@astral-mcp/projection 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -17
- package/dist/index.d.mts +513 -107
- package/dist/index.d.mts.map +1 -1
- package/dist/index.mjs +2127 -1095
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -4,14 +4,19 @@ Turn any MCP server into a **code-mode** server with **human-approved side
|
|
|
4
4
|
effects**, built on MCP MRTR (Multi Round-Trip Requests, revision
|
|
5
5
|
2026-07-28) and XState v5.
|
|
6
6
|
|
|
7
|
-
Projection wraps an existing MCP server and exposes
|
|
7
|
+
Projection wraps an existing MCP server and exposes two projections of it —
|
|
8
|
+
five tools, never the wrapped server's own:
|
|
8
9
|
|
|
9
|
-
-
|
|
10
|
-
QuickJS WebAssembly sandbox
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
10
|
+
- **Code mode** — `execute_machine` runs an LLM-authored XState v5 state
|
|
11
|
+
machine in a QuickJS WebAssembly sandbox (read-only calls run inline; any
|
|
12
|
+
write suspends the machine into a sealed, encrypted blob and asks the human
|
|
13
|
+
to approve that exact call via MRTR elicitation); `discover_apis` returns
|
|
14
|
+
the generated TypeScript definitions and the authoring contract.
|
|
15
|
+
- **Catalog** — `search_tools` lists the wrapped tools with their approval
|
|
16
|
+
posture, `describe_tool` returns one tool's schemas and types, and
|
|
17
|
+
`call_tool` runs one tool by name under the same approval gate. The
|
|
18
|
+
instructions route the model: one step → `call_tool`; a workflow →
|
|
19
|
+
`execute_machine`. Either projection can be disabled.
|
|
15
20
|
|
|
16
21
|
All suspension state rides the MRTR `requestState` payload, so Projection is
|
|
17
22
|
fully stateless: any server instance can resume any workflow.
|
|
@@ -33,20 +38,21 @@ export default createMcpHandler(facade.serverFactory);
|
|
|
33
38
|
|
|
34
39
|
`serverFactory` carries the negotiated protocol era into each serving unit:
|
|
35
40
|
modern (2026-07-28) clients get MRTR approval round trips; legacy clients
|
|
36
|
-
still run read-only machines and get a structured error the
|
|
37
|
-
|
|
41
|
+
still run read-only machines and calls, and get a structured error the
|
|
42
|
+
moment a call needs approval. You can also wrap a connected SDK `Client` to put
|
|
38
43
|
Projection in front of a server you don't own.
|
|
39
44
|
|
|
40
45
|
## Security model
|
|
41
46
|
|
|
42
|
-
| Invariant | How it holds
|
|
43
|
-
| ------------------------------------------------------- |
|
|
44
|
-
| The tools bridge is the only way out of the sandbox | No `fetch`, no filesystem, no host globals; only `xstate` and `@astral-mcp/tools` resolve as imports
|
|
45
|
-
| No gated call runs without a matching approval | The approved name and arguments are sealed in the blob and executed from there
|
|
46
|
-
| Clients are untrusted couriers | Blobs are AES-256-GCM encrypted under a per-blob HKDF-derived key and authenticated
|
|
47
|
-
| A snapshot cannot resume under different code | The blob binds a SHA-256 hash of the original `code`
|
|
48
|
-
| A
|
|
49
|
-
|
|
|
47
|
+
| Invariant | How it holds |
|
|
48
|
+
| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
|
|
49
|
+
| The tools bridge is the only way out of the sandbox | No `fetch`, no filesystem, no host globals; only `xstate` and `@astral-mcp/tools` resolve as imports |
|
|
50
|
+
| No gated call runs without a matching approval | The approved name and arguments are sealed in the blob and executed from there |
|
|
51
|
+
| Clients are untrusted couriers | Blobs are AES-256-GCM encrypted under a per-blob HKDF-derived key and authenticated |
|
|
52
|
+
| A snapshot cannot resume under different code | The blob binds a SHA-256 hash of the original `code` — for `call_tool`, of the canonical `{ kind, name, args }` request |
|
|
53
|
+
| A blob answers only the tool that issued it | Blobs carry their kind; a `call_tool` blob cannot resume `execute_machine` or vice versa |
|
|
54
|
+
| A wrapped server's annotations are hints, not authority | Unannotated tools default to asking; developer overrides always win |
|
|
55
|
+
| Approval prompts cannot be forged | Prompt text comes from the catalog and redacted arguments, rendered inert |
|
|
50
56
|
|
|
51
57
|
## Documentation
|
|
52
58
|
|