@crediolabs/policy-builder-mcp 0.2.0 → 0.3.0

package/dist-cjs/src/schemas.js

@@ -0,0 +1,114 @@
+"use strict";
+// packages/policy-builder-mcp/src/schemas.ts
+//
+// MCP-only tool shapes. The CORE input/output schemas and the MCP server
+// registrations all live on `@crediolabs/policy-synth` (the tool-body glue
+// sits at `@crediolabs/policy-synth/run`; the underlying Zod input schemas
+// live at `@crediolabs/policy-synth/run`). What stays here is just the flat
+// `ZodRawShape` needed by `@modelcontextprotocol/sdk`'s `tool()` registration
+// API, which does not accept the strict discriminated union `synthesize_policy`
+// needs.
+//
+// The body of every tool call re-validates against the strict schemas via
+// `runRecordTransaction` / `runSynthesizePolicy`, so wire inputs still
+// fail closed. The mutual-exclusion rules (e.g. exactly-one-of hash/xdr)
+// live on the strict schemas, NOT on the tool shape; the SDK does not
+// invoke `.refine()` at registration time, so any refined rule must be
+// re-checked in the body.
+//
+// The tool-shape fields below are hand-rolled simple types rather than
+// references into the refined strict schemas (`.refine()` returns
+// `ZodEffects`, which has no `.shape`). They MUST stay in lockstep with
+// the strict schemas - a drift in field type or optionality breaks the
+// SDK's emitted JSON Schema.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetInterpreterInfoToolShape = exports.RevokePolicyToolShape = exports.InstallPolicyToolShape = exports.VerifyPolicyToolShape = exports.SimulatePolicyToolShape = exports.SynthesizePolicyToolShape = exports.RecordTransactionToolShape = exports.ToolErrorSchema = exports.SynthesizePolicyInputSchema = exports.RevokePolicyInputSchema = exports.RecordTransactionInputSchema = exports.RecordedTransactionSchema = exports.PredicateNodeSchema = exports.NetworkSchema = exports.InterpreterOptionsSchema = exports.InstallPolicyInputSchema = exports.GetInterpreterInfoInputSchema = exports.ComposeUserResponsesSchema = void 0;
+const run_1 = require("@crediolabs/policy-synth/run");
+Object.defineProperty(exports, "ComposeUserResponsesSchema", { enumerable: true, get: function () { return run_1.ComposeUserResponsesSchema; } });
+Object.defineProperty(exports, "GetInterpreterInfoInputSchema", { enumerable: true, get: function () { return run_1.GetInterpreterInfoInputSchema; } });
+Object.defineProperty(exports, "InstallPolicyInputSchema", { enumerable: true, get: function () { return run_1.InstallPolicyInputSchema; } });
+Object.defineProperty(exports, "InterpreterOptionsSchema", { enumerable: true, get: function () { return run_1.InterpreterOptionsSchema; } });
+Object.defineProperty(exports, "NetworkSchema", { enumerable: true, get: function () { return run_1.NetworkSchema; } });
+Object.defineProperty(exports, "PredicateNodeSchema", { enumerable: true, get: function () { return run_1.PredicateNodeSchema; } });
+Object.defineProperty(exports, "RecordedTransactionSchema", { enumerable: true, get: function () { return run_1.RecordedTransactionSchema; } });
+Object.defineProperty(exports, "RecordTransactionInputSchema", { enumerable: true, get: function () { return run_1.RecordTransactionInputSchema; } });
+Object.defineProperty(exports, "RevokePolicyInputSchema", { enumerable: true, get: function () { return run_1.RevokePolicyInputSchema; } });
+Object.defineProperty(exports, "SynthesizePolicyInputSchema", { enumerable: true, get: function () { return run_1.SynthesizePolicyInputSchema; } });
+Object.defineProperty(exports, "ToolErrorSchema", { enumerable: true, get: function () { return run_1.ToolErrorSchema; } });
+const zod_1 = require("zod");
+/** Flat ZodRawShape used for the MCP SDK tool registration. The body
+ *  re-validates against `RecordTransactionInputSchema` so the mutual-exclusion
+ *  rule still fires (the SDK does not invoke `.refine()` at registration time). */
