@mcp-ts/sdk 2.4.5 → 2.5.0

package/src/server/storage/tool-policy.ts

@@ -0,0 +1,89 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { ToolPolicy } from './types.js';
+
+export type ToolPolicyInput = {
+    mode?: unknown;
+    toolIds?: unknown;
+    updatedAt?: unknown;
+} | null | undefined;
+
+export function createToolId(serverId: string, toolName: string): string {
+    return `${serverId}::${toolName}`;
+}
+
+function normalizeToolIds(input?: unknown): string[] {
+    if (!Array.isArray(input)) return [];
+
+    return Array.from(new Set(
+        input
+            .filter((id): id is string => typeof id === 'string')
+            .map((id) => id.trim())
+            .filter(Boolean)
+    ));
+}
+
+export function normalizeToolPolicy(input?: ToolPolicyInput, now = Date.now()): ToolPolicy | undefined {
+    if (!input || typeof input !== 'object') {
+        return undefined;
+    }
+
+    const mode = input.mode === 'allowlist' || input.mode === 'denylist'
+        ? input.mode
+        : 'all';
+    const updatedAt = typeof input.updatedAt === 'number' && Number.isFinite(input.updatedAt)
+        ? input.updatedAt
+        : now;
+
+    if (mode === 'all') {
+        return { mode: 'all', toolIds: [], updatedAt };
+    }
+
+    return { mode, toolIds: normalizeToolIds(input.toolIds), updatedAt };
+}
+
+export function normalizeToolPolicyForUpdate(input: ToolPolicyInput, now = Date.now()): ToolPolicy {
+    return normalizeToolPolicy(input, now) ?? { mode: 'all', toolIds: [], updatedAt: now };
+}
+
+export function isToolAllowed(policy: ToolPolicy | undefined, toolName: string, serverId?: string): boolean {
+    if (!policy || policy.mode === 'all') return true;
+    if (!serverId) return false;
+
+    const toolId = createToolId(serverId, toolName);
+    if (policy.mode === 'allowlist') {
+        return policy.toolIds.includes(toolId);
+    }
+
+    return !policy.toolIds.includes(toolId);
+}
+
+export function assertToolAllowed(policy: ToolPolicy | undefined, toolName: string, serverId?: string): void {
+    if (isToolAllowed(policy, toolName, serverId)) return;
+    throw new Error(`Tool "${toolName}" is not allowed for this MCP session`);
+}
+
+export function filterToolsByPolicy<T extends Pick<Tool, 'name'>>(
+    tools: T[],
+    policy: ToolPolicy | undefined,
+    serverId?: string
+): T[] {
+    if (!policy || policy.mode === 'all') return tools;
+    return tools.filter((tool) => isToolAllowed(policy, tool.name, serverId));
+}
+
+export function validateToolPolicyAgainstTools(
+    policy: ToolPolicy,
+    tools: Array<Pick<Tool, 'name'>>,
+    serverId?: string
+): void {
+    if (policy.mode === 'all') return;
+    if (!serverId) {
+        throw new Error('Cannot validate MCP tool policy without a serverId');
+    }
+
+    const availableIds = new Set(tools.map((tool) => createToolId(serverId, tool.name)));
+    const unknownIds = policy.toolIds.filter((id) => !availableIds.has(id));
+    if (unknownIds.length > 0) {
+        throw new Error(`Unknown tool id(s) for this MCP session: ${unknownIds.join(', ')}`);
+    }
+}

package/src/server/storage/types.ts

@@ -14,6 +14,14 @@ export interface OAuthState {
 
 export type SessionStatus = 'pending' | 'active';
 
+export type ToolPolicyMode = 'all' | 'allowlist' | 'denylist';
+
+export interface ToolPolicy {
+    mode: ToolPolicyMode;
+    toolIds: string[];
+    updatedAt: number;
+}
+
 export interface Session {
     sessionId: string;
     serverId?: string; // Database server ID for mapping
@@ -37,6 +45,7 @@ export interface Session {
      * - active: restorable session after successful connection/auth completion
      */
     status?: SessionStatus;
+    toolPolicy?: ToolPolicy;
 }
 
 export interface SessionCredentials {
@@ -158,3 +167,5 @@ export interface SessionStore {
      */
     disconnect(): Promise<void>;
 }
+
+

package/src/shared/types.ts

@@ -21,6 +21,7 @@ export interface ToolClient {
   callTool(name: string, args: Record<string, unknown>): Promise<any>;
   getServerId?(): string | undefined;
   getServerName?(): string | undefined;
+  getServerUrl?(): string | undefined;
   getSessionId?(): string;
 }
 
@@ -169,6 +170,13 @@ export type ToolInfo = {
 // Transport type
 export type TransportType = 'sse' | 'streamable-http';
 export type SessionStatus = 'pending' | 'active';
+export type ToolPolicyMode = 'all' | 'allowlist' | 'denylist';
+
+export interface ToolPolicy {
+  mode: ToolPolicyMode;
+  toolIds: string[];
+  updatedAt: number;
+}
 
 // SSE/RPC types
 export type McpRpcMethod =
@@ -182,7 +190,9 @@ export type McpRpcMethod =
   | 'listPrompts'
   | 'getPrompt'
   | 'listResources'
-  | 'readResource';
+  | 'readResource'
+  | 'setToolPolicy'
+  | 'getToolPolicy';
 
 export interface McpRpcRequest {
   id: string;
@@ -239,6 +249,18 @@ export interface FinishAuthParams {
   code: string;
 }
 
+export interface SetToolPolicyParams {
+  sessionId: string;
+  toolPolicy: {
+    mode: ToolPolicyMode;
+    toolIds?: string[];
+  };
+}
+
+export interface GetToolPolicyParams {
+  sessionId: string;
+}
+
 export type McpRpcParams =
   | ConnectParams
   | DisconnectParams
@@ -247,6 +269,8 @@ export type McpRpcParams =
   | GetPromptParams
   | ReadResourceParams
   | FinishAuthParams
+  | SetToolPolicyParams
+  | GetToolPolicyParams
   | undefined;
 
 // RPC Result Types
@@ -263,6 +287,7 @@ export interface SessionInfo {
    * `pending` means auth is in progress and should be resumed explicitly by user action.
    */
   status: SessionStatus;
+  toolPolicy?: ToolPolicy;
 }
 
 export interface SessionListResult {
@@ -292,6 +317,25 @@ export interface ListToolsRpcResult {
   tools: Tool[];
 }
 
+export interface SetToolPolicyResult {
+  success: boolean;
+  toolPolicy: ToolPolicy;
+  tools: Tool[];
+  toolCount: number;
+}
+
+export type ToolAccessInfo = Tool & {
+  toolId: string;
+  allowed: boolean;
+};
+
+export interface GetToolPolicyResult {
+  toolPolicy: ToolPolicy;
+  tools: ToolAccessInfo[];
+  toolCount: number;
+  allowedToolCount: number;
+}
+
 export interface ListPromptsResult {
   prompts: Array<{
     name: string;
@@ -314,3 +358,6 @@ export interface ListResourcesResult {
 }
 
 export type { CallToolResult };
+
+
+