@mehmoodqureshi/chrome-mcp 0.9.9 → 0.9.10

package/dist/src/cli.js

@@ -329,7 +329,9 @@ async function main() {
     // the next connection. This is what makes reconnects "just work".
     process.stdin.on('end', shutdown);
     process.stdin.on('close', shutdown);
-    await (0, server_2.startMcpServer)(version());
+    // The resolved policy shapes the advertised catalog: a capability that is off
+    // means its tools are never described to the model.
+    await (0, server_2.startMcpServer)(version(), cfg.policy);
 }
 main().catch((err) => {
     // Port-busy and bad-flag failures carry a plain-English message already

package/dist/src/mcp/server.d.ts

@@ -7,11 +7,19 @@
  * go to stderr via `logErr`.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Policy } from '../security/policy';
 export { getLogLevel, logDebug, logErr, setLogLevel } from './log';
-/** Build a fresh `Server` with the full tool surface registered (no transport). */
-export declare function createServer(version?: string): McpServer;
+/**
+ * Build a fresh `Server` with the tool surface registered (no transport).
+ *
+ * `policy` is optional: pass it and tools whose capability the policy has
+ * switched off are left out of the catalog (they could only answer
+ * POLICY_DENIED, and the catalog is re-sent on every turn). Omit it and the
+ * full catalog is advertised, which is what the tests want.
+ */
+export declare function createServer(version?: string, policy?: Policy): McpServer;
 /** Start over stdio. Idempotent. */
-export declare function startMcpServer(version?: string): Promise<void>;
+export declare function startMcpServer(version?: string, policy?: Policy): Promise<void>;
 /** Stop and release the transport. Idempotent, best-effort. */
 export declare function stopMcpServer(): Promise<void>;
 export declare function isMcpServerRunning(): boolean;

package/dist/src/mcp/server.js

@@ -30,10 +30,17 @@ const SERVER_VERSION = '0.1.0';
 const DEFAULT_VERSION = SERVER_VERSION;
 let server = null;
 let transport = null;
-/** Build a fresh `Server` with the full tool surface registered (no transport). */
-function createServer(version = DEFAULT_VERSION) {
+/**
+ * Build a fresh `Server` with the tool surface registered (no transport).
+ *
+ * `policy` is optional: pass it and tools whose capability the policy has
+ * switched off are left out of the catalog (they could only answer
+ * POLICY_DENIED, and the catalog is re-sent on every turn). Omit it and the
+ * full catalog is advertised, which is what the tests want.
+ */
+function createServer(version = DEFAULT_VERSION, policy) {
     const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, { capabilities: { tools: {} } });
-    (0, tools_1.registerTools)(srv);
+    (0, tools_1.registerTools)(srv, policy);
     // `McpServer` wraps the low-level `Server`, which owns the `onerror` hook.
     srv.server.onerror = (err) => {
         (0, log_1.logErr)(`server error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
@@ -41,12 +48,12 @@ function createServer(version = DEFAULT_VERSION) {
     return srv;
 }
 /** Start over stdio. Idempotent. */
-async function startMcpServer(version = DEFAULT_VERSION) {
+async function startMcpServer(version = DEFAULT_VERSION, policy) {
     if (server) {
         (0, log_1.logErr)('startMcpServer called but already running; ignoring.');
         return;
     }
-    const srv = createServer(version);
+    const srv = createServer(version, policy);
     const tx = new stdio_js_1.StdioServerTransport();
     try {
         await srv.connect(tx);

package/dist/src/mcp/tools.d.ts

@@ -42,6 +42,25 @@ export declare const TOOL_NAMES: readonly string[];
 export declare function setToolAllowlist(names: readonly string[] | null | undefined): void;
 /** Is `name` on the surface? True for every catalog tool when no allowlist is set. */
 export declare function isToolEnabled(name: string): boolean;
+/**
+ * Is `name` usable at all under `policy`? Undefined policy = advertise
+ * everything (tests and any caller that builds a server without one).
+ */
+export declare function isToolPolicyUsable(name: string, policy?: Policy): boolean;
+export interface DisabledCapability {
+    capability: string;
+    flag: string;
+    hiddenTools: string[];
+}
+/**
+ * Which capabilities the policy has switched off, the flag for each, and the
+ * tools that left the catalog because of it. Surfaced by `chrome_status`: once
+ * `navigate` is hidden the model cannot learn about it from a POLICY_DENIED
+ * any more, so without this it would tell the user it "can't browse" instead
+ * of naming the one flag that fixes it. Tools already cut by `--tools` are not
+ * listed, since the flag would not bring them back.
+ */
+export declare function disabledCapabilities(policy: Policy): DisabledCapability[];
 /** The names actually advertised, in catalog order. */
 export declare function enabledToolNames(): readonly string[];
 interface ToolCtx {
@@ -56,5 +75,5 @@ export declare function resetRateLimiter(): void;
 export declare function dispatchToolCall(name: string, rawArgs: unknown): Promise<CallToolResult>;
 /** Assert the catalog and the dispatch table describe the same tool set. */
 export declare function assertNoDrift(): void;
-export declare function registerTools(server: McpServer): void;
+export declare function registerTools(server: McpServer, policy?: Policy): void;
 export {};

