@guardbee/mcp-security-proxy 0.3.1 → 1.1.0

package/dist/gateway/config.d.ts

@@ -0,0 +1,36 @@
+import type { AuditConfig, McpServerConfig, ProxyConfig } from "../types.js";
+import { type Label } from "./labels.js";
+import type { PolicyAction, PolicyRule } from "./policy.js";
+import type { TaintMode } from "./taint.js";
+export interface GatewayConfig {
+    upstreams: Record<string, McpServerConfig>;
+    /** Prefix tool and prompt names with `<upstream>__`. Off only for the legacy single-server config. */
+    namespaced: boolean;
+    /** Label overrides by the tool name the agent sees; replaces the heuristic labels entirely. */
+    labels: Record<string, Label[]>;
+    rules: PolicyRule[];
+    taint: {
+        mode: TaintMode;
+    };
+    /** How long an `approve` decision waits for the person before it becomes a deny. */
+    approval: {
+        timeoutSeconds: number;
+    };
+    defaults: {
+        action: PolicyAction;
+    };
+    audit: AuditConfig;
+    interceptors: NonNullable<ProxyConfig["interceptors"]>;
+}
+export declare function parseGatewayYaml(source: string, fileLabel?: string): GatewayConfig;
+/**
+ * The 0.x single-server config keeps its behavior: tool names are not prefixed,
+ * payloads are logged, and a toxic flow only warns.
+ */
+export declare function fromLegacyConfig(config: ProxyConfig): GatewayConfig;
+/**
+ * 1. `--config <file.yaml>`  2. GUARDBEE_PROXY_CONFIG pointing at a .yaml/.yml
+ * 3. ./guardbee-proxy.yaml (or .yml)  4. the legacy JSON / `-- <command>` / PROXY_* setup.
+ */
+export declare function loadGatewayConfig(argv?: string[], cwd?: string): GatewayConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/gateway/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/gateway/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAU,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,sGAAsG;IACtG,UAAU,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,QAAQ,EAAE;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC;IACnC,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,WAAW,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;CACxD;AAyHD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAwB,GAAG,aAAa,CAuBjG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAYnE;AAgBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAM,EAAiB,EAAE,GAAG,GAAE,MAAsB,GAAG,aAAa,CAmB3G"}

