@iicp/client 0.7.83 → 0.7.85

package/README.md

@@ -39,7 +39,7 @@ What good looks like:
 ```bash
 iicp-node --help       # shows query, serve, proxy, mcp-gateway, credits, ...
 which iicp-node        # points to your Node/npm environment
-iicp-node --version    # prints iicp-node 0.7.83 or newer
+iicp-node --version    # prints iicp-node 0.7.85 or newer
 ```
 
 The query command contacts the public directory, discovers a matching live node,
@@ -51,6 +51,16 @@ keeps key-ready transport/relay paths confidential, but it is not
 executor-blind inference. For sensitive data, use local/browser inference or a
 fail-closed routing profile.
 
+## MCP gateway safety
+
+`iicp-node mcp-gateway --tools format_json,summarize_text` advertises only the
+tools you name. Shell, file, network, browser, credential, system-control and
+regulated-decision tools are denied by default. Enabling one requires all four
+controls: `--allow-dangerous-tools`, `--authz-policy ID`, `--sandbox container`
+and `--audit-redaction` (equivalent `IICP_MCP_*` environment variables exist).
+Policy receipts include risk/decision metadata and argument counts, never tool
+arguments, prompts, credentials or response content.
+
 ## Use from TypeScript
 
 ```typescript

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAiDA,OAAO,EAeL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAGvB,KAAK,aAAa,GAAG,cAAc,cAAc,CAAC,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,yBAA8B,GAAG,MAAM,IAAI,CA+C3F;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoBD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/D,wBAAgB,uBAAuB,IAAI,gBAAgB,CAM1D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,GAAG,kBAAkB,CAGpG;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAKrF;AAsaD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,OAAO,EACxB,aAAa,EAAE,OAAO,GACrB,KAAK,CAAC,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC,CAGtC;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWlE;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAEhB,OAAO,CAAC,EAAE,GAAG,GACZ,MAAM,GAAG,IAAI,CAUf;AAiFD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB9E;AA+2BD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5D;AA0pBD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAiDA,OAAO,EAeL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAIvB,KAAK,aAAa,GAAG,cAAc,cAAc,CAAC,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,yBAA8B,GAAG,MAAM,IAAI,CA+C3F;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoBD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/D,wBAAgB,uBAAuB,IAAI,gBAAgB,CAM1D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,GAAG,kBAAkB,CAGpG;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAKrF;AAsaD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,OAAO,EACxB,aAAa,EAAE,OAAO,GACrB,KAAK,CAAC,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC,CAGtC;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWlE;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAEhB,OAAO,CAAC,EAAE,GAAG,GACZ,MAAM,GAAG,IAAI,CAUf;AAiFD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB9E;AA+2BD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5D;AA0pBD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlF"}

package/dist/cli.js

@@ -50,6 +50,7 @@ const index_js_2 = require("./backends/index.js");
 const recovery_js_1 = require("./recovery.js");
 const identity_js_1 = require("./identity.js");
 const delegation_js_1 = require("./delegation.js");
+const mcp_policy_js_1 = require("./mcp_policy.js");
 /**
  * Start the default-on provider updater for long-running TS node processes.
  *
@@ -2152,20 +2153,6 @@ async function main(argv = process.argv.slice(2)) {
     }
 }
 // ── mcp-gateway (#512) ───────────────────────────────────────────────────────
-// Backstop denylist on top of the operator's explicit --tools allowlist
-// (red-team pass 3): shells/interpreters/exec primitives never to expose, even
-// by accident. The required --tools allowlist + allow_tool_execution opt-in are
-// the primary controls; this is a best-effort safety net.
