@enactprotocol/mcp-server 2.2.1 → 2.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enactprotocol/mcp-server",
-  "version": "2.2.1",
+  "version": "2.2.4",
   "description": "MCP protocol server for Enact tool integration",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,9 +24,9 @@
     "dev:http": "bun run src/index.ts --http"
   },
   "dependencies": {
-    "@enactprotocol/api": "2.2.1",
-    "@enactprotocol/execution": "2.2.1",
-    "@enactprotocol/shared": "2.2.1",
+    "@enactprotocol/api": "2.2.4",
+    "@enactprotocol/execution": "2.2.4",
+    "@enactprotocol/shared": "2.2.4",
     "@modelcontextprotocol/sdk": "^1.10.0"
   },
   "devDependencies": {

package/src/index.ts

@@ -13,6 +13,7 @@
  * @see https://modelcontextprotocol.io/specification/2025-03-26/basic/transports
  */
 
+import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { type IncomingMessage, type ServerResponse, createServer } from "node:http";
@@ -23,8 +24,10 @@ import {
   getToolInfo,
   getToolVersion,
   searchTools,
+  verifyAllAttestations,
 } from "@enactprotocol/api";
 import { DaggerExecutionProvider } from "@enactprotocol/execution";
+import { resolveSecret } from "@enactprotocol/secrets";
 import {
   type ToolManifest,
   addMcpTool,
@@ -33,7 +36,10 @@ import {
   getActiveToolset,
   getCacheDir,
   getMcpToolInfo,
+  getMinimumAttestations,
   getToolCachePath,
+  getTrustPolicy,
+  isIdentityTrusted,
   listMcpTools,
   loadConfig,
   loadManifestFromDir,
@@ -64,6 +70,33 @@ function fromMcpName(mcpName: string): string {
   return mcpName.replace(/__/g, "/");
 }
 
+/**
+ * Resolve secrets from the keyring for a tool's environment variables
+ * Only resolves variables marked with secret: true in the manifest
+ */
+async function resolveManifestSecrets(
+  toolName: string,
+  manifest: ToolManifest
+): Promise<Record<string, string>> {
+  const envOverrides: Record<string, string> = {};
+
+  if (!manifest.env) {
+    return envOverrides;
+  }
+
+  for (const [envName, envDecl] of Object.entries(manifest.env)) {
+    // Only resolve secrets (not regular env vars)
+    if (envDecl && typeof envDecl === "object" && envDecl.secret) {
+      const result = await resolveSecret(toolName, envName);
+      if (result.found && result.value) {
+        envOverrides[envName] = result.value;
+      }
+    }
+  }
+
+  return envOverrides;
+}
+
 /**
  * Convert Enact JSON Schema to MCP tool input schema
  */
@@ -111,23 +144,31 @@ async function extractBundle(bundleData: ArrayBuffer, destPath: string): Promise
 
   mkdirSync(destPath, { recursive: true });
 
-  const proc = Bun.spawn(["tar", "-xzf", tempFile, "-C", destPath], {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
+  await new Promise<void>((resolve, reject) => {
+    const proc = spawn("tar", ["-xzf", tempFile, "-C", destPath], {
+      stdio: ["ignore", "pipe", "pipe"],
+    });
 
-  const exitCode = await proc.exited;
+    let stderr = "";
+    proc.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(`Failed to extract bundle: ${stderr}`));
+      } else {
+        resolve();
+      }
+    });
+  });
 
   try {
     unlinkSync(tempFile);
   } catch {
     // Ignore cleanup errors
   }
-
-  if (exitCode !== 0) {
-    const stderr = await new Response(proc.stderr).text();
-    throw new Error(`Failed to extract bundle: ${stderr}`);
-  }
 }
 
 /**
@@ -327,6 +368,10 @@ async function handleMetaTool(
         const toolInfo = getMcpToolInfo(toolNameArg);
         let manifest: ToolManifest;
         let cachePath: string;
+        let bundleHash: string | undefined;
+        let toolVersion: string | undefined;
+
+        const apiClient = getApiClient();
 
         if (toolInfo) {
           // Tool is installed, use cached version
@@ -339,10 +384,19 @@ async function handleMetaTool(
           }
           manifest = loaded.manifest;
           cachePath = toolInfo.cachePath;
+          toolVersion = toolInfo.version;
+
+          // Get bundle hash for installed tool from registry
+          try {
+            const versionInfo = await getToolVersion(apiClient, toolNameArg, toolVersion);
+            bundleHash = versionInfo.bundle.hash;
+          } catch {
+            // Continue without hash - will skip verification
+          }
         } else {
           // Tool not installed - fetch and install temporarily
-          const apiClient = getApiClient();
           const info = await getToolInfo(apiClient, toolNameArg);
+          toolVersion = info.latestVersion;
 
           // Download bundle
           const bundleResult = await downloadBundle(apiClient, {
@@ -350,6 +404,7 @@ async function handleMetaTool(
             version: info.latestVersion,
             verify: true,
           });
+          bundleHash = bundleResult.hash;
 