+exports.RecordTransactionToolShape = {
+    hash: zod_1.z.string().min(1).optional(),
+    xdr: zod_1.z.string().min(1).optional(),
+    network: run_1.NetworkSchema,
+    confidenceOverride: zod_1.z.number().min(0).max(1).optional(),
+};
+/** Flat ZodRawShape used for MCP tool registration. Every field is optional
+ *  so the JSON-Schema the SDK exposes to clients stays permissive; the body
+ *  re-validates against the strict schema. */
+exports.SynthesizePolicyToolShape = {
+    source: zod_1.z.literal('recording').optional(),
+    recordedTx: run_1.RecordedTransactionSchema.optional(),
+    network: run_1.NetworkSchema.optional(),
+    userResponses: run_1.ComposeUserResponsesSchema.optional(),
+    confidenceOverride: zod_1.z.object({ threshold: zod_1.z.number().min(0).max(1) }).optional(),
+    interpreter: run_1.InterpreterOptionsSchema.optional(),
+    // Without this the tool chain has no join. A ProposedPolicy carries
+    // `policyDocuments[].encodedPredicate` (canonical ScVal bytes), while
+    // `simulate_policy` and `verify_policy` both want the PredicateNode TREE,
+    // and the tree is only returned under `explain`. Omitting it here left an
+    // MCP client able to synthesize a policy and then unable to prove anything
+    // about it - the two checks were reachable only with `predicate: null`,
+    // which skips the interpreter predicate entirely.
+    explain: zod_1.z.boolean().optional(),
+};
+/** `simulate_policy` and `verify_policy` share their input: the predicate tree
+ *  (from `synthesize_policy` under `explain`) plus the recording it was
+ *  synthesised from. */
+const PolicyCheckToolShape = {
+    predicate: run_1.PredicateNodeSchema,
+    permitTx: run_1.RecordedTransactionSchema,
+    validUntilLedger: zod_1.z.number().int().positive().optional(),
+};
+exports.SimulatePolicyToolShape = { ...PolicyCheckToolShape };
+exports.VerifyPolicyToolShape = { ...PolicyCheckToolShape };
+/** Common base for `install_policy` and `revoke_policy`: smartAccount,
+ *  sourceAccount, optional RPC URL, optional base fee. Both share the
+ *  same smart-account context, so the SDK-emitted JSON Schema stays
+ *  identical for those fields. The body re-validates against the strict
+ *  schemas in `@crediolabs/policy-synth/run`. */
+const SmartAccountToolShape = {
+    smartAccount: zod_1.z.string().min(1).optional(),
+    sourceAccount: zod_1.z.string().min(1).optional(),
+    rpcUrl: zod_1.z.string().url().optional(),
+    baseFee: zod_1.z.number().int().positive().optional(),
+};
+/** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
+ *  at the tool boundary because the rule schema is a discriminated union
+ *  the SDK does not accept at registration; the body re-validates
+ *  against `InstallPolicyInputSchema`. `encodedPredicate` /
+ *  `predicateHash` live INSIDE `rule.policies[].predicateBlobBase64`
+ *  (the policy already carries the encoded predicate); the run-layer
+ *  extracts them from there. */
+exports.InstallPolicyToolShape = {
+    ...SmartAccountToolShape,
+    rule: zod_1.z.unknown().optional(),
+    installNonce: zod_1.z.number().int().positive().optional(),
+    interpreterAddress: zod_1.z.string().optional(),
+};
+/** Flat ZodRawShape for `revoke_policy`. */
+exports.RevokePolicyToolShape = {
+    ...SmartAccountToolShape,
+    ruleId: zod_1.z.number().int().nonnegative().optional(),
+    interpreterAddress: zod_1.z.string().optional(),
+};
+/** Flat ZodRawShape for `get_interpreter_info`. `verifyLive` triggers an
+ *  optional RPC `grammar_version()` call so the caller can verify the
+ *  deployed contract matches the pin. */
+exports.GetInterpreterInfoToolShape = {
+    network: zod_1.z.enum(['mainnet', 'testnet']).optional(),
+    verifyLive: zod_1.z.boolean().optional(),
+    rpcUrl: zod_1.z.string().url().optional(),
+};

