@kynver-app/mcp-agent-os 0.3.42 → 0.3.45

package/dist/lib/mcp-sse-server.d.ts

@@ -23,6 +23,21 @@ export declare function headerValue(req: IncomingMessage, name: string): string
 export declare function timingSafeEqualString(a: string, b: string): boolean;
 export declare function hasForbiddenQueryAuth(url: URL): boolean;
 export declare function resolveListenHost(): string;
+/** Positive integer from env, else fallback. */
+export declare function intFromEnv(name: string, fallback: number): number;
+/**
+ * Resolve + validate the Kynver API origin the server sends bearer keys to.
+ * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
+ * anything that isn't https (http is allowed only for localhost dev).
+ */
+export declare function resolveApiBaseUrl(): string;
+/** First client IP from x-forwarded-for, else the socket address. */
+export declare function clientIp(req: IncomingMessage): string;
+type RateLimiter = {
+    check: (key: string) => boolean;
+};
+/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
+export declare function createFixedWindowRateLimiter(limit: number, windowMs: number): RateLimiter;
 export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<unknown>;
 export declare function validateMcporterServerName(name: string): string;
 export declare function startKynverMcpSseServer(options: StartKynverMcpSseServerOptions): void;

package/dist/lib/mcp-sse-server.js

@@ -26,6 +26,61 @@ export function resolveListenHost() {
     const configured = process.env.MCP_SSE_HOST?.trim();
     return configured || "127.0.0.1";
 }
+/** Positive integer from env, else fallback. */
+export function intFromEnv(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+/**
+ * Resolve + validate the Kynver API origin the server sends bearer keys to.
+ * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
+ * anything that isn't https (http is allowed only for localhost dev).
+ */
+export function resolveApiBaseUrl() {
+    const raw = process.env.KYNVER_API_URL?.trim();
+    if (!raw)
+        return "https://kynver.com";
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`Invalid KYNVER_API_URL: ${raw}`);
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
+        throw new Error(`KYNVER_API_URL must be https (got "${parsed.protocol}//${parsed.hostname}"); API keys are sent to this origin.`);
+    }
+    return raw.replace(/\/$/, "");
+}
+/** First client IP from x-forwarded-for, else the socket address. */
+export function clientIp(req) {
+    const fwd = headerValue(req, "x-forwarded-for");
+    if (fwd)
+        return fwd.split(",")[0].trim();
+    return req.socket?.remoteAddress ?? "unknown";
+}
+/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
+export function createFixedWindowRateLimiter(limit, windowMs) {
+    const hits = new Map();
+    return {
+        check(key) {
+            const now = Date.now();
+            const entry = hits.get(key);
+            if (!entry || now >= entry.resetAt) {
+                hits.set(key, { count: 1, resetAt: now + windowMs });
+                return true;
+            }
+            if (entry.count >= limit)
+                return false;
+            entry.count += 1;
+            return true;
+        },
+    };
+}
 export function parseJsonBody(req, maxBytes = MAX_SSE_BODY_BYTES) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -106,14 +161,37 @@ function json(res, status, body) {
 }
 export function startKynverMcpSseServer(options) {
     const port = parseInt(process.env.PORT ?? String(options.defaultPort), 10);
-    const baseUrl = process.env.KYNVER_API_URL ?? "https://kynver.com";
+    const baseUrl = resolveApiBaseUrl();
     const serviceSecret = process.env.KYNVER_SERVICE_SECRET ?? "";
     const host = resolveListenHost();
     const sessions = {};
+    // Resource / abuse limits (env-overridable; in-process per server).
+    const maxSessions = intFromEnv("MCP_SSE_MAX_SESSIONS", 200);
+    const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
+    const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
+    const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
+    const rejectQueryApiKey = /^(1|true|yes)$/i.test(process.env.MCP_SSE_REJECT_QUERY_APIKEY ?? "");
+    const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
+    // Close idle SSE sessions so a flood of half-open connections can't pin memory.
+    const idleSweep = setInterval(() => {
+        const now = Date.now();
+        for (const [sid, entry] of Object.entries(sessions)) {
+            if (now - entry.lastActivity > idleTimeoutMs) {
+                delete sessions[sid];
+                void entry.transport.close().catch(() => { });
+            }
+        }
+    }, 60 * 1000);
+    idleSweep.unref?.();
     const httpServer = createServer(async (req, res) => {
         const url = parseUrl(req, port);
         const path = url.pathname;
         if (req.method === "GET" && path === "/sse") {
+            // Pre-auth rate limit by client IP (we don't know the user yet).
+            if (!rateLimiter.check(`sse:${clientIp(req)}`)) {
+                json(res, 429, { error: "Too many requests. Slow down and retry." });
+                return;
+            }
             if (hasForbiddenQueryAuth(url)) {
                 json(res, 400, {
                     error: "Internal auth via query params is not allowed. Use X-Kynver-User-Id and X-Kynver-Service-Secret headers.",
@@ -121,6 +199,12 @@ export function startKynverMcpSseServer(options) {
                 return;
             }
             if (url.searchParams.has("apiKey")) {
+                if (rejectQueryApiKey) {
+                    json(res, 400, {
+                        error: "apiKey via query param is disabled. Use Authorization: Bearer <key>.",
+                    });
+                    return;
+                }
                 console.warn("[MCP SSE] WARNING: apiKey in query string may leak via logs. Prefer Authorization header when your client supports it.");
             }
             let userId = null;
@@ -144,9 +228,20 @@ export function startKynverMcpSseServer(options) {
                 });
                 return;
             }
+            // Connection caps — bound total + per-user concurrent SSE sessions so an
+            // authenticated caller can't exhaust memory/sockets by opening many.
+            const allEntries = Object.values(sessions);
+            if (allEntries.length >= maxSessions) {
+                json(res, 503, { error: "Server at capacity. Try again shortly." });
+                return;
+            }
+            if (allEntries.filter((s) => s.userId === userId).length >= maxSessionsPerUser) {
+                json(res, 429, { error: "Too many concurrent connections for this account." });
+                return;
+            }
             console.log(`[MCP SSE] New connection (${options.label}, user: ${userId.slice(0, 8)}...)`);
             const transport = new SSEServerTransport("/messages", res);
-            sessions[transport.sessionId] = { transport, userId, auth };
+            sessions[transport.sessionId] = { transport, userId, auth, lastActivity: Date.now() };
             res.on("close", () => {
                 delete sessions[transport.sessionId];
             });
@@ -165,6 +260,12 @@ export function startKynverMcpSseServer(options) {
                 json(res, 401, { error: "Unauthorized. Re-send the same credentials used to open the SSE session." });
                 return;
             }
+            // Per-user rate limit on tool/message traffic.
+            if (!rateLimiter.check(`msg:${entry.userId}`)) {
+                json(res, 429, { error: "Too many requests. Slow down and retry." });
+                return;
+            }
+            entry.lastActivity = Date.now();
             try {
                 const body = await parseJsonBody(req);
                 await options.requestContext.run({ userId: entry.userId }, async () => {

package/dist/server.js

@@ -23,6 +23,8 @@ import { registerPrBacklogTools } from "./tools/pr-backlog.js";
 import { registerMeshLivenessTools } from "./tools/mesh-liveness.js";
 import { registerDiagnosticsTools } from "./tools/diagnostics.js";
 import { registerSkillsTools } from "./tools/skills.js";
+import { registerMemoryLedgerTools } from "./tools/memory-ledger.js";
+import { registerMemoryVaultTools } from "./tools/memory-vault.js";
 import { registerMonitorTools } from "./tools/monitor.js";
 import { readOwnPackageVersion } from "./lib/package-version.js";
 const PACKAGE_VERSION = readOwnPackageVersion(import.meta.url);
@@ -308,7 +310,7 @@ export function createAgentOsServer() {
         const s = await resolveToolSlug(slug);
         return jsonResult(await patch(`/agent-os/${s}/projects/${projectId}`, body));
     });
-    register("agent_os_search_memory", "Semantic + keyword hybrid search over the agent's long-term memory (ownerType=agent). Use to recall specific decisions, project details, or lessons without loading full context. Replaces grep/reading MEMORY.md. Optionally restrict to one source namespace via sourceId, or several via sourceIds (sourceId takes precedence when both are set). Workspace owners and env admins receive operator diagnostics (rrfScore, lanes, hygiene) unless surface=customer; grantees always receive grantee-safe hits (content, trust, evidence links only).", {
+    register("agent_os_search_memory", "Search the agent's long-term memory (ownerType=agent). Use to recall specific decisions, project details, or lessons without loading full context. Replaces grep/reading MEMORY.md. Optionally restrict to one source namespace via sourceId, or several via sourceIds (sourceId takes precedence when both are set). Workspace owners and env admins receive additional operator diagnostics unless surface=customer; grantees always receive grantee-safe hits (content, trust, evidence links only).", {
         query: z.string().describe("Natural language query to search memory."),
         k: z.number().optional().describe("Number of results (default 5, max 50)."),
         sourceId: z
@@ -321,7 +323,7 @@ export function createAgentOsServer() {
             .describe("Restrict search to any of these source namespaces. Ignored when sourceId is also set."),
         ticker: z.string().optional().describe("Trading desk: filter hits to this ticker symbol."),
         debatePersona: z.enum(["bull", "bear"]).optional().describe("Trading desk: filter to bull or bear advocate memories."),
-        personaSlug: z.string().optional().describe("Layer in this persona's operating rules in Lane A alongside global rules."),
+        personaSlug: z.string().optional().describe("Layer in this persona's operating rules alongside global rules."),
         surface: memorySurfaceField,
         slug: slugField,
     }, async (args) => {
@@ -717,7 +719,7 @@ export function createAgentOsServer() {
     registerCommandCenterTools({ register, resolveToolSlug, jsonResult });
     // Memory quality feedback (M2): record events + query status.
     registerMemoryQualityFeedbackTools({ register, resolveToolSlug, jsonResult, compact });
-    // Lane A instruction policy (operating rules boundary).
+    // Operating-rules instruction policy.
     registerOperatingRulesTools({ register, resolveToolSlug, jsonResult, compact });
     // Daemon-mediated provider evidence (read-only verification surface).
     registerProviderEvidenceTools({ register, resolveToolSlug, jsonResult });
@@ -729,6 +731,8 @@ export function createAgentOsServer() {
     registerDiagnosticsTools({ register, resolveToolSlug, jsonResult });
     // Skill library: query-first discovery + on-demand recipe fetch (bounded, metadata-first).
     registerSkillsTools({ register, resolveToolSlug, jsonResult });
+    registerMemoryLedgerTools({ register, resolveToolSlug, jsonResult });
+    registerMemoryVaultTools({ register, resolveToolSlug, jsonResult });
     registerMonitorTools({ register, resolveToolSlug, jsonResult });
     return server;
 }

