@guardbee/mcp-security-proxy 1.1.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +45 -1
- package/TR.md +45 -1
- package/ZH.md +233 -0
- package/dist/audit/dashboard-sink.d.ts +26 -0
- package/dist/audit/dashboard-sink.d.ts.map +1 -0
- package/dist/audit/dashboard-sink.js +88 -0
- package/dist/audit/dashboard-sink.js.map +1 -0
- package/dist/audit/logger.d.ts +4 -2
- package/dist/audit/logger.d.ts.map +1 -1
- package/dist/audit/logger.js +12 -4
- package/dist/audit/logger.js.map +1 -1
- package/dist/gateway/config.d.ts +15 -2
- package/dist/gateway/config.d.ts.map +1 -1
- package/dist/gateway/config.js +70 -12
- package/dist/gateway/config.js.map +1 -1
- package/dist/gateway/gateway.d.ts +12 -1
- package/dist/gateway/gateway.d.ts.map +1 -1
- package/dist/gateway/gateway.js +25 -4
- package/dist/gateway/gateway.js.map +1 -1
- package/dist/gateway/upstream.d.ts +9 -3
- package/dist/gateway/upstream.d.ts.map +1 -1
- package/dist/gateway/upstream.js +23 -1
- package/dist/gateway/upstream.js.map +1 -1
- package/dist/http-server.d.ts +20 -0
- package/dist/http-server.d.ts.map +1 -0
- package/dist/http-server.js +146 -0
- package/dist/http-server.js.map +1 -0
- package/dist/index.d.ts +6 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +7 -1
- package/dist/index.js.map +1 -1
- package/dist/init.d.ts +3 -2
- package/dist/init.d.ts.map +1 -1
- package/dist/init.js +21 -6
- package/dist/init.js.map +1 -1
- package/dist/proxy.d.ts +3 -1
- package/dist/proxy.d.ts.map +1 -1
- package/dist/proxy.js +64 -6
- package/dist/proxy.js.map +1 -1
- package/dist/types.d.ts +21 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +4 -0
- package/dist/types.js.map +1 -1
- package/package.json +4 -3
|
@@ -0,0 +1,146 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
3
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
|
+
};
|
|
5
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
+
exports.startHttpGateway = startHttpGateway;
|
|
7
|
+
const http_1 = __importDefault(require("http"));
|
|
8
|
+
const crypto_1 = require("crypto");
|
|
9
|
+
const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
|
|
10
|
+
const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
|
|
11
|
+
const proxy_js_1 = require("./proxy.js");
|
|
12
|
+
const MAX_BODY_BYTES = 4 * 1024 * 1024;
|
|
13
|
+
const digest = (value) => (0, crypto_1.createHash)("sha256").update(value).digest();
|
|
14
|
+
function jsonRpcError(res, status, message, headers = {}) {
|
|
15
|
+
res.writeHead(status, { "content-type": "application/json", ...headers });
|
|
16
|
+
res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32000, message }, id: null }));
|
|
17
|
+
}
|
|
18
|
+
function readJson(req) {
|
|
19
|
+
return new Promise((resolve, reject) => {
|
|
20
|
+
const chunks = [];
|
|
21
|
+
let size = 0;
|
|
22
|
+
req.on("data", (chunk) => {
|
|
23
|
+
size += chunk.length;
|
|
24
|
+
if (size > MAX_BODY_BYTES) {
|
|
25
|
+
reject(new Error("request body too large"));
|
|
26
|
+
req.destroy();
|
|
27
|
+
return;
|
|
28
|
+
}
|
|
29
|
+
chunks.push(chunk);
|
|
30
|
+
});
|
|
31
|
+
req.on("end", () => {
|
|
32
|
+
try {
|
|
33
|
+
resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString("utf8")) : undefined);
|
|
34
|
+
}
|
|
35
|
+
catch {
|
|
36
|
+
reject(new Error("request body is not valid JSON"));
|
|
37
|
+
}
|
|
38
|
+
});
|
|
39
|
+
req.on("error", reject);
|
|
40
|
+
});
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* The proxy as a Streamable HTTP MCP server. Every MCP session gets its own
|
|
44
|
+
* Gateway — taint, PII tokens and tool pins never leak between sessions —
|
|
45
|
+
* while all sessions share the upstream connections.
|
|
46
|
+
*/
|
|
47
|
+
async function startHttpGateway(upstreams, config, audit, listen) {
|
|
48
|
+
const sessions = new Map();
|
|
49
|
+
const keyDigests = listen.apiKeys.map(digest);
|
|
50
|
+
const authorized = (req) => {
|
|
51
|
+
if (keyDigests.length === 0)
|
|
52
|
+
return true;
|
|
53
|
+
const match = /^Bearer\s+(.+)$/i.exec(req.headers.authorization ?? "");
|
|
54
|
+
if (!match?.[1])
|
|
55
|
+
return false;
|
|
56
|
+
const presented = digest(match[1].trim());
|
|
57
|
+
// Compare fixed-length digests in constant time; check every key so timing does not reveal which one matched.
