@mcp-audit-gateway/core 0.1.0

package/dist/cli.js

@@ -0,0 +1,364 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { Gateway, ToolCallError } from "./proxy/gateway.js";
+import { GatewayConfigSchema } from "./types.js";
+const USAGE = `mcp-audit — cryptographic proof of what your AI agents did
+
+Commands:
+  wrap -- <cmd>     Wrap any MCP server with transparent audit logging
+  tail              Live stream of audit records
+  verify <log>      Verify integrity of an audit log file
+  serve [config]    Start the full gateway (multi-upstream, policy, OTel)
+  keygen [dir]      Generate Ed25519 key pair
+  help              Show this help
+
+Examples:
+  mcp-audit wrap -- npx @modelcontextprotocol/server-github
+  mcp-audit tail
+  mcp-audit verify ~/.mcp-audit/audit.jsonl
+  mcp-audit serve ./gateway.config.json
+`;
+async function main() {
+    const [command = "serve", ...args] = process.argv.slice(2);
+    switch (command) {
+        case "wrap":
+            return wrap(args);
+        case "tail":
+            return tail();
+        case "serve":
+            return serve(args[0]);
+        case "verify":
+            return verify(args[0]);
+        case "keygen":
+            return keygen(args[0]);
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(USAGE);
+            return;
+        default:
+            if (command.endsWith(".json")) {
+                return serve(command);
+            }
+            console.error(`Unknown command: ${command}`);
+            console.log(USAGE);
+            process.exit(1);
+    }
+}
+async function wrap(args) {
+    const dashDash = args.indexOf("--");
+    const cmdArgs = dashDash >= 0 ? args.slice(dashDash + 1) : args;
+    if (cmdArgs.length === 0) {
+        console.error("Usage: mcp-audit wrap -- <command> [args...]");
+        console.error("Example: mcp-audit wrap -- npx @modelcontextprotocol/server-github");
+        process.exit(1);
+    }
+    const [command, ...rest] = cmdArgs;
+    const { runWrapProxy } = await import("./wrap/proxy.js");
+    await runWrapProxy(command, rest);
+}
+async function tail() {
+    const { homedir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { createReadStream, watch } = await import("node:fs");
+    const { stat } = await import("node:fs/promises");
+    const logPath = join(homedir(), ".mcp-audit", "audit.jsonl");
+    try {
+        await stat(logPath);
+    }
+    catch {
+        console.error(`No audit log found at ${logPath}`);
+        console.error("Start wrapping an MCP server first: mcp-audit wrap -- <command>");
+        process.exit(1);
+    }
+    console.log(`Tailing ${logPath}...\n`);
+    let position = 0;
+    const s = await stat(logPath);
+    position = s.size;
+    const printLine = (line) => {
+        try {
+            const entry = JSON.parse(line);
+            const status = entry.success ? "\x1b[32m✓\x1b[0m" : "\x1b[31m✗\x1b[0m";
+            const dur = `${entry.durationMs}ms`.padStart(7);
+            const tool = (entry.toolName ?? "unknown").padEnd(30);
+            const time = entry.timestamp?.substring(11, 19) ?? "";
+            console.log(`${status} ${time} ${tool} ${dur}  ${entry.id.substring(0, 8)}`);
+        }
+        catch { }
+    };
+    const readNewLines = () => {
+        const stream = createReadStream(logPath, { start: position, encoding: "utf-8" });
+        let buffer = "";
+        stream.on("data", (chunk) => {
+            buffer += chunk;
+            const lines = buffer.split("\n");
+            buffer = lines.pop() ?? "";
+            for (const line of lines) {
+                if (line.trim())
+                    printLine(line);
+            }
+            position += Buffer.byteLength(chunk);
+        });
+    };
+    readNewLines();
+    watch(logPath, () => readNewLines());
+}
+async function serve(configPath) {
+    const resolved = resolve(configPath ?? "gateway.config.json");
+    let rawConfig;
+    try {
+        const content = await readFile(resolved, "utf-8");
+        rawConfig = JSON.parse(content);
+    }
+    catch (err) {
+        console.error(`Failed to read config from ${resolved}:`, err);
+        process.exit(1);
+    }
+    const parsed = GatewayConfigSchema.safeParse(rawConfig);
+    if (!parsed.success) {
+        console.error("Invalid configuration:");
+        for (const issue of parsed.error.issues) {
+            console.error(`  ${issue.path.join(".")}: ${issue.message}`);
+        }
+        process.exit(1);
+    }
+    const config = parsed.data;
+    const gateway = new Gateway(config);
+    await gateway.init();
+    console.log(`${config.name} v${config.version} started`);
+    console.log(`  Transport: ${config.listen.transport}`);
+    console.log(`  Upstreams: ${config.upstreams.length}`);
+    console.log(`  Attestation: ${config.attestation.enabled ? config.attestation.algorithm : "disabled"}`);
+    console.log(`  Telemetry: ${config.telemetry.enabled ? "enabled" : "disabled"}`);
+    console.log(`  Audit log: ${config.auditLog.enabled ? config.auditLog.path : "disabled"}`);
+    console.log(`  Policy: default=${config.policy.defaultEffect}, ${config.policy.rules.length} rules`);
+    console.log();
+    if (config.listen.transport === "streamable-http") {
+        const { createServer } = await import("node:http");
+        const server = createServer(async (req, res) => {
+            if (req.url === "/health") {
+                const status = gateway.getStatus();
