@highflame/policy 2.2.40 → 2.2.41
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/_schemas/agent_ops/templates/ported/organization/organization_deny_baseline.cedar +2 -2
- package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_mcp_server_allowlist.cedar +24 -4
- package/_schemas/ai_gateway/detectors.json +928 -0
- package/_schemas/ai_gateway/templates/mcp_server_allowlist.cedar +24 -4
- package/_schemas/guardrails/detectors.json +2193 -0
- package/_schemas/guardrails/templates/mcp_server_allowlist.cedar +24 -4
- package/_schemas/overwatch/detectors.json +1082 -0
- package/_schemas/sentry/detectors.json +857 -0
- package/dist/agent_ops-defaults.gen.js +26 -6
- package/dist/ai_gateway-defaults.gen.js +24 -4
- package/dist/ai_gateway-detectors.gen.d.ts +1 -1
- package/dist/ai_gateway-detectors.gen.js +22 -8
- package/dist/guardrails-defaults.gen.js +24 -4
- package/dist/guardrails-detectors.gen.d.ts +1 -1
- package/dist/guardrails-detectors.gen.js +22 -8
- package/dist/overwatch-defaults.gen.js +25 -5
- package/dist/overwatch-detectors.gen.d.ts +1 -1
- package/dist/overwatch-detectors.gen.js +22 -8
- package/package.json +1 -1
|
@@ -2,8 +2,23 @@
|
|
|
2
2
|
// MCP Server Allowlist
|
|
3
3
|
// =============================================================================
|
|
4
4
|
// Restricts MCP server connections to a pre-approved list. Customize the
|
|
5
|
-
// `context.mcp_server` values
|
|
6
|
-
//
|
|
5
|
+
// `context.mcp_server` values to match the allowed servers for your
|
|
6
|
+
// environment — the SAME list appears in both rules and both must be edited.
|
|
7
|
+
//
|
|
8
|
+
// Both rules are conditional on the allowlist, and both are needed:
|
|
9
|
+
//
|
|
10
|
+
// permit ... when { allowlisted } grants access; Cedar is default-deny,
|
|
11
|
+
// so without this nothing allows the
|
|
12
|
+
// allowlisted servers either.
|
|
13
|
+
// forbid ... unless { allowlisted } claws back everything else, including
|
|
14
|
+
// when a broad Baseline Permit is loaded.
|
|
15
|
+
//
|
|
16
|
+
// The forbid MUST carry the negation. `forbid` always beats `permit` in Cedar,
|
|
17
|
+
// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
|
|
18
|
+
// what this template used to do (highflame-policy#186).
|
|
19
|
+
//
|
|
20
|
+
// The `context has mcp_server` guard stays inside both conditions: a request
|
|
21
|
+
// naming no server cannot be on the allowlist, so it is denied.
|
|
7
22
|
//
|
|
8
23
|
// Context keys consumed:
|
|
9
24
|
// - mcp_server: String
|
|
@@ -30,7 +45,7 @@ when {
|
|
|
30
45
|
|
|
31
46
|
@id("tools.deny-non-allowlisted-mcp")
|
|
32
47
|
@name("Block non-allowlisted MCP servers")
|
|
33
|
-
@description("Blocks connect_server
|
|
48
|
+
@description("Blocks connect_server unless mcp_server is in the allowlist.")
|
|
34
49
|
@severity("medium")
|
|
35
50
|
@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
|
|
36
51
|
@reject_message("MCP server connection blocked: server is not on the allowlist.")
|
|
@@ -38,4 +53,9 @@ forbid (
|
|
|
38
53
|
principal,
|
|
39
54
|
action == AIGateway::Action::"connect_server",
|
|
40
55
|
resource
|
|
41
|
-
)
|
|
56
|
+
)
|
|
57
|
+
unless {
|
|
58
|
+
context has mcp_server &&
|
|
59
|
+
(context.mcp_server == "filesystem" ||
|
|
60
|
+
context.mcp_server == "playwright")
|
|
61
|
+
};
|