@auth51/mcp-proxy 0.1.0

package/README.md

@@ -0,0 +1,146 @@
+# @auth51/mcp-proxy
+
+**Least-privilege enforcement + a real audit trail at the MCP tool boundary — for AI coding agents.**
+
+Claude Code, Cursor, and Codex run with your full permissions, call MCP tools that touch repos / databases / infra / prod, and leave **no record** that your existing security tooling can see. A staging token with broad rights let one agent [delete a production database *and all backups* in 9 seconds](https://thehackernews.com/2026/03/how-ceros-gives-security-teams.html). Six disclosed exploits broke coding agents by stealing their *credentials*, not their models.
+
+`@auth51/mcp-proxy` drops in front of **any** MCP server. It inspects every `tools/call`, **blocks destructive or out-of-scope actions before they reach the tool**, and writes an append-only audit log of everything the agent tried. No account required to start.
+
+```
+   coding agent  ──►  @auth51/mcp-proxy  ──►  your MCP server
+ (Claude/Cursor)      ▲ allow / DENY + audit
+```
+
+---
+
+## Quickstart (≈ 5 minutes)
+
+### 1. See it block a destructive call (no install of your own needed)
+
+```bash
+git clone <this repo> && cd auth51-mcp-proxy
+npm install && npm run build
+node examples/demo-drive.mjs
+```
+
+You'll see a safe `SELECT` pass through, and `DROP TABLE` / `DELETE`-without-`WHERE` **blocked at the boundary** — with the agent told exactly why, and an audit trail at `.auth51/demo-audit.jsonl`.
+
+### 2. Guard your own MCP server
+
+Wrap any existing MCP server entry in your client config. **Before:**
+
+```jsonc
+// .cursor/mcp.json  (or Claude Code / Codex MCP config)
+{
+  "mcpServers": {
+    "postgres": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-postgres", "postgres://..."]
+    }
+  }
+}
+```
+
+**After** — insert the proxy and move the real command after `--`:
+
+```jsonc
+{
+  "mcpServers": {
+    "postgres": {
+      "command": "npx",
+      "args": [
+        "-y", "@auth51/mcp-proxy",
+        "--policy", "./auth51.policy.json",
+        "--label", "postgres",
+        "--",
+        "npx", "-y", "@modelcontextprotocol/server-postgres", "postgres://..."
+      ]
+    }
+  }
+}
+```
+
+Restart your agent. Destructive calls are now blocked, everything is audited. That's it.
+
+---
+
+## Policy
+
+A policy is JSON: `default` decision plus `rules`. Each rule matches a tool by name
+(`tool` glob or `toolMatch` regex) and optionally by argument content
+(`denyArgsMatch` — regexes against the call arguments; supports a leading `(?i)`
+for case-insensitivity). First matching rule wins.
+
+```json
+{
+  "version": "1",
+  "default": "allow",
+  "rules": [
+    {
+      "id": "no-drop-or-truncate",
+      "tool": "*",
+      "denyArgsMatch": ["(?i)\\bdrop\\s+(table|database)\\b", "(?i)\\btruncate\\s+table\\b"],
+      "reason": "Irreversible data destruction requires human approval."
+    }
+  ]
+}
+```
+
+With **no `--policy`**, a conservative built-in default blocks destructive SQL,
+recursive `rm -rf`, destructive tool names, and reads of `.aws/credentials` /
+`.ssh` keys / `.env`. See [`examples/auth51.policy.json`](examples/auth51.policy.json).
+
+---
+
+## Connect to an auth51 authority (teams & enterprise)
+
+Local mode enforces policy and audits to disk — enough for one developer. Point it
+at an **auth51 authority** and every *allowed* call is backed by a **scoped,
+short-lived intent token** (carrying the agent's identity + Proof-of-Possession),
+and decisions are centralized for your org/tenant.
+
+```bash
+export AUTH51_AUTHORITY_URL=https://authority.auth51.com
+export AUTH51_CLIENT_ID=...        # your org/app API key
+export AUTH51_CLIENT_SECRET=...
+# add --authority to the proxy args (or set AUTH51_AUTHORITY_URL)
+```
+
+The authority path is **fail-open** in v0: local policy is always the binding
+enforcement point, so an authority outage can never wedge your agent. A local
+*deny* always wins.
+
+- **Individual developers:** local mode, or the hosted authority (SaaS) — authority server only.
+- **Enterprise:** the same authority self-hosted (on-prem container) or as a dedicated SaaS tenant.
+
+---
+
+## CLI
+
+```
+auth51-mcp-proxy [options] -- <mcp-server-command> [args...]
+
+  --policy <path>    Policy JSON (default: built-in safe defaults)
+  --audit <path>     Audit log JSONL (default: ./.auth51/audit.jsonl)
+  --label <name>     Friendly name for this server in logs/audit
+  --agent <id>       Agent identity to attribute decisions to
+  --authority <url>  auth51 authority base URL (or AUTH51_AUTHORITY_URL)
+```
+
+## How it works
+
+- Transparent stdio MCP proxy: spawns your server, relays JSON-RPC line-for-line.
+- Only `tools/call` is intercepted; everything else passes through untouched.
+- On `tools/call`: evaluate policy → **allow** (forward, zero added latency) or
+  **deny** (return an MCP `isError` result explaining the block; never forward).
+- Every decision is appended to the audit log; with an authority, allowed calls
+  also mint a scoped intent token and record the decision centrally.
+
+## Status
+
+v0. Stdio transport (the dominant local coding-agent case). HTTP/SSE transport,
+per-tool scope grants, and the agent-runtime identity surface are next.
+
+## License
+
+Apache-2.0

package/dist/audit.d.ts

@@ -0,0 +1,13 @@
+import type { AuditEntry } from "./types.js";
+/**
+ * Append-only local audit log (JSONL). Every tool-call decision is recorded here
+ * regardless of whether an authority is connected, so an individual developer can
+ * see exactly what their coding agent tried to do — the trail that today's
+ * locally-running agents leave nowhere.
+ */
+export declare class Auditor {
+    private path;
+    constructor(path: string);
+    record(entry: AuditEntry): void;
+}
+export declare function nowIso(): string;

package/dist/audit.js

@@ -0,0 +1,32 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Append-only local audit log (JSONL). Every tool-call decision is recorded here
+ * regardless of whether an authority is connected, so an individual developer can
+ * see exactly what their coding agent tried to do — the trail that today's
+ * locally-running agents leave nowhere.
+ */
+export class Auditor {
+    path;
+    constructor(path) {
+        this.path = path;
+        try {
+            mkdirSync(dirname(path), { recursive: true });
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    record(entry) {
+        try {
+            appendFileSync(this.path, JSON.stringify(entry) + "\n", "utf8");
+        }
+        catch {
+            /* never let auditing crash the proxy */
+        }
+    }
+}
+export function nowIso() {
+    return new Date().toISOString();
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,MAAM,OAAO,OAAO;IACV,IAAI,CAAS;IAErB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAiB;QACtB,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/authority.d.ts

@@ -0,0 +1,85 @@
+import type { AuthorityConfig, GrantInfo, RSEndpoint } from "./types.js";
+/**
+ * Optional integration with the auth51 authority server.
+ *
+ * Without it, the proxy enforces policy locally and writes a local audit trail —
+ * enough for an individual developer to try in minutes. With it, allowed calls are
+ * backed by a *scoped, short-lived intent token* minted by the authority (carrying
+ * the agent identity + Proof-of-Possession), and decisions are centralized for an
+ * org / enterprise tenant.
+ *
+ * The authority path is best-effort and FAIL-OPEN in v0: local policy remains the
+ * binding enforcement point, so an authority outage cannot wedge a developer's
+ * agent. Local-deny always wins regardless of the authority.
+ */
+export declare class AuthorityClient {
+    private cfg;
+    private accessTokens;
+    private warned;
+    constructor(cfg: AuthorityConfig);
+    private base;
+    private warnOnce;
+    /**
+     * Get a client_credentials token carrying `generate:intent-token` (permission
+     * to mint) PLUS the scopes being delegated. The authority enforces that an
+     * intent token's `requested_scopes` are a subset of the caller's OAuth-token
+     * scopes — you can't delegate more than you hold — so the OAuth token must
+     * carry both. Cached per distinct scope-set.
+     */
+    private accessTokenFor;
+    /**
+     * Fetch this agent's current grant envelope from the authority (Slice 2d):
+     * GET /v1/grants/{appId}/{agentId}. The proxy uses it to filter tools/list to
+     * the granted surface and to deny out-of-grant calls when mode==="enforce".
+     *
+     * Fail-open: returns null on any error / 404 (no grant registered) / missing
+     * config, so a developer without an authority-side grant keeps working on
+     * local policy alone. Local policy + the authority's own mint-time enforcement
+     * remain the binding controls regardless.
+     */
+    fetchGrant(): Promise<GrantInfo | null>;
+    /**
+     * Mint a scoped intent token for an allowed call (authority TokenRequest shape:
+     * grant_type="agent_checksum" + agent_id + computed_checksum + requested_scopes).
+     * The minted intent token is returned in the response's `access_token`.
+     * Returns the token + its jti for the audit chain, or null if the authority is
+     * unreachable / not provisioned (fail-open).
+     */
+    mintIntent(opts: {
+        scope: string;
+        workflowId?: string;
+        workflowStep?: Record<string, unknown>;
+        delegationContext?: Record<string, unknown>;
+    }): Promise<{
+        jti: string;
+        token: string;
+    } | null>;
+    /**
+     * Fetch a resource server's registered endpoint catalog (O6):
+     * GET /v1/resource-servers/{rsId}/endpoints → `[{method, path_template, scope,
+     * risk_tier}]`. The egress uses it to map a CONCRETE request (`GET /repos/42`)
+     * to its route TEMPLATE (`/repos/{id}`) and thus the exact scope the verifier
+     * will require. Returns [] on any error / missing catalog (the egress then
+     * falls back to deriving the scope from the concrete path).
+     */
+    fetchEndpoints(rsId: string): Promise<RSEndpoint[]>;
+    /**
+     * Hop B (RFC 8693): exchange a Hop-A intent token (subject) for a downstream
+     * token scoped + audienced for the resource server the MCP server is about to
+     * call. Used at the server→RS egress: the proxy derives the endpoint's
+     * `a51:rs:*` scope from the concrete method+URL (see scopes.ts) and requests
+     * exactly it here. The proxy authenticates as ITSELF (its OAuth client) — that
+     * is the verifiable identity on this hop; the agent identity rode in the
+     * subject token. `cnfJkt` binds the result to the proxy's DPoP key (RFC 9449),
+     * so the downstream RS token is sender-constrained to this proxy.
+     *
+     * Fail-open like the rest: returns null on any error, so an authority hiccup
+     * degrades to forwarding without the RS token rather than wedging the call.
+     */
+    exchangeToken(opts: {
+        subjectToken: string;
+        audience: string;
+        scope?: string;
+        cnfJkt?: string;
+    }): Promise<string | null>;
+}

package/dist/authority.js

@@ -0,0 +1,266 @@
+/**
+ * Optional integration with the auth51 authority server.
+ *
+ * Without it, the proxy enforces policy locally and writes a local audit trail —
+ * enough for an individual developer to try in minutes. With it, allowed calls are
+ * backed by a *scoped, short-lived intent token* minted by the authority (carrying
+ * the agent identity + Proof-of-Possession), and decisions are centralized for an
+ * org / enterprise tenant.
+ *
+ * The authority path is best-effort and FAIL-OPEN in v0: local policy remains the
+ * binding enforcement point, so an authority outage cannot wedge a developer's
+ * agent. Local-deny always wins regardless of the authority.
+ */
+export class AuthorityClient {
+    cfg;
+    accessTokens = new Map();
+    warned = false;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    base(path) {
+        return this.cfg.baseUrl.replace(/\/$/, "") + path;
+    }
+    warnOnce(msg) {
+        if (this.warned)
+            return;
+        this.warned = true;
+        process.stderr.write(`[auth51] authority unavailable, continuing on local policy: ${msg}\n`);
+    }
+    /**
+     * Get a client_credentials token carrying `generate:intent-token` (permission
+     * to mint) PLUS the scopes being delegated. The authority enforces that an
+     * intent token's `requested_scopes` are a subset of the caller's OAuth-token
+     * scopes — you can't delegate more than you hold — so the OAuth token must
+     * carry both. Cached per distinct scope-set.
+     */
+    async accessTokenFor(scope) {
+        const full = ["generate:intent-token", ...scope.split(/\s+/).filter(Boolean)].join(" ");
+        const now = Date.now();
+        const cached = this.accessTokens.get(full);
+        if (cached && now < cached.exp - 5000)
+            return cached.token;
+        try {
+            const res = await fetch(this.base("/v1/oauth/token"), {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({
+                    grant_type: "client_credentials",
+                    client_id: this.cfg.clientId,
+                    client_secret: this.cfg.clientSecret,
+                    scope: full,
+                }),
+            });
+            if (!res.ok) {
+                this.warnOnce(`token endpoint returned ${res.status}`);
+                return null;
+            }
+            const data = (await res.json());
+            if (!data.access_token) {
+                this.warnOnce("token endpoint returned no access_token");
+                return null;
+            }
+            this.accessTokens.set(full, { token: data.access_token, exp: now + (data.expires_in ?? 300) * 1000 });
+            return data.access_token;
+        }
+        catch (err) {
+            this.warnOnce(err.message);
+            return null;
+        }
+    }
+    /**
+     * Fetch this agent's current grant envelope from the authority (Slice 2d):
+     * GET /v1/grants/{appId}/{agentId}. The proxy uses it to filter tools/list to
+     * the granted surface and to deny out-of-grant calls when mode==="enforce".
