@aiwerk/mcp-bridge 1.4.0 → 1.5.0

package/dist/src/mcp-router.js

@@ -5,6 +5,7 @@ import { fetchToolsList, initializeProtocol, PACKAGE_VERSION } from "./protocol.
 import { compressDescription } from "./schema-compression.js";
 import { IntentRouter } from "./intent-router.js";
 import { createEmbeddingProvider } from "./embeddings.js";
+import { isToolAllowed, processResult } from "./security.js";
 const DEFAULT_IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 const DEFAULT_MAX_CONCURRENT = 5;
 export class McpRouter {
@@ -121,6 +122,11 @@ export class McpRouter {
             if (!state.toolNames.includes(tool)) {
                 return this.error("unknown_tool", `Tool '${tool}' not found on server '${server}'`, state.toolNames);
             }
+            // Defense in depth: double-check tool filter
+            const serverConfig = this.servers[server];
+            if (!isToolAllowed(tool, serverConfig)) {
+                return this.error("unknown_tool", `Tool '${tool}' is not allowed on server '${server}'`, state.toolNames);
+            }
             this.markUsed(server);
             const response = await state.transport.sendRequest({
                 jsonrpc: "2.0",
@@ -133,7 +139,9 @@ export class McpRouter {
             if (response.error) {
                 return this.error("mcp_error", response.error.message, undefined, response.error.code);
             }
-            return { server, action: "call", tool, result: response.result };
+            // Security pipeline: truncate → sanitize → trust-tag
+            const result = processResult(response.result, server, serverConfig, this.clientConfig);
+            return { server, action: "call", tool, result };
         }
         catch (error) {
             return this.error("mcp_error", error instanceof Error ? error.message : String(error));
@@ -148,7 +156,9 @@ export class McpRouter {
             this.markUsed(server);
             return state.toolsCache;
         }
-        const tools = await fetchToolsList(state.transport);
+        const allTools = await fetchToolsList(state.transport);
+        const serverConfig = this.servers[server];
+        const tools = allTools.filter((tool) => isToolAllowed(tool.name, serverConfig));
         state.toolNames = tools.map((tool) => tool.name);
         // Store full tool metadata for action=schema
         state.fullToolsMap = new Map(tools.map((tool) => [tool.name, { description: tool.description || "", inputSchema: tool.inputSchema }]));

package/dist/src/security.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Security processing for MCP tool results.
+ *
+ * Pipeline order: truncate → sanitize → trust-tag
+ */
+import type { McpServerConfig, McpClientConfig } from "./types.js";
+/**
+ * Sanitize a tool result by stripping HTML and prompt injection patterns.
+ */
+export declare function sanitizeResult(result: any): any;
+/**
+ * Check if a tool is allowed by the server's toolFilter config.
+ * Returns true if the tool should be visible/callable.
+ */
+export declare function isToolAllowed(toolName: string, serverConfig: McpServerConfig): boolean;
+/**
+ * Apply max result size truncation.
+ * Returns the result as-is or a truncation wrapper.
+ */
+export declare function applyMaxResultSize(result: any, serverConfig: McpServerConfig, clientConfig: McpClientConfig): any;
+/**
+ * Apply trust level wrapping/sanitization.
+ */
+export declare function applyTrustLevel(result: any, serverName: string, serverConfig: McpServerConfig): any;
+/**
+ * Full security pipeline: truncate → sanitize → trust-tag
+ */
+export declare function processResult(result: any, serverName: string, serverConfig: McpServerConfig, clientConfig: McpClientConfig): any;