-const _MCP_DANGEROUS = new Set([
-    // shells / interpreters / process execution
-    "bash", "sh", "zsh", "fish", "shell", "powershell", "pwsh", "cmd",
-    "exec", "execute", "run_command", "run", "system", "eval",
-    "python", "python3", "node", "ruby", "perl", "subprocess", "popen", "spawn",
-    // #601 tool-risk classes that must not be public-unknown by default
-    "write_file", "file_write", "filesystem_write", "delete_file", "remove_file",
-    "browser_control", "computer_use", "credential_access", "read_secret", "secrets",
-    "system_control", "service_control", "physical_world", "regulated_decision",
-]);
 function _toolToIntent(name) {
     const safe = name.toLowerCase().replace(/[^a-z0-9_]/g, "_");
     return `urn:iicp:intent:mcp:${safe}:v1`;
@@ -2183,7 +2170,11 @@ async function runMcpGateway(argv) {
             `  --directory-url URL  IICP_DIRECTORY_URL (default https://iicp.network/api/v1)\n` +
             `  --region REGION      IICP_REGION (default local)\n` +
             `  --port N             IICP_PORT (default 9484)\n` +
-            `  --host HOST          IICP_HOST (default ::)\n`);
+            `  --host HOST          IICP_HOST (default ::)\n` +
+            `  --allow-dangerous-tools  IICP_MCP_ALLOW_DANGEROUS_TOOLS (requires all controls below)\n` +
+            `  --authz-policy ID    IICP_MCP_AUTHZ_POLICY\n` +
+            `  --sandbox PROFILE    IICP_MCP_SANDBOX (strict/container/sandbox)\n` +
+            `  --audit-redaction    IICP_MCP_AUDIT_REDACTION\n`);
         return 0;
     }
     const { values } = safeParseArgs({
@@ -2197,15 +2188,32 @@ async function runMcpGateway(argv) {
             region: { type: "string" },
             port: { type: "string" },
             host: { type: "string" },
+            "allow-dangerous-tools": { type: "boolean" },
+            "authz-policy": { type: "string" },
+            sandbox: { type: "string" },
+            "audit-redaction": { type: "boolean" },
         },
         allowPositionals: false,
     });
     const mcpUrl = (values["mcp-url"] ?? envOr("IICP_MCP_URL") ?? "http://localhost:8001").replace(/\/$/, "");
     const rawTools = (values["tools"] ?? envOr("IICP_MCP_TOOLS") ?? "")
         .split(",").map((t) => t.trim()).filter(Boolean);
-    const activeTools = rawTools.filter((t) => !_MCP_DANGEROUS.has(t.toLowerCase()));
+    const toolPolicy = new mcp_policy_js_1.McpToolPolicy({
+        allowDangerousTools: Boolean(values["allow-dangerous-tools"]) || envBool("IICP_MCP_ALLOW_DANGEROUS_TOOLS"),
+        authzPolicy: values["authz-policy"] ?? envOr("IICP_MCP_AUTHZ_POLICY") ?? "",
+        sandboxProfile: values["sandbox"] ?? envOr("IICP_MCP_SANDBOX") ?? "",
+        auditRedaction: Boolean(values["audit-redaction"]) || envBool("IICP_MCP_AUDIT_REDACTION"),
+    });
+    const activeTools = rawTools.filter((t) => toolPolicy.allows(t));
+    const deniedTools = rawTools.filter((t) => !toolPolicy.allows(t));
+    if (deniedTools.length) {
+        process.stderr.write(`WARNING: denied high-risk MCP tools until all authz, sandbox and redacted-audit controls are configured: ${deniedTools.join(", ")}\n`);
+    }
     if (activeTools.length === 0) {
-        process.stderr.write(`ERROR: --tools is required. Provide a comma-separated list of MCP tool names.\n` +
+        const reason = rawTools.length > 0
+            ? "all requested tools were denied by the MCP safety policy"
+            : "--tools is required";
+        process.stderr.write(`ERROR: ${reason}. Provide safe tool names, or configure every dangerous-tool control.\n` +
             `  Example: iicp-node mcp-gateway --tools summarize_text,lookup_status --mcp-url http://localhost:8001\n`);
         return 2;
     }
@@ -2216,9 +2224,26 @@ async function runMcpGateway(argv) {
     const host = values["host"] ?? envOr("IICP_HOST") ?? "::";