+     *
+     * Fail-open: returns null on any error / 404 (no grant registered) / missing
+     * config, so a developer without an authority-side grant keeps working on
+     * local policy alone. Local policy + the authority's own mint-time enforcement
+     * remain the binding controls regardless.
+     */
+    async fetchGrant() {
+        if (!this.cfg.appId || !this.cfg.agentId) {
+            this.warnOnce("no appId/agentId configured; cannot fetch agent grant");
+            return null;
+        }
+        const token = await this.accessTokenFor("read:agents");
+        if (!token)
+            return null;
+        try {
+            const path = `/v1/grants/${encodeURIComponent(this.cfg.appId)}/${encodeURIComponent(this.cfg.agentId)}`;
+            const res = await fetch(this.base(path), {
+                headers: { authorization: `Bearer ${token}` },
+            });
+            if (res.status === 404)
+                return null; // no grant registered → fail-open
+            if (!res.ok) {
+                this.warnOnce(`grant fetch returned ${res.status}`);
+                return null;
+            }
+            const d = (await res.json());
+            return {
+                allowedScopes: d.allowed_scopes ?? [],
+                stepUpScopes: d.step_up_scopes ?? [],
+                mode: d.mode === "observe" ? "observe" : "enforce",
+                version: d.version ?? 0,
+                source: d.source ?? "unknown",
+                expiresAt: d.expires_at ?? null,
+            };
+        }
+        catch (err) {
+            this.warnOnce(err.message);
+            return null;
+        }
+    }
+    /**
+     * Mint a scoped intent token for an allowed call (authority TokenRequest shape:
+     * grant_type="agent_checksum" + agent_id + computed_checksum + requested_scopes).
+     * The minted intent token is returned in the response's `access_token`.
+     * Returns the token + its jti for the audit chain, or null if the authority is
+     * unreachable / not provisioned (fail-open).
+     */
+    async mintIntent(opts) {
+        const token = await this.accessTokenFor(opts.scope);
+        if (!token)
+            return null;
+        if (!this.cfg.agentId || !this.cfg.agentChecksum) {
+            this.warnOnce("no agentId/agentChecksum configured; cannot mint intent token");
+            return null;
+        }
+        try {
+            const res = await fetch(this.base("/v1/intent/token"), {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${token}`,
+                },
+                body: JSON.stringify({
+                    grant_type: "agent_checksum",
+                    agent_id: this.cfg.agentId,
+                    computed_checksum: this.cfg.agentChecksum,
+                    requested_scopes: opts.scope ? opts.scope.split(/\s+/).filter(Boolean) : [],
+                    audience: this.cfg.audience ?? "",
+                    workflow_id: opts.workflowId,
+                    workflow_step: opts.workflowStep,
+                    delegation_context: opts.delegationContext,
+                    // The MCP proxy does NOT use the authority's pre-registered workflow-DAG
+                    // authorization (that 403s on any unregistered workflow_id). Our workflow
+                    // provenance is the prev_jti hash-chain (§4.3); workflow_id/step ride along
+                    // for the audit + token claims, informational only. Flip to true later if
+                    // we register workflows in the authority (calibration model, Slice 2+).
+                    workflow_enabled: false,
+                }),
+            });
+            if (!res.ok) {
+                this.warnOnce(`intent mint returned ${res.status}`);
+                return null;
+            }
+            const data = (await res.json());
+            const intentToken = data.access_token;
+            if (!intentToken)
+                return null;
+            const jti = parseJti(intentToken) ?? "unknown";
+            return { jti, token: intentToken };
+        }
+        catch (err) {
+            this.warnOnce(err.message);
+            return null;
+        }
+    }
+    /**
+     * Fetch a resource server's registered endpoint catalog (O6):
+     * GET /v1/resource-servers/{rsId}/endpoints → `[{method, path_template, scope,
+     * risk_tier}]`. The egress uses it to map a CONCRETE request (`GET /repos/42`)
+     * to its route TEMPLATE (`/repos/{id}`) and thus the exact scope the verifier
+     * will require. Returns [] on any error / missing catalog (the egress then
+     * falls back to deriving the scope from the concrete path).
