@kya-os/mcp-i 1.12.2 → 1.12.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -5
- package/dist/125.js +1 -0
- package/dist/runtime/248.js +1 -0
- package/dist/runtime/adapter-express.js +3 -3
- package/dist/runtime/adapter-nextjs.js +3 -3
- package/dist/runtime/delegation-verifier-agentshield.d.ts +5 -5
- package/dist/runtime/delegation-verifier-agentshield.js +20 -20
- package/dist/runtime/delegation-verifier.d.ts +3 -3
- package/dist/runtime/delegation-verifier.js +1 -1
- package/dist/runtime/http.js +3 -3
- package/dist/runtime/identity.d.ts +26 -0
- package/dist/runtime/identity.js +37 -4
- package/dist/runtime/mcpi-runtime-wrapper.js +4 -2
- package/dist/runtime/mcpi-runtime.d.ts +2 -2
- package/dist/runtime/mcpi-runtime.js +63 -62
- package/dist/runtime/proof-batch-queue.d.ts +3 -3
- package/dist/runtime/proof-batch-queue.js +9 -9
- package/dist/runtime/stdio.js +3 -3
- package/dist/runtime/tool-protection.d.ts +4 -4
- package/dist/runtime/tool-protection.js +5 -5
- package/dist/runtime/utils/tools.js +5 -5
- package/dist/test/examples/test-usage-example.d.ts +8 -8
- package/package.json +3 -3
- package/dist/365.js +0 -1
- package/dist/runtime/160.js +0 -1
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
* Configuration Resolution Priority (highest to lowest):
|
|
8
8
|
* 1. Inline config (passed to runtime) - for testing and overrides
|
|
9
9
|
* 2. Local file (tool-protections.json) - for development
|
|
10
|
-
* 3.
|
|
10
|
+
* 3. Checkpoint API - for production (NOT IMPLEMENTED YET)
|
|
11
11
|
*/
|
|
12
12
|
import type { AuthorizationRequirement } from '@kya-os/contracts/tool-protection';
|
|
13
13
|
/**
|
|
@@ -18,7 +18,7 @@ export interface ToolProtectionConfig {
|
|
|
18
18
|
requiresDelegation: boolean;
|
|
19
19
|
/** Required scopes for this tool (Phase 1: simple string array) */
|
|
20
20
|
requiredScopes?: string[];
|
|
21
|
-
/** Optional risk level indicator (for
|
|
21
|
+
/** Optional risk level indicator (for Checkpoint UI) */
|
|
22
22
|
riskLevel?: 'low' | 'medium' | 'high' | 'critical';
|
|
23
23
|
/** Optional custom authorization URL for this specific tool */
|
|
24
24
|
authorizationUrl?: string;
|
|
@@ -61,7 +61,7 @@ export declare class FileToolProtectionSource implements ToolProtectionConfigSou
|
|
|
61
61
|
load(): Promise<ToolProtectionMap | null>;
|
|
62
62
|
}
|
|
63
63
|
/**
|
|
64
|
-
*
|
|
64
|
+
* Checkpoint API configuration source (lowest priority)
|
|
65
65
|
* NOTE: This is a placeholder for future implementation
|
|
66
66
|
*/
|
|
67
67
|
export declare class AgentShieldToolProtectionSource implements ToolProtectionConfigSource {
|
|
@@ -112,7 +112,7 @@ export declare function createToolProtectionResolver(options: {
|
|
|
112
112
|
inline?: ToolProtectionMap;
|
|
113
113
|
/** Local file path (default: tool-protections.json) */
|
|
114
114
|
localFile?: string | false;
|
|
115
|
-
/**
|
|
115
|
+
/** Checkpoint API configuration */
|
|
116
116
|
agentShield?: {
|
|
117
117
|
apiUrl: string;
|
|
118
118
|
agentDid: string;
|
|
@@ -8,7 +8,7 @@
|
|
|
8
8
|
* Configuration Resolution Priority (highest to lowest):
|
|
9
9
|
* 1. Inline config (passed to runtime) - for testing and overrides
|
|
10
10
|
* 2. Local file (tool-protections.json) - for development
|
|
11
|
-
* 3.