           // Extract to cache
           cachePath = getToolCachePath(toolNameArg, info.latestVersion);
@@ -369,6 +424,79 @@ async function handleMetaTool(
           manifest = loaded.manifest;
         }
 
+        // Verify attestations before execution
+        let verificationStatus = "⚠️ UNVERIFIED";
+
+        if (bundleHash && toolVersion) {
+          try {
+            const verified = await verifyAllAttestations(
+              apiClient,
+              toolNameArg,
+              toolVersion,
+              bundleHash
+            );
+
+            if (verified.length > 0) {
+              const auditorList = verified.map((v) => v.providerIdentity).join(", ");
+              verificationStatus = `✅ VERIFIED by: ${auditorList}`;
+            } else {
+              verificationStatus = "⚠️ UNVERIFIED - No valid attestations found";
+            }
+          } catch (verifyErr) {
+            verificationStatus = `⚠️ UNVERIFIED - Verification failed: ${verifyErr instanceof Error ? verifyErr.message : "Unknown error"}`;
+          }
+        } else {
+          verificationStatus = "⚠️ UNVERIFIED - Could not determine bundle hash";
+        }
+
+        // Enforce trust policy
+        const trustPolicy = getTrustPolicy();
+        const minimumAttestations = getMinimumAttestations();
+
+        // Count verified attestations from trusted auditors
+        let verifiedCount = 0;
+        if (bundleHash && toolVersion) {
+          try {
+            const verified = await verifyAllAttestations(
+              apiClient,
+              toolNameArg,
+              toolVersion,
+              bundleHash
+            );
+            verifiedCount = verified.filter((v) => isIdentityTrusted(v.providerIdentity)).length;
+          } catch {
+            // Already handled above in verificationStatus
+          }
+        }
+
+        // Check if trust requirements are met
+        if (verifiedCount < minimumAttestations) {
+          if (trustPolicy === "require_attestation") {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Trust policy violation: Tool requires ${minimumAttestations} attestation(s) from trusted auditors, but only ${verifiedCount} found.\n\nConfigured trust policy: ${trustPolicy}\nTo run unverified tools, update your ~/.enact/config.yaml trust policy to 'allow' or 'prompt'.`,
+                },
+              ],
+              isError: true,
+            };
+          }
+          if (trustPolicy === "prompt") {
+            // In MCP context, we can't prompt interactively, so we block with a clear message
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Trust policy violation: Tool requires ${minimumAttestations} attestation(s) from trusted auditors, but only ${verifiedCount} found.\n\nConfigured trust policy: ${trustPolicy}\nMCP server cannot prompt interactively. To run unverified tools via MCP, update your ~/.enact/config.yaml trust policy to 'allow'.`,
+                },
+              ],
+              isError: true,
+            };
+          }
+          // policy === 'allow' - continue execution with warning
+        }
+
         // Validate and apply defaults
         const inputsWithDefaults = manifest.inputSchema
           ? applyDefaults(toolArgs, manifest.inputSchema)
@@ -385,22 +513,26 @@ async function handleMetaTool(
 
         const finalInputs = validation.coercedValues ?? inputsWithDefaults;
 
+        // Resolve secrets from keyring
+        const secretOverrides = await resolveManifestSecrets(toolNameArg, manifest);
+
         // Execute the tool
         const provider = new DaggerExecutionProvider({ verbose: false });
         await provider.initialize();
 
         const result = await provider.execute(
           manifest,
-          { params: finalInputs, envOverrides: {} },
+          { params: finalInputs, envOverrides: secretOverrides },
           { mountDirs: { [cachePath]: "/workspace" } }
         );
 
         if (result.success) {
+          const output = result.output?.stdout || "Tool executed successfully (no output)";
           return {
             content: [
               {
                 type: "text",
-                text: result.output?.stdout || "Tool executed successfully (no output)",
+                text: `[${verificationStatus}]\n\n${output}`,
               },
             ],
           };
@@ -409,7 +541,7 @@ async function handleMetaTool(
           content: [
             {
               type: "text",
-              text: `Tool execution failed: ${result.error?.message || "Unknown error"}\n\n${result.output?.stderr || ""}`,
+              text: `[${verificationStatus}]\n\nTool execution failed: ${result.error?.message || "Unknown error"}\n\n${result.output?.stderr || ""}`,
             },
           ],
           isError: true,
@@ -604,6 +736,9 @@ function createMcpServer(): Server {
 
     const finalInputs = validation.coercedValues ?? inputsWithDefaults;
 
+    // Resolve secrets from keyring
+    const secretOverrides = await resolveManifestSecrets(enactToolName, manifest);
+
     // Execute the tool using Dagger
     const provider = new DaggerExecutionProvider({
       verbose: false,
@@ -616,7 +751,7 @@ function createMcpServer(): Server {
         manifest,
         {
           params: finalInputs,
-          envOverrides: {},
+          envOverrides: secretOverrides,
         },
         {
           mountDirs: {