@chkp/policy-insights-mcp 0.4.0 → 0.4.3

package/dist/index.js

@@ -1606,6 +1606,11 @@ function sanitizeData(kwargs) {
   return data;
 }
 
+// ../mcp-utils/dist/cli-options.js
+function booleanOptionDefault(envValue, optionDefault) {
+  return envValue === "true" || optionDefault === "true";
+}
+
 // ../mcp-utils/dist/launcher.js
 import { Command } from "commander";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -1771,7 +1776,96 @@ var SettingsManager = class _SettingsManager {
 };
 SettingsManager.globalDebugState = void 0;
 
+// ../mcp-utils/dist/telemetry.js
+import machineIdPkg from "node-machine-id";
+import { createHash } from "crypto";
+var { machineIdSync } = machineIdPkg;
+var machineId = null;
+var hashedMachineId = null;
+var transportType = "stdio";
+function setTransportType(type) {
+  transportType = type;
+}
+function isTelemetryDisabled() {
+  return process.env.TELEMETRY_DISABLED === "true" || process.env.TELEMETRY_DISABLED === "1";
+}
+function getTelemetryUrl() {
+  return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
+}
+function hashString(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function getMachineId() {
+  if (!machineId) {
+    try {
+      machineId = machineIdSync();
+    } catch (error) {
+      console.warn("Failed to get machine ID for telemetry:", error);
+      machineId = "unknown";
+    }
+  }
+  return machineId;
+}
+function getHashedMachineId() {
+  if (!hashedMachineId) {
+    hashedMachineId = hashString(getMachineId());
+  }
+  return hashedMachineId;
+}
+function calculateChecksum(mcpName, toolName, machineId2, clientVersion) {
+  const data = mcpName + machineId2.slice(0, 16) + toolName + clientVersion;
+  return hashString(data);
+}
+async function trackToolCall(mcpName, toolName, clientVersion, extra) {
+  if (isTelemetryDisabled()) {
+    return;
+  }
+  try {
+    const machineId2 = getHashedMachineId();
+    const checksum = calculateChecksum(mcpName, toolName, machineId2, clientVersion);
+    fetch(getTelemetryUrl(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        mcp_name: mcpName,
+        tool_name: toolName,
+        machine_id: machineId2,
+        client_version: clientVersion,
+        transport_type: transportType,
+        checksum
+      })
+    }).catch(() => {
+    });
+  } catch (error) {
+  }
+}
+
 // ../mcp-utils/dist/launcher.js
+function optionKey(flag) {
+  const long = flag.split(/[,\s]+/).find((part) => part.startsWith("--"));
+  if (!long)
+    return void 0;
+  const negated = long.startsWith("--no-");
+  return {
+    key: long.replace(/^--(no-)?/, "").replace(/-([a-z])/g, (_match, char) => char.toUpperCase()),
+    negated
+  };
+}
+function mirrorBooleanFlagsToEnv(config, options) {
+  for (const option of config.options) {
+    if (option.type !== "boolean" || !option.env)
+      continue;
+    const derived = optionKey(option.flag);
+    if (!derived)
+      continue;
+    if (derived.negated) {
+      throw new Error(`Option '${option.flag}' in the configuration for '${config.name}' is a negatable flag paired with env var '${option.env}', which cannot be mirrored automatically: commander keys it as '${derived.key}' and inverts its meaning, so whether the flag being present should set '${option.env}' to 'true' or 'false' depends on how that variable is named. Mirror it explicitly in launchMCPServer instead, the way --no-telemetry does for TELEMETRY_DISABLED.`);
+    }
+    if (options[derived.key] === true) {
+      process.env[option.env] = "true";
+    }
+  }
+}
 async function launchMCPServer(configPath, serverModule2) {
   const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
   const program = new Command();
@@ -1782,7 +1876,7 @@ async function launchMCPServer(configPath, serverModule2) {
     const envValue = option.env ? process.env[option.env] : void 0;
     const defaultValue = envValue || option.default;
     if (option.type === "boolean") {
-      const boolDefault = envValue === "true" || option.default === "true";
+      const boolDefault = booleanOptionDefault(envValue, option.default);
       program.option(option.flag, option.description, boolDefault);
     } else {
       program.option(option.flag, option.description, defaultValue);
@@ -1806,6 +1900,7 @@ async function launchMCPServer(configPath, serverModule2) {
   if (options.telemetryUrl) {
     process.env.TELEMETRY_URL = options.telemetryUrl;
   }
+  mirrorBooleanFlagsToEnv(config, options);
   if (!serverModule2.settingsManager) {
     throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
   }
@@ -1814,11 +1909,13 @@ async function launchMCPServer(configPath, serverModule2) {
     console.error("[launchMCPServer] Applying tool policy before connecting");
     serverModule2.server.applyToolPolicy();
   }
-  const transportType = (options.transport || process.env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
+  const transportType2 = (options.transport || process.env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
   const transportPort = options.transportPort ? parseInt(options.transportPort, 10) : process.env.MCP_TRANSPORT_PORT ? parseInt(process.env.MCP_TRANSPORT_PORT, 10) : 3e3;
-  if (transportType === "http") {
+  if (transportType2 === "http") {
+    setTransportType("http");
     await launchHTTPServer(config, serverModule2, transportPort);
   } else {
+    setTransportType("stdio");
     const transport = new StdioServerTransport();
     const defaultSessionId = "default";
     const sessionMetadata = {
@@ -2548,10 +2645,11 @@ function wrapServerWithTracking(server2, createServerFn) {
         newServer[reg.method](...reg.args);
       }
     }
-    if (typeof server2.setToolPolicy === "function" && typeof newServer.setToolPolicy === "function") {
-      const toolPolicy = server2._toolPolicyCallback;
-      if (toolPolicy) {
-        newServer.setToolPolicy(toolPolicy);
+    const toolPolicy = typeof server2.getToolPolicy === "function" ? server2.getToolPolicy() : void 0;
+    if (toolPolicy && typeof newServer.setToolPolicy === "function") {
+      newServer.setToolPolicy(toolPolicy);
+      if (typeof newServer.applyToolPolicy === "function") {
+        newServer.applyToolPolicy();
       }
     }
     return newServer;
@@ -2590,65 +2688,6 @@ function createServerModule(server2, Settings2, pkg2, apiManagerClass, toolPolic
 // ../mcp-utils/dist/index.js
 init_ui_dialog();
 