package/dist/gateway/config.js

@@ -0,0 +1,206 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseGatewayYaml = parseGatewayYaml;
+exports.fromLegacyConfig = fromLegacyConfig;
+exports.loadGatewayConfig = loadGatewayConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const yaml_1 = require("yaml");
+const zod_1 = require("zod");
+const config_js_1 = require("../config.js");
+const labels_js_1 = require("./labels.js");
+const labelSchema = zod_1.z.enum(labels_js_1.LABELS);
+const actionSchema = zod_1.z.enum(["allow", "deny", "mask", "warn", "approve"]);
+const interceptorSchema = zod_1.z.object({ enabled: zod_1.z.boolean(), action: zod_1.z.enum(["block", "warn"]) }).strict();
+const upstreamSchema = zod_1.z
+    .object({
+    command: zod_1.z.string().min(1).optional(),
+    args: zod_1.z.array(zod_1.z.string()).optional(),
+    env: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
+    url: zod_1.z.string().optional(),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (value.url !== undefined) {
+        ctx.addIssue({ code: "custom", message: "HTTP upstreams (url) are not supported yet; run the server with command/args" });
+    }
+    else if (value.command === undefined) {
+        ctx.addIssue({ code: "custom", message: "an upstream needs a command" });
+    }
+});
+const yamlSchema = zod_1.z
+    .object({
+    version: zod_1.z.literal(1),
+    upstreams: zod_1.z.record(zod_1.z.string(), upstreamSchema).superRefine((upstreams, ctx) => {
+        const names = Object.keys(upstreams);
+        if (names.length === 0)
+            ctx.addIssue({ code: "custom", message: "at least one upstream is required" });
+        for (const name of names) {
+            // Checked here, not as the record's key schema: zod replaces a key schema's message with "Invalid key in record".
+            if (!/^[A-Za-z0-9-]+(?:_[A-Za-z0-9-]+)*$/.test(name)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: [name],
+                    message: "upstream names use letters, digits, - and single _ (a double __ is the namespace separator)",
+                });
+            }
+        }
+    }),
+    labels: zod_1.z.record(zod_1.z.string(), zod_1.z.array(labelSchema)).default({}),
+    rules: zod_1.z
+        .array(zod_1.z
+        .object({
+        id: zod_1.z.string().optional(),
+        match: zod_1.z
+            .object({
+            tool: zod_1.z.string().optional(),
+            upstream: zod_1.z.string().optional(),
+            label: labelSchema.optional(),
+            session: zod_1.z.enum(["clean", "tainted"]).optional(),
+            args: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
+        })
+            .strict(),
+        action: actionSchema,
+        mask: zod_1.z.object({ fields: zod_1.z.array(zod_1.z.string()).min(1) }).strict().optional(),
+    })
+        .strict()
+        .refine((rule) => rule.mask === undefined || rule.action === "mask", {
+        message: "mask.fields only applies to action: mask",
+        path: ["mask"],
+    }))
+        .default([]),
+    taint: zod_1.z.object({ mode: zod_1.z.enum(["strict", "approve", "warn", "off"]).default("strict") }).strict().default({ mode: "strict" }),
+    approval: zod_1.z
+        .object({ timeoutSeconds: zod_1.z.number().int().positive().default(120) })
+        .strict()
+        .default({ timeoutSeconds: 120 }),
+    defaults: zod_1.z.object({ action: actionSchema.default("allow") }).strict().default({ action: "allow" }),
+    audit: zod_1.z
+        .object({
+        enabled: zod_1.z.boolean().default(true),
+        sink: zod_1.z.enum(["console", "file"]).default("console"),
+        filePath: zod_1.z.string().optional(),
+        includePayloads: zod_1.z.boolean().default(false),
+    })
+        .strict()
+        .default({ enabled: true, sink: "console", includePayloads: false }),
+    interceptors: zod_1.z
+        .object({
+        promptInjection: interceptorSchema.optional(),
+        toolResultInjection: interceptorSchema.optional(),
+        definitionDrift: interceptorSchema
+            .extend({ recheck: zod_1.z.enum(["every-call", "on-change"]).optional() })
+            .optional(),
+        piiMasking: zod_1.z
+            .object({
+            enabled: zod_1.z.boolean(),
+            patterns: zod_1.z.array(zod_1.z.string()).optional(),
+            mode: zod_1.z.enum(["redact", "tokenize"]).optional(),
+            detokenizeForEgress: zod_1.z.boolean().optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .default({}),
+})
+    .strict();
+/** Replace `${VAR}` with the environment value; config files never hold the secret itself. */
+function interpolate(value, where) {
+    return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => {
+        const resolved = process.env[name];
+        if (resolved === undefined)
+            throw new Error(`Environment variable ${name} (used in ${where}) is not set`);
+        return resolved;
+    });
+}
+function interpolateUpstream(name, upstream) {
+    const where = `upstreams.${name}`;
+    return {
+        command: interpolate(upstream.command, where),
+        args: upstream.args?.map((arg) => interpolate(arg, where)),
+        env: upstream.env
+            ? Object.fromEntries(Object.entries(upstream.env).map(([k, v]) => [k, interpolate(v, where)]))
+            : undefined,
+    };
+}
+function parseGatewayYaml(source, fileLabel = "guardbee-proxy.yaml") {
+    const parsed = yamlSchema.safeParse((0, yaml_1.parse)(source));
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((issue) => `  - ${issue.path.join(".") || "(root)"}: ${issue.message}`);
+        throw new Error(`Invalid ${fileLabel}:\n${issues.join("\n")}`);
+    }
+    const cfg = parsed.data;
+    return {
+        upstreams: Object.fromEntries(Object.entries(cfg.upstreams).map(([name, upstream]) => [
+            name,
+            interpolateUpstream(name, upstream),
+        ])),
+        namespaced: true,
+        labels: cfg.labels,
+        rules: cfg.rules,
+        taint: cfg.taint,
+        approval: cfg.approval,
+        defaults: cfg.defaults,
+        audit: cfg.audit,
+        interceptors: cfg.interceptors,
+    };
+}
+/**
+ * The 0.x single-server config keeps its behavior: tool names are not prefixed,
+ * payloads are logged, and a toxic flow only warns.
+ */
+function fromLegacyConfig(config) {
+    return {
+        upstreams: { default: config.server },
+        namespaced: false,
+        labels: {},
+        rules: [],
+        taint: { mode: "warn" },
+        approval: { timeoutSeconds: 120 },
+        defaults: { action: "allow" },
+        audit: { includePayloads: true, ...(config.audit ?? { enabled: true, sink: "console" }) },
+        interceptors: config.interceptors ?? {},
+    };
+}
+function configFlag(argv) {
+    const end = argv.indexOf("--");
+    const own = end === -1 ? argv : argv.slice(0, end);
+    const at = own.indexOf("--config");
+    if (at === -1)
+        return null;
+    const value = own[at + 1];
+    if (!value)
+        throw new Error("--config needs a file path");
+    return value;
+}
+function isYaml(filePath) {
+    return /\.ya?ml$/i.test(filePath);
+}
+/**
+ * 1. `--config <file.yaml>`  2. GUARDBEE_PROXY_CONFIG pointing at a .yaml/.yml
+ * 3. ./guardbee-proxy.yaml (or .yml)  4. the legacy JSON / `-- <command>` / PROXY_* setup.
+ */
+function loadGatewayConfig(argv = process.argv, cwd = process.cwd()) {
+    const explicit = configFlag(argv);
+    const fromEnv = process.env["GUARDBEE_PROXY_CONFIG"];
+    const candidates = explicit
+        ? [explicit]
+        : fromEnv && isYaml(fromEnv)
+            ? [fromEnv]
+            : [path_1.default.join(cwd, "guardbee-proxy.yaml"), path_1.default.join(cwd, "guardbee-proxy.yml")];
+    for (const candidate of candidates) {
+        const resolved = candidate.startsWith("~/") ? path_1.default.join(process.env["HOME"] ?? "", candidate.slice(2)) : candidate;
+        if (!fs_1.default.existsSync(resolved)) {
+            if (candidate === explicit || candidate === fromEnv)
+                throw new Error(`Config file not found: ${resolved}`);
+            continue;
+        }
+        return parseGatewayYaml(fs_1.default.readFileSync(resolved, "utf8"), path_1.default.basename(resolved));
+    }
+    return fromLegacyConfig((0, config_js_1.loadProxyConfig)(argv));
+}
+//# sourceMappingURL=config.js.map