package/dist/tools/memory-ledger.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Memory ledger MCP tools (audited-memory M5) — agent-readable summaries so
+ * the runtime agent can narrate what was read and why, then steer the
+ * workbench to the Memory activity panel.
+ */
+type ToolResult = {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent?: unknown;
+};
+export interface MemoryLedgerToolDeps {
+    register: (name: string, description: string, inputSchema: Record<string, unknown>, cb: (args: any) => any) => void;
+    resolveToolSlug: (explicitSlug?: string) => Promise<string>;
+    jsonResult: (data: unknown) => ToolResult;
+}
+export declare function registerMemoryLedgerTools({ register, resolveToolSlug, jsonResult, }: MemoryLedgerToolDeps): void;
+export {};

package/dist/tools/memory-ledger.js

@@ -0,0 +1,48 @@
+/**
+ * Memory ledger MCP tools (audited-memory M5) — agent-readable summaries so
+ * the runtime agent can narrate what was read and why, then steer the
+ * workbench to the Memory activity panel.
+ */
+import { z } from "zod";
+import { get } from "../lib/kynver-client.js";
+export function registerMemoryLedgerTools({ register, resolveToolSlug, jsonResult, }) {
+    register("agent_os_memory_ledger_summary", [
+        "Read a narrated summary of the workspace owner's signed memory access ledger",
+        "(receipt counts, recent human-framed activity lines, chain integrity, and workbench",
+        "steering hints). Use when the operator asks what memories were read, what changed,",
+        "or wants a weekly digest. Customer vocabulary only — no retrieval mechanics.",
+        "After summarizing, offer to open Memory activity via agent_os_workbench_view",
+        "(kind=open_panel, panel=memory-activity). Read-only and safe for unattended use.",
+    ].join(" "), {
+        slug: z.string().optional().describe("AgentOS slug. Defaults to env/primary."),
+        periodDays: z
+            .number()
+            .int()
+            .min(1)
+            .max(90)
+            .optional()
+            .describe("Rolling window in days when from/to omitted (default 7)."),
+        from: z.string().optional().describe("Inclusive ISO lower bound."),
+        to: z.string().optional().describe("Inclusive ISO upper bound."),
+        recentLimit: z
+            .number()
+            .int()
+            .min(1)
+            .max(25)
+            .optional()
+            .describe("Recent narrated lines (default 12)."),
+    }, async (args) => {
+        const slug = await resolveToolSlug(args.slug);
+        const params = new URLSearchParams();
+        if (args.periodDays != null)
+            params.set("periodDays", String(args.periodDays));
+        if (args.from)
+            params.set("from", args.from);
+        if (args.to)
+            params.set("to", args.to);
+        if (args.recentLimit != null)
+            params.set("recentLimit", String(args.recentLimit));
+        const qs = params.toString();
+        return jsonResult(await get(`/agent-os/${encodeURIComponent(slug)}/memory-ledger/summary${qs ? `?${qs}` : ""}`));
+    });
+}