package/dist-cjs/src/server.d.ts

@@ -0,0 +1,6 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** Build a fresh, stateless MCP server. The caller owns the returned object
+ *  and connects it to a single transport (stdio or Streamable HTTP). */
+export declare function createMcpServer(): McpServer;
+/** Idempotent registration of the T1 tool set on the given server. */
+export declare function registerTools(server: McpServer): void;

package/dist-cjs/src/server.js

@@ -0,0 +1,42 @@
+"use strict";
+// packages/policy-builder-mcp/src/server.ts
+//
+// Registers the T1 tool surface on a fresh McpServer instance. The
+// registration uses the official MCP SDK's `tool()` API with ZodRawShape
+// schemas (the SDK does not accept ZodEffects / discriminated unions at the
+// tool registration boundary - the known gotcha). The body re-validates
+// against the strict discriminated union in `@crediolabs/policy-synth/run`
+// so wire inputs still fail closed.
+//
+// Stateless: a fresh McpServer is constructed per transport (stdio/HTTP). No
+// shared mutable state across calls; nothing here caches, queues, or holds
+// key material.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpServer = createMcpServer;
+exports.registerTools = registerTools;
+const run_1 = require("@crediolabs/policy-synth/run");
+const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
+const schemas_ts_1 = require("./schemas.js");
+const result_ts_1 = require("./tools/result.js");
+/** Our envelope types `structuredContent` precisely (T / ToolError); the SDK's
+ *  CallToolResult widens it to Record<string, unknown>, so the nominal types
+ *  do not overlap. The runtime shapes match, so we assert through `unknown`
+ *  at the transport boundary - in one place, used by every tool. */
+const toCallToolResult = (res) => (0, result_ts_1.mcpResultFromCore)(res);
+/** Build a fresh, stateless MCP server. The caller owns the returned object
+ *  and connects it to a single transport (stdio or Streamable HTTP). */
+function createMcpServer() {
+    const server = new mcp_js_1.McpServer({ name: 'policy-builder-mcp', version: '0.0.0' }, { capabilities: { tools: {} } });
+    registerTools(server);
+    return server;
+}
+/** Idempotent registration of the T1 tool set on the given server. */
+function registerTools(server) {
+    server.tool('record_transaction', 'Decode a Soroban transaction (on-chain hash OR base64 envelope XDR) into a RecordedTransaction. Returns a machine-readable ToolError on validation failure.', schemas_ts_1.RecordTransactionToolShape, (args) => (0, run_1.runRecordTransaction)(args).then(toCallToolResult));
+    server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).', schemas_ts_1.SynthesizePolicyToolShape, (args) => (0, run_1.runSynthesizePolicy)(args).then(toCallToolResult));
+    server.tool('simulate_policy', 'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.', schemas_ts_1.SimulatePolicyToolShape, (args) => toCallToolResult((0, run_1.runSimulatePolicy)(args)));
+    server.tool('verify_policy', 'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.', schemas_ts_1.VerifyPolicyToolShape, (args) => toCallToolResult((0, run_1.runVerifyPolicy)(args)));
+    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', schemas_ts_1.InstallPolicyToolShape, (args) => (0, run_1.runInstallPolicy)(args).then(toCallToolResult));
+    server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', schemas_ts_1.RevokePolicyToolShape, (args) => (0, run_1.runRevokePolicy)(args).then(toCallToolResult));
+    server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', schemas_ts_1.GetInterpreterInfoToolShape, (args) => (0, run_1.runGetInterpreterInfo)(args).then(toCallToolResult));
+}

