@chkp/policy-insights-mcp 0.4.1 → 0.4.3

package/dist/index.js

@@ -1606,6 +1606,11 @@ function sanitizeData(kwargs) {
   return data;
 }
 
+// ../mcp-utils/dist/cli-options.js
+function booleanOptionDefault(envValue, optionDefault) {
+  return envValue === "true" || optionDefault === "true";
+}
+
 // ../mcp-utils/dist/launcher.js
 import { Command } from "commander";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -1836,6 +1841,31 @@ async function trackToolCall(mcpName, toolName, clientVersion, extra) {
 }
 
 // ../mcp-utils/dist/launcher.js
+function optionKey(flag) {
+  const long = flag.split(/[,\s]+/).find((part) => part.startsWith("--"));
+  if (!long)
+    return void 0;
+  const negated = long.startsWith("--no-");
+  return {
+    key: long.replace(/^--(no-)?/, "").replace(/-([a-z])/g, (_match, char) => char.toUpperCase()),
+    negated
+  };
+}
+function mirrorBooleanFlagsToEnv(config, options) {
+  for (const option of config.options) {
+    if (option.type !== "boolean" || !option.env)
+      continue;
+    const derived = optionKey(option.flag);
+    if (!derived)
+      continue;
+    if (derived.negated) {
+      throw new Error(`Option '${option.flag}' in the configuration for '${config.name}' is a negatable flag paired with env var '${option.env}', which cannot be mirrored automatically: commander keys it as '${derived.key}' and inverts its meaning, so whether the flag being present should set '${option.env}' to 'true' or 'false' depends on how that variable is named. Mirror it explicitly in launchMCPServer instead, the way --no-telemetry does for TELEMETRY_DISABLED.`);
+    }
+    if (options[derived.key] === true) {
+      process.env[option.env] = "true";
+    }
+  }
+}
 async function launchMCPServer(configPath, serverModule2) {
   const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
   const program = new Command();
@@ -1846,7 +1876,7 @@ async function launchMCPServer(configPath, serverModule2) {
     const envValue = option.env ? process.env[option.env] : void 0;
     const defaultValue = envValue || option.default;
     if (option.type === "boolean") {
-      const boolDefault = envValue === "true" || option.default === "true";
+      const boolDefault = booleanOptionDefault(envValue, option.default);
       program.option(option.flag, option.description, boolDefault);
     } else {
       program.option(option.flag, option.description, defaultValue);
@@ -1870,6 +1900,7 @@ async function launchMCPServer(configPath, serverModule2) {
   if (options.telemetryUrl) {
     process.env.TELEMETRY_URL = options.telemetryUrl;
   }
+  mirrorBooleanFlagsToEnv(config, options);
   if (!serverModule2.settingsManager) {
     throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
   }
@@ -2614,10 +2645,11 @@ function wrapServerWithTracking(server2, createServerFn) {
         newServer[reg.method](...reg.args);
       }
     }
-    if (typeof server2.setToolPolicy === "function" && typeof newServer.setToolPolicy === "function") {
-      const toolPolicy = server2._toolPolicyCallback;
-      if (toolPolicy) {
-        newServer.setToolPolicy(toolPolicy);
+    const toolPolicy = typeof server2.getToolPolicy === "function" ? server2.getToolPolicy() : void 0;
+    if (toolPolicy && typeof newServer.setToolPolicy === "function") {
+      newServer.setToolPolicy(toolPolicy);
+      if (typeof newServer.applyToolPolicy === "function") {
+        newServer.applyToolPolicy();
       }
     }
     return newServer;
@@ -2673,35 +2705,61 @@ var CPMcpServer = class extends McpServer {
     console.error("[CPMcpServer] Setting tool policy callback");
     this.toolPolicyCallback = callback;
   }
+  /**
+   * Get the tool policy callback, if one was set.
+   *
+   * Needed so the policy can be carried onto the per-session server instances
+   * created for HTTP transport. A typed accessor keeps that transfer honest:
+   * callers do not have to reach into the private field, where a misspelling
+   * would go unnoticed by the compiler.
+   */
+  getToolPolicy() {
+    return this.toolPolicyCallback;
+  }
   /**
    * Apply the tool policy by checking all registered tools
    * This should be called after all tools are registered but before connecting
+   *
+   * Per-tool tracing is behind the debug flag. This used to run once per process
+   * on the template server, where a line per tool was a cheap startup banner.
+   * It now also runs per session under HTTP transport, so unconditional tracing
+   * would scale stderr with sessions x tools and bury the summary. The summary
+   * line always prints — it is the fact worth having for every session.
    */
   applyToolPolicy() {
+    const verbose = SettingsManager.globalDebugState === true || SettingsManager.globalDebugState === "true";
     if (!this.toolPolicyCallback) {
-      console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      if (verbose) {
+        console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      }
       return;
     }
-    console.error("[CPMcpServer] Applying tool policy");
     const registeredTools = this._registeredTools;
     if (!registeredTools || typeof registeredTools !== "object") {
       console.error("[CPMcpServer] No tools registered yet");
       return;
     }
     const toolNames = Object.keys(registeredTools);
-    console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    if (verbose) {
+      console.error(`[CPMcpServer] Applying tool policy`);
+      console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    }
     let enabledCount = 0;
     let disabledCount = 0;
     for (const [toolName, tool] of Object.entries(registeredTools)) {
       const isAllowed = this.toolPolicyCallback(toolName);
       if (!isAllowed) {
-        console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        }
         if (typeof tool.disable === "function") {
           tool.disable();
           disabledCount++;
         }
       } else {
-        console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        }
         enabledCount++;
       }
     }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },

package/package.json.bak

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },