@crediolabs/policy-builder-mcp 0.1.18 → 0.3.0

package/dist-cjs/src/server.js

@@ -33,9 +33,9 @@ function createMcpServer() {
 /** Idempotent registration of the T1 tool set on the given server. */
 function registerTools(server) {
     server.tool('record_transaction', 'Decode a Soroban transaction (on-chain hash OR base64 envelope XDR) into a RecordedTransaction. Returns a machine-readable ToolError on validation failure.', schemas_ts_1.RecordTransactionToolShape, (args) => (0, run_1.runRecordTransaction)(args).then(toCallToolResult));
-    server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from either a deterministic MandateSpec (`source: mandate`) or a RecordedTransaction (`source: recording`). The discriminated `source` field selects the front-end.', schemas_ts_1.SynthesizePolicyToolShape, (args) => (0, run_1.runSynthesizePolicy)(args).then(toCallToolResult));
-    server.tool('simulate_policy', 'Replay a RecordedTransaction against a proposed PredicateNode (or null for an OZ-only policy) and emit the SimulationResult envelope (permit verdict + deny-case battery). Returns a SIMULATION_ERROR ToolError on runtime evaluation failure.', schemas_ts_1.SimulatePolicyToolShape, (args) => (0, run_1.runSimulatePolicy)(args).then(toCallToolResult));
-    server.tool('verify_policy', 'Run the static minimality check on a proposed PredicateNode against a RecordedTransaction (no conjunct is load-bearing-free). Returns VERIFICATION_FAILED with the dropped-constraint fingerprints when the predicate is over-broad.', schemas_ts_1.VerifyPolicyToolShape, (args) => (0, run_1.runVerifyPolicy)(args).then(toCallToolResult));
+    server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).', schemas_ts_1.SynthesizePolicyToolShape, (args) => (0, run_1.runSynthesizePolicy)(args).then(toCallToolResult));
+    server.tool('simulate_policy', 'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.', schemas_ts_1.SimulatePolicyToolShape, (args) => toCallToolResult((0, run_1.runSimulatePolicy)(args)));
+    server.tool('verify_policy', 'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.', schemas_ts_1.VerifyPolicyToolShape, (args) => toCallToolResult((0, run_1.runVerifyPolicy)(args)));
     server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', schemas_ts_1.InstallPolicyToolShape, (args) => (0, run_1.runInstallPolicy)(args).then(toCallToolResult));
     server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', schemas_ts_1.RevokePolicyToolShape, (args) => (0, run_1.runRevokePolicy)(args).then(toCallToolResult));
     server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', schemas_ts_1.GetInterpreterInfoToolShape, (args) => (0, run_1.runGetInterpreterInfo)(args).then(toCallToolResult));

