@chkp/harmony-email-mcp 0.1.0 → 0.1.3

package/README.md

@@ -1,12 +1,12 @@
-# Check Point Harmony Email & Collaboration MCP
+# Check Point Email Security MCP
 
 ## What is MCP?
 
 Model Context Protocol (MCP) servers expose a structured, machine-readable API for your enterprise data, designed for AI-powered automation, copilots and decision engines. By delivering a clear, contextual slice of your security environment, MCP lets you query, analyze and act on complex systems without building custom SDKs or parsing raw exports.
 
-## Why MCP for Harmony Email & Collaboration?
+## Why MCP for Email Security?
 
-Harmony Email & Collaboration (HEC) protects email and the SaaS apps around it. Answering an everyday question - "did phishing go up this week?", "why was this message quarantined?", "who is waiting on a restore?" - usually means several console screens and a working knowledge of which engine produced which verdict.
+Email Security protects email and the SaaS apps around it. Answering an everyday question - "did phishing go up this week?", "why was this message quarantined?", "who is waiting on a restore?" - usually means several console screens and a working knowledge of which engine produced which verdict.
 
 This server puts that behind an MCP interface, with a SOC-analyst persona and a glossary so the assistant speaks HEC's own vocabulary. Broad questions are answered by server-side aggregators that return counts rather than message bodies, so a month-wide question stays cheap and keeps personal data out of the transcript. Remediation is available, and every remediation tool previews before it acts.
 

package/dist/index.js

@@ -365,6 +365,11 @@ var init_ui_dialog = __esm({
   }
 });
 
+// ../mcp-utils/dist/cli-options.js
+function booleanOptionDefault(envValue, optionDefault) {
+  return envValue === "true" || optionDefault === "true";
+}
+
 // ../mcp-utils/dist/launcher.js
 import { Command } from "commander";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -595,6 +600,31 @@ async function trackToolCall(mcpName, toolName, clientVersion, extra) {
 }
 
