@botbotgo/agent-harness 0.0.161 → 0.0.162

package/README.md

@@ -911,3 +911,4 @@ ACP transport notes:
 - `serveAcpStdio(runtime)` exposes newline-delimited JSON-RPC over stdio for local IDE, CLI, or subprocess clients.
 - `serveAcpHttp(runtime)` exposes JSON-RPC over HTTP plus SSE runtime events so remote operator surfaces can connect without importing the runtime in-process.
 - `exportRunPackage(...)` and `exportSessionPackage(...)` package stable runtime records, transcript, approvals, events, and artifacts for operator tooling without reaching into persistence internals.
+- `runtime/default.governance.remoteMcp` can now deny or allow specific MCP servers, raise approval requirements by transport, and stamp transport-based risk tiers into runtime governance bundles.

package/README.zh.md

@@ -870,3 +870,4 @@ ACP transport 说明：
 - `serveAcpStdio(runtime)` 提供基于 stdio 的 newline-delimited JSON-RPC，适合本地 IDE、CLI 或子进程客户端。
 - `serveAcpHttp(runtime)` 提供基于 HTTP 的 JSON-RPC 与 SSE runtime events，适合远程 operator surface 或独立控制面接入。
 - `exportRunPackage(...)` 与 `exportSessionPackage(...)` 可把稳定 runtime 记录、transcript、approvals、events 和 artifacts 打包给 operator tooling，而不必直接访问 persistence 内部实现。
+- `runtime/default.governance.remoteMcp` 现在可以按 MCP server 或 transport 做 allow/deny、审批升级，并把 transport 风险等级写进 runtime governance bundles。

package/dist/contracts/runtime.d.ts

@@ -102,6 +102,8 @@ export type RuntimeGovernanceToolPolicy = {
     toolId: string;
     toolType: string;
     category: "local" | "backend" | "mcp" | "provider-native";
+    mcpServerRef?: string;
+    mcpTransport?: string;
     risk: RuntimeGovernanceRiskLevel;
     requiresApproval: boolean;
     approvalPolicy: "explicit-hitl" | "runtime-default" | "none";

package/dist/package-version.d.ts

@@ -1 +1 @@
-export declare const AGENT_HARNESS_VERSION = "0.0.160";
+export declare const AGENT_HARNESS_VERSION = "0.0.161";

package/dist/package-version.js

@@ -1 +1 @@
-export const AGENT_HARNESS_VERSION = "0.0.160";
+export const AGENT_HARNESS_VERSION = "0.0.161";

package/dist/runtime/harness/run/governance.js

@@ -57,6 +57,25 @@ function readRisk(value) {
 function readApprovalPolicy(value) {
     return value === "explicit-hitl" || value === "runtime-default" || value === "none" ? value : undefined;
 }
+function normalizeServerRef(value) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.startsWith("mcp/") ? trimmed : `mcp/${trimmed}`;
+}
+function readRemoteMcpMetadata(tool) {
+    const config = asObject(tool.config);
+    const mcpReference = asObject(config?.mcp);
+    const inlineServer = asObject(config?.mcpServer);
+    const transport = typeof inlineServer?.transport === "string" && inlineServer.transport.trim().length > 0
+        ? inlineServer.transport.trim()
+        : undefined;
+    return {
+        ...(normalizeServerRef(mcpReference?.serverRef) ? { serverRef: normalizeServerRef(mcpReference?.serverRef) } : {}),
+        ...(transport ? { transport } : {}),
+    };
+}
 function matchesToolPolicy(rule, policy) {
     const match = asObject(rule.match) ?? rule;
     const toolName = typeof match.toolName === "string" ? match.toolName.trim() : undefined;
@@ -102,14 +121,49 @@ function applyGovernanceOverrides(binding, policies) {
         return merged;
     });
 }
+function applyRemoteMcpGovernance(binding, policies) {
+    const governance = asObject(binding.harnessRuntime.governance);
+    const remoteMcp = asObject(governance?.remoteMcp);
+    if (!remoteMcp) {
+        return policies;
+    }
+    const requireApprovalTransports = new Set(readStringArray(remoteMcp.requireApprovalTransports));
+    const riskByTransport = asObject(remoteMcp.riskByTransport);
+    const inputRiskHintsByTransport = asObject(remoteMcp.inputRiskHintsByTransport);
+    return policies.map((policy) => {
+        if (policy.category !== "mcp") {
+            return policy;
+        }
+        const merged = { ...policy };
+        const transport = merged.mcpTransport;
+        if (transport && requireApprovalTransports.has(transport)) {
+            merged.requiresApproval = true;
+            if (merged.approvalPolicy === "none") {
+                merged.approvalPolicy = "runtime-default";
+            }
+        }
+        const transportRisk = transport ? readRisk(riskByTransport?.[transport]) : undefined;
+        if (transportRisk) {
+            merged.risk = transportRisk;
+        }
+        const transportHints = transport ? readStringArray(inputRiskHintsByTransport?.[transport]) : [];
+        if (transportHints.length > 0) {
+            merged.inputRiskHints = Array.from(new Set([...merged.inputRiskHints, ...transportHints]));
+        }
+        return merged;
+    });
+}
 export function buildRuntimeGovernanceBundles(binding) {
-    const toolPolicies = applyGovernanceOverrides(binding, getBindingPrimaryTools(binding).map((tool) => {
+    const toolPolicies = applyGovernanceOverrides(binding, applyRemoteMcpGovernance(binding, getBindingPrimaryTools(binding).map((tool) => {
         const requiresApproval = toolRequiresRuntimeApproval(tool);
+        const remoteMcp = readRemoteMcpMetadata(tool);
         return {
             toolName: tool.name,
             toolId: tool.id,
             toolType: tool.type,
             category: toCategory(tool.type),
+            ...(remoteMcp.serverRef ? { mcpServerRef: remoteMcp.serverRef } : {}),
+            ...(remoteMcp.transport ? { mcpTransport: remoteMcp.transport } : {}),
             risk: classifyRisk({
                 toolType: tool.type,
                 requiresApproval,
@@ -122,7 +176,7 @@ export function buildRuntimeGovernanceBundles(binding) {
             hasInputSchema: typeof tool.inputSchemaRef === "string" && tool.inputSchemaRef.trim().length > 0,
             inputRiskHints: inputHints(binding, tool),
         };
-    }));
+    })));
     if (toolPolicies.length === 0) {
         return [];
     }