+     */
+    async fetchEndpoints(rsId) {
+        const token = await this.accessTokenFor("read:agents");
+        if (!token)
+            return [];
+        try {
+            const path = `/v1/resource-servers/${encodeURIComponent(rsId)}/endpoints`;
+            const res = await fetch(this.base(path), {
+                headers: { authorization: `Bearer ${token}` },
+            });
+            if (!res.ok)
+                return [];
+            const rows = (await res.json());
+            return rows.map((r) => ({
+                method: (r.method ?? "GET").toUpperCase(),
+                pathTemplate: r.path_template ?? "/",
+                scope: r.scope ?? "",
+                riskTier: r.risk_tier ?? "low",
+            }));
+        }
+        catch (err) {
+            this.warnOnce(err.message);
+            return [];
+        }
+    }
+    /**
+     * Hop B (RFC 8693): exchange a Hop-A intent token (subject) for a downstream
+     * token scoped + audienced for the resource server the MCP server is about to
+     * call. Used at the server→RS egress: the proxy derives the endpoint's
+     * `a51:rs:*` scope from the concrete method+URL (see scopes.ts) and requests
+     * exactly it here. The proxy authenticates as ITSELF (its OAuth client) — that
+     * is the verifiable identity on this hop; the agent identity rode in the
+     * subject token. `cnfJkt` binds the result to the proxy's DPoP key (RFC 9449),
+     * so the downstream RS token is sender-constrained to this proxy.
+     *
+     * Fail-open like the rest: returns null on any error, so an authority hiccup
+     * degrades to forwarding without the RS token rather than wedging the call.
+     */
+    async exchangeToken(opts) {
+        try {
+            const body = {
+                grant_type: TOKEN_EXCHANGE_GRANT,
+                subject_token: opts.subjectToken,
+                subject_token_type: JWT_TOKEN_TYPE,
+                audience: opts.audience,
+            };
+            if (opts.scope)
+                body.scope = opts.scope;
+            // Authenticate the exchanging party (the proxy) when credentials exist —
+            // this is the proxy's own verifiable identity on the Hop-B exchange.
+            if (this.cfg.clientId)
+                body.client_id = this.cfg.clientId;
+            if (this.cfg.clientSecret)
+                body.client_secret = this.cfg.clientSecret;
+            if (opts.cnfJkt)
+                body.cnf_jkt = opts.cnfJkt;
+            const res = await fetch(this.base("/v1/oauth/token"), {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams(body),
+            });
+            if (!res.ok) {
+                this.warnOnce(`token exchange returned ${res.status}`);
+                return null;
+            }
+            const data = (await res.json());
+            return data.access_token ?? null;
+        }
+        catch (err) {
+            this.warnOnce(err.message);
+            return null;
+        }
+    }
+}
+const TOKEN_EXCHANGE_GRANT = "urn:ietf:params:oauth:grant-type:token-exchange";
+const JWT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:jwt";
+/** Extract the jti claim from a JWT without verifying it (audit display only). */
+function parseJti(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return typeof payload.jti === "string" ? payload.jti : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IAClB,GAAG,CAAkB;IACrB,YAAY,GAAG,IAAI,GAAG,EAA0C,CAAC;IACjE,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,GAAoB;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACpD,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,GAAG,IAAI,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,MAAM,IAAI,GAAG,CAAC,uBAAuB,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBACpD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;oBAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;oBACpC,KAAK,EAAE,IAAI;iBACZ,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;YAClF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;YACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAO1B,CAAC;YACF,OAAO;gBACL,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,EAAE;gBACrC,YAAY,EAAE,CAAC,CAAC,cAAc,IAAI,EAAE;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAClD,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;gBAC7B,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,IAKhB;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,gBAAgB;oBAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;oBAC1B,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa;oBACzC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;oBAC3E,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE;oBACjC,WAAW,EAAE,IAAI,CAAC,UAAU;oBAC5B,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB;oBAC1C,yEAAyE;oBACzE,0EAA0E;oBAC1E,4EAA4E;oBAC5E,0EAA0E;oBAC1E,wEAAwE;oBACxE,gBAAgB,EAAE,KAAK;iBACxB,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;YACtC,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;YAC/C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK5B,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;gBACzC,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG;gBACpC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;gBACpB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK;aAC/B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CAAC,IAKnB;QACC,IAAI,CAAC;YACH,MAAM,IAAI,GAA2B;gBACnC,UAAU,EAAE,oBAAoB;gBAChC,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,kBAAkB,EAAE,cAAc;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,IAAI,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACxC,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY;gBAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACtE,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBACpD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAE9D,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/egress.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Server→RS egress: the proxy's Hop-B (non-embed parity, DESIGN-proxy-egress-hop-b).
