@auth51/mcp-proxy 0.1.0

package/dist/egress.js

@@ -0,0 +1,204 @@
+/**
+ * Server→RS egress: the proxy's Hop-B (non-embed parity, DESIGN-proxy-egress-hop-b).
+ *
+ * The MCP server's outbound RS calls are routed through this reverse-proxy (v1
+ * on-ramp: governed RS base URLs point here). For each request it:
+ *   1. maps the CONCRETE (method, path) to the registered endpoint TEMPLATE →
+ *      the exact `a51:rs:*` scope the verifier will require (O6);
+ *   2. obtains a Hop-A intent token — the in-flight one the embed put in `_meta`
+ *      (Case E), or one the proxy mints itself (Case T) — then EXCHANGES it
+ *      (RFC 8693) for a downstream, DPoP-bound, RS-scoped token;
+ *   3. attaches `Authorization: Bearer <rs-token>` (+ DPoP) and forwards.
+ * An ungoverned path (no scope match, no catalog) is a transparent passthrough.
+ * Fail-open throughout: any hiccup forwards the request unchanged.
+ */
+import * as http from "node:http";
+import { deriveScope, InvalidScope } from "./scopes.js";
+import * as pop from "./pop.js";
+// ── Ingress→egress bridge (single-flight) ───────────────────────────────────
+// The stdio ingress records the current tool call's intent token here (Case E,
+// from `_meta`); the egress reads it for the exchange. One in-flight tool call
+// at a time for a stdio server, so a single slot is correct (concurrent HTTP
+// servers need a real correlator — see the design §4).
+let _inFlightIntent = null;
+export function setInFlightIntent(token) {
+    _inFlightIntent = token;
+}
+export function getInFlightIntent() {
+    return _inFlightIntent;
+}
+// ── Route matching: concrete path → registered template → scope ─────────────
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Compile a route template (`/repos/{id}`) to an anchored matcher. */
+export function templateToRegex(template) {
+    let re = "";
+    let i = 0;
+    while (i < template.length) {
+        if (template[i] === "{") {
+            const end = template.indexOf("}", i);
+            if (end === -1) {
+                re += escapeRe(template.slice(i));
+                break;
+            }
+            re += "[^/]+"; // a single path segment
+            i = end + 1;
+        }
+        else {
+            const next = template.indexOf("{", i);
+            const lit = next === -1 ? template.slice(i) : template.slice(i, next);
+            re += escapeRe(lit);
+            i = next === -1 ? template.length : next;
+        }
+    }
+    return new RegExp("^" + re + "$");
+}
+/** Strip query + trailing slash, collapse `//` — the concrete request path. */
+export function cleanPath(p) {
+    const q = p.indexOf("?");
+    if (q >= 0)
+        p = p.slice(0, q);
+    p = "/" + p.replace(/^\/+/, "").replace(/\/+$/, "");
+    return p.replace(/\/{2,}/g, "/") || "/";
+}
+function paramCount(template) {
+    return (template.match(/\{[^}]+\}/g) || []).length;
+}
+/**
+ * The registered endpoint whose (method, template) matches this concrete
+ * request, preferring the most specific (fewest params) on a tie — so a static
+ * `/files/latest` wins over `/files/{id}`.
+ */
+export function matchEndpoint(method, path, endpoints) {
+    const m = method.toUpperCase();
+    const clean = cleanPath(path);
+    const hits = endpoints
+        .filter((e) => e.method.toUpperCase() === m && templateToRegex(e.pathTemplate).test(clean))
+        .sort((a, b) => paramCount(a.pathTemplate) - paramCount(b.pathTemplate));
+    return hits[0] ?? null;
+}
+/**
+ * The `a51:rs` scope to request for this request. Prefer the registered
+ * endpoint's stored scope (templated routes need the catalog to be right). If
+ * no catalog/match, derive from the concrete path — correct for parameterless
+ * routes, best-effort otherwise (a `{id}` route can't be recovered from one
+ * concrete path). Returns null only for an underivable request (bad method).
+ */
+export function selectScope(method, path, endpoints, rsId) {
+    const ep = matchEndpoint(method, path, endpoints);
+    if (ep && ep.scope)
+        return { scope: ep.scope, matched: true };
+    try {
+        return { scope: deriveScope(rsId, method, cleanPath(path)), matched: false };
+    }
+    catch (e) {
+        if (e instanceof InvalidScope)
+            return null;
+        throw e;
+    }
+}
+/**