package/dist-cjs/src/transports/http.js

@@ -3,8 +3,10 @@
 //
 // Streamable HTTP transport (hosted). Uses the Node http module directly so
 // the package stays thin - no express / hono dep. We run in STATELESS mode
-// (sessionIdGenerator: undefined) so each POST /mcp is its own transaction:
-// this matches the brief's "stateless across calls" invariant.
+// (no sessionIdGenerator: the SDK disables session management when it is not
+// provided) so each POST /mcp is its own transaction: this matches the
+// brief's "stateless across calls" invariant. Stateless means a fresh server
+// and transport per request - see the handler for why the SDK requires it.
 //
 // Single endpoint: POST /mcp (the SDK also accepts GET for SSE streaming, but
 // the T1 surface does not emit server-initiated messages so we omit it).
@@ -37,13 +39,6 @@ async function startHttpServer(opts) {
     if (!LOOPBACK_HOSTS.has(host) && opts.allowExternalHost !== true) {
         throw new Error(`startHttpServer: refusing to bind host ${host}: the MCP surface is unauthenticated, so only loopback (127.0.0.1, ::1, localhost) is permitted by default. Pass \`allowExternalHost: true\` to opt in to a non-loopback bind.`);
     }
-    const server = (0, server_ts_1.createMcpServer)();
-    // One transport per server (the SDK reuses the transport for every request
-    // in stateless mode). We connect it once at startup and reuse it.
-    const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
-        sessionIdGenerator: undefined,
-    });
-    await server.connect(transport);
     const httpServer = (0, node_http_1.createServer)(async (req, res) => {
         if (!req.url) {
             sendJson(res, 400, { error: 'missing url' });
@@ -89,7 +84,33 @@ async function startHttpServer(opts) {
             });
             return;
         }
+        // A stateless transport handles exactly ONE request: the SDK refuses to
+        // reuse one ("Stateless transport cannot be reused across requests"),
+        // because a shared instance would let concurrent clients collide on
+        // JSON-RPC message ids. So the server and its transport are built here,
+        // per request, and torn down when the response closes.
+        // No `sessionIdGenerator`: the SDK disables session management when the
+        // option is absent, which is the stateless mode this surface wants.
+        // Passing an explicit `undefined` means the same thing to the SDK but is
+        // not assignable under `exactOptionalPropertyTypes`, so omission is both
+        // the type-correct and the documented spelling.
+        const server = (0, server_ts_1.createMcpServer)();
+        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport();
+        // Registered before dispatch, not after: once the response has closed the
+        // event is gone, so a listener attached afterwards would never fire and
+        // the pair would leak.
+        res.on('close', () => {
+            void transport.close().catch(() => { });
+            void server.close().catch(() => { });
+        });
         try {
+            // The SDK declares `Transport.onclose` as an optional `() => void`, but
+            // exposes it on this class as an accessor pair typed `(() => void) |
+            // undefined`. Those are not assignable under `exactOptionalPropertyTypes`.
+            // The widening is upstream and structural only - the runtime object does
+            // satisfy `Transport` - so the assertion is narrowed to this one call
+            // rather than relaxing the compiler flag for the whole package.
+            await server.connect(transport);
             // `handleRequest` writes the response and returns once the message has
             // been dispatched. No shared state across calls in stateless mode.
             await transport.handleRequest(req, res, body);
@@ -122,10 +143,11 @@ async function startHttpServer(opts) {
         port: opts.port,
         host,
         path,
+        // Nothing outlives a request, so closing the listener is the whole
+        // shutdown: each request's server and transport are already torn down by
+        // the `close` handler on its own response.
         close: async () => {
             await new Promise((resolve) => httpServer.close(() => resolve()));
-            await transport.close().catch(() => { });
-            await server.close().catch(() => { });
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-mcp",
-  "version": "0.1.18",
+  "version": "0.3.0",
   "license": "MIT",
   "description": "MCP server exposing the OZ policy-synth core (record_transaction + synthesize_policy) over stdio and Streamable HTTP transports.",
   "type": "module",
@@ -12,12 +12,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/untangledfinance/octogate.git",
+    "url": "https://github.com/untangledfinance/oz-policy-builder.git",
     "directory": "packages/policy-builder-mcp"
   },
-  "homepage": "https://github.com/untangledfinance/octogate#readme",
+  "homepage": "https://github.com/untangledfinance/oz-policy-builder#readme",
   "bugs": {
-    "url": "https://github.com/untangledfinance/octogate/issues"
+    "url": "https://github.com/untangledfinance/oz-policy-builder/issues"
   },
   "keywords": [
     "stellar",
@@ -63,8 +63,8 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.1.18",
-    "@modelcontextprotocol/sdk": "1.18.1",
+    "@crediolabs/policy-synth": "0.3.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"
   },

package/src/schemas.ts

@@ -26,18 +26,13 @@ import {
   GetInterpreterInfoInputSchema,
   InstallPolicyInputSchema,
   InterpreterOptionsSchema,
-  MandateSpecSchema,
   NetworkSchema,
-  OraclePriceFixtureSchema,
-  OzAdapterConfigSchema,
   PredicateNodeSchema,
   RecordedTransactionSchema,
   RecordTransactionInputSchema,
   RevokePolicyInputSchema,
-  SimulatePolicyInputSchema,
   SynthesizePolicyInputSchema,
   ToolErrorSchema,
-  VerifyPolicyInputSchema,
 } from '@crediolabs/policy-synth/run'
 import { z } from 'zod'
 
@@ -51,18 +46,13 @@ export {
   GetInterpreterInfoInputSchema,
   InstallPolicyInputSchema,
   InterpreterOptionsSchema,
-  MandateSpecSchema,
   NetworkSchema,
-  OraclePriceFixtureSchema,
-  OzAdapterConfigSchema,
   PredicateNodeSchema,
   RecordedTransactionSchema,
   RecordTransactionInputSchema,
   RevokePolicyInputSchema,
-  SimulatePolicyInputSchema,
   SynthesizePolicyInputSchema,
   ToolErrorSchema,
-  VerifyPolicyInputSchema,
 }
 
