@atbash/atbash-mcp 0.1.2 → 0.19.1-dev.0

package/dist/index.js

@@ -1,512 +1,26 @@
 #!/usr/bin/env node
-
-// src/index.ts
 import { Atbash, setupTelemetry, shutdownTelemetry } from "@atbash/sdk";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-
-// src/prompts/safety.ts
-import { z } from "zod";
-function registerSafetyPrompt(server2) {
-  const promptServer = server2;
-  if (!promptServer.registerPrompt) {
-    return;
-  }
-  promptServer.registerPrompt(
-    "atbash_safety_check",
-    {
-      description: "Prepare a consistent pre-execution Atbash safety review request.",
-      argsSchema: {
-        action: z.string().describe("Action to evaluate"),
-        context: z.string().describe("Why the action is being taken")
-      }
-    },
-    async ({ action, context }) => ({
-      messages: [
-        {
-          role: "user",
-          content: {
-            type: "text",
-            text: [
-              "Use the Atbash tools to evaluate the following action before execution.",
-              `Action: ${action}`,
-              `Context: ${context}`,
-              "If the result is HOLD, explain that operator review is required before proceeding."
-            ].join("\n")
-          }
-        }
-      ]
-    })
-  );
-}
-
-// src/resources/policy.ts
-function registerPolicyResource(server2, client2) {
-  void server2;
-  void client2;
-}
-
-// src/startup.ts
-function assertMcpSdkCapabilities(sdk) {
-  const missing = [
-    typeof sdk.fromConfig === "function" ? null : "fromConfig",
-    typeof sdk.prototype?.auditToolCall === "function" ? null : "auditToolCall"
-  ].filter((name) => name !== null);
-  if (missing.length > 0) {
-    throw new Error(
-      `Incompatible @atbash/sdk: missing required MCP capabilities: ${missing.join(", ")}. Refusing to start without an active safety gate.`
-    );
-  }
-}
-var DECISION_VERDICTS = [
-  "ALLOW",
-  "HOLD",
-  "BLOCK",
-  "ERROR"
-];
-function isDecisionShaped(value) {
-  const decision = value;
-  return typeof decision === "object" && decision !== null && typeof decision.allow === "boolean" && DECISION_VERDICTS.includes(decision.verdict);
-}
-function hardenJudgeClient(client2) {
-  const sdkAudit = client2.auditToolCall;
-  const sdkJudge = client2.judgeAction;
-  async function guardedAuditToolCall(input) {
-    let wire;
-    const shadow = Object.create(client2);
-    Object.defineProperty(shadow, "judgeAction", {
-      value: async (...args) => {
-        const result = await sdkJudge.apply(client2, args);
-        wire = result;
-        return result;
-      }
-    });
-    const decision = await sdkAudit.call(shadow, input);
-    if (!isDecisionShaped(decision)) {
-      throw new Error(
-        "judge decision is not verdict-shaped and cannot be trusted"
-      );
-    }
-    if (decision.verdict !== "ALLOW" || decision.allow !== true) {
-      return { ...decision, allow: false };
-    }
-    if (wire === void 0) {
-      throw new Error(
-        "judge returned an allow without a judge response to back it"
-      );
-    }
-    if (wire.verdict !== "ALLOW" || wire.actionType !== "allow") {
-      throw new Error(
-        `judge response body does not carry an allow (verdict ${JSON.stringify(wire.verdict)}, action_type ${JSON.stringify(wire.actionType)})`
-      );
-    }
-    return decision;
-  }
-  Object.defineProperty(client2, "auditToolCall", {
-    value: guardedAuditToolCall,
-    writable: true,
-    configurable: true
-  });
-  return client2;
-}
-function createAtbashClient(env, sdk) {
-  assertMcpSdkCapabilities(sdk);
-  const agentKey = env.ATBASH_AGENT_PRIVKEY;
-  if (!agentKey) {
-    throw new Error("ATBASH_AGENT_PRIVKEY env var is required");
-  }
-  const endpoint = env.ATBASH_ENDPOINT?.trim();
-  const orgName = env.ATBASH_ORG_NAME?.trim();
-  return hardenJudgeClient(
-    sdk.fromConfig({
-      agentKey,
-      ...endpoint ? { judge: { endpoint } } : {},
-      ...orgName ? { orgName } : {}
-    })
-  );
-}
-
-// src/tools/judge.ts
-import { z as z2 } from "zod";
-
-// src/utils.ts
-function safeErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function toJsonContent(value) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
-  };
-}
-function toErrorContent(error) {
-  return {
-    content: [{ type: "text", text: `Error: ${safeErrorMessage(error)}` }],
