOnlyHint: true },
       handler: () => {
         throw toolError("UPSTREAM_ERROR", "the CRM is having a bad day", "retry in a minute", {
@@ -4179,7 +4493,7 @@ ${steps.length} calls; halts: ${halts.join(", ") || "none"}. Now run: agentguard
 }
 
 // src/commands/connect.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { relative as relative2 } from "path";
 var DEFAULT_PROXY_URL = "https://agentwares-agentguard-proxy.vercel.app";
 function fail(e) {
@@ -4257,11 +4571,12 @@ async function connectCommand(args, io, fetchImpl = fetch) {
       return 1;
     }
     for (const c of chosen) {
-      if (!existsSync5(c.path)) {
+      if (!existsSync6(c.path)) {
         io.err(`no MCP config at ${c.path}`);
         return 1;
       }
-      const { backup, replaced } = mergeServerIntoConfig(c, PROXY_SERVER_NAME, entry);
+      const forClient = isGeminiConfig(c) ? { httpUrl: entry.url, ...entry.headers ? { headers: entry.headers } : {} } : entry;
+      const { backup, replaced } = mergeServerIntoConfig(c, PROXY_SERVER_NAME, forClient);
       io.out(
         `${replaced ? "updated" : "wrote  "} ${rel(c.path)} (${c.label}) \u2192 ${PROXY_SERVER_NAME} = ${conn.mcpUrl}`
       );
@@ -4376,13 +4691,13 @@ async function approvalsCommand(args, io) {
 }
 
 // src/commands/keys.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import YAML2, { isMap, isSeq, YAMLSeq } from "yaml";
 import { generateAgentKey, hashAgentKey } from "@agentwares/agentguard-core";
 async function keyCommand(args, io) {
   const [sub, name] = args.positionals;
   const path2 = policyPathFrom(args, io);
-  const doc = YAML2.parseDocument(readFileSync4(path2, "utf8"));
+  const doc = YAML2.parseDocument(readFileSync5(path2, "utf8"));
   let agents = doc.get("agents");
   if (!isSeq(agents)) {
     agents = new YAMLSeq();
@@ -4465,14 +4780,65 @@ async function keyCommand(args, io) {
 }
 
 // src/commands/proxy.ts
-import { resolveAgent as resolveAgent2 } from "@agentwares/agentguard-core";
+import { existsSync as existsSync7 } from "fs";
+import { dirname } from "path";
+import { Guard as Guard3, defaultPolicy, resolveAgent as resolveAgent2 } from "@agentwares/agentguard-core";
+import { FileKillSwitch as FileKillSwitch3, resolvePath } from "@agentwares/agentguard-core/node";
 function newRunId(now = /* @__PURE__ */ new Date()) {
   return `run_${now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;
 }
+function unconfiguredPolicy(args, io) {
+  if (flagString(args, "config") !== void 0 || io.env.AGENTGUARD_CONFIG) return void 0;
+  const path2 = policyPathFrom(args, io);
+  if (existsSync7(path2)) return void 0;
+  const policy = defaultPolicy();
+  const baseDir = dirname(path2);
+  return {
+    policy,
+    path: path2,
+    baseDir,
+    stateDir: resolvePath(policy.state.dir, baseDir),
+    auditPath: resolvePath(policy.audit.path, baseDir),
+    killPath: resolvePath(policy.kill.file, baseDir)
+  };
+}
+async function serveOverStdio(runtime) {
+  const server = createDownstreamServer(runtime);
+  const stop = async () => {
+    await runtime.close();
+  };
+  process.once("SIGINT", () => void stop().then(() => process.exit(0)));
+  process.once("SIGTERM", () => void stop().then(() => process.exit(0)));
+  await serveStdio(server);
+  await stop();
+  return 0;
+}
 async function proxyCommand(args, io) {
-  const loaded = loadPolicyFor(args, io);
   const log = (line) => io.err(`[agentguard] ${line}`);
   const modeOverride = flagString(args, "mode");
+  const http = flagBool(args, "http") === true;
+  const unconfigured = http ? void 0 : unconfiguredPolicy(args, io);
+  if (unconfigured) {
+    if (modeOverride === "dry-run" || modeOverride === "enforce")
+      unconfigured.policy.mode = modeOverride;
+    const runtime2 = new ProxyRuntime({
+      loaded: unconfigured,
+      guard: new Guard3({
+        policy: unconfigured.policy,
+        env: io.env,
+        kill: new FileKillSwitch3(unconfigured.killPath)
+      }),
+      configured: false,
+      defaultRunId: flagString(args, "run-id") ?? newRunId(),
+      log
+    });
+    await runtime2.start();
+    log(
+      `no policy file at ${unconfigured.path}: serving agentguard's own read-only tools only. To guard your MCP servers, run \`${INIT_COMMAND}\` in the project directory.`
+    );
+    return serveOverStdio(runtime2);
+  }
+  const loaded = loadPolicyFor(args, io);
   if (modeOverride === "dry-run" || modeOverride === "enforce") loaded.policy.mode = modeOverride;
   const agentName = flagString(args, "agent");
   let agent = void 0;
@@ -4486,7 +4852,6 @@ async function proxyCommand(args, io) {
     }
     agent = resolved.agent;
   }
-  const http = flagBool(args, "http") === true;
   let approvalBase;
   const fileGuard = createFileGuard(loaded, {
     log,
@@ -4512,59 +4877,55 @@ async function proxyCommand(args, io) {
     log(
       `kill switch is ON (${killed.reason}); every call returns KILLED until \`agentguard resume\``
     );
+  if (runtime.upstreamStatus().length === 0)
+    log(
+      `${loaded.path} lists no upstreams: serving agentguard's own read-only tools only. Add servers under \`upstreams:\` to guard them.`
+    );
   if (http) {
-    const server2 = await startHttpProxy({
+    const server = await startHttpProxy({
       runtime,
       port: flagNumber(args, "port") ?? 8788,
       host: flagString(args, "host") ?? "127.0.0.1",
       token: io.env.AGENTGUARD_HTTP_TOKEN
     });
-    approvalBase = { baseUrl: server2.url.replace(/\/mcp$/, ""), token: server2.token };
+    approvalBase = { baseUrl: server.url.replace(/\/mcp$/, ""), token: server.token };
     log(
-      `Streamable HTTP at ${server2.url} \xB7 GET ${approvalBase.baseUrl}/health \xB7 control token in ${loaded.stateDir}/http.json`
+      `Streamable HTTP at ${server.url} \xB7 GET ${approvalBase.baseUrl}/health \xB7 control token in ${loaded.stateDir}/http.json`
     );
     log(
-      `point your agent at ${server2.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`
+      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`
     );
-    const stop2 = async () => {
-      await server2.close();
+    const stop = async () => {
+      await server.close();
       await runtime.close();
       process.exit(0);
     };
-    process.once("SIGINT", () => void stop2());
-    process.once("SIGTERM", () => void stop2());
+    process.once("SIGINT", () => void stop());
+    process.once("SIGTERM", () => void stop());
     await new Promise(() => void 0);
   }
-  const server = createDownstreamServer(runtime);
-  const stop = async () => {
-    await runtime.close();
-  };
-  process.once("SIGINT", () => void stop().then(() => process.exit(0)));
-  process.once("SIGTERM", () => void stop().then(() => process.exit(0)));
-  await serveStdio(server);
-  await stop();
-  return 0;
+  return serveOverStdio(runtime);
 }
 