|
|
11
|
+
* 3. Checkpoint API - for production (NOT IMPLEMENTED YET)
|
|
12
12
|
*/
|
|
13
13
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
14
14
|
exports.ToolProtectionResolver = exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = void 0;
|
|
@@ -65,7 +65,7 @@ class FileToolProtectionSource {
|
|
|
65
65
|
}
|
|
66
66
|
exports.FileToolProtectionSource = FileToolProtectionSource;
|
|
67
67
|
/**
|
|
68
|
-
*
|
|
68
|
+
* Checkpoint API configuration source (lowest priority)
|
|
69
69
|
* NOTE: This is a placeholder for future implementation
|
|
70
70
|
*/
|
|
71
71
|
class AgentShieldToolProtectionSource {
|
|
@@ -80,10 +80,10 @@ class AgentShieldToolProtectionSource {
|
|
|
80
80
|
this.apiKey = apiKey;
|
|
81
81
|
}
|
|
82
82
|
async load() {
|
|
83
|
-
// TODO: Implement
|
|
83
|
+
// TODO: Implement Checkpoint API fetch
|
|
84
84
|
// GET /v1/agents/{agentDid}/tool-protections
|
|
85
85
|
// Headers: { Authorization: `Bearer ${apiKey}` }
|
|
86
|
-
console.warn('[ToolProtection]
|
|
86
|
+
console.warn('[ToolProtection] Checkpoint API source not yet implemented');
|
|
87
87
|
return null;
|
|
88
88
|
}
|
|
89
89
|
}
|
|
@@ -184,7 +184,7 @@ function createToolProtectionResolver(options) {
|
|
|
184
184
|
const filePath = options.localFile || 'tool-protections.json';
|
|
185
185
|
resolver.addSource(new FileToolProtectionSource(filePath));
|
|
186
186
|
}
|
|
187
|
-
// Add
|
|
187
|
+
// Add Checkpoint source if configured
|
|
188
188
|
if (options.agentShield) {
|
|
189
189
|
resolver.addSource(new AgentShieldToolProtectionSource(options.agentShield.apiUrl, options.agentShield.agentDid, options.agentShield.apiKey));
|
|
190
190
|
}
|
|
@@ -104,7 +104,7 @@ async function initializeProofBatchQueue(debug) {
|
|
|
104
104
|
if (destConfig.type === "agentshield") {
|
|
105
105
|
destinations.push(new proof_batch_queue_1.AgentShieldProofDestination(destConfig.apiUrl, destConfig.apiKey));
|
|
106
106
|
if (debug) {
|
|
107
|
-
console.error(`[MCPI] Added
|
|
107
|
+
console.error(`[MCPI] Added Checkpoint destination: ${destConfig.apiUrl}`);
|
|
108
108
|
}
|
|
109
109
|
}
|
|
110
110
|
else if (destConfig.type === "kta") {
|
|
@@ -480,7 +480,7 @@ async function addToolsToServer(server, toolModules, identityConfig, clientMessa
|
|
|
480
480
|
`1. Configure a delegation verifier:\n` +
|
|
481
481
|
` - MemoryDelegationVerifier (development/testing)\n` +
|
|
482
482
|
` - KVDelegationVerifier (production with KV store)\n` +
|
|
483
|
-
` - AgentShieldVerifier (production with
|
|
483
|
+
` - AgentShieldVerifier (production with Checkpoint service)\n\n` +
|
|
484
484
|
`2. Enable delegation in your runtime config:\n` +
|
|
485
485
|
` const runtime = new MCPIRuntime({\n` +
|
|
486
486
|
` delegation: { enabled: true },\n` +
|
|
@@ -570,7 +570,7 @@ async function addToolsToServer(server, toolModules, identityConfig, clientMessa
|
|
|
570
570
|
}
|
|
571
571
|
// Check if authorization method matches current tool requirements
|
|
572
572
|
// This prevents stale delegations from working after tool auth method changes
|
|
573
|
-
// NOTE: Authorization validation only applies when credential is present (
|
|
573
|
+
// NOTE: Authorization validation only applies when credential is present (Checkpoint API verifier).
|
|
574
574
|
// KV/Memory verifiers don't return credential data, so we skip auth method validation for them.