package/dist/src/security.js

@@ -0,0 +1,127 @@
+/**
+ * Security processing for MCP tool results.
+ *
+ * Pipeline order: truncate → sanitize → trust-tag
+ */
+// Prompt injection patterns to strip (case-insensitive)
+const INJECTION_PATTERNS = [
+    /ignore\s+(all\s+)?previous\s+instructions/gi,
+    /ignore\s+(all\s+)?prior\s+instructions/gi,
+    /disregard\s+(all\s+)?previous\s+instructions/gi,
+    /you\s+are\s+now\b/gi,
+    /^system\s*:/gim,
+    /\bact\s+as\s+(a|an)\s+/gi,
+    /pretend\s+you\s+are\b/gi,
+    /from\s+now\s+on\s+you\s+are\b/gi,
+    /new\s+instructions\s*:/gi,
+    /override\s+(all\s+)?instructions/gi,
+];
+function stripHtmlTags(text) {
+    return text.replace(/<[^>]*>/g, "");
+}
+function stripInjectionPatterns(text) {
+    let result = text;
+    for (const pattern of INJECTION_PATTERNS) {
+        // Reset lastIndex for global regexes
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, "");
+    }
+    return result;
+}
+function sanitizeString(text) {
+    return stripInjectionPatterns(stripHtmlTags(text));
+}
+/**
+ * Sanitize a tool result by stripping HTML and prompt injection patterns.
+ */
+export function sanitizeResult(result) {
+    if (typeof result === "string") {
+        return sanitizeString(result);
+    }
+    if (Array.isArray(result)) {
+        return result.map((item) => sanitizeResult(item));
+    }
+    if (result !== null && typeof result === "object") {
+        // MCP standard content array
+        if (Array.isArray(result.content)) {
+            return {
+                ...result,
+                content: result.content.map((item) => {
+                    if (item.type === "text" && typeof item.text === "string") {
+                        return { ...item, text: sanitizeString(item.text) };
+                    }
+                    return item;
+                }),
+            };
+        }
+        // Recursively sanitize object values
+        const sanitized = {};
+        for (const [key, value] of Object.entries(result)) {
+            sanitized[key] = sanitizeResult(value);
+        }
+        return sanitized;
+    }
+    return result;
+}
+/**
+ * Check if a tool is allowed by the server's toolFilter config.
+ * Returns true if the tool should be visible/callable.
+ */
+export function isToolAllowed(toolName, serverConfig) {
+    const filter = serverConfig.toolFilter;
+    if (!filter)
+        return true;
+    const { allow, deny } = filter;
+    if (allow && allow.length > 0) {
+        // Whitelist mode: only allowed tools, minus denied
+        if (!allow.includes(toolName))
+            return false;
+    }
+    if (deny && deny.length > 0) {
+        if (deny.includes(toolName))
+            return false;
+    }
+    return true;
+}
+/**
+ * Apply max result size truncation.
+ * Returns the result as-is or a truncation wrapper.
+ */
+export function applyMaxResultSize(result, serverConfig, clientConfig) {
+    const limit = serverConfig.maxResultChars ?? clientConfig.maxResultChars;
+    if (limit === undefined)
+        return result;
+    const serialized = JSON.stringify(result);
+    if (serialized.length <= limit)
+        return result;
+    return {
+        _truncated: true,
+        _originalLength: serialized.length,
+        result: serialized.slice(0, limit),
+    };
+}
+/**
+ * Apply trust level wrapping/sanitization.
+ */
+export function applyTrustLevel(result, serverName, serverConfig) {
+    const trust = serverConfig.trust ?? "trusted";
+    switch (trust) {
+        case "trusted":
+            return result;
+        case "untrusted":
+            return { _trust: "untrusted", _server: serverName, result };
+        case "sanitize":
+            return sanitizeResult(result);
+        default:
+            return result;
+    }
+}
+/**
+ * Full security pipeline: truncate → sanitize → trust-tag
+ */
+export function processResult(result, serverName, serverConfig, clientConfig) {
+    let processed = applyMaxResultSize(result, serverConfig, clientConfig);
+    // Sanitize step (only for trust=sanitize, handled inside applyTrustLevel)
+    processed = applyTrustLevel(processed, serverName, serverConfig);
+    return processed;
+}

package/dist/src/types.d.ts

@@ -14,6 +14,12 @@ export interface McpServerConfig {
     args?: string[];
     env?: Record<string, string>;
     framing?: "auto" | "lsp" | "newline";
+    trust?: "trusted" | "untrusted" | "sanitize";
+    toolFilter?: {
+        deny?: string[];
+        allow?: string[];
+    };
+    maxResultChars?: number;
 }
 export interface McpClientConfig {
     servers: Record<string, McpServerConfig>;
@@ -33,6 +39,7 @@ export interface McpClientConfig {
         model?: string;
         minScore?: number;
     };
+    maxResultChars?: number;
 }
 export interface McpTool {
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",