     const publicEndpoint = values["public-endpoint"] ?? envOr("IICP_PUBLIC_ENDPOINT") ?? `http://localhost:${port}`;
     const intents = activeTools.map(_toolToIntent);
+    const capabilities = activeTools.map((tool, index) => ({
+        intent: intents[index],
+        models: [`mcp:${tool}`],
+        max_tokens: 65536,
+    }));
     let nodeToken = envOr("IICP_NODE_TOKEN") ?? "";
     async function doRegister() {
-        const payload = { node_id: nodeId, region, endpoint: publicEndpoint, intents, mcp_tools: activeTools, protocol_version: "1.0" };
+        const payload = {
+            node_id: nodeId,
+            region,
+            endpoint: publicEndpoint,
+            capabilities,
+            limits: { max_concurrent: 1, tokens_per_min: 65536 },
+            backend: "custom",
+            policy: {
+                allow_remote_inference: false,
+                allow_tool_execution: true,
+                allow_file_access: activeTools.some((tool) => ["file_read", "file_write"].includes((0, mcp_policy_js_1.toolRiskLabel)(tool))),
+            },
+        };
         const headers = { "Content-Type": "application/json" };
         if (nodeToken)
             headers["Authorization"] = `Bearer ${nodeToken}`;
@@ -2271,7 +2296,16 @@ async function runMcpGateway(argv) {
     const stopAutoUpdate = startProviderAutoUpdate();
     const server = http.createServer(async (req, res) => {
         if (req.method === "GET" && req.url === "/iicp/health") {
-            const body = JSON.stringify({ status: "ok", node_id: nodeId, active_tools: activeTools, mcp_server: mcpUrl, timestamp: Math.floor(Date.now() / 1000) });
+            const body = JSON.stringify({
+                status: "ok", node_id: nodeId, active_tools: activeTools, mcp_server: mcpUrl,
+                mcp_policy: {
+                    dangerous_tools_enabled: toolPolicy.dangerousReady,
+                    authz_policy: toolPolicy.authzPolicy || null,
+                    sandbox_profile: toolPolicy.sandboxProfile || null,
+                    audit_redacted: toolPolicy.auditRedaction,
+                },
+                timestamp: Math.floor(Date.now() / 1000),
+            });
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(body);
             return;
@@ -2307,9 +2341,11 @@ async function runMcpGateway(argv) {
                 res.end(JSON.stringify({ error: "Cannot determine tool name" }));
                 return;
             }
-            if (_MCP_DANGEROUS.has(toolName.toLowerCase())) {
+            const args = (payload["arguments"] ?? {});
+            const argumentCount = args && typeof args === "object" ? Object.keys(args).length : 0;
+            if (!toolPolicy.allows(toolName)) {
                 res.writeHead(403, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: "Tool not permitted" }));
+                res.end(JSON.stringify({ error: "Tool not permitted by MCP risk policy", policy_receipt: toolPolicy.receipt(toolName, "denied", argumentCount) }));
                 return;
             }
             if (activeTools.length && !activeTools.includes(toolName)) {
@@ -2319,9 +2355,9 @@ async function runMcpGateway(argv) {
             }
             const taskId = body["task_id"] ?? (0, node_crypto_1.randomUUID)();
             try {
-                const result = await callMcp(toolName, (payload["arguments"] ?? {}));
+                const result = await callMcp(toolName, args);
                 res.writeHead(200, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ task_id: taskId, status: "completed", result }));
+                res.end(JSON.stringify({ task_id: taskId, status: "completed", result, policy_receipt: toolPolicy.receipt(toolName, "allowed", argumentCount) }));
             }
             catch (err) {
                 const msg = err.message ?? "error";