package/dist/gateway/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/gateway/config.ts"],"names":[],"mappings":";;;;;AAgJA,4CAuBC;AAMD,4CAYC;AAoBD,8CAmBC;AAhOD,4CAAoB;AACpB,gDAAwB;AACxB,+BAA0C;AAC1C,6BAAwB;AACxB,4CAA+C;AAE/C,2CAAiD;AAmBjD,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,kBAAM,CAAC,CAAC;AACnC,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEzG,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;IAC5H,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,OAAC;KACjB,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,kHAAkH;YAClH,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,6FAA6F;iBACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,KAAK,EAAE,OAAC;SACL,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,KAAK,EAAE,OAAC;aACL,MAAM,CAAC;YACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;YAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;YAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SACtF,CAAC;aACD,MAAM,EAAE;QACX,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3E,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;QACnE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC,CACL;SACA,OAAO,CAAC,EAAE,CAAC;IACd,KAAK,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9H,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC,EAAE,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;SACpE,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;IACnC,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KAC5C,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACtE,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB;aAC/B,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;aACnE,QAAQ,EAAE;QACb,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8FAA8F;AAC9F,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,aAAa,KAAK,cAAc,CAAC,CAAC;QAC1G,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,QAAyB;IAClE,MAAM,KAAK,GAAG,aAAa,IAAI,EAAE,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAC7C,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1D,GAAG,EAAE,QAAQ,CAAC,GAAG;YACf,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAc,EAAE,SAAS,GAAG,qBAAqB;IAChF,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAA,YAAS,EAAC,MAAM,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YACtD,IAAI;YACJ,mBAAmB,CAAC,IAAI,EAAE,QAA2B,CAAC;SACvD,CAAC,CACH;QACD,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY,EAAE,GAAG,CAAC,YAAY;KAC/B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,OAAO;QACL,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QACrC,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACvB,QAAQ,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE;QACjC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC7B,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;QACzF,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB;IAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,OAAiB,OAAO,CAAC,IAAI,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1F,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACZ,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;YAC1B,CAAC,CAAC,CAAC,OAAO,CAAC;YACX,CAAC,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAEpF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;YAC3G,SAAS;QACX,CAAC;QACD,OAAO,gBAAgB,CAAC,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,cAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAA,2BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/gateway/fields.d.ts

@@ -0,0 +1,7 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * Replace the values of the named keys with `[MASKED]` — in JSON text content
+ * and in structuredContent. Key names compare case-insensitively.
+ */
+export declare function maskFields(result: CallToolResult, fieldNames: readonly string[]): CallToolResult;
+//# sourceMappingURL=fields.d.ts.map

package/dist/gateway/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../src/gateway/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AA2BzE;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAUhG"}