|
|
58
|
+
return keyDigests.reduce((ok, key) => (0, crypto_1.timingSafeEqual)(key, presented) || ok, false);
|
|
59
|
+
};
|
|
60
|
+
const openSession = async (req, res, body) => {
|
|
61
|
+
if (sessions.size >= listen.maxSessions) {
|
|
62
|
+
jsonRpcError(res, 503, `Too many sessions (listen.maxSessions=${listen.maxSessions})`);
|
|
63
|
+
return;
|
|
64
|
+
}
|
|
65
|
+
const sessionId = (0, crypto_1.randomUUID)();
|
|
66
|
+
const { gateway, server } = (0, proxy_js_1.createGatewayServer)(upstreams, config, audit, { sessionId });
|
|
67
|
+
const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
|
|
68
|
+
sessionIdGenerator: () => sessionId,
|
|
69
|
+
onsessioninitialized: (id) => {
|
|
70
|
+
sessions.set(id, { transport, gateway });
|
|
71
|
+
},
|
|
72
|
+
});
|
|
73
|
+
transport.onclose = () => {
|
|
74
|
+
sessions.delete(sessionId);
|
|
75
|
+
gateway.dispose();
|
|
76
|
+
};
|
|
77
|
+
await server.connect(transport);
|
|
78
|
+
await transport.handleRequest(req, res, body);
|
|
79
|
+
};
|
|
80
|
+
const handle = async (req, res) => {
|
|
81
|
+
const path = (req.url ?? "/").split("?")[0];
|
|
82
|
+
if (req.method === "GET" && path === "/healthz") {
|
|
83
|
+
res.writeHead(200, { "content-type": "application/json" });
|
|
84
|
+
res.end(JSON.stringify({ ok: true, sessions: sessions.size }));
|
|
85
|
+
return;
|
|
86
|
+
}
|
|
87
|
+
if (path !== listen.path) {
|
|
88
|
+
jsonRpcError(res, 404, "Not found");
|
|
89
|
+
return;
|
|
90
|
+
}
|
|
91
|
+
if (!authorized(req)) {
|
|
92
|
+
jsonRpcError(res, 401, "Missing or invalid Bearer API key", { "www-authenticate": "Bearer" });
|
|
93
|
+
return;
|
|
94
|
+
}
|
|
95
|
+
let body;
|
|
96
|
+
if (req.method === "POST") {
|
|
97
|
+
try {
|
|
98
|
+
body = await readJson(req);
|
|
99
|
+
}
|
|
100
|
+
catch (err) {
|
|
101
|
+
jsonRpcError(res, 400, err instanceof Error ? err.message : "Bad request");
|
|
102
|
+
return;
|
|
103
|
+
}
|
|
104
|
+
}
|
|
105
|
+
const header = req.headers["mcp-session-id"];
|
|
106
|
+
const sessionId = Array.isArray(header) ? header[0] : header;
|
|
107
|
+
if (sessionId) {
|
|
108
|
+
const session = sessions.get(sessionId);
|
|
109
|
+
if (!session) {
|
|
110
|
+
jsonRpcError(res, 404, "Session not found");
|
|
111
|
+
return;
|
|
112
|
+
}
|
|
113
|
+
await session.transport.handleRequest(req, res, body);
|
|
114
|
+
return;
|
|
115
|
+
}
|
|
116
|
+
if (req.method === "POST" && (0, types_js_1.isInitializeRequest)(body)) {
|
|
117
|
+
await openSession(req, res, body);
|
|
118
|
+
return;
|
|
119
|
+
}
|
|
120
|
+
jsonRpcError(res, 400, "Bad request: no valid session; start with an initialize request");
|
|
121
|
+
};
|
|
122
|
+
const server = http_1.default.createServer((req, res) => {
|
|
123
|
+
handle(req, res).catch((err) => {
|
|
124
|
+
if (!res.headersSent)
|
|
125
|
+
jsonRpcError(res, 500, err instanceof Error ? err.message : "Internal error");
|
|
126
|
+
else
|
|
127
|
+
res.end();
|
|
128
|
+
});
|
|
129
|
+
});
|
|
130
|
+
await new Promise((resolve, reject) => {
|
|
131
|
+
server.once("error", reject);
|
|
132
|
+
server.listen(listen.port, listen.host, () => resolve());
|
|
133
|
+
});
|
|
134
|
+
const address = server.address();
|
|
135
|
+
const port = typeof address === "object" && address ? address.port : listen.port;
|
|
136
|
+
const host = listen.host.includes(":") ? `[${listen.host}]` : listen.host;
|
|
137
|
+
return {
|
|
138
|
+
url: `http://${host}:${port}${listen.path}`,
|
|
139
|
+
sessionCount: () => sessions.size,
|
|
140
|
+
async close() {
|
|
141
|
+
await Promise.allSettled([...sessions.values()].map((session) => session.transport.close()));
|
|
142
|
+
await new Promise((resolve) => server.close(() => resolve()));
|
|
143
|
+
},
|
|
144
|
+
};
|
|
145
|
+
}
|
|
146
|
+