 // src/commands/report.ts
 import { resolve as resolve4 } from "path";
 import {
-  buildReport,
-  latestRunId,
-  listRuns,
+  buildReport as buildReport2,
+  latestRunId as latestRunId2,
+  listRuns as listRuns2,
   renderMutationDiff,
-  renderReportMarkdown
+  renderReportMarkdown as renderReportMarkdown2
 } from "@agentwares/agentguard-core";
 import { readAuditFile, verifyAuditFile } from "@agentwares/agentguard-core/node";
 function pickRun(args, entries) {
   if (flagBool(args, "all")) return void 0;
-  return flagString(args, "run") ?? latestRunId(entries);
+  return flagString(args, "run") ?? latestRunId2(entries);
 }
 async function reportCommand(args, io) {
   const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
   const entries = readAuditFile(loaded.auditPath);
   const runId = pickRun(args, entries);
-  const report = buildReport(entries, { runId });
+  const report = buildReport2(entries, { runId });
   if (flagBool(args, "json")) {
     io.out(
       JSON.stringify(
@@ -4583,12 +4944,12 @@ async function reportCommand(args, io) {
     );
     return 0;
   }
-  io.out(renderReportMarkdown(report));
+  io.out(renderReportMarkdown2(report));
   const chain = await verifyAuditFile(loaded.auditPath);
   io.out(
     chain.ok ? `Audit chain: ${chain.entries} entries, verified (${loaded.auditPath}).` : `Audit chain BROKEN at entry ${chain.brokenAt}: ${chain.reason}`
   );
-  if (runId && listRuns(entries).length > 1) io.out(`Other runs: agentguard report --all`);
+  if (runId && listRuns2(entries).length > 1) io.out(`Other runs: agentguard report --all`);
   return 0;
 }
 async function diffCommand(args, io) {
@@ -4615,7 +4976,7 @@ async function statusCommand(args, io) {
   const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
   const { guard, kill } = createFileGuard(loaded, { alerts: false, env: io.env });
   const entries = readAuditFile(loaded.auditPath);
-  const runId = flagString(args, "run") ?? latestRunId(entries) ?? "(none yet)";
+  const runId = flagString(args, "run") ?? latestRunId2(entries) ?? "(none yet)";
   const status = await guard.status(runId);
   const killed = kill.check();
   const reg = readRegistration(loaded);
@@ -4784,6 +5145,6 @@ export {
   seedState,
   serversToUpstreams,
   startHttpProxy,
-  toCallToolResult
+  toCallToolResult2 as toCallToolResult
 };
 //# sourceMappingURL=index.js.map