+ * Obtain the downstream RS token for a request: select the scope, get a subject
+ * intent token (in-flight from `_meta`, Case E; else mint it, Case T), and
+ * exchange it (RFC 8693) for a DPoP-bound RS-scoped token. Null ⇒ passthrough.
+ */
+export async function governedExchange(authority, cfg, method, path, endpoints) {
+    const sel = selectScope(method, path, endpoints, cfg.rsId);
+    if (!sel)
+        return null;
+    // Case E: the embed's Hop-A token from _meta. Case T: mint one now (weaker,
+    // proxy-asserted identity) — same downstream path either way.
+    let subject = getInFlightIntent();
+    if (!subject) {
+        const minted = await authority.mintIntent({ scope: sel.scope });
+        subject = minted?.token ?? null;
+    }
+    if (!subject)
+        return null; // fail-open (no token → forward unchanged)
+    const cnfJkt = cfg.popEnabled === false ? undefined : pop.jkt();
+    const token = await authority.exchangeToken({
+        subjectToken: subject, audience: cfg.audience, scope: sel.scope, cnfJkt,
+    });
+    if (!token)
+        return null;
+    return { token, scope: sel.scope, matched: sel.matched, cnfJkt };
+}
+// ── Reverse-proxy server (v1 on-ramp) ───────────────────────────────────────
+async function readBody(req) {
+    const chunks = [];
+    for await (const c of req)
+        chunks.push(c);
+    return Buffer.concat(chunks);
+}
+/**
+ * Start the egress reverse-proxy. Point the MCP server's governed RS base URL at
+ * `http://127.0.0.1:<port>`; the proxy governs each call and forwards to
+ * `cfg.targetBaseUrl`. `onAudit` (optional) receives one record per request.
+ */
+export function createEgressServer(authority, cfg, onAudit) {
+    let endpoints = null;
+    const getEndpoints = async () => {
+        if (endpoints === null)
+            endpoints = await authority.fetchEndpoints(cfg.rsId);
+        return endpoints;
+    };
+    const server = http.createServer((req, res) => {
+        void (async () => {
+            const method = req.method || "GET";
+            const path = req.url || "/";
+            const body = await readBody(req);
+            const targetUrl = cfg.targetBaseUrl.replace(/\/$/, "") + path;
+            let result = null;
+            try {
+                result = await governedExchange(authority, cfg, method, path, await getEndpoints());
+            }
+            catch {
+                result = null; // fail-open
+            }
+            const headers = {};
+            for (const [k, v] of Object.entries(req.headers)) {
+                if (typeof v === "string" && k.toLowerCase() !== "host")
+                    headers[k] = v;
+            }
+            if (result) {
+                headers["authorization"] = `Bearer ${result.token}`;
+                if (result.cnfJkt) {
+                    try {
+                        headers["dpop"] = pop.proof(method, targetUrl, { token: result.token });
+                    }
+                    catch { /* proof best-effort */ }
+                }
+            }
+            try {
+                const upstream = await fetch(targetUrl, {
+                    method,
+                    headers,
+                    body: ["GET", "HEAD"].includes(method.toUpperCase()) ? undefined : body,
+                });
+                const buf = Buffer.from(await upstream.arrayBuffer());
+                res.statusCode = upstream.status;
+                upstream.headers.forEach((val, key) => {
+                    if (key.toLowerCase() !== "content-encoding")
+                        res.setHeader(key, val);
+                });
+                res.end(buf);
+                onAudit?.({
+                    method, path, target: targetUrl, status: upstream.status,
+                    governed: !!result, scope: result?.scope ?? null,
+                    matched: result?.matched ?? null,
+                });
+            }
+            catch (err) {
+                res.statusCode = 502;
+                res.end(JSON.stringify({ error: `egress forward failed: ${err.message}` }));
+            }
+        })();
+    });
+    return {
+        server,
+        port: () => server.address().port,
+        close: () => new Promise((resolve) => server.close(() => resolve())),
+    };
+}
+//# sourceMappingURL=egress.js.map

package/dist/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAehC,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AACvD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,eAAe,GAAG,KAAK,CAAC;AAC1B,CAAC;AACD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM;YACR,CAAC;YACD,EAAE,IAAI,OAAO,CAAC,CAAC,wBAAwB;YACvC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACtE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EAAE,IAAY,EAAE,SAAuB;IAErD,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,SAAS;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EAAE,IAAY,EAAE,SAAuB,EAAE,IAAY;IAEnE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,YAAY;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAA0B,EAC1B,GAAiB,EACjB,MAAc,EACd,IAAY,EACZ,SAAuB;IAEvB,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAEtE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC;QAC1C,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM;KACxE,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,QAAQ,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,GAAiB,EACjB,OAAgD;IAEhD,IAAI,SAAS,GAAwB,IAAI,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,IAA2B,EAAE;QACrD,IAAI,SAAS,KAAK,IAAI;YAAE,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;YAE9D,IAAI,MAAM,GAA0B,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC,CAAC,YAAY;YAC7B,CAAC;YAED,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;oBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC1E,CAAC;oBAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;oBACtC,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;iBACxE,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACtD,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACpC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,kBAAkB;wBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxE,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACb,OAAO,EAAE,CAAC;oBACR,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;oBAChD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI;iBACjC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,GAAG,EAAE,CAAE,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI;QACvD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+import { basename } from "node:path";
+import { startProxy } from "./proxy.js";
+const USAGE = `auth51-mcp-proxy — least-privilege enforcement + audit at the MCP tool boundary.
+
+Usage:
+  auth51-mcp-proxy [options] -- <mcp-server-command> [args...]
+
+Wrap any MCP server. Put this in front of an entry in your Claude Code / Cursor
+MCP config, e.g.:
+
+  "filesystem": {
+    "command": "npx",
+    "args": ["-y", "@auth51/mcp-proxy", "--",
+             "npx", "-y", "@modelcontextprotocol/server-filesystem", "/work"]
+  }
+
+Options:
+  --policy <path>    Policy JSON file (default: built-in safe defaults)
+  --audit <path>     Append-only JSONL audit log (default: ./.auth51/audit.jsonl)
+  --label <name>     Friendly name for this server in logs/audit
+  --grant <a,b,c>    Static capability grant: comma-separated allowed tool names
+                     (also AUTH51_GRANT). tools/list is filtered to this set;
+                     calls outside it are denied. Omit = allow all. When an
+                     authority + --app-id is configured, the agent's server-side
+                     grant supersedes this and honours its observe/enforce mode.
+  --app-id <name>    App id (e.g. "Patchet"), also AUTH51_APP_ID. With an
+                     authority, the proxy fetches this agent's grant and filters
+                     the tool surface to it (Slice 2d).
+  --agent <id>       Agent identity label or checksum to attribute decisions to
+  --authority <url>  auth51 authority base URL (also via AUTH51_AUTHORITY_URL).
+                     Requires AUTH51_CLIENT_ID + AUTH51_CLIENT_SECRET.
+  -h, --help         Show this help
+
+Authority env:
+  AUTH51_AUTHORITY_URL, AUTH51_CLIENT_ID, AUTH51_CLIENT_SECRET, AUTH51_AUDIENCE,
+  AUTH51_AGENT_ID, AUTH51_AGENT_CHECKSUM, AUTH51_APP_ID   (the registered agent to mint intent tokens / fetch the grant for)
+
+Everything works with NO account: local policy enforces, decisions are logged
+locally. Connect an authority to back allowed calls with scoped intent tokens
+and centralize the audit trail for a team / enterprise tenant.
+`;
+function parseArgs(argv) {
+    const sep = argv.indexOf("--");
+    if (sep === -1) {
+        process.stderr.write(USAGE);
+        process.stderr.write(`\nerror: missing "--" followed by the MCP server command.\n`);
+        process.exit(2);
+    }
+    const flags = argv.slice(0, sep);
+    const rest = argv.slice(sep + 1);
+    if (flags.includes("-h") || flags.includes("--help")) {
+        process.stdout.write(USAGE);
+        process.exit(0);
+    }
+    if (rest.length === 0) {
+        process.stderr.write(`error: no MCP server command after "--".\n`);
+        process.exit(2);
+    }
+    const getFlag = (name) => {
+        const i = flags.indexOf(name);
+        return i >= 0 && i + 1 < flags.length ? flags[i + 1] : undefined;
+    };
+    const command = rest[0];
+    const commandArgs = rest.slice(1);
+    const serverLabel = getFlag("--label") ?? basename(command);
+    const grantRaw = getFlag("--grant") ?? process.env.AUTH51_GRANT;
+    const grant = grantRaw
+        ? grantRaw.split(",").map((s) => s.trim()).filter(Boolean)
+        : undefined;
+    const authorityUrl = getFlag("--authority") ?? process.env.AUTH51_AUTHORITY_URL;
+    let authority;
+    if (authorityUrl) {
+        const clientId = process.env.AUTH51_CLIENT_ID;
+        const clientSecret = process.env.AUTH51_CLIENT_SECRET;
+        if (!clientId || !clientSecret) {
+            process.stderr.write(`[auth51] --authority set but AUTH51_CLIENT_ID / AUTH51_CLIENT_SECRET missing; ` +
+                `running local-only.\n`);
+        }
+        else {
+            authority = {
+                baseUrl: authorityUrl,
+                clientId,
+                clientSecret,
+                audience: process.env.AUTH51_AUDIENCE,
+                agentId: process.env.AUTH51_AGENT_ID,
+                agentChecksum: process.env.AUTH51_AGENT_CHECKSUM,
+                appId: getFlag("--app-id") ?? process.env.AUTH51_APP_ID,
+            };
+        }
+    }
+    // Server→RS egress governance (Hop-B). Opt-in: only when a target RS base URL
+    // is given. rsId/audience default to AUTH51_AUDIENCE (the governed RS).
+    let egress;
+    const egressTarget = getFlag("--egress-target") ?? process.env.AUTH51_EGRESS_TARGET;
+    if (egressTarget) {
+        const rsId = getFlag("--rs-id") ?? process.env.AUTH51_RS_ID ?? process.env.AUTH51_AUDIENCE;
+        if (!rsId) {
+            process.stderr.write("[auth51] --egress-target set but no --rs-id / AUTH51_RS_ID / AUTH51_AUDIENCE; skipping egress.\n");
+        }
+        else {
+            const portStr = getFlag("--egress-port") ?? process.env.AUTH51_EGRESS_PORT;
+            egress = {
+                rsId,
+                audience: process.env.AUTH51_AUDIENCE ?? rsId,
+                targetBaseUrl: egressTarget,
+                port: portStr ? Number(portStr) : undefined,
+                popEnabled: process.env.AUTH51_POP_ENABLED !== "0",
+            };
+        }
+    }
+    return {
+        command,
+        commandArgs,
+        policyPath: getFlag("--policy"),
+        auditPath: getFlag("--audit") ?? `${process.cwd()}/.auth51/audit.jsonl`,
+        serverLabel,
+        grant,
+        agent: getFlag("--agent") ?? process.env.AUTH51_AGENT,
+        authority,
+        egress,
+    };
+}
+startProxy(parseArgs(process.argv.slice(2)));
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCb,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAY,EAAsB,EAAE;QACnD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAChF,IAAI,SAAsC,CAAC;IAC3C,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gFAAgF;gBAC9E,uBAAuB,CAC1B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,GAAG;gBACV,OAAO,EAAE,YAAY;gBACrB,QAAQ;gBACR,YAAY;gBACZ,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;gBACrC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;gBACpC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;gBAChD,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,MAA8B,CAAC;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kGAAkG,CACnG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC3E,MAAM,GAAG;gBACP,IAAI;gBACJ,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI;gBAC7C,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;aACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB;QACvE,WAAW;QACX,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QACrD,SAAS;QACT,MAAM;KACP,CAAC;AACJ,CAAC;AAED,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/integrity.d.ts