//# sourceMappingURL=http-server.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":";;;;;AA8DA,4CA0GC;AAxKD,gDAAwB;AACxB,mCAAiE;AACjE,0FAAmG;AACnG,iEAAyE;AAKzE,yCAAiD;AAIjD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAcvC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AAE9E,SAAS,YAAY,CAAC,GAAwB,EAAE,MAAc,EAAE,OAAe,EAAE,UAAkC,EAAE;IACnH,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAyB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CACpC,SAAqB,EACrB,MAAqB,EACrB,KAAkB,EAClB,MAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,CAAC,GAAyB,EAAW,EAAE;QACxD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,8GAA8G;QAC9G,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,IAAA,wBAAe,EAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACtF,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAE,IAAa,EAAiB,EAAE;QAC9G,IAAI,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,yCAAyC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,8BAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,SAAS;YACnC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC;SACF,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAiB,EAAE;QAC1F,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAA,8BAAmB,EAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,iEAAiE,CAAC,CAAC;IAC5F,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;;gBAC/F,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAE1E,OAAO;QACL,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE;QAC3C,YAAY,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI;QACjC,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -5,9 +5,9 @@ export { PiiVault } from "./gateway/tokens.js";
|
|
|
5
5
|
export { maskFields } from "./gateway/fields.js";
|
|
6
6
|
export { loadProxyConfig } from "./config.js";
|
|
7
7
|
export { loadGatewayConfig, parseGatewayYaml, fromLegacyConfig } from "./gateway/config.js";
|
|
8
|
-
export type { GatewayConfig } from "./gateway/config.js";
|
|
8
|
+
export type { GatewayConfig, ListenConfig } from "./gateway/config.js";
|
|
9
9
|
export { Gateway } from "./gateway/gateway.js";
|
|
10
|
-
export { clientUpstream, connectStdioUpstream } from "./gateway/upstream.js";
|
|
10
|
+
export { clientUpstream, connectStdioUpstream, connectHttpUpstream, connectUpstream } from "./gateway/upstream.js";
|
|
11
11
|
export type { Upstream } from "./gateway/upstream.js";
|
|
12
12
|
export { labelTool, LABELS } from "./gateway/labels.js";
|
|
13
13
|
export type { Label } from "./gateway/labels.js";
|
|
@@ -21,7 +21,10 @@ export { ToolDefinitionPin } from "./interceptors/definition-drift.js";
|
|
|
21
21
|
export { maskPiiInValue, maskPiiInText } from "./interceptors/pii-masker.js";
|
|
22
22
|
export { AuditLogger, verifyAuditChain } from "./audit/logger.js";
|
|
23
23
|
export type { ChainVerification } from "./audit/logger.js";
|
|
24
|
-
export type { ProxyConfig, McpServerConfig, InterceptResult, AuditEvent, AuditConfig } from "./types.js";
|
|
24
|
+
export type { ProxyConfig, McpServerConfig, HttpUpstreamConfig, UpstreamConfig, InterceptResult, AuditEvent, AuditConfig, DashboardSinkConfig } from "./types.js";
|
|
25
25
|
export { planInit, runInit, clientConfigPath } from "./init.js";
|
|
26
26
|
export type { ClientName, InitPlan, InitOptions, InitResult } from "./init.js";
|
|
27
|
+
export { startHttpGateway } from "./http-server.js";
|
|
28
|
+
export type { HttpGateway } from "./http-server.js";
|
|
29
|
+
export { DashboardSink } from "./audit/dashboard-sink.js";
|
|
27
30
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnH,YAAY,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAClK,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAChE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.clientConfigPath = exports.runInit = exports.planInit = exports.verifyAuditChain = exports.AuditLogger = exports.maskPiiInText = exports.maskPiiInValue = exports.ToolDefinitionPin = exports.scanToolResult = exports.scanForPromptInjection = exports.TaintTracker = exports.globToRegExp = exports.evaluatePolicy = exports.LABELS = exports.labelTool = exports.connectStdioUpstream = exports.clientUpstream = exports.Gateway = exports.fromLegacyConfig = exports.parseGatewayYaml = exports.loadGatewayConfig = exports.loadProxyConfig = exports.maskFields = exports.PiiVault = exports.elicitationApprover = exports.createGatewayServer = exports.createProxyServer = exports.startGateway = exports.startProxy = void 0;
|
|
3
|
+
exports.DashboardSink = exports.startHttpGateway = exports.clientConfigPath = exports.runInit = exports.planInit = exports.verifyAuditChain = exports.AuditLogger = exports.maskPiiInText = exports.maskPiiInValue = exports.ToolDefinitionPin = exports.scanToolResult = exports.scanForPromptInjection = exports.TaintTracker = exports.globToRegExp = exports.evaluatePolicy = exports.LABELS = exports.labelTool = exports.connectUpstream = exports.connectHttpUpstream = exports.connectStdioUpstream = exports.clientUpstream = exports.Gateway = exports.fromLegacyConfig = exports.parseGatewayYaml = exports.loadGatewayConfig = exports.loadProxyConfig = exports.maskFields = exports.PiiVault = exports.elicitationApprover = exports.createGatewayServer = exports.createProxyServer = exports.startGateway = exports.startProxy = void 0;