package/dist/gateway/fields.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskFields = maskFields;
+const MASKED = "[MASKED]";
+function blankKeys(value, fields) {
+    if (Array.isArray(value))
+        return value.map((item) => blankKeys(item, fields));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, v]) => [key, fields.has(key.toLowerCase()) ? MASKED : blankKeys(v, fields)]));
+    }
+    return value;
+}
+/** A text item that holds JSON (as most DB and API tools return) is parsed, blanked and re-serialized. */
+function blankText(text, fields) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("["))
+        return text;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return text;
+    }
+    return JSON.stringify(blankKeys(parsed, fields), null, trimmed.includes("\n") ? 2 : undefined);
+}
+/**
+ * Replace the values of the named keys with `[MASKED]` — in JSON text content
+ * and in structuredContent. Key names compare case-insensitively.
+ */
+function maskFields(result, fieldNames) {
+    const fields = new Set(fieldNames.map((name) => name.toLowerCase()));
+    if (fields.size === 0)
+        return result;
+    return {
+        ...result,
+        content: result.content.map((item) => (item.type === "text" ? { ...item, text: blankText(item.text, fields) } : item)),
+        ...(result.structuredContent
+            ? { structuredContent: blankKeys(result.structuredContent, fields) }
+            : {}),
+    };
+}
+//# sourceMappingURL=fields.js.map

package/dist/gateway/fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../src/gateway/fields.ts"],"names":[],"mappings":";;AA+BA,gCAUC;AAvCD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,SAAS,SAAS,CAAC,KAAc,EAAE,MAA2B;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0GAA0G;AAC1G,SAAS,SAAS,CAAC,IAAY,EAAE,MAA2B;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,MAAsB,EAAE,UAA6B;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtH,GAAG,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAA4B,EAAE;YAC/F,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/gateway/gateway.d.ts

@@ -0,0 +1,59 @@
+import type { CallToolResult, GetPromptResult, Prompt, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { AuditLogger } from "../audit/logger.js";
+import type { Approver } from "./approval.js";
+import type { GatewayConfig } from "./config.js";
+import { TaintTracker } from "./taint.js";
+import { PiiVault } from "./tokens.js";
+import type { Upstream } from "./upstream.js";
+/**
+ * The policy pipeline between the agent and its MCP servers. Transport-free:
+ * proxy.ts wires it to stdio, tests drive it directly.
+ *
+ * A tool call runs: input injection scan → definition drift → policy rules
+ * (incl. approval) → toxic-flow check → detokenize → upstream → result
+ * injection scan → PII masking / tokenizing → field masking → taint update.
+ */
+export declare class Gateway {
+    private readonly upstreams;
+    private readonly config;
+    private readonly audit;
+    private readonly approver?;
+    readonly taint: TaintTracker;
+    readonly vault: PiiVault;
+    private readonly pins;
+    private readonly tools;
+    private readonly resources;
+    private readonly prompts;
+    /** Upstreams that announced tools/list_changed since the agent last listed tools. */
+    private readonly stale;
+    private readonly toolListeners;
+    constructor(upstreams: readonly Upstream[], config: GatewayConfig, audit: AuditLogger, approver?: Approver | undefined);
+    /** Called when any upstream's tool list changed; proxy.ts relays it to the agent. */
+    onToolsChanged(listener: () => void): void;
+    private get interceptors();
+    private exposed;
+    private pinFor;
+    private log;
+    private get driftEnabled();
+    private get driftAction();
+    private get resultAction();
+    /**
+     * Find PII in a value (it taints the session either way) and hide it unless
+     * masking is off. `force` comes from a `mask` rule and overrides "off".
+     */
+    private protect;
+    listTools(): Promise<Tool[]>;
+    callTool(name: string, args: Record<string, unknown>): Promise<CallToolResult>;
+    listResources(): Promise<Resource[]>;
+    /** Resource contents come from outside the agent's control: they taint the session like an untrusted tool. */
+    readResource(uri: string): Promise<ReadResourceResult>;
+    listPrompts(): Promise<Prompt[]>;
+    /**
+     * A prompt template is text a server puts straight into the conversation, so
+     * it gets the same injection scan and PII masking as a tool result. It does
+     * not taint the session: the person picked it.
+     */
+    getPrompt(name: string, args?: Record<string, string>): Promise<GetPromptResult>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=gateway.d.ts.map

package/dist/gateway/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,MAAM,EACN,kBAAkB,EAClB,QAAQ,EACR,IAAI,EACL,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAgB9C;;;;;;;GAOG;AACH,qBAAa,OAAO;IAYhB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAd5B,QAAQ,CAAC,KAAK,eAAsB;IACpC,QAAQ,CAAC,KAAK,WAAkB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2D;IACnF,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;gBAGjC,SAAS,EAAE,SAAS,QAAQ,EAAE,EAC9B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,WAAW,EAClB,QAAQ,CAAC,EAAE,QAAQ,YAAA;IAUtC,qFAAqF;IACrF,cAAc,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAI1C,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,GAAG;IAIX,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAEtB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED;;;OAGG;IACH,OAAO,CAAC,OAAO;IAST,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAmC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IA+J9E,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAe1C,8GAA8G;IACxG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkCtD,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBtC;;;;OAIG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAqBhF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}