@@ -0,0 +1,42 @@
+/** The security-relevant surface of a tool, as seen in a tools/list result. */
+export interface ToolDescriptor {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}
+export interface DriftFinding {
+    tool: string;
+    kind: "new" | "changed" | "removed";
+    oldFp?: string;
+    newFp?: string;
+}
+/**
+ * L0 — metadata fingerprint. Hash of the tool's *declared surface*: name +
+ * input schema + description, scoped to the server. Catches description/schema
+ * rug-pulls. NOTE (see design §2.2): L0 is blind to "same metadata, changed code"
+ * — that needs L1 (artifact) + L3 (behavioral). This is the cheap, necessary layer.
+ */
+export declare function toolFingerprint(serverLabel: string, t: ToolDescriptor): string;
+/**
+ * L1 — artifact fingerprint of the launched server (command + args). Any change
+ * to a local server's code requires a new artifact *iff* the version is pinned;
+ * v0 captures command+args. Richer resolution (lockfile integrity / image digest)
+ * is a later enhancement (design §2.2, L2 via the artifactory).
+ */
+export declare function artifactFingerprint(command: string, args: string[]): string;
+/**
+ * Tracks tool/artifact fingerprints against a persisted baseline so drift across
+ * sessions (and mid-session via tools/list_changed) is detected. In the full
+ * model the baseline is the *registered* surface (E1); here it's a local file,
+ * which already catches rug-pulls between runs.
+ */
+export declare class IntegrityTracker {
+    private path;
+    private baseline;
+    constructor(path: string);
+    private persist;
+    /** L1: record/compare the launched-artifact fingerprint. Returns drift if changed. */
+    checkArtifact(serverLabel: string, command: string, args: string[]): DriftFinding | null;
+    /** L0: record/compare tool metadata fingerprints. Returns drift findings. */
+    checkTools(serverLabel: string, tools: ToolDescriptor[]): DriftFinding[];
+}