package/dist/tools/memory-vault.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Memory vault MCP tools (audited-memory M4) — sealed-memory label visibility
+ * for the runtime agent. STRICT contract: the agent may learn that sealed
+ * memories exist (label + slug + createdAt) and nothing else. Sealed content
+ * is encrypted client-side; opening requires the user's explicit per-request
+ * consent in the Kynver web chat, where they decrypt it locally.
+ */
+type ToolResult = {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent?: unknown;
+};
+export interface MemoryVaultToolDeps {
+    register: (name: string, description: string, inputSchema: Record<string, unknown>, cb: (args: any) => any) => void;
+    resolveToolSlug: (explicitSlug?: string) => Promise<string>;
+    jsonResult: (data: unknown) => ToolResult;
+}
+export declare function registerMemoryVaultTools({ register, resolveToolSlug, jsonResult, }: MemoryVaultToolDeps): void;
+export {};

package/dist/tools/memory-vault.js

@@ -0,0 +1,24 @@
+/**
+ * Memory vault MCP tools (audited-memory M4) — sealed-memory label visibility
+ * for the runtime agent. STRICT contract: the agent may learn that sealed
+ * memories exist (label + slug + createdAt) and nothing else. Sealed content
+ * is encrypted client-side; opening requires the user's explicit per-request
+ * consent in the Kynver web chat, where they decrypt it locally.
+ */
+import { z } from "zod";
+import { get } from "../lib/kynver-client.js";
+export function registerMemoryVaultTools({ register, resolveToolSlug, jsonResult, }) {
+    register("agent_os_vault_labels", [
+        "List the workspace owner's sealed (vault) memories — labels, slugs, and creation dates",
+        "ONLY. Sealed content is encrypted in the user's browser before upload and can never be",
+        "read by you or the platform; this tool proves a sealed memory exists, nothing more.",
+        "To use one, ask the user to open it — they decrypt it locally and choose per request",
+        "(opens happen in the Kynver web chat via a consent card; each open is receipted in the",
+        "Memory activity ledger). Read-only and safe for unattended use.",
+    ].join(" "), {
+        slug: z.string().optional().describe("AgentOS slug. Defaults to env/primary."),
+    }, async (args) => {
+        const slug = await resolveToolSlug(args.slug);
+        return jsonResult(await get(`/agent-os/${encodeURIComponent(slug)}/memory/vault/labels`));
+    });
+}

package/dist/tools/operating-rules.d.ts

@@ -1,7 +1,7 @@
 /**
- * MCP tools for Lane A instruction policy (operating rules boundary).
+ * MCP tools for the operating-rules instruction policy.
  *
- * agent_os_operating_rules_get — deterministic Lane A policy + optional injection markdown.
+ * agent_os_operating_rules_get — deterministic operating-rules policy + optional injection markdown.
  */
 import type { MemoryQualityFeedbackToolDeps } from "./memory-quality-feedback.js";
 export declare function registerOperatingRulesTools(deps: MemoryQualityFeedbackToolDeps): void;

package/dist/tools/operating-rules.js

@@ -1,7 +1,7 @@
 /**
- * MCP tools for Lane A instruction policy (operating rules boundary).
+ * MCP tools for the operating-rules instruction policy.
  *
- * agent_os_operating_rules_get — deterministic Lane A policy + optional injection markdown.
+ * agent_os_operating_rules_get — deterministic operating-rules policy + optional injection markdown.
  */
 import { z } from "zod";
 import { get } from "../lib/kynver-client.js";
@@ -9,7 +9,7 @@ export function registerOperatingRulesTools(deps) {
     const { register, resolveToolSlug, jsonResult, compact } = deps;
     register("agent_os_operating_rules_get", [
         "Return the AgentOS instruction policy (internal + custom operating-rule tiers).",
-        "Uses explicit kind=operating-rule Prisma fetch — not semantic Lane A recall.",
+        "Returns operating rules by exact lookup, not semantic search.",
         "Operator access required; internal-tier mechanics visible to Kynver platform admins only.",
         "Set includeMarkdown=1 to receive prompt injection text.",
     ].join(" "), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/mcp-agent-os",
-  "version": "0.3.42",
+  "version": "0.3.45",
   "description": "Kynver Agentic OS MCP server — slug-keyed agent identity, goals, projects, sessions, and long-term memory",
   "type": "module",
   "bin": {