package/dist-cjs/src/tools/result.d.ts

@@ -0,0 +1,24 @@
+import type { ToolError, ToolResponse } from '@crediolabs/policy-synth';
+export interface McpToolSuccess<T> {
+    isError: false;
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    structuredContent: T;
+}
+export interface McpToolError {
+    isError: true;
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    structuredContent: ToolError;
+}
+export type McpToolResult<T> = McpToolSuccess<T> | McpToolError;
+/** Map a core ToolResponse<T> to the MCP result envelope. The handler in
+ *  src/server.ts wraps this in the SDK's `{ content, isError }` shape. */
+export declare function mcpResultFromCore<T>(res: ToolResponse<T>): McpToolResult<T>;
+/** Map a core ToolError directly (for inputs that already failed validation
+ *  inside the handler). */
+export declare function mcpErrorFromCore(err: ToolError): McpToolError;

package/dist-cjs/src/tools/result.js

@@ -0,0 +1,38 @@
+"use strict";
+// packages/policy-builder-mcp/src/tools/result.ts
+//
+// Transport-layer mapping between the core's ToolResponse<T> envelope and the
+// MCP result envelope. This is the ONLY place the two envelopes meet; no
+// business logic lives here. The shapes follow the MCP spec for the
+// `CallToolResult` type:
+//
+//   success:  { content: [{ type: 'text', text: JSON.stringify(data) }], isError: false }
+//   failure:  { content: [{ type: 'text', text: JSON.stringify(error) }], isError: true }
+//
+// Both branches carry the structured content as a single JSON-encoded text
+// block so clients that do not parse `structuredContent` still see a usable
+// payload. The shape is intentionally tiny - any extra keys belong in the
+// core, not here.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpResultFromCore = mcpResultFromCore;
+exports.mcpErrorFromCore = mcpErrorFromCore;
+/** Map a core ToolResponse<T> to the MCP result envelope. The handler in
+ *  src/server.ts wraps this in the SDK's `{ content, isError }` shape. */
+function mcpResultFromCore(res) {
+    if (!res.ok)
+        return mcpErrorFromCore(res.error);
+    return {
+        isError: false,
+        content: [{ type: 'text', text: JSON.stringify(res.data) }],
+        structuredContent: res.data,
+    };
+}
+/** Map a core ToolError directly (for inputs that already failed validation
+ *  inside the handler). */
+function mcpErrorFromCore(err) {
+    return {
+        isError: true,
+        content: [{ type: 'text', text: JSON.stringify(err) }],
+        structuredContent: err,
+    };
+}

package/dist-cjs/src/transports/http.d.ts

@@ -0,0 +1,21 @@
+export interface StartHttpServerOptions {
+    port: number;
+    host?: string;
+    /** Path the server mounts the MCP endpoint at. Default `/mcp`. */
+    path?: string;
+    /** Opt-in to binding a NON-loopback host (e.g. `0.0.0.0` to expose the
+     *  server on a LAN / public NIC). The MCP surface is unauthenticated, so
+     *  this is gated behind a flag: the default refuse-then-opt-in shape
+     *  keeps the security boundary auditable in code review. A caller that
+     *  sets this is taking responsibility for downstream auth / firewall. */
+    allowExternalHost?: boolean;
+}
+export interface RunningHttpServer {
+    port: number;
+    host: string;
+    path: string;
+    close: () => Promise<void>;
+}
+/** Stateless Streamable HTTP server. Resolves once the server is listening.
+ *  The returned handle exposes `close()` for tests + clean shutdown. */
+export declare function startHttpServer(opts: StartHttpServerOptions): Promise<RunningHttpServer>;