|
|
575
575
|
if (verifyResult.authorized &&
|
|
576
576
|
toolProtection.authorization &&
|
|
@@ -701,7 +701,7 @@ async function addToolsToServer(server, toolModules, identityConfig, clientMessa
|
|
|
701
701
|
identityState: "anonymous", // Phase 5: Synthesized sessions are anonymous
|
|
702
702
|
};
|
|
703
703
|
// Determine scopeId from tool protection configuration
|
|
704
|
-
// This enables
|
|
704
|
+
// This enables Checkpoint tool auto-discovery
|
|
705
705
|
let scopeId;
|
|
706
706
|
const toolProtection = tool_protection_registry_1.toolProtectionRegistry.get(name);
|
|
707
707
|
if (toolProtection?.requiredScopes &&
|
|
@@ -739,7 +739,7 @@ async function addToolsToServer(server, toolModules, identityConfig, clientMessa
|
|
|
739
739
|
outcome: proof.meta.submissionOutcome ?? "success",
|
|
740
740
|
});
|
|
741
741
|
if (identityConfig?.debug) {
|
|
742
|
-
console.error(`[MCPI] Proof enqueued for submission to
|
|
742
|
+
console.error(`[MCPI] Proof enqueued for submission to Checkpoint`);
|
|
743
743
|
}
|
|
744
744
|
}
|
|
745
745
|
catch (queueError) {
|
|
@@ -26,14 +26,14 @@ export declare function exampleProofTesting(): Promise<{
|
|
|
26
26
|
hashes: boolean;
|
|
27
27
|
error?: string | undefined;
|
|
28
28
|
};
|
|
29
|
-
|
|
29
|
+
signature: {
|
|
30
30
|
valid: boolean;
|
|
31
|
-
|
|
31
|
+
algorithm: string;
|
|
32
32
|
error?: string | undefined;
|
|
33
33
|
};
|
|
34
|
-
|
|
34
|
+
session: {
|
|
35
35
|
valid: boolean;
|
|
36
|
-
|
|
36
|
+
expired: boolean;
|
|
37
37
|
error?: string | undefined;
|
|
38
38
|
};
|
|
39
39
|
errors: string[];
|
|
@@ -92,14 +92,14 @@ export declare function exampleCompleteTestScenario(): Promise<{
|
|
|
92
92
|
hashes: boolean;
|
|
93
93
|
error?: string | undefined;
|
|
94
94
|
};
|
|
95
|
-
|
|
95
|
+
signature: {
|
|
96
96
|
valid: boolean;
|
|
97
|
-
|
|
97
|
+
algorithm: string;
|
|
98
98
|
error?: string | undefined;
|
|
99
99
|
};
|
|
100
|
-
|
|
100
|
+
session: {
|
|
101
101
|
valid: boolean;
|
|
102
|
-
|
|
102
|
+
expired: boolean;
|
|
103
103
|
error?: string | undefined;
|
|
104
104
|
};
|
|
105
105
|
errors: string[];
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kya-os/mcp-i",
|
|
3
|
-
"version": "1.12.
|
|
3
|
+
"version": "1.12.4",
|
|
4
4
|
"description": "The TypeScript MCP framework with identity features built-in",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -63,7 +63,7 @@
|
|
|
63
63
|
"model-context-protocol"
|
|
64
64
|
],
|
|
65
65
|
"dependencies": {
|
|
66
|
-
"@kya-os/contracts": "^1.12.
|
|
66
|
+
"@kya-os/contracts": "^1.12.4",
|
|
67
67
|
"@kya-os/mcp-i-core": "^1.9.2",
|
|
68
68
|
"@kya-os/mcp-i-runtime": "^1.2.4",
|
|
69
69
|
"@modelcontextprotocol/sdk": "^1.11.4",
|
|
@@ -103,8 +103,8 @@
|
|
|
103
103
|
"@modelcontextprotocol/inspector": "^0.20.0"
|
|
104
104
|
},
|
|
105
105
|
"devDependencies": {
|
|
106
|
-
"@kya-os/mcp": "1.11.0",
|
|
107
106
|
"@aws-sdk/client-dynamodb": "^3.992.0",
|
|
107
|
+
"@kya-os/mcp": "1.16.0",
|
|
108
108
|
"@types/content-type": "^1.1.9",
|
|
109
109
|
"@types/fs-extra": "^11.0.4",
|
|
110
110
|
"@types/jsonwebtoken": "^9.0.9",
|