 /** Flat ZodRawShape used for the MCP SDK tool registration. The body
@@ -76,17 +66,15 @@ export const RecordTransactionToolShape = {
 } as const
 
 /** Flat ZodRawShape used for MCP tool registration. Every field is optional
- *  so the JSON-Schema the SDK exposes to clients does not forbid either
- *  front-end; the body re-validates against the discriminated union. */
+ *  so the JSON-Schema the SDK exposes to clients stays permissive; the body
+ *  re-validates against the strict schema. */
 export const SynthesizePolicyToolShape = {
-  source: z.enum(['mandate', 'recording']).optional(),
-  mandate: MandateSpecSchema.optional(),
+  source: z.literal('recording').optional(),
   recordedTx: RecordedTransactionSchema.optional(),
   network: NetworkSchema.optional(),
   userResponses: ComposeUserResponsesSchema.optional(),
   confidenceOverride: z.object({ threshold: z.number().min(0).max(1) }).optional(),
   interpreter: InterpreterOptionsSchema.optional(),
-  ozConfig: OzAdapterConfigSchema.optional(),
   // Without this the tool chain has no join. A ProposedPolicy carries
   // `policyDocuments[].encodedPredicate` (canonical ScVal bytes), while
   // `simulate_policy` and `verify_policy` both want the PredicateNode TREE,
@@ -97,35 +85,18 @@ export const SynthesizePolicyToolShape = {
   explain: z.boolean().optional(),
 } as const
 
-/** Flat ZodRawShape for `simulate_policy`. The `predicate` is typed as
- *  `z.unknown()` at the tool boundary because the recursive
- *  `PredicateNodeSchema` is a `z.lazy()` union (the SDK does not accept
- *  unions at the tool-registration boundary); the body re-validates
- *  against `SimulatePolicyInputSchema`, which fails closed on a
- *  malformed predicate. `predicate` is nullable here (vs required for
- *  verify_policy) so the SDK-emitted JSON Schema mirrors the engine's
- *  "OZ-only / no interpreter predicate" contract. */
-export const SimulatePolicyToolShape = {
-  predicate: z.unknown().nullable().optional(),
+/** `simulate_policy` and `verify_policy` share their input: the predicate tree
+ *  (from `synthesize_policy` under `explain`) plus the recording it was
+ *  synthesised from. */
+const PolicyCheckToolShape = {
+  predicate: PredicateNodeSchema,
   permitTx: RecordedTransactionSchema,
   validUntilLedger: z.number().int().positive().optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
 } as const
 
-/** Flat ZodRawShape for `verify_policy`. Same `z.unknown()` boundary
- *  trick for `predicate` as `SimulatePolicyToolShape`; `predicate` is
- *  required at the strict-schema level (`VerifyPolicyInputSchema`) so
- *  the body fails closed on a missing predicate. */
-export const VerifyPolicyToolShape = {
-  predicate: z.unknown(),
-  permitTx: RecordedTransactionSchema,
-  validUntilLedger: z.number().int().positive().optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
-} as const
+export const SimulatePolicyToolShape = { ...PolicyCheckToolShape } as const
+export const VerifyPolicyToolShape = { ...PolicyCheckToolShape } as const
 
-// Re-export the strict input schemas so MCP consumers (and downstream
-// tests) can import the canonical wire shapes from the same module
-// that owns the tool-shape glue.
 export type {
   GetInterpreterInfoInput,
   InstallPolicyInput,

package/src/server.ts

@@ -64,23 +64,23 @@ export function registerTools(server: McpServer): void {
 
   server.tool(
     'synthesize_policy',
-    'Synthesize a ProposedPolicy from either a deterministic MandateSpec (`source: mandate`) or a RecordedTransaction (`source: recording`). The discriminated `source` field selects the front-end.',
+    'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).',
     SynthesizePolicyToolShape,
     (args) => runSynthesizePolicy(args).then(toCallToolResult)
   )
 
   server.tool(
     'simulate_policy',
-    'Replay a RecordedTransaction against a proposed PredicateNode (or null for an OZ-only policy) and emit the SimulationResult envelope (permit verdict + deny-case battery). Returns a SIMULATION_ERROR ToolError on runtime evaluation failure.',
+    'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.',
     SimulatePolicyToolShape,
-    (args) => runSimulatePolicy(args).then(toCallToolResult)
+    (args) => toCallToolResult(runSimulatePolicy(args))
   )
 