-// ../mcp-utils/dist/telemetry.js
-import machineIdPkg from "node-machine-id";
-import { createHash } from "crypto";
-var { machineIdSync } = machineIdPkg;
-var machineId = null;
-var hashedMachineId = null;
-function isTelemetryDisabled() {
-  return process.env.TELEMETRY_DISABLED === "true" || process.env.TELEMETRY_DISABLED === "1";
-}
-function getTelemetryUrl() {
-  return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
-}
-function hashString(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function getMachineId() {
-  if (!machineId) {
-    try {
-      machineId = machineIdSync();
-    } catch (error) {
-      console.warn("Failed to get machine ID for telemetry:", error);
-      machineId = "unknown";
-    }
-  }
-  return machineId;
-}
-function getHashedMachineId() {
-  if (!hashedMachineId) {
-    hashedMachineId = hashString(getMachineId());
-  }
-  return hashedMachineId;
-}
-function calculateChecksum(mcpName, toolName, machineId2, clientVersion) {
-  const data = mcpName + machineId2.slice(0, 16) + toolName + clientVersion;
-  return hashString(data);
-}
-async function trackToolCall(mcpName, toolName, clientVersion, extra) {
-  if (isTelemetryDisabled()) {
-    return;
-  }
-  try {
-    const machineId2 = getHashedMachineId();
-    const checksum = calculateChecksum(mcpName, toolName, machineId2, clientVersion);
-    fetch(getTelemetryUrl(), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        mcp_name: mcpName,
-        tool_name: toolName,
-        machine_id: machineId2,
-        client_version: clientVersion,
-        checksum
-      })
-    }).catch(() => {
-    });
-  } catch (error) {
-  }
-}
-
 // ../mcp-utils/dist/mcp-server.js
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 var CPMcpServer = class extends McpServer {
@@ -2666,35 +2705,61 @@ var CPMcpServer = class extends McpServer {
     console.error("[CPMcpServer] Setting tool policy callback");
     this.toolPolicyCallback = callback;
   }
+  /**
+   * Get the tool policy callback, if one was set.
+   *
+   * Needed so the policy can be carried onto the per-session server instances
+   * created for HTTP transport. A typed accessor keeps that transfer honest:
+   * callers do not have to reach into the private field, where a misspelling
+   * would go unnoticed by the compiler.
+   */
+  getToolPolicy() {
+    return this.toolPolicyCallback;
+  }
   /**
    * Apply the tool policy by checking all registered tools
    * This should be called after all tools are registered but before connecting
+   *
+   * Per-tool tracing is behind the debug flag. This used to run once per process
+   * on the template server, where a line per tool was a cheap startup banner.
+   * It now also runs per session under HTTP transport, so unconditional tracing
+   * would scale stderr with sessions x tools and bury the summary. The summary
+   * line always prints — it is the fact worth having for every session.
    */
   applyToolPolicy() {
+    const verbose = SettingsManager.globalDebugState === true || SettingsManager.globalDebugState === "true";
     if (!this.toolPolicyCallback) {
-      console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      if (verbose) {
+        console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      }
       return;
     }
-    console.error("[CPMcpServer] Applying tool policy");
     const registeredTools = this._registeredTools;
     if (!registeredTools || typeof registeredTools !== "object") {
       console.error("[CPMcpServer] No tools registered yet");
       return;
     }
     const toolNames = Object.keys(registeredTools);
-    console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    if (verbose) {
+      console.error(`[CPMcpServer] Applying tool policy`);
+      console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    }
     let enabledCount = 0;
     let disabledCount = 0;
     for (const [toolName, tool] of Object.entries(registeredTools)) {
       const isAllowed = this.toolPolicyCallback(toolName);
       if (!isAllowed) {
-        console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        }
         if (typeof tool.disable === "function") {
           tool.disable();
           disabledCount++;
         }
       } else {
-        console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        }
         enabledCount++;
       }
     }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.4.0",
+  "version": "0.4.3",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.4.0",
+  "version": "0.4.3",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },

package/package.json.bak

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.4.0",
+  "version": "0.4.3",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },