@dobbyai/mcp-external 1.1.0 → 1.2.0

package/dist/tools/index.js

@@ -1,53 +1,216 @@
 /**
  * MCP Tools Index
  *
- * Exports all tool definitions and handlers.
+ * Exports all tool definitions; execution dispatches through the capability
+ * registry (@dobbyai/capability-core, ADR-019).
  * Gateway integration: Auth check + audit logging via gateway MCP endpoint.
  */
-export * from './tasks.js';
-export * from './messages.js';
-export * from './approvals.js';
-export * from './services.js';
-export * from './crewai.js';
-export * from './crew-builder.js';
-export * from './mcp-tools.js';
-export * from './jira.js';
-export * from './ops.js';
-export * from './github-mcp.js';
-export * from './mem0.js';
-export * from './exa.js';
-export * from './mcp-metrics.js';
-export * from './workflow.js';
-export * from './web-eval.js';
-export * from './memory-graph.js';
-export * from './agent-mail.js';
-export * from './schedules.js';
-export * from './moltbook.js';
-export * from './unified-agents.js';
-export * from './governance.js';
-export * from './tiers.js';
-import { taskTools, handleCreateTask, handleListTasks, handleGetTask, handleUpdateTask, handleGetTaskTimeline, handleCancelTask } from './tasks.js';
-import { messageTools, handleGetMessages, handleSendMessage } from './messages.js';
-import { approvalTools, handleGetPendingApprovals, handleApproveTask, handleRejectTask, handleRequestChanges } from './approvals.js';
-import { serviceTools, handleListServices } from './services.js';
-import { crewaiTools, handleCrewAIHealth, handleCrewAIInputs, handleCrewAIKickoff, handleCrewAIStatus } from './crewai.js';
-import { crewBuilderTools, handleCrewValidate, handleCrewKickoff, handleCrewStatus, handleCrewList } from './crew-builder.js';
-import { mcpRemoteTools, handleMcpDiscoverTools, handleMcpCallTool } from './mcp-tools.js';
-import { jiraTools, handleJiraSearchIssues, handleJiraGetIssue, handleJiraCreateIssue, handleJiraUpdateIssue, handleJiraAddComment, handleJiraGetComments, handleJiraGetTransitions, handleJiraTransitionIssue, handleJiraListProjects, handleJiraAssignIssue } from './jira.js';
-import { opsTools, handleGetOpsHealthSummary, handleGetServiceStatus, handleGetActiveIssues, handleAcknowledgeOpsIssue, handleGetOpsAuditLog } from './ops.js';
-import { githubMcpTools, handleGithubSearchCode, handleGithubGetFile, handleGithubCreatePr, handleGithubListPrs, handleGithubListIssues, handleGithubCreateIssue, handleGithubGetWorkflowRuns } from './github-mcp.js';
-import { mem0Tools, handleMem0Store, handleMem0Search, handleMem0List, handleMem0Delete } from './mem0.js';
-import { exaTools, handleExaWebSearch, handleExaFindSimilar, handleExaGetContents } from './exa.js';
-import { mcpMetricsTools, handleMcpHealthCheck, handleMcpConnectionInfo } from './mcp-metrics.js';
-import { workflowTools, handleWorkflowClassifyTask, handleWorkflowAutoAssign, handleWorkflowAgentWorkload, handleWorkflowAssignmentRules } from './workflow.js';
-import { webEvalTools, handleWebEvalRunTests, handleWebEvalCheckHealth, handleWebEvalTestApiEndpoint, handleWebEvalCoverageReport } from './web-eval.js';
-import { memoryGraphTools, handleMemoryGraphStore, handleMemoryGraphQuery, handleMemoryGraphTimeline, handleMemoryGraphContext } from './memory-graph.js';
-import { agentMailTools, handleAgentMailSendNotification, handleAgentMailGetInbox, handleAgentMailGetIdentity } from './agent-mail.js';
-import { scheduleTools, handleCreateSchedule, handleListSchedules, handlePauseSchedule, handleDeleteSchedule } from './schedules.js';
-import { moltbookTools, handleMoltbookGetProfile, handleMoltbookUpdateProfile, handleMoltbookGetHomeFeed, handleMoltbookGetPosts, handleMoltbookGetPost, handleMoltbookCreatePost, handleMoltbookGetComments, handleMoltbookCreateComment, handleMoltbookUpvotePost, handleMoltbookDownvotePost, handleMoltbookSearch, handleMoltbookGetNotifications } from './moltbook.js';
-import { unifiedAgentTools, handleListAllAgents } from './unified-agents.js';
-import { governanceTools, handleExportPolicies, handleImportPolicies, handleValidatePolicies, handleApplyGuardrail } from './governance.js';
-import { filterToolsByTier } from './tiers.js';
+export * from "./tasks.js";
+export * from "./messages.js";
+export * from "./approvals.js";
+export * from "./services.js";
+export * from "./crewai.js";
+export * from "./crew-builder.js";
+export * from "./mcp-tools.js";
+export * from "./jira.js";
+export * from "./ops.js";
+export * from "./github-mcp.js";
+export * from "./mem0.js";
+export * from "./exa.js";
+export * from "./mcp-metrics.js";
+export * from "./workflow.js";
+export * from "./web-eval.js";
+export * from "./memory-graph.js";
+export * from "./agent-mail.js";
+export * from "./schedules.js";
+export * from "./moltbook.js";
+export * from "./unified-agents.js";
+export * from "./governance.js";
+export * from "./control-plane.js";
+export * from "./monitoring-attribution.js";
+export * from "./setup-status.js";
+export * from "./claude-code-sync.js";
+export * from "./memory-stores.js";
+export * from "./agent-versions.js";
+export * from "./orchestrations.js";
+export * from "./external-agents.js";
+export * from "./workloads.js";
+export * from "./tiers.js";
+import { taskTools } from "./tasks.js";
+import { messageTools } from "./messages.js";
+import { approvalTools } from "./approvals.js";
+import { serviceTools } from "./services.js";
+import { crewaiTools } from "./crewai.js";
+import { crewBuilderTools } from "./crew-builder.js";
+import { mcpRemoteTools } from "./mcp-tools.js";
+import { jiraTools } from "./jira.js";
+import { opsTools } from "./ops.js";
+import { githubMcpTools } from "./github-mcp.js";
+import { mem0Tools } from "./mem0.js";
+import { exaTools } from "./exa.js";
+import { mcpMetricsTools } from "./mcp-metrics.js";
+import { workflowTools } from "./workflow.js";
+import { webEvalTools } from "./web-eval.js";
+import { memoryGraphTools } from "./memory-graph.js";
+import { agentMailTools } from "./agent-mail.js";
+import { scheduleTools } from "./schedules.js";
+import { moltbookTools } from "./moltbook.js";
+import { unifiedAgentTools } from "./unified-agents.js";
+import { governanceTools } from "./governance.js";
+import { controlPlaneTools } from "./control-plane.js";
+import { monitoringAttributionTools } from "./monitoring-attribution.js";
+import { hostedAgentsTools } from "./hosted-agents.js";
+import { setupStatusTools } from "./setup-status.js";
+import { claudeCodeSyncTools } from "./claude-code-sync.js";
+import { memoryStoreTools } from "./memory-stores.js";
+import { sessionTools } from "./sessions.js";
+import { agentVersionTools } from "./agent-versions.js";
+import { orchestrationTools } from "./orchestrations.js";
+import { outcomeTools } from "./outcomes.js";
+import { externalAgentTools } from "./external-agents.js";
+import { llmProviderTools } from "./llm-providers.js";
+import { workloadTools } from "./workloads.js";
+import { TOOL_TIERS, filterToolsByTier, resolveToolTier, isReadOnlyScopes, } from "./tiers.js";
+import { roleCapAllows, createRegistry, toMcpResult, } from "@dobbyai/capability-core";
+// ============================================
+// RBAC role-cap (ADR-019 Phase 2)
+// ============================================
+// Plan-tier ∩ role-cap: on top of the plan tier, each tool has a minimum
+// TENANT role. Derived (not a 131-entry hand-map): admin-class tools →
+// tenant_admin, readOnlyHint tools → viewer, everything else (mutations) →
+// member. The role signal rides authInfo.extra.tenant_role (set by the web
+// introspect route). GRACEFUL: a nullish role (signal absent / not-yet-emitted)
+// skips role gating and falls back to tier-only — role-cap only bites when a
+// concrete role is known, so this never breaks existing tier-gated callers.
+// is_super_admin bypasses the cap entirely. Uses capability-core's roleCapAllows
+// (the ONE shared graceful role-cap helper — the SAME rule the registry's
+// visibleTo() applies, so listing + call gating can't drift) + TenantRole canon
+// (rbac.ts, NOT the legacy constants/roles.ts enum).
+const ADMIN_CLASS_TOOLS = new Set([
+    "approve_task",
+    "reject_task",
+    "request_changes",
+    "deregister_external_agent",
+    "update_external_agent",
+    "agent_version_rollback",
+    "delete_schedule",
+    "delete_agent_schedule",
+    "import_policies",
+    // Creates an Org/Tenant/Process-layer policy (capability-core minRole
+    // tenant_admin) — same admin bar as import_policies.
+    "create_policy",
+    // Edit / soft-delete a single policy (PATCH/DELETE routes enforce
+    // withTenantAuth admin) — same admin bar as create_policy. test_policy is
+    // NOT here: it's a read-only dry-run (viewer).
+    "update_policy",
+    "delete_policy",
+    // Seeds sample runs + fires real compliance scans — same admin bar as
+    // connecting a real workload (the route enforces withTenantAuth admin).
+    "try_sample_workload",
+    // Writes a tenant-wide LLM provider credential (the route enforces
+    // withTenantAuth admin) — same admin bar as connecting a real workload.