package/dist/integrity.js

@@ -0,0 +1,103 @@
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+function sha256(s) {
+    return createHash("sha256").update(s).digest("hex");
+}
+/**
+ * L0 — metadata fingerprint. Hash of the tool's *declared surface*: name +
+ * input schema + description, scoped to the server. Catches description/schema
+ * rug-pulls. NOTE (see design §2.2): L0 is blind to "same metadata, changed code"
+ * — that needs L1 (artifact) + L3 (behavioral). This is the cheap, necessary layer.
+ */
+export function toolFingerprint(serverLabel, t) {
+    const canonical = JSON.stringify({
+        s: serverLabel,
+        n: t.name,
+        d: t.description ?? "",
+        i: t.inputSchema ?? null,
+    });
+    return "l0:" + sha256(canonical);
+}
+/**
+ * L1 — artifact fingerprint of the launched server (command + args). Any change
+ * to a local server's code requires a new artifact *iff* the version is pinned;
+ * v0 captures command+args. Richer resolution (lockfile integrity / image digest)
+ * is a later enhancement (design §2.2, L2 via the artifactory).
+ */
+export function artifactFingerprint(command, args) {
+    return "l1:" + sha256(JSON.stringify({ command, args }));
+}
+/**
+ * Tracks tool/artifact fingerprints against a persisted baseline so drift across
+ * sessions (and mid-session via tools/list_changed) is detected. In the full
+ * model the baseline is the *registered* surface (E1); here it's a local file,
+ * which already catches rug-pulls between runs.
+ */
+export class IntegrityTracker {
+    path;
+    baseline = {};
+    constructor(path) {
+        this.path = path;
+        try {
+            this.baseline = JSON.parse(readFileSync(path, "utf8"));
+        }
+        catch {
+            /* first run — empty baseline */
+        }
+    }
+    persist() {
+        try {
+            mkdirSync(dirname(this.path), { recursive: true });
+            writeFileSync(this.path, JSON.stringify(this.baseline, null, 2), "utf8");
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    /** L1: record/compare the launched-artifact fingerprint. Returns drift if changed. */
+    checkArtifact(serverLabel, command, args) {
+        const fp = artifactFingerprint(command, args);
+        const entry = (this.baseline[serverLabel] ??= { tools: {} });
+        let finding = null;
+        if (entry.artifact && entry.artifact !== fp) {
+            finding = { tool: "(server artifact)", kind: "changed", oldFp: entry.artifact, newFp: fp };
+        }
+        entry.artifact = fp;
+        this.persist();
+        return finding;
+    }
+    /** L0: record/compare tool metadata fingerprints. Returns drift findings. */
+    checkTools(serverLabel, tools) {
+        const entry = (this.baseline[serverLabel] ??= { tools: {} });
+        const hadBaseline = Object.keys(entry.tools).length > 0;
+        const findings = [];
+        const seen = new Set();
+        for (const t of tools) {
+            if (!t || typeof t.name !== "string")
+                continue;
+            const fp = toolFingerprint(serverLabel, t);
+            seen.add(t.name);
+            const prev = entry.tools[t.name];
+            if (prev === undefined) {
+                if (hadBaseline)
+                    findings.push({ tool: t.name, kind: "new", newFp: fp });
+            }
+            else if (prev !== fp) {
+                findings.push({ tool: t.name, kind: "changed", oldFp: prev, newFp: fp });
+            }
+            entry.tools[t.name] = fp;
+        }
+        if (hadBaseline) {
+            for (const name of Object.keys(entry.tools)) {
+                if (!seen.has(name)) {
+                    findings.push({ tool: name, kind: "removed", oldFp: entry.tools[name] });
+                    delete entry.tools[name];
+                }
+            }
+        }
+        this.persist();
+        return findings;
+    }
+}
+//# sourceMappingURL=integrity.js.map

package/dist/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../src/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBpC,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,CAAiB;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,CAAC,EAAE,WAAW;QACd,CAAC,EAAE,CAAC,CAAC,IAAI;QACT,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;QACtB,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,IAAc;IACjE,OAAO,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACnB,IAAI,CAAS;IACb,QAAQ,GAAa,EAAE,CAAC;IAEhC,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAa,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,aAAa,CAAC,WAAmB,EAAE,OAAe,EAAE,IAAc;QAChE,MAAM,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAwB,IAAI,CAAC;QACxC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6EAA6E;IAC7E,UAAU,CAAC,WAAmB,EAAE,KAAuB;QACrD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAC/C,MAAM,EAAE,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzE,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/meta.d.ts