-    isError: true
-  };
-}
-
-// src/tools/judge.ts
-function toJudgeFailureContent(error, toolName = "atbash_judge") {
-  return {
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify(
-          {
-            verdict: "ERROR",
-            allow: false,
-            reason: `Atbash judge unavailable \u2014 treat this as BLOCK and do NOT proceed with the action (fail-closed). Retry ${toolName} once the service is reachable. Cause: ${safeErrorMessage(error)}`
-          },
-          null,
-          2
-        )
-      }
-    ],
-    isError: true
-  };
-}
-function denyUnlessExplicitlyAllowed(decision) {
-  return decision.verdict === "ALLOW" && decision.allow === true ? decision : { ...decision, allow: false };
-}
-function registerJudgeTools(server2, client2) {
-  server2.registerTool(
-    "atbash_judge",
-    {
-      description: "Submit an action for safety judgment before executing it. Returns ALLOW, HOLD, BLOCK, or ERROR.",
-      inputSchema: z2.object({
-        action: z2.string().describe("Plain text description of the action to judge"),
-        context: z2.string().describe("Why this action is being taken"),
-        tool_name: z2.string().optional().describe("Name of the tool being called"),
-        tool_args_json: z2.string().optional().describe("JSON string of tool arguments")
-      })
-    },
-    async ({ action, context, tool_name, tool_args_json }) => {
-      try {
-        let parsedArgs = void 0;
-        if (tool_args_json) {
-          try {
-            parsedArgs = JSON.parse(tool_args_json);
-          } catch {
-            parsedArgs = tool_args_json;
-          }
-        }
-        const rawDecision = await client2.auditToolCall({
-          toolName: tool_name ?? "mcp_judge",
-          args: parsedArgs ?? { action },
-          context: `${action} \u2014 ${context}`
-        });
-        const decision = denyUnlessExplicitlyAllowed(rawDecision);
-        if (decision.verdict === "ERROR") {
-          return toJudgeFailureContent(
-            new Error(decision.reason ?? "judge returned an error verdict")
-          );
-        }
-        if (decision.verdict === "HOLD") {
-          const holdParts = [
-            "Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",
-            `Reason: ${decision.reason ?? ""}`
-          ];
-          if (decision.toolCallId) holdParts.push(`Tool Call ID: ${decision.toolCallId}`);
-          return toJsonContent({ ...decision, allow: false, reason: holdParts.join("\n") });
-        }
-        return toJsonContent(decision);
-      } catch (error) {
-        return toJudgeFailureContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_log",
-    {
-      description: "Submit a tool call for Atbash safety judgment and logging. Returns ALLOW, HOLD, BLOCK, or ERROR.",
-      inputSchema: z2.object({
-        action: z2.string().describe("Action description"),
-        context: z2.string().describe("Action context"),
-        tool_name: z2.string().optional().describe("Tool name"),
-        tool_args_json: z2.string().optional().describe("Tool arguments JSON")
-      })
-    },
-    async ({ action, context, tool_name, tool_args_json }) => {
-      try {
-        let parsedArgs = void 0;
-        if (tool_args_json) {
-          try {
-            parsedArgs = JSON.parse(tool_args_json);
-          } catch {
-            parsedArgs = tool_args_json;
-          }
-        }
-        const rawDecision = await client2.auditToolCall({
-          toolName: tool_name ?? "mcp_log",
-          args: parsedArgs ?? { action },
-          context: `${action} \u2014 ${context}`
-        });
-        const decision = denyUnlessExplicitlyAllowed(rawDecision);
-        if (decision.verdict === "ERROR") {
-          return toJudgeFailureContent(
-            new Error(decision.reason ?? "judge returned an error verdict"),
-            "atbash_log"
-          );
-        }
-        if (decision.verdict === "HOLD") {
-          const holdParts = [
-            "Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",
-            `Reason: ${decision.reason ?? ""}`
-          ];
-          if (decision.toolCallId) holdParts.push(`Tool Call ID: ${decision.toolCallId}`);
-          return toJsonContent({ ...decision, allow: false, reason: holdParts.join("\n") });
-        }