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(status));
+                return;
+            }
+            if (req.url === "/discover") {
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(gateway.getServerDiscover()));
+                return;
+            }
+            if (req.method === "POST" && req.url === "/mcp") {
+                const MAX_BODY_SIZE = 10 * 1024 * 1024;
+                let body = "";
+                let size = 0;
+                let aborted = false;
+                const principalHeader = config.listen.principalHeader;
+                const transportPrincipal = principalHeader
+                    ? req.headers[principalHeader.toLowerCase()]
+                    : undefined;
+                req.on("data", (chunk) => {
+                    size += chunk.length;
+                    if (size > MAX_BODY_SIZE) {
+                        aborted = true;
+                        res.writeHead(413, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            jsonrpc: "2.0",
+                            id: null,
+                            error: { code: -32600, message: "Request body too large" },
+                        }));
+                        req.destroy();
+                        return;
+                    }
+                    body += chunk;
+                });
+                req.on("end", async () => {
+                    if (aborted)
+                        return;
+                    let requestId = null;
+                    try {
+                        const request = JSON.parse(body);
+                        requestId = request.id ?? null;
+                        const result = await handleJsonRpc(gateway, request, transportPrincipal);
+                        res.writeHead(200, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify(result));
+                    }
+                    catch (err) {
+                        res.writeHead(500, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            jsonrpc: "2.0",
+                            id: requestId,
+                            error: { code: -32603, message: String(err) },
+                        }));
+                    }
+                });
+                return;
+            }
+            res.writeHead(404);
+            res.end("Not found");
+        });
+        server.listen(config.listen.port, config.listen.host, () => {
+            console.log(`Listening on http://${config.listen.host}:${config.listen.port}`);
+        });
+        process.on("SIGINT", async () => {
+            await gateway.shutdown();
+            server.close();
+            process.exit(0);
+        });
+    }
+    else {
+        console.log("stdio transport: reading JSON-RPC from stdin");
+        const { createInterface } = await import("node:readline");
+        const rl = createInterface({ input: process.stdin });
+        for await (const line of rl) {
+            if (!line.trim())
+                continue;
+            let requestId = null;
+            try {
+                const request = JSON.parse(line);
+                requestId = request.id ?? null;
+                const result = await handleJsonRpc(gateway, request);
+                process.stdout.write(JSON.stringify(result) + "\n");
+            }
+            catch (err) {
+                process.stdout.write(JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: requestId,
+                    error: { code: -32603, message: String(err) },
+                }) + "\n");
+            }
+        }
+    }
+}
+async function verify(logPath) {
+    if (!logPath) {
+        console.error("Usage: mcp-audit-gateway verify <audit-log-path>");
+        process.exit(1);
+    }
+    const resolved = resolve(logPath);
+    const { verifyAuditLog } = await import("./attestation/verify.js");
+    const { HmacSigner, Ed25519Signer } = await import("./attestation/signer.js");
+    const { homedir } = await import("node:os");
+    const { join } = await import("node:path");
+    const configPath = process.env.GATEWAY_CONFIG ?? "gateway.config.json";
+    let signer;
+    try {
+        const content = await readFile(resolve(configPath), "utf-8");
+        const config = GatewayConfigSchema.parse(JSON.parse(content));
+        if (config.attestation.algorithm === "hmac-sha256" && config.attestation.secret) {
+            signer = new HmacSigner(config.attestation.secret);
+        }
+        else {
+            const edSigner = new Ed25519Signer(config.attestation.keyPath);
+            await edSigner.init();
+            signer = edSigner;
+        }
+    }
+    catch {
+        const wrapKeyPath = join(homedir(), ".mcp-audit", "key.hex");
+        try {
+            const keyHex = await readFile(wrapKeyPath, "utf-8");
+            signer = new HmacSigner(keyHex.trim());
+        }
+        catch {
+            console.error("Cannot find signing key. Checked gateway.config.json and ~/.mcp-audit/key.hex");
+            process.exit(1);
+        }
+    }
+    console.log(`Verifying ${resolved}...`);
+    const result = await verifyAuditLog(resolved, signer, { verifyChain: true });
+    console.log(`\nResults:`);
+    console.log(`  Total records: ${result.total}`);
+    console.log(`  Valid: ${result.valid}`);
+    console.log(`  Invalid: ${result.invalid}`);
+    if (result.errors.length > 0) {
+        console.log(`\nErrors:`);
+        for (const err of result.errors.slice(0, 20)) {
+            console.log(`  Line ${err.line} [${err.id}]: ${err.reason}`);
+        }
+        if (result.errors.length > 20) {
+            console.log(`  ... and ${result.errors.length - 20} more`);
+        }
+        process.exit(1);
+    }
+    console.log("\nAll records verified successfully.");
+}
+async function keygen(dir) {
+    const outputDir = resolve(dir ?? ".");
+    const { generateKeyPair } = await import("./attestation/keygen.js");
+    const { publicKeyPath, privateKeyPath } = await generateKeyPair(outputDir);
+    console.log(`Key pair generated:`);
+    console.log(`  Private key: ${privateKeyPath}`);
+    console.log(`  Public key:  ${publicKeyPath}`);
+    console.log(`\nAdd to gateway.config.json:`);
+    console.log(`  "attestation": { "enabled": true, "algorithm": "ed25519", "keyPath": "${privateKeyPath}" }`);
+}
+async function handleJsonRpc(gateway, request, transportPrincipal) {
+    const { id, method, params } = request;
+    const principal = transportPrincipal ?? undefined;
+    const traceContext = params?._meta?.traceContext;
+    switch (method) {
+        case "server/discover":
+            return { jsonrpc: "2.0", id, result: gateway.getServerDiscover() };
+        case "tools/list": {
+            const listResult = await gateway.handleToolsList(principal);
+            return { jsonrpc: "2.0", id, result: listResult };
+        }
+        case "tools/call": {
+            const toolName = params?.name;
+            const args = (params?.arguments ?? {});
+            try {
+                const { result, auditRecord } = await gateway.handleToolsCall(toolName, args, principal, traceContext);
+                return {
+                    jsonrpc: "2.0",
+                    id,
+                    result: {
+                        ...result,
+                        _meta: {
+                            "x-gateway-attestation/v1": {
+                                auditId: auditRecord.id,
+                                attestation: auditRecord.attestation,
+                                timestamp: auditRecord.timestamp,
+                            },
+                        },
+                    },
+                };
+            }
+            catch (err) {
+                if (err instanceof ToolCallError) {
+                    return {
+                        jsonrpc: "2.0",
+                        id,
+                        error: {
+                            code: err.code,
+                            message: err.message,
+                            data: {
+                                _meta: {
+                                    "x-gateway-attestation/v1": {
+                                        auditId: err.auditRecord.id,
+                                        attestation: err.auditRecord.attestation,
+                                        timestamp: err.auditRecord.timestamp,
+                                    },
+                                },
+                            },
+                        },
+                    };
+                }
+                throw err;
+            }
+        }
+        case "x-gateway-routing/v1/status":
+            return { jsonrpc: "2.0", id, result: gateway.getStatus() };
+        default:
+            return {
+                jsonrpc: "2.0",
+                id,
+                error: { code: -32601, message: `Method not found: ${method}` },
+            };
+    }
+}
+main().catch((err) => {
+    console.error("Fatal:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;CAeb,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,IAAI,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO;QACT;YACE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACnC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,OAAO,CAAC,CAAC;IAEvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;IAElB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACvE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAe,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,YAAY,EAAE,CAAC;IACf,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,UAAmB;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC,CAAC;IAE9D,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAErB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAClD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC7C,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAChD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;gBACvC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;gBACtD,MAAM,kBAAkB,GAAG,eAAe;oBACxC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAwB;oBACpE,CAAC,CAAC,SAAS,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACvB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;wBACzB,OAAO,GAAG,IAAI,CAAC;wBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;4BACrB,OAAO,EAAE,KAAK;4BACd,EAAE,EAAE,IAAI;4BACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE;yBAC3D,CAAC,CAAC,CAAC;wBACJ,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,OAAO;oBACT,CAAC;oBACD,IAAI,IAAI,KAAK,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;oBACvB,IAAI,OAAO;wBAAE,OAAO;oBACpB,IAAI,SAAS,GAAY,IAAI,CAAC;oBAC9B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjC,SAAS,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;wBAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;wBACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;4BACrB,OAAO,EAAE,KAAK;4BACd,EAAE