@@ -0,0 +1,20 @@
+/**
+ * MCP intent-token propagation — the `_meta` profile (Hop A).
+ *
+ * The minted intent token rides INSIDE the JSON-RPC call under
+ * `params._meta["io.auth51/intent"]` (NOT an HTTP header), so it binds to this
+ * exact tool + args and travels with the message to the server. This mirrors
+ * the embed's shape (auth51.mcp) byte-for-byte — `{ v, token, chain? }` — so a
+ * server can't tell whether the embed or this proxy produced it.
+ */
+export declare const INTENT_META_KEY = "io.auth51/intent";
+export declare const META_VERSION = 1;
+/**
+ * Return `line` (a JSON-RPC message) with the intent token injected into
+ * `params._meta["io.auth51/intent"]`, preserving any existing `_meta` keys and
+ * params. On any parse/shape problem it returns the original line unchanged —
+ * injection must never break the call.
+ */
+export declare function injectIntentMeta(line: string, token: string, chain?: Record<string, unknown>): string;
+/** MCP-server side: pull the intent token out of an incoming call's `_meta`. */
+export declare function extractIntent(meta: unknown): string | null;

package/dist/meta.js

@@ -0,0 +1,47 @@
+/**
+ * MCP intent-token propagation — the `_meta` profile (Hop A).
+ *
+ * The minted intent token rides INSIDE the JSON-RPC call under
+ * `params._meta["io.auth51/intent"]` (NOT an HTTP header), so it binds to this
+ * exact tool + args and travels with the message to the server. This mirrors
+ * the embed's shape (auth51.mcp) byte-for-byte — `{ v, token, chain? }` — so a
+ * server can't tell whether the embed or this proxy produced it.
+ */
+export const INTENT_META_KEY = "io.auth51/intent";
+export const META_VERSION = 1;
+/**
+ * Return `line` (a JSON-RPC message) with the intent token injected into
+ * `params._meta["io.auth51/intent"]`, preserving any existing `_meta` keys and
+ * params. On any parse/shape problem it returns the original line unchanged —
+ * injection must never break the call.
+ */
+export function injectIntentMeta(line, token, chain) {
+    try {
+        const msg = JSON.parse(line);
+        if (!msg || typeof msg !== "object")
+            return line;
+        const params = msg.params && typeof msg.params === "object" ? msg.params : {};
+        const meta = params._meta && typeof params._meta === "object" ? params._meta : {};
+        const entry = { v: META_VERSION, token };
+        if (chain)
+            entry.chain = chain;
+        meta[INTENT_META_KEY] = entry;
+        params._meta = meta;
+        msg.params = params;
+        return JSON.stringify(msg);
+    }
+    catch {
+        return line;
+    }
+}
+/** MCP-server side: pull the intent token out of an incoming call's `_meta`. */
+export function extractIntent(meta) {
+    if (!meta || typeof meta !== "object")
+        return null;
+    const entry = meta[INTENT_META_KEY];
+    if (entry && typeof entry === "object" && typeof entry.token === "string") {
+        return entry.token;
+    }
+    return null;
+}
+//# sourceMappingURL=meta.js.map

package/dist/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../src/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,KAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAA4B,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAClE,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;QAC9B,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,KAAK,GAAI,IAA4B,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,14 @@
+import type { Policy, ToolCall, Decision } from "./types.js";
+/**
+ * The default policy if none is supplied. It is deliberately conservative for the
+ * coding-agent use case: allow by default, but block the classes of action that
+ * caused the real-world incidents (prod data destruction, recursive deletes,
+ * credential exfiltration, unscoped privilege escalation).
+ */
+export declare const DEFAULT_POLICY: Policy;
+export declare class PolicyEngine {
+    private policy;
+    constructor(policy: Policy);
+    static load(path?: string): PolicyEngine;
+    evaluate(call: ToolCall): Decision;
+}