|
|
4
4
|
var proxy_js_1 = require("./proxy.js");
|
|
5
5
|
Object.defineProperty(exports, "startProxy", { enumerable: true, get: function () { return proxy_js_1.startProxy; } });
|
|
6
6
|
Object.defineProperty(exports, "startGateway", { enumerable: true, get: function () { return proxy_js_1.startGateway; } });
|
|
@@ -23,6 +23,8 @@ Object.defineProperty(exports, "Gateway", { enumerable: true, get: function () {
|
|
|
23
23
|
var upstream_js_1 = require("./gateway/upstream.js");
|
|
24
24
|
Object.defineProperty(exports, "clientUpstream", { enumerable: true, get: function () { return upstream_js_1.clientUpstream; } });
|
|
25
25
|
Object.defineProperty(exports, "connectStdioUpstream", { enumerable: true, get: function () { return upstream_js_1.connectStdioUpstream; } });
|
|
26
|
+
Object.defineProperty(exports, "connectHttpUpstream", { enumerable: true, get: function () { return upstream_js_1.connectHttpUpstream; } });
|
|
27
|
+
Object.defineProperty(exports, "connectUpstream", { enumerable: true, get: function () { return upstream_js_1.connectUpstream; } });
|
|
26
28
|
var labels_js_1 = require("./gateway/labels.js");
|
|
27
29
|
Object.defineProperty(exports, "labelTool", { enumerable: true, get: function () { return labels_js_1.labelTool; } });
|
|
28
30
|
Object.defineProperty(exports, "LABELS", { enumerable: true, get: function () { return labels_js_1.LABELS; } });
|
|
@@ -47,4 +49,8 @@ var init_js_1 = require("./init.js");
|
|
|
47
49
|
Object.defineProperty(exports, "planInit", { enumerable: true, get: function () { return init_js_1.planInit; } });
|
|
48
50
|
Object.defineProperty(exports, "runInit", { enumerable: true, get: function () { return init_js_1.runInit; } });
|
|
49
51
|
Object.defineProperty(exports, "clientConfigPath", { enumerable: true, get: function () { return init_js_1.clientConfigPath; } });
|
|
52
|
+
var http_server_js_1 = require("./http-server.js");
|
|
53
|
+
Object.defineProperty(exports, "startHttpGateway", { enumerable: true, get: function () { return http_server_js_1.startHttpGateway; } });
|
|
54
|
+
var dashboard_sink_js_1 = require("./audit/dashboard-sink.js");
|
|
55
|
+
Object.defineProperty(exports, "DashboardSink", { enumerable: true, get: function () { return dashboard_sink_js_1.DashboardSink; } });
|
|
50
56
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAA8F;AAArF,sGAAA,UAAU,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AACzE,qDAA4D;AAAnD,kHAAA,mBAAmB,OAAA;AAE5B,iDAA+C;AAAtC,qGAAA,QAAQ,OAAA;AACjB,iDAAiD;AAAxC,uGAAA,UAAU,OAAA;AACnB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AACxB,iDAA4F;AAAnF,8GAAA,iBAAiB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAE9D,mDAA+C;AAAtC,qGAAA,OAAO,OAAA;AAChB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAA8F;AAArF,sGAAA,UAAU,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AACzE,qDAA4D;AAAnD,kHAAA,mBAAmB,OAAA;AAE5B,iDAA+C;AAAtC,qGAAA,QAAQ,OAAA;AACjB,iDAAiD;AAAxC,uGAAA,UAAU,OAAA;AACnB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AACxB,iDAA4F;AAAnF,8GAAA,iBAAiB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAE9D,mDAA+C;AAAtC,qGAAA,OAAO,OAAA;AAChB,qDAAmH;AAA1G,6GAAA,cAAc,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAEnF,iDAAwD;AAA/C,sGAAA,SAAS,OAAA;AAAE,mGAAA,MAAM,OAAA;AAE1B,iDAAmE;AAA1D,2GAAA,cAAc,OAAA;AAAE,yGAAA,YAAY,OAAA;AAErC,+CAAkD;AAAzC,wGAAA,YAAY,OAAA;AAErB,0EAA4E;AAAnE,6HAAA,sBAAsB,OAAA;AAC/B,gEAA+D;AAAtD,gHAAA,cAAc,OAAA;AACvB,0EAAuE;AAA9D,wHAAA,iBAAiB,OAAA;AAC1B,8DAA6E;AAApE,+GAAA,cAAc,OAAA;AAAE,8GAAA,aAAa,OAAA;AACtC,+CAAkE;AAAzD,wGAAA,WAAW,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAGtC,qCAAgE;AAAvD,mGAAA,QAAQ,OAAA;AAAE,kGAAA,OAAO,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAE5C,mDAAoD;AAA3C,kHAAA,gBAAgB,OAAA;AAEzB,+DAA0D;AAAjD,kHAAA,aAAa,OAAA"}
|
package/dist/init.d.ts
CHANGED
|
@@ -15,8 +15,9 @@ export interface InitPlan {
|
|
|
15
15
|
}[];
|
|
16
16
|
}
|
|
17
17
|
/**
|
|
18
|
-
* Work out the migration without touching the disk. stdio
|
|
19
|
-
* the YAML;
|
|
18
|
+
* Work out the migration without touching the disk. stdio and Streamable HTTP
|
|
19
|
+
* servers move into the YAML; SSE servers, disabled entries and an existing
|
|
20
|
+
* proxy entry stay.