package/dist-cjs/src/transports/http.js

@@ -0,0 +1,181 @@
+"use strict";
+// packages/policy-builder-mcp/src/transports/http.ts
+//
+// Streamable HTTP transport (hosted). Uses the Node http module directly so
+// the package stays thin - no express / hono dep. We run in STATELESS mode
+// (no sessionIdGenerator: the SDK disables session management when it is not
+// provided) so each POST /mcp is its own transaction: this matches the
+// brief's "stateless across calls" invariant. Stateless means a fresh server
+// and transport per request - see the handler for why the SDK requires it.
+//
+// Single endpoint: POST /mcp (the SDK also accepts GET for SSE streaming, but
+// the T1 surface does not emit server-initiated messages so we omit it).
+// Listens on 127.0.0.1 by default.
+//
+// SECURITY BOUNDARY: the MCP server has NO auth - any request is processed.
+// Binding to a non-loopback interface (e.g. `0.0.0.0`, `::`, an external
+// NIC) would expose that unauthenticated surface to every reachable host
+// (LAN peers, public cloud metadata, the open internet on a misconfigured
+// VPS). The host boundary is therefore FAIL-CLOSED: only loopback
+// (`127.0.0.1`, `::1`, `localhost`) is accepted by default. A caller that
+// KNOWS they want to expose the server MUST pass `allowExternalHost: true`
+// explicitly - the flag is the auditable intent. Test runners and the
+// in-process CLI client do not need it; they bind 127.0.0.1 already.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startHttpServer = startHttpServer;
+const node_http_1 = require("node:http");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const server_ts_1 = require("../server.js");
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
+/** Stateless Streamable HTTP server. Resolves once the server is listening.
+ *  The returned handle exposes `close()` for tests + clean shutdown. */
+async function startHttpServer(opts) {
+    const host = opts.host ?? '127.0.0.1';
+    const path = opts.path ?? '/mcp';
+    // Default-deny: refuse to bind a non-loopback host unless the caller has
+    // explicitly opted in. The MCP server has no auth, so the only thing
+    // standing between this binary and an open attack surface on `0.0.0.0` is
+    // this check; we would rather fail loudly here than silently expose it.
+    if (!LOOPBACK_HOSTS.has(host) && opts.allowExternalHost !== true) {
+        throw new Error(`startHttpServer: refusing to bind host ${host}: the MCP surface is unauthenticated, so only loopback (127.0.0.1, ::1, localhost) is permitted by default. Pass \`allowExternalHost: true\` to opt in to a non-loopback bind.`);
+    }
+    const httpServer = (0, node_http_1.createServer)(async (req, res) => {
+        if (!req.url) {
+            sendJson(res, 400, { error: 'missing url' });
+            return;
+        }
+        const url = new URL(req.url, `http://${host}`);
+        if (url.pathname !== path) {
+            sendJson(res, 404, { error: 'not found', path: url.pathname });
+            return;
+        }
+        if (req.method !== 'POST') {
+            // The SDK ignores non-POST in stateless mode (no GET/SSE needed in T1).
+            sendJson(res, 405, { error: 'method not allowed', method: req.method ?? null });
+            return;
+        }
+        // Reject an over-cap body fast via Content-Length; the streaming reader is
+        // the backstop for chunked/unknown-length requests.
+        const declaredLength = Number(req.headers['content-length']);
+        if (Number.isFinite(declaredLength) && declaredLength > MAX_BODY_BYTES) {
+            sendJson(res, 413, { error: 'request body too large' });
+            return;
+        }
+        // Read the JSON-RPC body. The SDK accepts a pre-parsed body, so we parse
+        // it here rather than the SDK trying to re-stream the raw req.
+        let body;
+        try {
+            body = await readJsonBody(req);
+        }
+        catch (e) {
+            if (e instanceof BodyTooLargeError) {
+                sendJson(res, 413, { error: 'request body too large' });
+            }
+            else {
+                sendJson(res, 400, { error: 'invalid JSON body' });
+            }
+            return;
+        }
+        // The T1 surface is one request per call. A JSON-RPC batch (array) is
+        // rejected explicitly rather than silently dropping the extra calls.
+        if (Array.isArray(body)) {
+            sendJson(res, 400, {
+                error: 'JSON-RPC batch requests are not supported; send one request per call',
+            });
+            return;
+        }
+        // A stateless transport handles exactly ONE request: the SDK refuses to
+        // reuse one ("Stateless transport cannot be reused across requests"),
+        // because a shared instance would let concurrent clients collide on
+        // JSON-RPC message ids. So the server and its transport are built here,
+        // per request, and torn down when the response closes.
+        // No `sessionIdGenerator`: the SDK disables session management when the
+        // option is absent, which is the stateless mode this surface wants.
+        // Passing an explicit `undefined` means the same thing to the SDK but is
+        // not assignable under `exactOptionalPropertyTypes`, so omission is both
+        // the type-correct and the documented spelling.
+        const server = (0, server_ts_1.createMcpServer)();
+        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport();
+        // Registered before dispatch, not after: once the response has closed the
+        // event is gone, so a listener attached afterwards would never fire and
+        // the pair would leak.
+        res.on('close', () => {
+            void transport.close().catch(() => { });
+            void server.close().catch(() => { });
+        });
+        try {
+            // The SDK declares `Transport.onclose` as an optional `() => void`, but
+            // exposes it on this class as an accessor pair typed `(() => void) |
+            // undefined`. Those are not assignable under `exactOptionalPropertyTypes`.
+            // The widening is upstream and structural only - the runtime object does
+            // satisfy `Transport` - so the assertion is narrowed to this one call
+            // rather than relaxing the compiler flag for the whole package.
+            await server.connect(transport);
+            // `handleRequest` writes the response and returns once the message has
+            // been dispatched. No shared state across calls in stateless mode.
+            await transport.handleRequest(req, res, body);
+        }
+        catch {
+            // The SDK normally writes structured errors itself; this is a belt +
+            // braces guard so a thrown error does not leave the socket hanging.
+            if (res.headersSent) {
+                res.end();
+            }
+            else {
+                const error = {
+                    code: 'SYNTHESIS_ERROR',
+                    message: 'internal server error',
+                    severity: 'error',
+                    retryable: false,
+                };
+                sendJson(res, 500, { error });
+            }
+        }
+    });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(opts.port, host, () => {
+            httpServer.off('error', reject);
+            resolve();
+        });
+    });
+    return {
+        port: opts.port,
+        host,
+        path,
+        // Nothing outlives a request, so closing the listener is the whole
+        // shutdown: each request's server and transport are already torn down by
+        // the `close` handler on its own response.
+        close: async () => {
+            await new Promise((resolve) => httpServer.close(() => resolve()));
+        },
+    };
+}
+function sendJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json');
+    res.end(JSON.stringify(body));
+}
+/** Reject bodies larger than this before buffering the whole payload - a
+ *  recorded transaction is far smaller, so this only stops abusive requests. */
+const MAX_BODY_BYTES = 1_048_576;
+/** Distinguishes an over-cap body from a malformed one so the handler can send
+ *  a 413 rather than a misleading 400. */
+class BodyTooLargeError extends Error {
+}
+async function readJsonBody(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        total += chunk.length;
+        if (total > MAX_BODY_BYTES)
+            throw new BodyTooLargeError('request body too large');
+        chunks.push(chunk);
+    }
+    if (chunks.length === 0)
+        return {};
+    const raw = Buffer.concat(chunks).toString('utf8');
+    if (!raw)
+        return {};
+    return JSON.parse(raw);
+}