-        return toJsonContent(decision);
-      } catch (error) {
-        return toJudgeFailureContent(error, "atbash_log");
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_check_agent",
-    {
-      description: "Check whether an agent is registered on the Atbash platform.",
-      inputSchema: z2.object({
-        pubkey: z2.string().optional().describe("Agent public key, defaults to this server agent")
-      })
-    },
-    async ({ pubkey }) => {
-      try {
-        const selectedPubkey = pubkey ?? client2.pubkey;
-        const registered = await client2.checkAgentExists(selectedPubkey);
-        return toJsonContent({ registered, pubkey: selectedPubkey });
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-}
-
-// src/tools/queries.ts
-import { z as z3 } from "zod";
-function defaultMaxCount(value) {
-  return value ?? 20;
-}
-function registerQueryTools(server2, client2) {
-  server2.registerTool(
-    "atbash_get_policy",
-    {
-      description: "Get an agent policy configuration and jail status.",
-      inputSchema: z3.object({
-        pubkey: z3.string().optional().describe("Agent public key, defaults to the server agent")
-      })
-    },
-    async ({ pubkey }) => {
-      try {
-        return toJsonContent(await client2.getAgentPolicy(pubkey ?? client2.pubkey));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_agent_detail",
-    {
-      description: "Get agent metadata for a public key.",
-      inputSchema: z3.object({
-        pubkey: z3.string().optional().describe("Agent public key, defaults to the server agent")
-      })
-    },
-    async ({ pubkey }) => {
-      try {
-        return toJsonContent(await client2.getAgentDetail(pubkey ?? client2.pubkey));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_tool_calls",
-    {
-      description: "List recent tool calls across all agents.",
-      inputSchema: z3.object({
-        max_count: z3.number().int().positive().optional().describe("Maximum number of records")
-      })
-    },
-    async ({ max_count }) => {
-      try {
-        return toJsonContent(await client2.getToolCalls(defaultMaxCount(max_count)));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_agent_tool_calls",
-    {
-      description: "List recent tool calls for one agent.",
-      inputSchema: z3.object({
-        pubkey: z3.string().optional().describe("Agent public key, defaults to the server agent"),
-        max_count: z3.number().int().positive().optional().describe("Maximum number of records")
-      })
-    },
-    async ({ pubkey, max_count }) => {
-      try {
-        return toJsonContent(
-          await client2.getAgentToolCalls(pubkey ?? client2.pubkey, defaultMaxCount(max_count))
-        );
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_org_tool_calls",
-    {
-      description: "List recent tool calls for an organization.",
-      inputSchema: z3.object({
-        org_name: z3.string().describe("Organization name"),
-        max_count: z3.number().int().positive().optional().describe("Maximum number of records")
-      })
-    },
-    async ({ org_name, max_count }) => {
-      try {
-        return toJsonContent(await client2.getOrgToolCalls(org_name, defaultMaxCount(max_count)));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_tool_call_full",
-    {
-      description: "Get the full detail for a single tool call.",
-      inputSchema: z3.object({
-        tool_call_id: z3.string().describe("Tool call identifier")
-      })
-    },
-    async ({ tool_call_id }) => {
-      try {
-        return toJsonContent(await client2.getToolCallFull(tool_call_id));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_tool_call_count",
-    {
-      description: "Get the total number of tool calls on-chain.",
-      inputSchema: z3.object({})
-    },
-    async () => {
-      try {
-        return toJsonContent({ count: await client2.getToolCallCount() });
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_tier_info",
-    {
-      description: "Get an organization's tier and enforcement information.",
-      inputSchema: z3.object({
-        org_name: z3.string().describe("Organization name")
-      })
-    },
-    async ({ org_name }) => {
-      try {
-        return toJsonContent(await client2.getOrgTierInfo(org_name));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_held_actions",