|
|
20
21
|
*/
|
|
21
22
|
export declare function planInit(clientConfigText: string, yamlPath: string, auditPath: string): InitPlan;
|
|
22
23
|
export interface InitOptions {
|
package/dist/init.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAErE,yDAAyD;AACzD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,kBAAmB,EAAE,IAAI,SAAe,GAAG,MAAM,CAW7G;AAED,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kDAAkD;IAClD,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAmCD
|
|
1
|
+
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAErE,yDAAyD;AACzD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,kBAAmB,EAAE,IAAI,SAAe,GAAG,MAAM,CAW7G;AAED,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kDAAkD;IAClD,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAmCD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAsEhG;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAqBxD"}
|
package/dist/init.js
CHANGED
|
@@ -53,8 +53,9 @@ function stringRecord(value) {
|
|
|
53
53
|
return Object.keys(out).length > 0 ? out : undefined;
|
|
54
54
|
}
|
|
55
55
|
/**
|
|
56
|
-
* Work out the migration without touching the disk. stdio
|
|
57
|
-
* the YAML;
|
|
56
|
+
* Work out the migration without touching the disk. stdio and Streamable HTTP
|
|
57
|
+
* servers move into the YAML; SSE servers, disabled entries and an existing
|
|
58
|
+
* proxy entry stay.
|
|
58
59
|
*/
|
|
59
60
|
function planInit(clientConfigText, yamlPath, auditPath) {
|
|
60
61
|
const root = asRecord(JSON.parse(clientConfigText));
|
|
@@ -83,8 +84,22 @@ function planInit(clientConfigText, yamlPath, auditPath) {
|
|
|
83
84
|
kept.push({ name: key, reason: "disabled" });
|
|
84
85
|
}
|
|
85
86
|
else if (typeof entry["command"] !== "string") {
|
|
86
|
-
|
|
87
|
-
|
|
87
|
+
const url = typeof entry["url"] === "string" ? entry["url"] : typeof entry["serverUrl"] === "string" ? entry["serverUrl"] : undefined;
|
|
88
|
+
if (!url || entry["type"] === "sse") {
|
|
89
|
+
remaining[key] = value;
|
|
90
|
+
kept.push({
|
|
91
|
+
name: key,
|
|
92
|
+
reason: url
|
|
93
|
+
? "SSE server: the proxy speaks Streamable HTTP only, so this one bypasses the policy"
|
|
94
|
+
: "no command or url",
|
|
95
|
+
});
|
|
96
|
+
}
|
|
97
|
+
else {
|
|
98
|
+
const name = upstreamName(key, taken);
|
|
99
|
+
const headers = stringRecord(entry["headers"]);
|
|
100
|
+
upstreams[name] = { url, ...(headers ? { headers } : {}) };
|
|
101
|
+
migrated[key] = name;
|
|
102
|
+
}
|
|
88
103
|
}
|
|
89
104
|
else {
|
|
90
105
|
const name = upstreamName(key, taken);
|
|
@@ -95,13 +110,13 @@ function planInit(clientConfigText, yamlPath, auditPath) {
|
|
|
95
110
|
}
|
|
96
111
|
}
|
|
97
112
|
if (Object.keys(upstreams).length === 0)
|
|
98
|
-
throw new Error("No
|
|
113
|
+
throw new Error("No MCP servers to move behind the proxy");
|
|
99
114
|
const proxyKey = !("guardbee" in remaining) ? "guardbee" : "guardbee-gateway";
|
|
100
115
|
// Pinned to 1.x: 0.x does not understand --config and would fail to start.