package/dist-cjs/src/transports/stdio.d.ts

@@ -0,0 +1 @@
+export declare function startStdioServer(): Promise<void>;

package/dist-cjs/src/transports/stdio.js

@@ -0,0 +1,18 @@
+"use strict";
+// packages/policy-builder-mcp/src/transports/stdio.ts
+//
+// stdio transport (Claude Desktop / local agents). The MCP SDK reads JSON-RPC
+// from stdin and writes to stdout. Each process serves ONE client and exits
+// when the client closes the stream. No key custody, no global state; the
+// per-call state lives entirely in the McpServer instance.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startStdioServer = startStdioServer;
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const server_ts_1 = require("../server.js");
+async function startStdioServer() {
+    const server = (0, server_ts_1.createMcpServer)();
+    const transport = new stdio_js_1.StdioServerTransport();
+    await server.connect(transport);
+    // The transport owns the process from here; no shutdown signal handling -
+    // SIGPIPE / EOF on stdin terminates the loop naturally.
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-mcp",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "license": "MIT",
   "description": "MCP server exposing the OZ policy-synth core (record_transaction + synthesize_policy) over stdio and Streamable HTTP transports.",
   "type": "module",
@@ -12,12 +12,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/untangledfinance/octogate.git",
+    "url": "https://github.com/untangledfinance/oz-policy-builder.git",
     "directory": "packages/policy-builder-mcp"
   },
-  "homepage": "https://github.com/untangledfinance/octogate#readme",
+  "homepage": "https://github.com/untangledfinance/oz-policy-builder#readme",
   "bugs": {
-    "url": "https://github.com/untangledfinance/octogate/issues"
+    "url": "https://github.com/untangledfinance/oz-policy-builder/issues"
   },
   "keywords": [
     "stellar",
@@ -37,6 +37,7 @@
       "types": "./dist/src/index.d.ts",
       "bun": "./src/index.ts",
       "import": "./dist/src/index.js",
+      "require": "./dist-cjs/src/index.js",
       "default": "./dist/src/index.js"
     },
     "./package.json": "./package.json"
@@ -46,6 +47,7 @@
   },
   "files": [
     "dist",
+    "dist-cjs",
     "src",
     "!src/**/*.test.ts"
   ],
@@ -54,13 +56,15 @@
   },
   "scripts": {
     "test": "bun test",
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
+    "build:esm": "tsc -p tsconfig.build.json",
+    "build:cjs": "tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
     "prepublishOnly": "bun run build && bun test",
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.2.0",
-    "@modelcontextprotocol/sdk": "1.26.0",
+    "@crediolabs/policy-synth": "0.3.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"
   },

package/src/schemas.ts

@@ -26,18 +26,13 @@ import {
   GetInterpreterInfoInputSchema,
   InstallPolicyInputSchema,
   InterpreterOptionsSchema,
-  MandateSpecSchema,
   NetworkSchema,
-  OraclePriceFixtureSchema,
-  OzAdapterConfigSchema,
   PredicateNodeSchema,
   RecordedTransactionSchema,
   RecordTransactionInputSchema,
   RevokePolicyInputSchema,
-  SimulatePolicyInputSchema,
   SynthesizePolicyInputSchema,
   ToolErrorSchema,
-  VerifyPolicyInputSchema,
 } from '@crediolabs/policy-synth/run'
 import { z } from 'zod'
 
@@ -51,18 +46,13 @@ export {
   GetInterpreterInfoInputSchema,
   InstallPolicyInputSchema,
   InterpreterOptionsSchema,
-  MandateSpecSchema,
   NetworkSchema,
-  OraclePriceFixtureSchema,
-  OzAdapterConfigSchema,
   PredicateNodeSchema,
   RecordedTransactionSchema,
   RecordTransactionInputSchema,
   RevokePolicyInputSchema,
-  SimulatePolicyInputSchema,
   SynthesizePolicyInputSchema,
   ToolErrorSchema,
-  VerifyPolicyInputSchema,
 }
 
 /** Flat ZodRawShape used for the MCP SDK tool registration. The body
@@ -76,17 +66,15 @@ export const RecordTransactionToolShape = {
 } as const
 