,EAAE,SAAS;4BACb,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;yBAC9C,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACzD,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC9B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,SAAS,GAAY,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,SAAS,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,SAAS;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;iBAC9C,CAAC,GAAG,IAAI,CACV,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAgB;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACnE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAE9E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,qBAAqB,CAAC;IACvE,IAAI,MAAgD,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,WAAW,CAAC,SAAS,KAAK,aAAa,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7E,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAY;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACtC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAEpE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,cAAc,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,aAAa,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,2EAA2E,cAAc,KAAK,CAAC,CAAC;AAC9G,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,OAA4E,EAC5E,kBAA2B;IAE3B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,SAAS,GAAG,kBAAkB,IAAI,SAAS,CAAC;IAClD,MAAM,YAAY,GAAI,MAAM,EAAE,KAAiC,EAAE,YAEpD,CAAC;IAEd,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAErE,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACpD,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAc,CAAC;YACxC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAA4B,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC,eAAe,CAC3D,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,YAAY,CACb,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,GAAI,MAAiB;wBACrB,KAAK,EAAE;4BACL,0BAA0B,EAAE;gCAC1B,OAAO,EAAE,WAAW,CAAC,EAAE;gCACvB,WAAW,EAAE,WAAW,CAAC,WAAW;gCACpC,SAAS,EAAE,WAAW,CAAC,SAAS;6BACjC;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;oBACjC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE;wBACF,KAAK,EAAE;4BACL,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,IAAI,EAAE;gCACJ,KAAK,EAAE;oCACL,0BAA0B,EAAE;wCAC1B,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE;wCAC3B,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW;wCACxC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS;qCACrC;iCACF;6BACF;yBACF;qBACF,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,6BAA6B;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QAE7D;YACE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,EAAE;gBACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,MAAM,EAAE,EAAE;aAChE,CAAC;IACN,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { Gateway, ToolCallError } from "./proxy/gateway.js";
+export { runWrapProxy } from "./wrap/proxy.js";
+export { McpServerAdapter } from "./proxy/mcp-server-adapter.js";
+export { UpstreamManager } from "./proxy/upstream-manager.js";
+export { PolicyEngine } from "./policy/engine.js";
+export { AuditLog } from "./attestation/audit-log.js";
+export { createSigner, HmacSigner, Ed25519Signer } from "./attestation/signer.js";
+export { verifyAuditLog } from "./attestation/verify.js";
+export { generateKeyPair } from "./attestation/keygen.js";
+export { GatewayTracer } from "./telemetry/tracer.js";
+export { GatewayConfigSchema, type GatewayConfig, type UpstreamConfig, type PolicyRule, type AttestationConfig, type TelemetryConfig, type AuditRecord, type ToolEntry, type UpstreamStatus, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+export { Gateway, ToolCallError } from "./proxy/gateway.js";
+export { runWrapProxy } from "./wrap/proxy.js";
+export { McpServerAdapter } from "./proxy/mcp-server-adapter.js";
+export { UpstreamManager } from "./proxy/upstream-manager.js";
+export { PolicyEngine } from "./policy/engine.js";
+export { AuditLog } from "./attestation/audit-log.js";
+export { createSigner, HmacSigner, Ed25519Signer } from "./attestation/signer.js";
+export { verifyAuditLog } from "./attestation/verify.js";
+export { generateKeyPair } from "./attestation/keygen.js";
+export { GatewayTracer } from "./telemetry/tracer.js";
+export { GatewayConfigSchema, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,GASpB,MAAM,YAAY,CAAC"}

package/dist/integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=integration.test.d.ts.map

package/dist/integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.d.ts","sourceRoot":"","sources":["../src/integration.test.ts"],"names":[],"mappings":""}

package/dist/integration.test.js

@@ -0,0 +1,88 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { ListToolsRequestSchema, CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { Gateway } from "./proxy/gateway.js";
+import { HmacSigner } from "./attestation/signer.js";
+import { verifyAuditLog } from "./attestation/verify.js";
+import { unlink } from "node:fs/promises";
+const AUDIT_PATH = "/tmp/integration-test-audit.jsonl";
+const config = {
+    name: "test-integration",
+    version: "0.1.0",
+    listen: { transport: "streamable-http", port: 3199, host: "127.0.0.1" },
+    upstreams: [],
+    policy: {
+        defaultEffect: "allow",
+        rules: [
+            { effect: "deny", principals: ["agent:blocked"], tools: ["*/secret_*"] },
+        ],
+    },
+    attestation: { enabled: true, algorithm: "hmac-sha256", secret: "c".repeat(64), includeParams: false, includeResult: false },