-    {
-      description: "List actions currently waiting for operator review.",
-      inputSchema: z3.object({
-        org_name: z3.string().describe("Organization name"),
-        max_count: z3.number().int().positive().optional().describe("Maximum number of records")
-      })
-    },
-    async ({ org_name, max_count }) => {
-      try {
-        return toJsonContent(
-          await client2.getPendingHeldActions(org_name, defaultMaxCount(max_count))
-        );
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_reviews",
-    {
-      description: "List completed operator reviews for held actions.",
-      inputSchema: z3.object({
-        org_name: z3.string().describe("Organization name"),
-        max_count: z3.number().int().positive().optional().describe("Maximum number of records")
-      })
-    },
-    async ({ org_name, max_count }) => {
-      try {
-        return toJsonContent(await client2.getHeldActionReviews(org_name, defaultMaxCount(max_count)));
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-  server2.registerTool(
-    "atbash_get_safety_stats",
-    {
-      description: "Get high-level chain-wide safety statistics.",
-      inputSchema: z3.object({})
-    },
-    async () => {
-      try {
-        return toJsonContent(await client2.getSafetyStats());
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-}
-
-// src/tools/status.ts
-import { z as z4 } from "zod";
-function registerStatusTools(server2, client2) {
-  server2.registerTool(
-    "atbash_judgment_status",
-    {
-      description: "Poll the status of a previously submitted judgment.",
-      inputSchema: z4.object({
-        tool_call_id: z4.string().describe("The tool_call_id returned from atbash_judge"),
-        agent_pubkey: z4.string().optional().describe("Agent public key, defaults to the server agent")
-      })
-    },
-    async ({ tool_call_id, agent_pubkey }) => {
-      try {
-        const status = await client2.getJudgmentStatus(tool_call_id, agent_pubkey);
-        return toJsonContent(status);
-      } catch (error) {
-        return toErrorContent(error);
-      }
-    }
-  );
-}
-
-// src/index.ts
-var client = createAtbashClient(process.env, Atbash);
+import { registerSafetyPrompt } from "./prompts/safety.js";
+import { registerPolicyResource } from "./resources/policy.js";
+import { createAtbashClient } from "./startup.js";
+import { registerJudgeTools } from "./tools/judge.js";
+import { registerQueryTools } from "./tools/queries.js";
+import { registerStatusTools } from "./tools/status.js";
+const client = createAtbashClient(process.env, Atbash);
 setupTelemetry({ enabled: true, source: "plugin:mcp" });
 process.once("beforeExit", () => shutdownTelemetry());
 process.once("SIGINT", () => shutdownTelemetry().finally(() => process.exit(0)));
 process.once("SIGTERM", () => shutdownTelemetry().finally(() => process.exit(0)));
-var server = new McpServer({
-  name: "atbash-safety",
-  version: "1.0.0"
+const server = new McpServer({
+    name: "atbash-safety",
+    version: "1.0.0",
 });
 registerJudgeTools(server, client);
 registerStatusTools(server, client);
 registerQueryTools(server, client);
 registerPolicyResource(server, client);
 registerSafetyPrompt(server);
-var transport = new StdioServerTransport();
+const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/no-execution-gate.test.js

@@ -0,0 +1,103 @@
+// CRITICAL-2 regression sentinel (see SECURITY-AUDIT-corebreak.md and
+// SECURITY-AUDIT-atbash-ai-migration.md): this package registers
+// atbash_judge/atbash_log as ordinary, optional MCP tools alongside whatever
+// real tools exist elsewhere on the host. It does not wrap, proxy, or gate
+// execution of any other tool — there is no executor in this package at
+// all. A tool call that arrives already-formed (prompt injection, a
+// compromised model, a host replaying a stored function call, or a model
+// that just skips the advisory step) reaches whatever real MCP server
+// executes it with zero interaction with Atbash.
+//
+// This test currently PASSES because that gap still exists. If a future
+// version adds real tool-execution gating, the assertions below should
+// start failing — that's the signal to re-audit CRITICAL-2, not to widen
+// the allowlist to make the test pass again.
