@highflame/policy 2.2.40 → 2.2.42

package/_schemas/ai_gateway/schema.cedarschema

@@ -74,7 +74,7 @@ entity FilePath in [Project];
 // ACTIONS
 // =============================================================================
 
-// Call an MCP tool
+// Call an MCP tool (tools/call). Enumeration is the `list` action.
 // Threat focus: command injection, tool poisoning, rug pull, secrets, PII
 action call_tool appliesTo {
   principal: [User, MCP_Client],
@@ -274,6 +274,108 @@ action connect_server appliesTo {
   },
 };
 
+// Enumerate a server's tools, prompts, or resources
+// (tools/list, prompts/list, resources/list)
+//
+// Threat focus: tool poisoning and rug pull in the DESCRIPTIONS returned by
+// enumeration — the text a host feeds the model when it assembles the
+// session's tool schema, and the vector a rug-pull exploits between scans.
+//
+// Distinct from the actions it enumerates, and deliberately NOT default-locked
+// (highflame-shield#515 / INV-AUTHZ-003). Listing is host plumbing: the model
+// never decides to enumerate, the host does it to build the session. Folding
+// it into call_tool / process_prompt / read_file made enumeration inherit
+// their lock, and because a list names no tool, no conditioned grant
+// (`context has tool_name && ...`) can ever match it — so an agent holding a
+// correct grant for every tool it uses was still denied the enumeration step,
+// and without tools/list it cannot call anything at all. The only grant that
+// could match was an unconditioned one, which would have lifted the lock for
+// every call as well. There is no way to express "may list, may not call"
+// while a list and a call are the same action. See highflame-firehog#589.
+//
+// Authorization over WHAT may be enumerated is expressed through the list
+// CONTENTS (the grant-derived list filter), not by denying the request.
+action list appliesTo {
+  principal: [User, MCP_Client],
+  resource: [Server],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+
+    // --- Content ---
+    // The enumerated item's description. Optional: a tool may declare none,
+    // and a policy must still evaluate when it does not.
+    content?: String,
+    mcp_server?: String,
+
+    // --- Enumerated item identity ---
+    // The list is scanned one item at a time, so the item being evaluated
+    // rides here while the resource stays the server being enumerated.
+    tool_name?: String,
+    tool_risk_score?: Long,
+    tool_category?: String,           // "safe", "sensitive", "dangerous"
+    tool_is_sensitive?: Bool,
+    tool_is_builtin?: Bool,
+    tool_operation_classes?: Set<String>,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Agent Security (0-100) — the reason this action scans at all ---
+    tool_poisoning_score?: Long,      // Hidden instructions in a tool description
+    tool_poisoning_detected?: Bool,
+    rug_pull_score?: Long,            // Description drift after trust establishment
+    rug_pull_detected?: Bool,
+    indirect_injection_score?: Long,
+
+    // --- ML Detector Confidence Scores (0-100) ---
+    injection_score?: Long,
+    jailbreak_score?: Long,
+
+    // --- Secrets ---
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- MCP Trust & Config Risk ---
+    mcp_server_verified?: Bool,
+    mcp_config_risk?: Bool,
+    mcp_risk_score?: Long,
+
+    // --- Session-Aware Threat Aggregation ---
+    session_threat_turns?: Long,
+    session_cumulative_risk_score?: Long,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_max_injection_score?: Long,
+    session_max_jailbreak_score?: Long,
+    session_max_command_injection_score?: Long,
+    session_max_pii_score?: Long,
+    session_max_secret_score?: Long,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
+  },
+};
+
 // Shared content-inspection context.
 //
 // Prompts and responses are inspected by the same detector pipeline and so
@@ -361,7 +463,8 @@ type ContentInspectionContext = {
     tpm_exceeded?: Bool,
 };
 
-// Process a prompt (MCP prompts/get or LLM chat completions)
+// Process a prompt (MCP prompts/get or LLM chat completions).
+// Enumeration (prompts/list) is the `list` action.
 // Threat focus: injection, jailbreak, secrets, PII, content safety
 action process_prompt appliesTo {
   principal: [User, MCP_Client],
@@ -384,7 +487,8 @@ action process_response appliesTo {
   context: ContentInspectionContext,
 };
 
-// Read an MCP resource (resources/read, resources/list)
+// Read an MCP resource (resources/read). Enumeration (resources/list)
+// is the `list` action.
 // Threat focus: secrets exposure, PII exposure, sensitive paths
 action read_file appliesTo {
   principal: [User, MCP_Client],

package/_schemas/ai_gateway/templates/mcp_server_allowlist.cedar

@@ -2,8 +2,23 @@
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// `context.mcp_server` values in the permit rule to match the allowed
-// servers for your environment.
+// `context.mcp_server` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. `forbid` always beats `permit` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The `context has mcp_server` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -30,7 +45,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -38,4 +53,9 @@ forbid (
     principal,
     action == AIGateway::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};