 // ../mcp-utils/dist/launcher.js
+function optionKey(flag) {
+  const long = flag.split(/[,\s]+/).find((part) => part.startsWith("--"));
+  if (!long)
+    return void 0;
+  const negated = long.startsWith("--no-");
+  return {
+    key: long.replace(/^--(no-)?/, "").replace(/-([a-z])/g, (_match, char) => char.toUpperCase()),
+    negated
+  };
+}
+function mirrorBooleanFlagsToEnv(config, options) {
+  for (const option of config.options) {
+    if (option.type !== "boolean" || !option.env)
+      continue;
+    const derived = optionKey(option.flag);
+    if (!derived)
+      continue;
+    if (derived.negated) {
+      throw new Error(`Option '${option.flag}' in the configuration for '${config.name}' is a negatable flag paired with env var '${option.env}', which cannot be mirrored automatically: commander keys it as '${derived.key}' and inverts its meaning, so whether the flag being present should set '${option.env}' to 'true' or 'false' depends on how that variable is named. Mirror it explicitly in launchMCPServer instead, the way --no-telemetry does for TELEMETRY_DISABLED.`);
+    }
+    if (options[derived.key] === true) {
+      process.env[option.env] = "true";
+    }
+  }
+}
 async function launchMCPServer(configPath, serverModule2) {
   const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
   const program = new Command();
@@ -605,7 +635,7 @@ async function launchMCPServer(configPath, serverModule2) {
     const envValue = option.env ? process.env[option.env] : void 0;
     const defaultValue = envValue || option.default;
     if (option.type === "boolean") {
-      const boolDefault = envValue === "true" || option.default === "true";
+      const boolDefault = booleanOptionDefault(envValue, option.default);
       program.option(option.flag, option.description, boolDefault);
     } else {
       program.option(option.flag, option.description, defaultValue);
@@ -629,6 +659,7 @@ async function launchMCPServer(configPath, serverModule2) {
   if (options.telemetryUrl) {
     process.env.TELEMETRY_URL = options.telemetryUrl;
   }
+  mirrorBooleanFlagsToEnv(config, options);
   if (!serverModule2.settingsManager) {
     throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
   }
@@ -1367,10 +1398,11 @@ function wrapServerWithTracking(server2, createServerFn) {
         newServer[reg.method](...reg.args);
       }
     }
-    if (typeof server2.setToolPolicy === "function" && typeof newServer.setToolPolicy === "function") {
-      const toolPolicy = server2._toolPolicyCallback;
-      if (toolPolicy) {
-        newServer.setToolPolicy(toolPolicy);
+    const toolPolicy = typeof server2.getToolPolicy === "function" ? server2.getToolPolicy() : void 0;
+    if (toolPolicy && typeof newServer.setToolPolicy === "function") {
+      newServer.setToolPolicy(toolPolicy);
+      if (typeof newServer.applyToolPolicy === "function") {
+        newServer.applyToolPolicy();
       }
     }
     return newServer;
@@ -1426,35 +1458,61 @@ var CPMcpServer = class extends McpServer {
     console.error("[CPMcpServer] Setting tool policy callback");
     this.toolPolicyCallback = callback;
   }
+  /**
+   * Get the tool policy callback, if one was set.
+   *
+   * Needed so the policy can be carried onto the per-session server instances
+   * created for HTTP transport. A typed accessor keeps that transfer honest:
+   * callers do not have to reach into the private field, where a misspelling
+   * would go unnoticed by the compiler.
+   */
+  getToolPolicy() {
+    return this.toolPolicyCallback;
+  }
   /**
    * Apply the tool policy by checking all registered tools
    * This should be called after all tools are registered but before connecting
+   *
+   * Per-tool tracing is behind the debug flag. This used to run once per process
+   * on the template server, where a line per tool was a cheap startup banner.
+   * It now also runs per session under HTTP transport, so unconditional tracing
+   * would scale stderr with sessions x tools and bury the summary. The summary
+   * line always prints — it is the fact worth having for every session.
    */
   applyToolPolicy() {
+    const verbose = SettingsManager.globalDebugState === true || SettingsManager.globalDebugState === "true";
     if (!this.toolPolicyCallback) {
-      console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      if (verbose) {
+        console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      }
       return;
     }
-    console.error("[CPMcpServer] Applying tool policy");
     const registeredTools = this._registeredTools;
     if (!registeredTools || typeof registeredTools !== "object") {
       console.error("[CPMcpServer] No tools registered yet");
       return;
     }
     const toolNames = Object.keys(registeredTools);
-    console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    if (verbose) {
+      console.error(`[CPMcpServer] Applying tool policy`);
+      console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    }
     let enabledCount = 0;
     let disabledCount = 0;
     for (const [toolName, tool] of Object.entries(registeredTools)) {
       const isAllowed = this.toolPolicyCallback(toolName);
       if (!isAllowed) {
-        console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        }
         if (typeof tool.disable === "function") {
           tool.disable();
           disabledCount++;
         }
       } else {
-        console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        }
         enabledCount++;
       }
     }

package/dist/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chkp/harmony-email-mcp",
-  "version": "0.1.0",
-  "description": "Harmony Email & Collaboration MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
+  "version": "0.1.3",
+  "description": "Email Security MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/server-config.json

@@ -1,6 +1,6 @@
 {
     "name": "harmony-email",
-    "description": "Harmony Email & Collaboration MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
+    "description": "Email Security MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
     "options": [
         {
             "flag": "--hec-domain <domain>",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chkp/harmony-email-mcp",
-  "version": "0.1.0",
-  "description": "Harmony Email & Collaboration MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
+  "version": "0.1.3",
+  "description": "Email Security MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/package.json.bak

@@ -1,7 +1,7 @@
 {
     "name": "@chkp/harmony-email-mcp",
-    "version": "0.1.0",
-    "description": "Harmony Email & Collaboration MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
+    "version": "0.1.3",
+    "description": "Email Security MCP Server - investigate email security events, entities and restore requests via the HEC SmartAPI",
     "type": "module",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",