+    "connect_llm_provider",
+    // Tears down a Managed Agent (the route enforces withTenantAuth admin).
+    "delete_hosted_agent",
+]);
+// Managed Agents mutation tools — the underlying routes enforce
+// guardHostedRoute(..., "developer", ...), a role this legacy function
+// otherwise has no bucket for (it only distinguishes tenant_admin/viewer/
+// member). Capability-core's `minRole: "developer"` is the source of truth;
+// this set keeps the legacy computation in parity with it.
+const DEVELOPER_CLASS_TOOLS = new Set([
+    "host_sample_agent",
+    "create_hosted_agent",
+    "deploy_hosted_agent",
+    "run_hosted_agent",
+]);
+// Read-only tools that still need "member" (not mere "viewer") because they
+// compose from routes gated at member (e.g. hosted-agent executions), not
+// just viewer-gated data.
+const MEMBER_CLASS_READONLY_TOOLS = new Set(["get_agent_results"]);
+export function minRoleForTool(name) {
+    if (ADMIN_CLASS_TOOLS.has(name))
+        return "tenant_admin";
+    if (DEVELOPER_CLASS_TOOLS.has(name))
+        return "developer";
+    if (MEMBER_CLASS_READONLY_TOOLS.has(name))
+        return "member";
+    const readOnly = allTools[name]?.annotations?.readOnlyHint === true;
+    return readOnly ? "viewer" : "member";
+}
+/**
+ * Does the caller's role clear the tool's minimum role? Superadmin bypasses;
+ * otherwise delegates to the shared `roleCapAllows` (a nullish role skips the
+ * cap — tier-only, non-breaking; a concrete role is checked fail-closed). This
+ * is the SAME helper the registry's `visibleTo()` uses, so the two gating paths
+ * are guaranteed identical.
+ */
+export function passesRoleCap(name, role, isSuperAdmin) {
+    if (isSuperAdmin)
+        return true;
+    return roleCapAllows(role, minRoleForTool(name));
+}
+// ============================================
+// Firewall Sidecar Interceptor
+// ============================================
+// Calls the Agentic Firewall sidecar (localhost:4000) before tool execution.
+// Fail-open: if sidecar is unavailable or times out, tool executes normally.
+// The sidecar returns: 200 (pass/redact), 403 (block), 202 (pause for approval).
+const FIREWALL_SIDECAR_URL = process.env.FIREWALL_SIDECAR_URL || "http://localhost:4000";
+const FIREWALL_TIMEOUT_MS = parseInt(process.env.FIREWALL_TIMEOUT_MS || "3000", 10);
+const FIREWALL_ENABLED = process.env.FIREWALL_ENABLED !== "false"; // Default: enabled
+async function interceptWithFirewall(toolName, args, context) {
+    if (!FIREWALL_ENABLED) {
+        return { action: "pass" };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), FIREWALL_TIMEOUT_MS);
+    try {
+        const response = await fetch(`${FIREWALL_SIDECAR_URL}/v1/tools/intercept`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                tool_name: toolName,
+                tool_arguments: args,
+                org_id: context.tenantId || "unknown", // Best effort
+                tenant_id: context.tenantId || "unknown",
+                actor: {
+                    actor_id: context.userId || "unknown",
+                    actor_type: "ai_agent",
+                    actor_name: context.userName,
+                },
+                session_id: `mcp_${Date.now()}`,
+                trace_id: `trace_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (response.status === 200) {
+            const body = (await response.json());
+            return body;
+        }
+        if (response.status === 403) {
+            const body = (await response.json());
+            return { action: "block", reason: body.reason || "Blocked by firewall" };
+        }
+        if (response.status === 202) {
+            const body = (await response.json());
+            return {
+                action: "pause",
+                job_id: body.job_id,
+                poll_url: body.poll_url,
+                message: body.message,
+            };
+        }
+        // Unknown status — fail-open
+        return { action: "pass" };
+    }
+    catch (error) {
+        clearTimeout(timeout);
+        // Sidecar down or timeout — fail-open (don't block tools)
+        return { action: "pass" };
+    }
+}
 // ============================================
 // All Tools
 // ============================================
@@ -73,32 +236,114 @@ export const allTools = {
     ...moltbookTools,
     ...unifiedAgentTools,
     ...governanceTools,
+    ...controlPlaneTools,
+    ...monitoringAttributionTools,
+    ...hostedAgentsTools,
+    ...setupStatusTools,
+    ...claudeCodeSyncTools,
+    ...memoryStoreTools,
+    ...sessionTools,
+    ...agentVersionTools,
+    ...orchestrationTools,
+    ...outcomeTools,
+    ...externalAgentTools,
+    ...workloadTools,
+    ...llmProviderTools,
 };
 // ============================================
+// Capability Registry (ADR-019 Phase 1)
+// ============================================
+// The registry is the runtime source of truth for tool EXECUTION and VISIBILITY:
+// handleToolCall dispatches every tool through capabilityRegistry.get(name).handler(...),
+// and getToolDefinitions derives its visible set from capabilityRegistry.visibleTo()
+// while sourcing the output shape from allTools (byte-identical listing). Built once
+// at module load from @dobbyai/capability-core (all 131 tools; the legacy handle*
+// bodies were deleted from src/tools/*.ts — the registry holds the only handlers).
+// getToolAccessDenial keeps its staged denial messages on allTools + tiers.ts, with
+// the role check flowing through the shared roleCapAllows rule.
+const capabilityRegistry = createRegistry();
+// ============================================
 // Tool Definitions with Tier Filtering
 // ============================================
 /**
  * Get tool definitions for ListTools response.
  * Filters by tier and includes annotations on each tool.
+ * With `readOnly`, additionally filters to tools annotated readOnlyHint
+ * (a missing annotation counts as NOT read-only — fail closed).
  *
- * Usage in MCP server:
- *   server.setRequestHandler(ListToolsRequestSchema, async () => ({
- *     tools: getToolDefinitions(resolveToolTier(authContext)),
+ * Usage in MCP server (HTTP mode):
+ *   server.setRequestHandler(ListToolsRequestSchema, async (_req, extra) => ({
+ *     tools: getToolDefinitions(resolveToolTier({ scopes }), {
+ *       readOnly: isReadOnlyScopes(scopes),
+ *     }),
  *   }));
  */
-export function getToolDefinitions(tier = 'enterprise') {
-    const allToolNames = Object.keys(allTools);
-    const allowedNames = filterToolsByTier(allToolNames, tier);
-    const allowedSet = new Set(allowedNames);
+export function getToolDefinitions(tier = "enterprise", opts = {}) {
+    // The visible SET comes from the ONE registry (plan-tier ∩ role-cap ∩
+    // read-only, ADR-019 P1 tail); the output SHAPE stays sourced from allTools
+    // so the MCP tool definitions are byte-identical. Proven equivalent to the
+    // legacy filterToolsByTier + read-only + passesRoleCap path across every
+    // tier × role × readOnly × superadmin combo in registry-listing-parity.test.ts.
+    const visibleIds = new Set(capabilityRegistry
+        .visibleTo({
+        tier,
+        role: (opts.role ?? undefined),
+        isSuperAdmin: opts.isSuperAdmin,
+        readOnly: opts.readOnly,
+    })
+        .map((c) => c.id));
     return Object.values(allTools)
-        .filter(tool => allowedSet.has(tool.name))
-        .map(tool => ({
+        .filter((tool) => visibleIds.has(tool.name))
+        .map((tool) => ({
         name: tool.name,
         description: tool.description,
         inputSchema: tool.inputSchema,
         annotations: tool.annotations || {},
     }));
 }
+/**
+ * Tier + read-only enforcement for CallTool — list filtering without call
+ * enforcement is cosmetic. Returns a human-readable denial message, or null
+ * when the call is allowed. Unknown tool names return null so the router's
+ * canonical "Unknown tool" error stays the single source for those.
+ */
+export function getToolAccessDenial(name, authContext) {
+    const tool = allTools[name];
+    if (!tool)
+        return null;
+    // superAdminOnly is a HARD call-time gate (defense-in-depth): the registry's
+    // visibleTo() only HIDES these from ListTools, which is cosmetic — a client
+    // can call any tool by name. Without this, a non-superadmin enterprise-tier
+    // token could invoke a superadmin-only tool (e.g. the platform ops tools) by
+    // name and reach its handler. Mirrors the registry's visibleTo() rule so the
+    // list and call paths gate identically.
+    if (capabilityRegistry.get(name)?.superAdminOnly &&
+        !authContext.isSuperAdmin) {
+        return `Tool "${name}" requires platform super-admin access.`;
+    }
+    const tier = resolveToolTier(authContext);
+    const allowed = new Set(filterToolsByTier(Object.keys(allTools), tier));
+    if (!allowed.has(name)) {
+        const requiredTier = TOOL_TIERS.pro.includes(name) ? "pro" : "enterprise";
+        return (`Tool "${name}" is not available on your current plan ` +
+            `(requires the ${requiredTier} tier; this token's tier is ${tier}). ` +
+            `Upgrade your Dobby plan at https://dobby-ai.com to unlock it.`);
+    }
+    if (isReadOnlyScopes(authContext.scopes) &&
+        allTools[name].annotations?.readOnlyHint !== true) {
+        return (`Tool "${name}" performs writes, but this token is read-only ` +
+            `(every scope ends in :read). Use a key with write scopes to call it.`);
+    }
+    // RBAC role-cap (ADR-019 Phase 2): plan-tier ∩ role. Superadmin bypasses;
+    // a nullish role skips (tier-only). Orthogonal to the read-only cap above —
+    // both must pass (stricter-wins).
+    if (!passesRoleCap(name, authContext.role, authContext.isSuperAdmin)) {
+        return (`Tool "${name}" requires the "${minRoleForTool(name)}" tenant role ` +
+            `or higher; your role is "${authContext.role ?? "none"}". ` +
+            `Ask a tenant admin/owner to grant a higher role.`);
+    }
+    return null;
+}
 /**
  * Check gateway auth for an MCP tool call.
  * Returns auth result from gateway. If no gatewayKey is configured, returns allowed.
@@ -110,11 +355,11 @@ async function checkGatewayAuth(toolName, mcpServer, context) {
     }
     try {
         const response = await fetch(`${context.gatewayUrl}/api/v1/gateway/mcp/tools`, {
-            method: 'POST',
+            method: "POST",
             headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${context.gatewayKey}`,
-                ...(context.tenantId ? { 'X-Tenant-Id': context.tenantId } : {}),
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${context.gatewayKey}`,
+                ...(context.tenantId ? { "X-Tenant-Id": context.tenantId } : {}),
             },
             body: JSON.stringify({
                 tool_name: toolName,
@@ -123,17 +368,19 @@ async function checkGatewayAuth(toolName, mcpServer, context) {
             }),
         });
         if (!response.ok) {
-            const errBody = await response.json().catch(() => ({ error: 'Gateway auth failed' }));
+            const errBody = (await response
+                .json()
+                .catch(() => ({ error: "Gateway auth failed" })));
             return {
                 allowed: false,
                 error: errBody.error || `Gateway returned ${response.status}`,
             };
         }
-        return await response.json();
+        return (await response.json());
     }
     catch (error) {
-        const errMsg = error instanceof Error ? error.message : 'Unknown error';
-        console.error('[MCP Gateway] Auth check failed:', errMsg);
+        const errMsg = error instanceof Error ? error.message : "Unknown error";
+        console.error("[MCP Gateway] Auth check failed:", errMsg);
         // Fail open with warning if gateway is unreachable
         return { allowed: true };
     }
@@ -142,34 +389,34 @@ async function checkGatewayAuth(toolName, mcpServer, context) {
  * Log tool call result to gateway.
  * Non-blocking — errors are logged but don't affect tool result.
  */
-async function logToolCallToGateway(toolCall, authResult, context, eventType = 'mcp.tool.call') {
+async function logToolCallToGateway(toolCall, authResult, context, eventType = "mcp.tool.call") {
     if (!context.gatewayKey || !context.gatewayUrl)
         return;
     try {
         await fetch(`${context.gatewayUrl}/api/v1/gateway/mcp/tools`, {
-            method: 'POST',
+            method: "POST",
             headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${context.gatewayKey}`,
-                ...(context.tenantId ? { 'X-Tenant-Id': context.tenantId } : {}),
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${context.gatewayKey}`,
+                ...(context.tenantId ? { "X-Tenant-Id": context.tenantId } : {}),
             },
             body: JSON.stringify({
-                action: 'log',
+                action: "log",
                 tool_call: toolCall,
                 event_type: eventType,
-                actor_type: authResult.actor?.actor_type || 'human',
+                actor_type: authResult.actor?.actor_type || "human",
                 actor_id: authResult.actor?.actor_id || context.userId,
                 on_behalf_of: authResult.actor?.on_behalf_of || undefined,
-                org_id: authResult.org_id || '',
+                org_id: authResult.org_id || "",
                 region: context.region,
             }),
         });
     }
     catch (error) {
-        console.error('[MCP Gateway] Log failed:', error.message);
+        console.error("[MCP Gateway] Log failed:", error.message);
     }
 }
-const MCP_SERVER_NAME = 'mcp-dobby-external';
+const MCP_SERVER_NAME = "mcp-dobby-external";
 export async function handleToolCall(toolName, args, context) {
     const { client, userId, userName } = context;
     const startTime = new Date();
@@ -178,349 +425,121 @@ export async function handleToolCall(toolName, args, context) {
     if (!authResult.allowed) {
         // Log denial to gateway (non-blocking)
         logToolCallToGateway({
-            tenant_id: context.tenantId || '',
-            agent_id: 'mcp-external',
-            task_id: args.task_id || '',
+            tenant_id: context.tenantId || "",
+            agent_id: "mcp-external",
+            task_id: args.task_id || "",
             mcp_server: MCP_SERVER_NAME,
             tool_name: toolName,
             tool_input: args,
-            status: 'error',
-            error_message: authResult.error || 'Gateway auth denied',
+            status: "error",
+            error_message: authResult.error || "Gateway auth denied",
             started_at: startTime.toISOString(),
             completed_at: new Date().toISOString(),
-        }, authResult, context, 'mcp.tool.denied');
+        }, authResult, context, "mcp.tool.denied");
         return {
             content: [
                 {
-                    type: 'text',
-                    text: `Tool call denied: ${authResult.error || 'Insufficient permissions'}`,
+                    type: "text",
+                    text: `Tool call denied: ${authResult.error || "Insufficient permissions"}`,
                 },
             ],
             isError: true,
         };
     }
+    // 1.5. Firewall sidecar interception (if running)
+    // Calls the Agentic Firewall at localhost:4000 before tool execution.
+    // Fail-open: if sidecar is unavailable, tool executes normally.
+    const firewallResult = await interceptWithFirewall(toolName, args, context);
+    if (firewallResult.action === "block") {
+        logToolCallToGateway({
+            tenant_id: context.tenantId || "",
+            agent_id: "mcp-external",
+            task_id: args.task_id || "",
+            mcp_server: MCP_SERVER_NAME,
+            tool_name: toolName,
+            tool_input: args,
+            status: "error",
+            error_message: firewallResult.reason || "Blocked by firewall policy",
+            started_at: startTime.toISOString(),
+            completed_at: new Date().toISOString(),
+        }, authResult, context, "mcp.tool.denied");
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Tool blocked by Agentic Firewall: ${firewallResult.reason || "Policy violation"}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+    if (firewallResult.action === "pause") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: [
+                        `⏳ Action "${toolName}" requires human approval.`,
+                        `Job ID: ${firewallResult.job_id}`,
+                        `Poll: ${firewallResult.poll_url}`,
+                        firewallResult.message || "",
+                    ]
+                        .filter(Boolean)
+                        .join("\n"),
+                },
+            ],
+            isError: false,
+        };
+    }
+    // If firewall returned 'redact', use modified arguments
+    if (firewallResult.action === "redact" && firewallResult.modified_arguments) {
+        Object.assign(args, firewallResult.modified_arguments);
+    }
     // 2. Execute tool
     let result;
     let toolError;
-    let toolStatus = 'success';
+    let toolStatus = "success";
     try {
-        switch (toolName) {
-            // Task tools
-            case 'create_task':
-                result = await handleCreateTask(client, args);
-                break;
-            case 'list_tasks':
-                result = await handleListTasks(client, args);
-                break;
-            case 'get_task':
-                result = await handleGetTask(client, args);
-                break;
-            case 'update_task':
-                result = await handleUpdateTask(client, args);
-                break;
-            case 'get_task_timeline':
-                result = await handleGetTaskTimeline(client, args);
-                break;
-            case 'cancel_task':
-                result = await handleCancelTask(client, args);
-                break;
-            // Message tools
-            case 'get_messages':
-                result = await handleGetMessages(client, args, userId);
-                break;
-            case 'send_message':
-                result = await handleSendMessage(client, args, userId, userName);
-                break;
-            // Approval tools
-            case 'get_pending_approvals':
-                result = await handleGetPendingApprovals(client);
-                break;
-            case 'approve_task':
-                result = await handleApproveTask(client, args);
-                break;
-            case 'reject_task':
-                result = await handleRejectTask(client, args);
-                break;
-            case 'request_changes':
-                result = await handleRequestChanges(client, args);
-                break;
-            // Service discovery tools
-            case 'list_services':
-                result = await handleListServices(client, args);
-                break;
-            // CrewAI tools (hosted platform)
-            case 'crewai_health':
-                result = await handleCrewAIHealth(client, args);
-                break;
-            case 'crewai_inputs':
-                result = await handleCrewAIInputs(client, args);
-                break;
-            case 'crewai_kickoff':
-                result = await handleCrewAIKickoff(client, args);
-                break;
-            case 'crewai_status':
-                result = await handleCrewAIStatus(client, args);
-                break;
-            // Crew Builder tools (local YAML-based crews)
-            case 'crew_validate':
-                result = await handleCrewValidate(client, args);
-                break;
-            case 'crew_kickoff':
-                result = await handleCrewKickoff(client, args);
-                break;
-            case 'crew_status':
-                result = await handleCrewStatus(client, args);
-                break;
-            case 'crew_list':
-                result = await handleCrewList(client, args);
-                break;
-            // MCP remote tools (discover and call tools on external MCP servers)
-            case 'mcp_discover_tools':
-                result = await handleMcpDiscoverTools(client, args);
-                break;
-            case 'mcp_call_tool':
-                result = await handleMcpCallTool(client, args);
-                break;
-            // Ops Layer tools (internal platform monitoring)
-            case 'get_ops_health_summary':
-                result = await handleGetOpsHealthSummary(client);
-                break;
-            case 'get_service_status':
-                result = await handleGetServiceStatus(client, args);
-                break;
-            case 'get_active_issues':
-                result = await handleGetActiveIssues(client, args);
-                break;
-            case 'acknowledge_ops_issue':
-                result = await handleAcknowledgeOpsIssue(client, args);
-                break;
-            case 'get_ops_audit_log':
-                result = await handleGetOpsAuditLog(client, args);
-                break;
-            // GitHub MCP tools (Phase 1, Task 1.1)
-            case 'github_search_code':
-                result = await handleGithubSearchCode(client, args);
-                break;
-            case 'github_get_file':
-                result = await handleGithubGetFile(client, args);
-                break;
-            case 'github_create_pr':
-                result = await handleGithubCreatePr(client, args);
-                break;
-            case 'github_list_prs':
-                result = await handleGithubListPrs(client, args);
-                break;
-            case 'github_list_issues':
-                result = await handleGithubListIssues(client, args);
-                break;
-            case 'github_create_issue':
-                result = await handleGithubCreateIssue(client, args);
-                break;
-            case 'github_get_workflow_runs':
-                result = await handleGithubGetWorkflowRuns(client, args);
-                break;
-            // Mem0 Memory tools (Phase 1, Task 1.2)
-            case 'mem0_store':
-                result = await handleMem0Store(client, args);
-                break;
-            case 'mem0_search':
-                result = await handleMem0Search(client, args);
-                break;
-            case 'mem0_list':
-                result = await handleMem0List(client, args);
-                break;
-            case 'mem0_delete':
-                result = await handleMem0Delete(client, args);
-                break;
-            // Exa Semantic Search tools (Phase 1, Task 1.3)
-            case 'exa_web_search':
-                result = await handleExaWebSearch(client, args);
-                break;
-            case 'exa_find_similar':
-                result = await handleExaFindSimilar(client, args);
-                break;
-            case 'exa_get_contents':
-                result = await handleExaGetContents(client, args);
-                break;
-            // MCP Metrics & Health tools (Phase 1, Task 1.5)
-            case 'mcp_health_check':
-                result = await handleMcpHealthCheck(client, args);
-                break;
-            case 'mcp_connection_info':
-                result = await handleMcpConnectionInfo(client, args);
-                break;
-            // Workflow Automation tools (Phase 2)
-            case 'workflow_classify_task':
-                result = await handleWorkflowClassifyTask(client, args);
-                break;
-            case 'workflow_auto_assign':
-                result = await handleWorkflowAutoAssign(client, args);
-                break;
-            case 'workflow_agent_workload':
-                result = await handleWorkflowAgentWorkload(client, args);
-                break;
-            case 'workflow_assignment_rules':
-                result = await handleWorkflowAssignmentRules(client, args);
-                break;
-            // Web Eval Agent tools (Phase 3)
-            case 'webeval_run_tests':
-                result = await handleWebEvalRunTests(client, args);
-                break;
-            case 'webeval_check_health':
-                result = await handleWebEvalCheckHealth(client, args);
-                break;
-            case 'webeval_test_api_endpoint':
-                result = await handleWebEvalTestApiEndpoint(client, args);
-                break;
-            case 'webeval_coverage_report':
-                result = await handleWebEvalCoverageReport(client, args);
-                break;
-            // Memory Graph tools (Phase 4)
-            case 'memory_graph_store':
-                result = await handleMemoryGraphStore(client, args);
-                break;
-            case 'memory_graph_query':
-                result = await handleMemoryGraphQuery(client, args);
-                break;
-            case 'memory_graph_timeline':
-                result = await handleMemoryGraphTimeline(client, args);
-                break;
-            case 'memory_graph_context':
-                result = await handleMemoryGraphContext(client, args);
-                break;
-            // AgentMail tools (Phase 5)
-            case 'agentmail_send_notification':
-                result = await handleAgentMailSendNotification(client, args);
-                break;
-            case 'agentmail_get_inbox':
-                result = await handleAgentMailGetInbox(client, args);
-                break;
-            case 'agentmail_get_identity':
-                result = await handleAgentMailGetIdentity(client, args);
-                break;
-            // Schedule tools
-            case 'create_schedule':
-                result = await handleCreateSchedule(client, args);
-                break;
-            case 'list_schedules':
-                result = await handleListSchedules(client, args);
-                break;
-            case 'pause_schedule':
-                result = await handlePauseSchedule(client, args);
-                break;
-            case 'delete_schedule':
-                result = await handleDeleteSchedule(client, args);
-                break;
-            // Jira Cloud tools
-            case 'jira_search_issues':
-                result = await handleJiraSearchIssues(client, args);
-                break;
-            case 'jira_get_issue':
-                result = await handleJiraGetIssue(client, args);
-                break;
-            case 'jira_create_issue':
-                result = await handleJiraCreateIssue(client, args);
-                break;
-            case 'jira_update_issue':
-                result = await handleJiraUpdateIssue(client, args);
-                break;
-            case 'jira_add_comment':
-                result = await handleJiraAddComment(client, args);
-                break;
-            case 'jira_get_comments':
-                result = await handleJiraGetComments(client, args);
-                break;
-            case 'jira_get_transitions':
-                result = await handleJiraGetTransitions(client, args);
-                break;
-            case 'jira_transition_issue':
-                result = await handleJiraTransitionIssue(client, args);
-                break;
-            case 'jira_list_projects':
-                result = await handleJiraListProjects(client, args);
-                break;
-            case 'jira_assign_issue':
-                result = await handleJiraAssignIssue(client, args);
-                break;
-            // Moltbook tools (social network for AI agents)
-            case 'moltbook_get_profile':
-                result = await handleMoltbookGetProfile(client, args);
-                break;
-            case 'moltbook_update_profile':
-                result = await handleMoltbookUpdateProfile(client, args);
-                break;
-            case 'moltbook_get_home_feed':
-                result = await handleMoltbookGetHomeFeed(client, args);
-                break;
-            case 'moltbook_get_posts':
-                result = await handleMoltbookGetPosts(client, args);
-                break;
-            case 'moltbook_get_post':
-                result = await handleMoltbookGetPost(client, args);
-                break;
-            case 'moltbook_create_post':
-                result = await handleMoltbookCreatePost(client, args);
-                break;
-            case 'moltbook_get_comments':
-                result = await handleMoltbookGetComments(client, args);
-                break;
-            case 'moltbook_create_comment':
-                result = await handleMoltbookCreateComment(client, args);
-                break;
-            case 'moltbook_upvote_post':
-                result = await handleMoltbookUpvotePost(client, args);
-                break;
-            case 'moltbook_downvote_post':
-                result = await handleMoltbookDownvotePost(client, args);
-                break;
-            case 'moltbook_search':
-                result = await handleMoltbookSearch(client, args);
-                break;
-            case 'moltbook_get_notifications':
-                result = await handleMoltbookGetNotifications(client, args);
-                break;
-            // Unified Agent Identity
-            case 'list_all_agents':
-                result = await handleListAllAgents(client, args);
-                break;
-            // Governance tools (Policy-as-Code)
-            case 'export_policies':
-                result = { content: [{ type: 'text', text: await handleExportPolicies(args, client) }] };
-                break;
-            case 'import_policies':
-                result = { content: [{ type: 'text', text: await handleImportPolicies(args, client) }] };
-                break;
-            case 'validate_policies':
-                result = { content: [{ type: 'text', text: await handleValidatePolicies(args, client) }] };
-                break;
-            case 'apply_guardrail':
-                result = { content: [{ type: 'text', text: await handleApplyGuardrail(args, client) }] };
-                break;
-            default:
-                result = {
-                    content: [
-                        {
-                            type: 'text',
-                            text: `Unknown tool: ${toolName}`,
-                        },
-                    ],
-                    isError: true,
-                };
-                toolStatus = 'error';
-                toolError = `Unknown tool: ${toolName}`;
+        const cap = capabilityRegistry.get(toolName);
+        if (!cap) {
+            result = {
+                content: [{ type: "text", text: `Unknown tool: ${toolName}` }],
+                isError: true,
+            };
+            toolStatus = "error";
+            toolError = `Unknown tool: ${toolName}`;
+        }
+        else {
+            const capResult = await cap.handler({
+                client,
+                userId,
+                userName,
+                tenantId: context.tenantId,
+                gatewayKey: context.gatewayKey,
+                gatewayUrl: context.gatewayUrl,
+                region: context.region,
+                // ADR-019/020: thread identity so a handler can authorize per call.
+                // Declared at capability-core types.ts:104-107; previously dropped here.
+                orgId: context.orgId,
+                scopes: context.scopes,
+                tenantRole: context.tenantRole,
+                orgRole: context.orgRole,
+                isSuperAdmin: context.isSuperAdmin,
+            }, args);
+            result = toMcpResult(capResult);
         }
         if (result?.isError) {
-            toolStatus = 'error';
-            toolError = result.content?.[0]?.text || 'Tool returned error';
+            toolStatus = "error";
+            toolError = result.content?.[0]?.text || "Tool returned error";
         }
     }
     catch (error) {
-        toolStatus = 'error';
+        toolStatus = "error";
         toolError = error.message;
         result = {
             content: [
                 {
-                    type: 'text',
+                    type: "text",
                     text: `Tool error: ${error.message}`,
                 },
             ],
@@ -530,9 +549,9 @@ export async function handleToolCall(toolName, args, context) {
     const endTime = new Date();
     // 3. Log result to gateway (non-blocking)
     logToolCallToGateway({
-        tenant_id: context.tenantId || '',
-        agent_id: 'mcp-external',
-        task_id: args.task_id || '',
+        tenant_id: context.tenantId || "",
+        agent_id: "mcp-external",
+        task_id: args.task_id || "",
         mcp_server: MCP_SERVER_NAME,
         tool_name: toolName,
         tool_input: args,
@@ -542,7 +561,7 @@ export async function handleToolCall(toolName, args, context) {
         duration_ms: endTime.getTime() - startTime.getTime(),
         started_at: startTime.toISOString(),
         completed_at: endTime.toISOString(),
-    }, authResult, context, 'mcp.tool.call');
+    }, authResult, context, "mcp.tool.call");
     return result;
 }
 //# sourceMappingURL=index.js.map