+ *
+ * The MCP server's outbound RS calls are routed through this reverse-proxy (v1
+ * on-ramp: governed RS base URLs point here). For each request it:
+ *   1. maps the CONCRETE (method, path) to the registered endpoint TEMPLATE →
+ *      the exact `a51:rs:*` scope the verifier will require (O6);
+ *   2. obtains a Hop-A intent token — the in-flight one the embed put in `_meta`
+ *      (Case E), or one the proxy mints itself (Case T) — then EXCHANGES it
+ *      (RFC 8693) for a downstream, DPoP-bound, RS-scoped token;
+ *   3. attaches `Authorization: Bearer <rs-token>` (+ DPoP) and forwards.
+ * An ungoverned path (no scope match, no catalog) is a transparent passthrough.
+ * Fail-open throughout: any hiccup forwards the request unchanged.
+ */
+import * as http from "node:http";
+import type { AuthorityClient } from "./authority.js";
+import type { RSEndpoint } from "./types.js";
+export interface EgressConfig {
+    /** The governed RS's id — namespaces its scopes (usually === its audience). */
+    rsId: string;
+    /** Token audience for the exchange (often === rsId). */
+    audience: string;
+    /** Where to forward the (now-governed) request — the real RS base URL. */
+    targetBaseUrl: string;
+    /** DPoP-bind the downstream token to the proxy key. Default true. */
+    popEnabled?: boolean;
+}
+export declare function setInFlightIntent(token: string | null): void;
+export declare function getInFlightIntent(): string | null;
+/** Compile a route template (`/repos/{id}`) to an anchored matcher. */
+export declare function templateToRegex(template: string): RegExp;
+/** Strip query + trailing slash, collapse `//` — the concrete request path. */
+export declare function cleanPath(p: string): string;
+/**
+ * The registered endpoint whose (method, template) matches this concrete
+ * request, preferring the most specific (fewest params) on a tie — so a static
+ * `/files/latest` wins over `/files/{id}`.
+ */
+export declare function matchEndpoint(method: string, path: string, endpoints: RSEndpoint[]): RSEndpoint | null;
+export interface ScopeSelection {
+    scope: string;
+    matched: boolean;
+}
+/**
+ * The `a51:rs` scope to request for this request. Prefer the registered
+ * endpoint's stored scope (templated routes need the catalog to be right). If
+ * no catalog/match, derive from the concrete path — correct for parameterless
+ * routes, best-effort otherwise (a `{id}` route can't be recovered from one
+ * concrete path). Returns null only for an underivable request (bad method).
+ */
+export declare function selectScope(method: string, path: string, endpoints: RSEndpoint[], rsId: string): ScopeSelection | null;
+export interface ExchangeResult {
+    token: string;
+    scope: string;
+    matched: boolean;
+    cnfJkt?: string;
+}
+/**
+ * Obtain the downstream RS token for a request: select the scope, get a subject
+ * intent token (in-flight from `_meta`, Case E; else mint it, Case T), and
+ * exchange it (RFC 8693) for a DPoP-bound RS-scoped token. Null ⇒ passthrough.
+ */
+export declare function governedExchange(authority: AuthorityClient, cfg: EgressConfig, method: string, path: string, endpoints: RSEndpoint[]): Promise<ExchangeResult | null>;
+export interface EgressServer {
+    server: http.Server;
+    port: () => number;
+    close: () => Promise<void>;
+}
+/**
+ * Start the egress reverse-proxy. Point the MCP server's governed RS base URL at
+ * `http://127.0.0.1:<port>`; the proxy governs each call and forwards to
+ * `cfg.targetBaseUrl`. `onAudit` (optional) receives one record per request.
+ */
+export declare function createEgressServer(authority: AuthorityClient, cfg: EgressConfig, onAudit?: (rec: Record<string, unknown>) => void): EgressServer;