   server.tool(
     'verify_policy',
-    'Run the static minimality check on a proposed PredicateNode against a RecordedTransaction (no conjunct is load-bearing-free). Returns VERIFICATION_FAILED with the dropped-constraint fingerprints when the predicate is over-broad.',
+    'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.',
     VerifyPolicyToolShape,
-    (args) => runVerifyPolicy(args).then(toCallToolResult)
+    (args) => toCallToolResult(runVerifyPolicy(args))
   )
 
   server.tool(

package/src/transports/http.ts

@@ -2,8 +2,10 @@
 //
 // Streamable HTTP transport (hosted). Uses the Node http module directly so
 // the package stays thin - no express / hono dep. We run in STATELESS mode
-// (sessionIdGenerator: undefined) so each POST /mcp is its own transaction:
-// this matches the brief's "stateless across calls" invariant.
+// (no sessionIdGenerator: the SDK disables session management when it is not
+// provided) so each POST /mcp is its own transaction: this matches the
+// brief's "stateless across calls" invariant. Stateless means a fresh server
+// and transport per request - see the handler for why the SDK requires it.
 //
 // Single endpoint: POST /mcp (the SDK also accepts GET for SSE streaming, but
 // the T1 surface does not emit server-initiated messages so we omit it).
@@ -22,6 +24,7 @@
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
 import type { ToolError } from '@crediolabs/policy-synth'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createMcpServer } from '../server.ts'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
@@ -60,14 +63,6 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
       `startHttpServer: refusing to bind host ${host}: the MCP surface is unauthenticated, so only loopback (127.0.0.1, ::1, localhost) is permitted by default. Pass \`allowExternalHost: true\` to opt in to a non-loopback bind.`
     )
   }
-  const server = createMcpServer()
-  // One transport per server (the SDK reuses the transport for every request
-  // in stateless mode). We connect it once at startup and reuse it.
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: undefined,
-  })
-  await server.connect(transport)
-
   const httpServer: Server = createServer(async (req, res) => {
     if (!req.url) {
       sendJson(res, 400, { error: 'missing url' })
@@ -114,7 +109,33 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
       return
     }
 
+    // A stateless transport handles exactly ONE request: the SDK refuses to
+    // reuse one ("Stateless transport cannot be reused across requests"),
+    // because a shared instance would let concurrent clients collide on
+    // JSON-RPC message ids. So the server and its transport are built here,
+    // per request, and torn down when the response closes.
+    // No `sessionIdGenerator`: the SDK disables session management when the
+    // option is absent, which is the stateless mode this surface wants.
+    // Passing an explicit `undefined` means the same thing to the SDK but is
+    // not assignable under `exactOptionalPropertyTypes`, so omission is both
+    // the type-correct and the documented spelling.
+    const server = createMcpServer()
+    const transport = new StreamableHTTPServerTransport()
+    // Registered before dispatch, not after: once the response has closed the
+    // event is gone, so a listener attached afterwards would never fire and
+    // the pair would leak.
+    res.on('close', () => {
+      void transport.close().catch(() => {})
+      void server.close().catch(() => {})
+    })
     try {
+      // The SDK declares `Transport.onclose` as an optional `() => void`, but
+      // exposes it on this class as an accessor pair typed `(() => void) |
+      // undefined`. Those are not assignable under `exactOptionalPropertyTypes`.
+      // The widening is upstream and structural only - the runtime object does
+      // satisfy `Transport` - so the assertion is narrowed to this one call
+      // rather than relaxing the compiler flag for the whole package.
+      await server.connect(transport as unknown as Transport)
       // `handleRequest` writes the response and returns once the message has
       // been dispatched. No shared state across calls in stateless mode.
       await transport.handleRequest(req as IncomingMessage & { auth?: never }, res, body)
@@ -147,10 +168,11 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
     port: opts.port,
     host,
     path,
+    // Nothing outlives a request, so closing the listener is the whole
+    // shutdown: each request's server and transport are already torn down by
+    // the `close` handler on its own response.
     close: async () => {
       await new Promise<void>((resolve) => httpServer.close(() => resolve()))
-      await transport.close().catch(() => {})
-      await server.close().catch(() => {})
     },
   }
 }