@highflame/policy 2.2.25 → 2.2.27

package/_schemas/guardrails/templates/mcp_server_allowlist.cedar

@@ -0,0 +1,41 @@
+// =============================================================================
+// MCP Server Allowlist
+// =============================================================================
+// Restricts MCP server connections to a pre-approved list. Customize the
+// `context.mcp_server` values in the permit rule to match the allowed
+// servers for your environment.
+//
+// Context keys consumed:
+//   - mcp_server: String
+//
+// Category:  tools
+// Namespace: Guardrails
+// =============================================================================
+
+@id("tools.allow-mcp-allowlist")
+@name("Allow allowlisted MCP servers")
+@description("Permits connect_server when mcp_server is in the allowlist.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+permit (
+    principal,
+    action == Guardrails::Action::"connect_server",
+    resource
+)
+when {
+    context has mcp_server &&
+    (context.mcp_server == "filesystem" ||
+     context.mcp_server == "playwright")
+};
+
+@id("tools.deny-non-allowlisted-mcp")
+@name("Block non-allowlisted MCP servers")
+@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+@reject_message("MCP server connection blocked: server is not on the allowlist.")
+forbid (
+    principal,
+    action == Guardrails::Action::"connect_server",
+    resource
+);

package/_schemas/guardrails/templates/templates.json

@@ -231,6 +231,15 @@
       "severity": "critical",
       "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
     },
+    {
+      "id": "tools.mcp-server-allowlist",
+      "name": "MCP Server Allowlist",
+      "description": "Restrict MCP server connections to a pre-approved list. Customize the allowlist values to match the servers permitted in your environment.",
+      "category": "tools",
+      "file": "mcp_server_allowlist.cedar",
+      "severity": "medium",
+      "tags": ["category:tools", "surface:connect-server", "scope:org-wide", "posture:deny-default"]
+    },
     {
       "id": "security.chat-assistant",
       "name": "Chat Assistant — Security",

package/_schemas/overwatch/context.json

@@ -233,6 +233,24 @@
           "required": true,
           "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved content"
         },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff a package install/download command was recognized in the request content."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise."
+        },
         {
           "key": "session_pii_detected",
           "type": "boolean",

package/dist/guardrails-defaults.gen.js

@@ -1184,6 +1184,48 @@ when {
     context has mcp_server_verified && context.mcp_server_verified == false
 };
 `;
+const GUARDRAILS_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// =============================================================================
+// MCP Server Allowlist
+// =============================================================================
+// Restricts MCP server connections to a pre-approved list. Customize the
+// \`context.mcp_server\` values in the permit rule to match the allowed
+// servers for your environment.
+//
+// Context keys consumed:
+//   - mcp_server: String
+//
+// Category:  tools
+// Namespace: Guardrails
+// =============================================================================
+
+@id("tools.allow-mcp-allowlist")
+@name("Allow allowlisted MCP servers")
+@description("Permits connect_server when mcp_server is in the allowlist.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+permit (
+    principal,
+    action == Guardrails::Action::"connect_server",
+    resource
+)
+when {
+    context has mcp_server &&
+    (context.mcp_server == "filesystem" ||
+     context.mcp_server == "playwright")
+};
+
+@id("tools.deny-non-allowlisted-mcp")
+@name("Block non-allowlisted MCP servers")
+@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+@reject_message("MCP server connection blocked: server is not on the allowlist.")
+forbid (
+    principal,
+    action == Guardrails::Action::"connect_server",
+    resource
+);
+`;
 const GUARDRAILS_SECURITY_CHAT_ASSISTANT_CEDAR = `// =============================================================================
 // Chat Assistant — Security
 // =============================================================================
@@ -3568,6 +3610,15 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'critical',
         tags: ['category:tools', 'threat:supply-chain', 'posture:deny-default'],
     },
+    {
+        id: 'tools.mcp-server-allowlist',
+        name: 'MCP Server Allowlist',
+        description: 'Restrict MCP server connections to a pre-approved list. Customize the allowlist values to match the servers permitted in your environment.',
+        category: 'tools',
+        cedarText: GUARDRAILS_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR,
+        severity: 'medium',
+        tags: ['category:tools', 'surface:connect-server', 'scope:org-wide', 'posture:deny-default'],
+    },
     {
         id: 'security.chat-assistant',
         name: 'Chat Assistant — Security',
@@ -3995,6 +4046,15 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "severity": "critical",
       "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
     },
+    {
+      "id": "tools.mcp-server-allowlist",
+      "name": "MCP Server Allowlist",
+      "description": "Restrict MCP server connections to a pre-approved list. Customize the allowlist values to match the servers permitted in your environment.",
+      "category": "tools",
+      "file": "mcp_server_allowlist.cedar",
+      "severity": "medium",
+      "tags": ["category:tools", "surface:connect-server", "scope:org-wide", "posture:deny-default"]
+    },
     {
       "id": "security.chat-assistant",
       "name": "Chat Assistant — Security",

package/dist/overwatch-defaults.gen.js

@@ -1654,8 +1654,8 @@ when {
 const OVERWATCH_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR = `// =============================================================================
 // Malicious Package (Default)
 // =============================================================================
-// Blocks tool calls that install or download packages flagged as malicious
-// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// Blocks prompts and tool calls that install or download packages flagged as
+// malicious by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
 // detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
 // yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
 // and checks each referenced package against the OSV batch API.
@@ -1678,13 +1678,13 @@ const OVERWATCH_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR = `// ===================
 
 @id("agent-security.block-malicious-package")
 @name("Block malicious package installs")
-@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@description("Blocks process_prompt and call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
 @severity("critical")
-@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:process-prompt,surface:call-tool,owasp:llm03,owasp:asi02")
 @reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
 forbid (
     principal,
-    action == Overwatch::Action::"call_tool",
+    action in [Overwatch::Action::"process_prompt", Overwatch::Action::"call_tool"],
     resource
 )
 when {
@@ -1699,13 +1699,13 @@ when {
 //
 // @id("agent-security.block-unverified-package")
 // @name("Block unverified package installs")
-// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @description("Blocks process_prompt and call_tool package installs when the malicious-package lookup is degraded.")
 // @severity("medium")
-// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:process-prompt,surface:call-tool,owasp:llm03")
 // @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
 // forbid (
 //     principal,
-//     action == Overwatch::Action::"call_tool",
+//     action in [Overwatch::Action::"process_prompt", Overwatch::Action::"call_tool"],
 //     resource
 // )
 // when {

package/dist/service-schemas.gen.js

@@ -3968,6 +3968,9 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "jailbreak_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context" },
                 { "key": "jailbreak_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns" },
                 { "key": "indirect_injection_score", "type": "number", "required": true, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved content" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "True iff a package install/download command was recognized in the request content." },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed (fail-open); empty otherwise." },
                 { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
                 { "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
                 { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.25",
+  "version": "2.2.27",
   "engines": {
     "node": ">=18"
   },