package/dist/runtime/harness/system/policy-engine.js

@@ -12,6 +12,9 @@ export class PolicyEngine {
         const governance = typeof binding.harnessRuntime.governance === "object" && binding.harnessRuntime.governance
             ? binding.harnessRuntime.governance
             : undefined;
+        const remoteMcp = typeof governance?.remoteMcp === "object" && governance.remoteMcp
+            ? governance.remoteMcp
+            : undefined;
         const denyConfig = typeof governance?.deny === "object" && governance.deny
             ? governance.deny
             : undefined;
@@ -38,6 +41,72 @@ export class PolicyEngine {
                 reasons.push(`runtime governance denied tool access: ${blocked.map((tool) => tool.name).join(", ")}`);
             }
         }
+        if (remoteMcp) {
+            const normalizeServerRef = (value) => {
+                if (typeof value !== "string" || value.trim().length === 0) {
+                    return undefined;
+                }
+                const trimmed = value.trim();
+                return trimmed.startsWith("mcp/") ? trimmed : `mcp/${trimmed}`;
+            };
+            const allowServerRefs = new Set(Array.isArray(remoteMcp.allowServerRefs)
+                ? remoteMcp.allowServerRefs
+                    .map((item) => normalizeServerRef(item))
+                    .filter((item) => Boolean(item))
+                : []);
+            const denyServerRefs = new Set(Array.isArray(remoteMcp.denyServerRefs)
+                ? remoteMcp.denyServerRefs
+                    .map((item) => normalizeServerRef(item))
+                    .filter((item) => Boolean(item))
+                : []);
+            const denyTransports = new Set(Array.isArray(remoteMcp.denyTransports)
+                ? remoteMcp.denyTransports.filter((item) => typeof item === "string" && item.trim().length > 0).map((item) => item.trim())
+                : []);
+            const tools = binding.execution?.params?.tools ?? binding.langchainAgentParams?.tools ?? binding.deepAgentParams?.tools ?? [];
+            const deniedRemoteTools = tools.flatMap((tool) => {
+                if (tool.type !== "mcp") {
+                    return [];
+                }
+                const config = typeof tool.config === "object" && tool.config && !Array.isArray(tool.config)
+                    ? tool.config
+                    : undefined;
+                const mcpRef = typeof config?.mcp === "object" && config.mcp && !Array.isArray(config.mcp)
+                    ? config.mcp
+                    : undefined;
+                const inlineMcpServer = typeof config?.mcpServer === "object" && config.mcpServer && !Array.isArray(config.mcpServer)
+                    ? config.mcpServer
+                    : undefined;
+                const serverRef = normalizeServerRef(mcpRef?.serverRef);
+                const transport = typeof inlineMcpServer?.transport === "string" && inlineMcpServer.transport.trim().length > 0
+                    ? inlineMcpServer.transport.trim()
+                    : undefined;
+                const serverDenied = serverRef ? denyServerRefs.has(serverRef) || (allowServerRefs.size > 0 && !allowServerRefs.has(serverRef)) : false;
+                const transportDenied = transport ? denyTransports.has(transport) : false;
+                return serverDenied || transportDenied
+                    ? [{
+                            toolName: tool.name,
+                            ...(serverRef ? { serverRef } : {}),
+                            ...(transport ? { transport } : {}),
+                        }]
+                    : [];
+            });
+            if (deniedRemoteTools.length > 0) {
+                allowed = false;
+                const details = deniedRemoteTools.map((tool) => {
+                    if (tool.serverRef && tool.transport) {
+                        return `${tool.toolName} (${tool.serverRef}, ${tool.transport})`;
+                    }
+                    if (tool.serverRef) {
+                        return `${tool.toolName} (${tool.serverRef})`;
+                    }
+                    if (tool.transport) {
+                        return `${tool.toolName} (${tool.transport})`;
+                    }
+                    return tool.toolName;
+                });
+                reasons.push(`runtime governance denied remote MCP access: ${details.join(", ")}`);
+            }
+        }
         for (const evaluator of getPolicyEvaluators()) {
             const decision = evaluator.evaluate(binding);
             if (!decision) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbotgo/agent-harness",
-  "version": "0.0.161",
+  "version": "0.0.162",
   "description": "Workspace runtime for multi-agent applications",
   "type": "module",
   "packageManager": "npm@10.9.2",