+    telemetry: { enabled: false, serviceName: "test", sampleRate: 0 },
+    auditLog: { enabled: true, path: AUDIT_PATH, rotateAfterMb: 10 },
+};
+describe("Integration: Gateway with in-memory MCP server", () => {
+    afterEach(async () => {
+        try {
+            await unlink(AUDIT_PATH);
+        }
+        catch { }
+    });
+    it("routes a tool call through the gateway and produces a verifiable audit record", async () => {
+        const server = new Server({ name: "echo-server", version: "1.0.0" }, { capabilities: { tools: {} } });
+        server.setRequestHandler(ListToolsRequestSchema, async () => ({
+            tools: [
+                { name: "echo", description: "Echoes input", inputSchema: { type: "object", properties: { msg: { type: "string" } } } },
+                { name: "secret_tool", description: "Secret", inputSchema: { type: "object" } },
+            ],
+        }));
+        server.setRequestHandler(CallToolRequestSchema, async (request) => ({
+            content: [{ type: "text", text: `echo: ${request.params.arguments?.msg}` }],
+        }));
+        const gateway = new Gateway(config);
+        await gateway.init();
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        const client = new Client({ name: "test-client", version: "1.0.0" }, { capabilities: {} });
+        await server.connect(serverTransport);
+        await client.connect(clientTransport);
+        const toolsResult = await client.listTools();
+        gateway.registerUpstreamTools("echo-server", "echo", toolsResult.tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })));
+        const listed = await gateway.handleToolsList();
+        expect(listed.tools).toHaveLength(2);
+        const names = listed.tools.map((t) => t.name);
+        expect(names).toContain("echo/echo");
+        expect(names).toContain("echo/secret_tool");
+        const filteredList = await gateway.handleToolsList("agent:blocked");
+        const filteredNames = filteredList.tools.map((t) => t.name);
+        expect(filteredNames).toContain("echo/echo");
+        expect(filteredNames).not.toContain("echo/secret_tool");
+        // Make a denied call to generate an audit record
+        try {
+            await gateway.handleToolsCall("echo/secret_tool", {}, "agent:blocked");
+        }
+        catch {
+            // expected denial
+        }
+        // Make a call to unknown tool to generate another audit record
+        try {
+            await gateway.handleToolsCall("echo/nonexistent", {});
+        }
+        catch {
+            // expected
+        }
+        const signer = new HmacSigner("c".repeat(64));
+        const verifyResult = await verifyAuditLog(AUDIT_PATH, signer);
+        expect(verifyResult.total).toBe(2);
+        expect(verifyResult.valid).toBe(2);
+        expect(verifyResult.invalid).toBe(0);
+        await client.close();
+        await server.close();
+    });
+});
+//# sourceMappingURL=integration.test.js.map

package/dist/integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.js","sourceRoot":"","sources":["../src/integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAEvD,MAAM,MAAM,GAAkB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;IACvE,SAAS,EAAE,EAAE;IACb,MAAM,EAAE;QACN,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE;YACL,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;SACzE;KACF;IACD,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;IAC5H,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE;IACjE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;CACjE,CAAC;AAEF,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,sBAAsB,EACtB,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE;gBAChI,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE;aACzF;SACF,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAClB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;SAC5E,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErB,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAExD,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAErC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/policy/engine.d.ts

@@ -0,0 +1,24 @@
+import type { PolicyRule, ToolEntry } from "../types.js";
+export interface PolicyDecision {
+    allowed: boolean;
+    reason?: string;
+    rateLimit?: {
+        maxPerMinute?: number;
+        maxPerHour?: number;
+    };
+}
+export declare class PolicyEngine {
+    private defaultEffect;
+    private rules;
+    private rateLimitState;
+    constructor(defaultEffect: "allow" | "deny", rules: PolicyRule[]);
+    evaluate(principal: string | undefined, tool: ToolEntry): PolicyDecision;
+    filterTools(principal: string | undefined, tools: ToolEntry[]): ToolEntry[];
+    recordInvocation(principal: string | undefined, tool: ToolEntry): void;
+    private ruleMatches;
+    private matchesPattern;
+    private globMatch;
+    private checkRateLimit;
+    private incrementCounter;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAOD,qBAAa,YAAY;IAOrB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,KAAK;IAPf,OAAO,CAAC,cAAc,CAGpB;gBAGQ,aAAa,EAAE,OAAO,GAAG,MAAM,EAC/B,KAAK,EAAE,UAAU,EAAE;IAG7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc;IA6BxE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE;IAI3E,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAKtE,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;CAiBzB"}