|
|
101
116
|
remaining[proxyKey] = { command: "npx", args: ["-y", `${PROXY_PACKAGE}@^1`, "--config", yamlPath] };
|
|
102
117
|
const yaml = "# GuardBee MCP gateway — generated by `guardbee-proxy init`.\n" +
|
|
103
118
|
"# Tools appear to the agent as <upstream>__<tool>. Check a change with `guardbee-proxy validate --config <this file>`.\n" +
|
|
104
|
-
"# env values were copied from the client config; move secrets to ${VAR} references where you can.\n" +
|
|
119
|
+
"# env and header values were copied from the client config; move secrets to ${VAR} references where you can.\n" +
|
|
105
120
|
(0, yaml_1.stringify)({
|
|
106
121
|
version: 1,
|
|
107
122
|
upstreams,
|
package/dist/init.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;AASA,4CAWC;
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;AASA,4CAWC;AAmDD,4BAsEC;AAeD,0BAqBC;AAjLD,4CAAoB;AACpB,4CAAoB;AACpB,gDAAwB;AACxB,+BAA2C;AAK3C,yDAAyD;AACzD,SAAgB,gBAAgB,CAAC,MAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,YAAE,CAAC,OAAO,EAAE;IACnG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,IAAI,QAAQ,KAAK,QAAQ;gBAAE,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YAC5H,IAAI,QAAQ,KAAK,OAAO;gBAAE,OAAO,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YACpJ,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAC5E,KAAK,QAAQ;YACX,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAChD,KAAK,aAAa;YAChB,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAaD,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAErD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjH,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAW,EAAE,KAAkB;IACnD,MAAM,IAAI,GACR,GAAG;SACA,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;IAC/C,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;IAC5D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5I,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,gBAAwB,EAAE,QAAgB,EAAE,SAAiB;IACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAE/G,MAAM,SAAS,GAAmC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;gBACpC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,GAAG;wBACT,CAAC,CAAC,oFAAoF;wBACtF,CAAC,CAAC,mBAAmB;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5G,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAEpG,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC9E,2EAA2E;IAC3E,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,aAAa,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;IAEpG,MAAM,IAAI,GACR,gEAAgE;QAChE,0HAA0H;QAC1H,gHAAgH;QAChH,IAAA,gBAAM,EAAC;YACL,OAAO,EAAE,CAAC;YACV,SAAS;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;SAC7C,CAAC,CAAC;IAEL,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI;QAChF,QAAQ;QACR,IAAI;KACL,CAAC;AACJ,CAAC;AAcD,kGAAkG;AAClG,SAAgB,OAAO,CAAC,OAAoB;IAC1C,MAAM,UAAU,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC1F,IAAI,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,+CAA+C,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,GAAG,UAAU,oBAAoB,KAAK,EAAE,CAAC;IAC5D,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,YAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,kFAAkF;IAEjH,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}
|
package/dist/proxy.d.ts
CHANGED
|
@@ -11,7 +11,9 @@ export declare function createProxyServer(gateway: Gateway): Server;
|
|
|
11
11
|
* server (MCP elicitation). The approver needs the server and the server needs
|
|
12
12
|
* the gateway, hence the late binding.
|
|
13
13
|
*/
|
|
14
|
-
export declare function createGatewayServer(upstreams: Upstream[], config: GatewayConfig, audit: AuditLogger
|
|
14
|
+
export declare function createGatewayServer(upstreams: Upstream[], config: GatewayConfig, audit: AuditLogger, options?: {
|
|
15
|
+
sessionId?: string;
|
|
16
|
+
}): {
|
|
15
17
|
gateway: Gateway;
|
|
16
18
|
server: Server;
|
|
17
19
|
};
|
package/dist/proxy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAUnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,
|
|
1
|
+
{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAUnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEvE,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAOtC;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCvE;AAED,iFAAiF;AACjF,wBAAsB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE"}
|
package/dist/proxy.js
CHANGED
|
@@ -1,4 +1,37 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
+
var ownKeys = function(o) {
|
|
20
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
+
var ar = [];
|
|
22
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
+
return ar;
|
|
24
|
+
};
|
|
25
|
+
return ownKeys(o);
|
|
26
|
+
};
|
|
27
|
+
return function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
34
|
+
})();
|
|
2
35
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
36
|
exports.createProxyServer = createProxyServer;
|
|
4
37
|
exports.createGatewayServer = createGatewayServer;
|
|
@@ -37,10 +70,10 @@ function createProxyServer(gateway) {
|
|
|
37
70
|
* server (MCP elicitation). The approver needs the server and the server needs
|
|
38
71
|
* the gateway, hence the late binding.