+import { describe, it, expect, vi } from "vitest";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { registerJudgeTools } from "./tools/judge.js";
+import { registerQueryTools } from "./tools/queries.js";
+import { registerStatusTools } from "./tools/status.js";
+import { registerPolicyResource } from "./resources/policy.js";
+const KNOWN_SAFE_TOOL_NAMES = [
+    "atbash_judge",
+    "atbash_log",
+    "atbash_check_agent",
+    "atbash_get_policy",
+    "atbash_get_agent_detail",
+    "atbash_get_tool_calls",
+    "atbash_get_agent_tool_calls",
+    "atbash_get_org_tool_calls",
+    "atbash_get_tool_call_full",
+    "atbash_get_tool_call_count",
+    "atbash_get_tier_info",
+    "atbash_get_held_actions",
+    "atbash_get_reviews",
+    "atbash_get_safety_stats",
+    "atbash_judgment_status",
+].sort();
+// A server double that only implements registerTool — any other method call
+// (setRequestHandler, a generic dispatch/proxy API, etc.) throws instead of
+// silently succeeding, so a future executor-style registration can't hide
+// behind an untested server method.
+function makeStrictServer() {
+    const registered = [];
+    return new Proxy({ registerTool: (name) => registered.push(name) }, {
+        get(target, prop, receiver) {
+            if (prop === "registered")
+                return registered;
+            if (prop in target)
+                return Reflect.get(target, prop, receiver);
+            throw new Error(`unexpected MCP server method called: ${String(prop)}`);
+        },
+    });
+}
+const fakeClient = {
+    auditToolCall: vi.fn(),
+    checkAgentExists: vi.fn(),
+    pubkey: "x",
+};
+describe("CRITICAL-2 sentinel: atbash-mcp registers no execution gate", () => {
+    it("the registered tool set is exactly the known judge/read-only set — nothing else", () => {
+        const server = makeStrictServer();
+        registerJudgeTools(server, fakeClient);
+        registerQueryTools(server, fakeClient);
+        registerStatusTools(server, fakeClient);
+        registerPolicyResource(server, fakeClient);
+        expect([...server.registered].sort()).toEqual(KNOWN_SAFE_TOOL_NAMES);
+    });
+    it("registerPolicyResource is a documented no-op", () => {
+        const server = makeStrictServer();
+        // Would throw via the Proxy above if this function called any server
+        // method other than nothing at all.
+        expect(() => registerPolicyResource(server, fakeClient)).not.toThrow();
+        expect(server.registered).toEqual([]);
+    });
+    it("no source file in this package contains an execution/proxy primitive", () => {
+        const srcDir = fileURLToPath(new URL(".", import.meta.url));
+        const files = [
+            "index.ts",
+            "tools/judge.ts",
+            "tools/queries.ts",
+            "tools/status.ts",
+            "resources/policy.ts",
+            "prompts/safety.ts",
+        ];
+        const executionPatterns = [
+            /child_process/,
+            /\bexec\(/,
+            /\bspawn\(/,
+            /new Function\(/,
+            /\beval\(/,
+            /forwardRequest/,
+            /proxyTool/,
+            /dispatchTool/,
+        ];
+        for (const file of files) {
+            const source = readFileSync(srcDir + file, "utf8");
+            for (const pattern of executionPatterns) {
+                expect(source, `${file} matched ${pattern}`).not.toMatch(pattern);
+            }
+        }
+    });
+});

package/dist/prompts/safety.js

@@ -0,0 +1,29 @@
+import { z } from "zod";
+export function registerSafetyPrompt(server) {
+    const promptServer = server;
+    if (!promptServer.registerPrompt) {
+        return;
+    }
+    promptServer.registerPrompt("atbash_safety_check", {
+        description: "Prepare a consistent pre-execution Atbash safety review request.",
+        argsSchema: {
+            action: z.string().describe("Action to evaluate"),
+            context: z.string().describe("Why the action is being taken"),
+        },
+    }, async ({ action, context }) => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: [
+                        "Use the Atbash tools to evaluate the following action before execution.",
+                        `Action: ${action}`,
+                        `Context: ${context}`,
+                        "If the result is HOLD, explain that operator review is required before proceeding.",
+                    ].join("\n"),
+                },
+            },
+        ],
+    }));
+}

package/dist/resources/policy.js

@@ -0,0 +1,6 @@
+export function registerPolicyResource(server, client) {
+    void server;
+    void client;
+    // MCP SDK resource registration shape is unstable across versions.
+    // Tool-based policy access remains available through `atbash_get_policy`.
+}