 /** Flat ZodRawShape used for MCP tool registration. Every field is optional
- *  so the JSON-Schema the SDK exposes to clients does not forbid either
- *  front-end; the body re-validates against the discriminated union. */
+ *  so the JSON-Schema the SDK exposes to clients stays permissive; the body
+ *  re-validates against the strict schema. */
 export const SynthesizePolicyToolShape = {
-  source: z.enum(['mandate', 'recording']).optional(),
-  mandate: MandateSpecSchema.optional(),
+  source: z.literal('recording').optional(),
   recordedTx: RecordedTransactionSchema.optional(),
   network: NetworkSchema.optional(),
   userResponses: ComposeUserResponsesSchema.optional(),
   confidenceOverride: z.object({ threshold: z.number().min(0).max(1) }).optional(),
   interpreter: InterpreterOptionsSchema.optional(),
-  ozConfig: OzAdapterConfigSchema.optional(),
   // Without this the tool chain has no join. A ProposedPolicy carries
   // `policyDocuments[].encodedPredicate` (canonical ScVal bytes), while
   // `simulate_policy` and `verify_policy` both want the PredicateNode TREE,
@@ -97,35 +85,18 @@ export const SynthesizePolicyToolShape = {
   explain: z.boolean().optional(),
 } as const
 
-/** Flat ZodRawShape for `simulate_policy`. The `predicate` is typed as
- *  `z.unknown()` at the tool boundary because the recursive
- *  `PredicateNodeSchema` is a `z.lazy()` union (the SDK does not accept
- *  unions at the tool-registration boundary); the body re-validates
- *  against `SimulatePolicyInputSchema`, which fails closed on a
- *  malformed predicate. `predicate` is nullable here (vs required for
- *  verify_policy) so the SDK-emitted JSON Schema mirrors the engine's
- *  "OZ-only / no interpreter predicate" contract. */
-export const SimulatePolicyToolShape = {
-  predicate: z.unknown().nullable().optional(),
+/** `simulate_policy` and `verify_policy` share their input: the predicate tree
+ *  (from `synthesize_policy` under `explain`) plus the recording it was
+ *  synthesised from. */
+const PolicyCheckToolShape = {
+  predicate: PredicateNodeSchema,
   permitTx: RecordedTransactionSchema,
   validUntilLedger: z.number().int().positive().optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
 } as const
 
-/** Flat ZodRawShape for `verify_policy`. Same `z.unknown()` boundary
- *  trick for `predicate` as `SimulatePolicyToolShape`; `predicate` is
- *  required at the strict-schema level (`VerifyPolicyInputSchema`) so
- *  the body fails closed on a missing predicate. */
-export const VerifyPolicyToolShape = {
-  predicate: z.unknown(),
-  permitTx: RecordedTransactionSchema,
-  validUntilLedger: z.number().int().positive().optional(),
-  oraclePricesByAsset: z.record(z.string(), OraclePriceFixtureSchema).optional(),
-} as const
+export const SimulatePolicyToolShape = { ...PolicyCheckToolShape } as const
+export const VerifyPolicyToolShape = { ...PolicyCheckToolShape } as const
 
-// Re-export the strict input schemas so MCP consumers (and downstream
-// tests) can import the canonical wire shapes from the same module
-// that owns the tool-shape glue.
 export type {
   GetInterpreterInfoInput,
   InstallPolicyInput,
@@ -167,15 +138,6 @@ export const RevokePolicyToolShape = {
   interpreterAddress: z.string().optional(),
 } as const
 
-/** Flat ZodRawShape for `merge_policy`: the tightening remedy when two rules
- *  our interpreter polices can serve the same calls. Two steps, in order. */
-export const MergePolicyToolShape = {
-  ...SmartAccountToolShape,
-  ruleId: z.number().int().nonnegative(),
-  incomingPredicateBlobBase64: z.string().min(1),
-  step: z.enum(['detach', 'reinstall']),
-} as const
-
 /** Flat ZodRawShape for `get_interpreter_info`. `verifyLive` triggers an
  *  optional RPC `grammar_version()` call so the caller can verify the
  *  deployed contract matches the pin. */