|
|
39
72
|
*/
|
|
40
|
-
function createGatewayServer(upstreams, config, audit) {
|
|
73
|
+
function createGatewayServer(upstreams, config, audit, options = {}) {
|
|
41
74
|
let server;
|
|
42
75
|
const approver = (request) => server ? (0, approval_js_1.elicitationApprover)(server, config.approval.timeoutSeconds)(request) : Promise.resolve("unavailable");
|
|
43
|
-
const gateway = new gateway_js_1.Gateway(upstreams, config, audit, approver);
|
|
76
|
+
const gateway = new gateway_js_1.Gateway(upstreams, config, audit, approver, options);
|
|
44
77
|
server = createProxyServer(gateway);
|
|
45
78
|
return { gateway, server };
|
|
46
79
|
}
|
|
@@ -48,15 +81,40 @@ async function startGateway(config) {
|
|
|
48
81
|
const audit = new logger_js_1.AuditLogger(config.audit);
|
|
49
82
|
const upstreams = [];
|
|
50
83
|
for (const [name, server] of Object.entries(config.upstreams)) {
|
|
51
|
-
upstreams.push(await (0, upstream_js_1.
|
|
84
|
+
upstreams.push(await (0, upstream_js_1.connectUpstream)(name, server));
|
|
85
|
+
}
|
|
86
|
+
if (config.listen.transport === "http") {
|
|
87
|
+
// Imported here: http-server.ts imports this module for createGatewayServer.
|
|
88
|
+
const { startHttpGateway } = await Promise.resolve().then(() => __importStar(require("./http-server.js")));
|
|
89
|
+
const http = await startHttpGateway(upstreams, config, audit, config.listen);
|
|
90
|
+
process.stderr.write(`[guardbee-proxy] listening on ${http.url}\n`);
|
|
91
|
+
const shutdown = async () => {
|
|
92
|
+
await http.close();
|
|
93
|
+
await audit.close();
|
|
94
|
+
await Promise.allSettled(upstreams.map((upstream) => upstream.close()));
|
|
95
|
+
process.exit(0);
|
|
96
|
+
};
|
|
97
|
+
process.on("SIGINT", shutdown);
|
|
98
|
+
process.on("SIGTERM", shutdown);
|
|
99
|
+
return;
|
|
52
100
|
}
|
|
53
101
|
const { gateway, server } = createGatewayServer(upstreams, config, audit);
|
|
54
102
|
await server.connect(new stdio_js_1.StdioServerTransport());
|
|
55
|
-
|
|
56
|
-
|
|
103
|
+
// The client usually just closes stdin; without this the process ended with
|
|
104
|
+
// audit events still queued for the dashboard.
|
|
105
|
+
let closing = false;
|
|
106
|
+
const shutdown = async () => {
|
|
107
|
+
if (closing)
|
|
108
|
+
return;
|
|
109
|
+
closing = true;
|
|
110
|
+
await server.close().catch(() => { });
|
|
57
111
|
await gateway.close();
|
|
58
112
|
process.exit(0);
|
|
59
|
-
}
|
|
113
|
+
};
|
|
114
|
+
server.onclose = () => void shutdown();
|
|
115
|
+
process.stdin.on("end", () => void shutdown());
|
|
116
|
+
process.on("SIGINT", () => void shutdown());
|
|
117
|
+
process.on("SIGTERM", () => void shutdown());
|
|
60
118
|
}
|
|
61
119
|
/** 0.x entry point: one server, unprefixed tool names, toxic flows only warn. */
|
|
62
120
|
async function startProxy(config) {
|
package/dist/proxy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,8CA2BC;AAOD,kDAYC;AAED,oCAwCC;AAGD,gCAEC;AA/GD,wEAAmE;AACnE,wEAAiF;AACjF,iEAO4C;AAE5C,iDAAgD;AAChD,uDAA2E;AAC3E,mDAA2E;AAC3E,qDAA+C;AAC/C,uDAAuE;AAEvE,iFAAiF;AACjF,SAAgB,iBAAiB,CAAC,OAAgB;IAChD,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EACrD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;YAC5B,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAC9D,CAAC;IACF,MAAM,CAAC,iBAAiB,CAAC,qCAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IACjH,MAAM,CAAC,iBAAiB,CAAC,oCAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACzG,MAAM,CAAC,iBAAiB,CAAC,mCAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC7D,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CACzD,CAAC;IACF,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE;QAC1B,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,SAAqB,EACrB,MAAqB,EACrB,KAAkB,EAClB,UAAkC,EAAE;IAEpC,IAAI,MAA0B,CAAC;IAC/B,MAAM,QAAQ,GAAa,CAAC,OAAO,EAAE,EAAE,CACrC,MAAM,CAAC,CAAC,CAAC,IAAA,iCAAmB,EAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,IAAI,oBAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,MAAqB;IACtD,MAAM,KAAK,GAAG,IAAI,uBAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,SAAS,CAAC,IAAI,CAAC,MAAM,IAAA,6BAAe,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,6EAA6E;QAC7E,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,kBAAkB,GAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,+BAAoB,EAAE,CAAC,CAAC;IAEjD,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,UAAU,CAAC,MAAmB;IAClD,MAAM,YAAY,CAAC,IAAA,4BAAgB,EAAC,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -3,6 +3,13 @@ export type McpServerConfig = {
|
|
|
3
3
|
args?: string[];
|
|
4
4
|
env?: Record<string, string>;
|
|
5
5
|
};
|
|
6
|
+
/** A Streamable HTTP MCP server the proxy connects to as a client. */
|
|
7
|
+
export type HttpUpstreamConfig = {
|
|
8
|
+
url: string;
|
|
9
|
+
headers?: Record<string, string>;
|
|
10
|
+
};
|
|
11
|
+
export type UpstreamConfig = McpServerConfig | HttpUpstreamConfig;
|
|
12
|
+
export declare function isHttpUpstream(config: UpstreamConfig): config is HttpUpstreamConfig;
|
|
6
13
|
export type AuditConfig = {
|
|
7
14
|
enabled: boolean;
|
|
8
15
|
sink: "console" | "file";
|
|
@@ -14,6 +21,18 @@ export type AuditConfig = {
|
|
|
14
21
|
* legacy JSON config, false for guardbee-proxy.yaml.
|
|
15
22
|
*/
|
|
16
23
|
includePayloads?: boolean;
|
|
24
|
+
/** Also send every event, batched, to the GuardBee dashboard. */
|
|
25
|
+
dashboard?: DashboardSinkConfig;
|
|
26
|
+
};
|
|
27
|
+
export type DashboardSinkConfig = {
|
|
28
|
+
/** Ingest endpoint, e.g. https://app.guardbee.ai/api/v1/gateway/events */
|
|
29
|
+
url: string;
|
|
30
|
+
/** Workspace API key with the gateway.write scope (resolved from apiKeyEnv). */
|
|
31
|
+
apiKey: string;
|
|
32
|
+
/** Names this proxy in the dashboard; defaults to the host name. */
|
|
33
|
+
source?: string;
|
|
34
|
+
batchSize?: number;
|
|
35
|
+
flushIntervalMs?: number;
|
|
17
36
|
};
|
|
18
37
|
export type ProxyConfig = {
|
|
19
38
|
server: McpServerConfig;
|
|
@@ -58,6 +77,8 @@ export type InterceptResult = {
|
|
|
58
77
|
export type AuditEvent = {
|
|
59
78
|
ts: string;
|
|
60
79
|
type: "tool_call" | "tool_response" | "blocked" | "warn" | "toxic_flow" | "resource_read" | "approval";
|
|
80
|
+
/** MCP session (HTTP mode); absent over stdio, where the process is the session. */
|
|
81
|
+
sessionId?: string;
|
|
61
82
|
tool?: string;
|
|
62
83
|
server?: string;
|
|
63
84
|
upstream?: string;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAElE,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,IAAI,kBAAkB,CAEnF;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,YAAY,CAAC,EAAE;QACb,eAAe,CAAC,EAAE;YAChB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC;QACF,mBAAmB,CAAC,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC;QACF,eAAe,CAAC,EAAE;YAChB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;YACzB;;;eAGG;YACH,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;SACtC,CAAC;QACF,UAAU,CAAC,EAAE;YACX,OAAO,EAAE,OAAO,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;YACpB,4GAA4G;YAC5G,IAAI,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;YAC7B,iFAAiF;YACjF,mBAAmB,CAAC,EAAE,OAAO,CAAC;SAC/B,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,CAAC;IACvG,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE;QAAE,YAAY,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC"}
|
package/dist/types.js
CHANGED
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;AAcA,wCAEC;AAFD,SAAgB,cAAc,CAAC,MAAsB;IACnD,OAAO,KAAK,IAAI,MAAM,CAAC;AACzB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/mcp-security-proxy",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.2.0",
|
|
4
4
|
"mcpName": "io.github.4hmetuyar/security-proxy",
|
|
5
5
|
"description": "MCP security gateway: several MCP servers behind one policy, with toxic-flow (lethal trifecta) blocking, approvals, PII masking and a hash-chained audit log",
|
|
6
6
|
"author": "GuardBee <hello@guardbee.ai>",
|
|
@@ -34,7 +34,8 @@
|
|
|
34
34
|
"files": [
|
|
35
35
|
"dist",
|
|
36
36
|
"README.md",
|
|
37
|
-
"TR.md"
|
|
37
|
+
"TR.md",
|
|
38
|
+
"ZH.md"
|
|
38
39
|
],
|
|
39
40
|
"engines": {
|
|
40
41
|
"node": ">=18"
|
|
@@ -43,7 +44,7 @@
|
|
|
43
44
|
"@modelcontextprotocol/sdk": "^1.30.0",
|
|
44
45
|
"yaml": "^2.9.1",
|
|
45
46
|
"zod": "^4.5.4",
|
|
46
|
-
"@guardbee/guard-core": "^0.2.
|
|
47
|
+
"@guardbee/guard-core": "^0.2.1",
|
|
47
48
|
"@guardbee/mcp-telemetry": "^0.1.3"
|
|
48
49
|
},
|
|
49
50
|
"scripts": {
|