package/dist/src/mcp/tools.js

@@ -15,6 +15,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TOOL_HANDLERS = exports.TOOL_NAMES = exports.TOOL_DEFINITIONS = void 0;
 exports.setToolAllowlist = setToolAllowlist;
 exports.isToolEnabled = isToolEnabled;
+exports.isToolPolicyUsable = isToolPolicyUsable;
+exports.disabledCapabilities = disabledCapabilities;
 exports.enabledToolNames = enabledToolNames;
 exports.setProfileBridge = setProfileBridge;
 exports.resetRateLimiter = resetRateLimiter;
@@ -27,6 +29,7 @@ const zod_1 = require("zod");
 const types_1 = require("../executor/types");
 const manager_1 = require("../executor/manager");
 const policy_1 = require("../security/policy");
+const policy_2 = require("../../shared/policy");
 const envelopes_1 = require("./envelopes");
 const limits_1 = require("./limits");
 const batch_1 = require("./batch");
@@ -183,7 +186,7 @@ exports.TOOL_DEFINITIONS = [
             tabId: tabIdField,
         },
     },
-    { name: 'chrome_status', description: 'Report backend/session status, including every paired browser profile and how it was named.', inputSchema: {} },
+    { name: 'chrome_status', description: 'Report backend/session status: paired browser profiles and how each was named, and flags for switched-off capabilities.', inputSchema: {} },
     { name: 'auth_check', description: 'Is the tab sitting on a sign-in wall? Reads the page (URL, title, password fields, sign-in controls) and returns { authRequired, confidence, signals }. Use it after a navigate, or whenever a step fails unexpectedly, to tell "the session expired" apart from "the agent got lost". Pass failOnAuthWall:true to get an [AUTH_REQUIRED] error instead of a verdict, so a harness can bucket the run as an auth failure.', inputSchema: { failOnAuthWall: authWallField, ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'profile_use', description: 'Switch the active browser profile (identity). Subsequent downloads, results, screenshots, and the action log are stored under profiles/<name>/. Resets the active task to "default" unless you then call task_new.', inputSchema: { name: zod_1.z.string().describe('Profile name (becomes a folder; sanitized to a safe path segment).') } },
     { name: 'profile_rename', description: 'Rename an automatically named browser profile (e.g. "profile-2" -> "work"). The name sticks across restarts; its saved artifacts move with it.', inputSchema: { from: zod_1.z.string().describe('Current profile name'), to: zod_1.z.string().describe('New profile name') } },
@@ -242,6 +245,141 @@ function setToolAllowlist(names) {
 function isToolEnabled(name) {
     return toolAllowlist === null || toolAllowlist.has(name);
 }
+// ---------------------------------------------------------------------------
+// Policy-dead tools (capability gates)
+// ---------------------------------------------------------------------------
+/**
+ * The wire method each tool is gated on, mirroring the `gate(ctx, ...)` call in
+ * its handler. `null` = the tool touches no page and no capability (tab listing,
+ * status, task bookkeeping, `batch` itself), so no policy can disable it.
+ *
+ * This exists so the catalog can drop tools the policy has switched off. The
+ * catalog is re-sent to the model on EVERY turn, and a tool whose capability is
+ * off can only ever answer POLICY_DENIED — so describing it is pure waste, and
+ * it also invites the model to spend a call discovering that.
+ *
+ * Kept in step with the handlers by `assertNoDrift`, which fails startup if a
+ * tool is missing an entry.
+ */
+const TOOL_GATE = {
+    // no gate — always usable
+    tabs_list: null,
+    chrome_status: null,
+    batch: null,
+    profile_use: null,
+    profile_rename: null,
+    task_new: null,
+    task_status: null,
+    tasks_list: null,
+    storage: null,
+    // tab management (mutation-gated)
+    tab_select: 'tab_select',
+    tab_new: 'tab_new',
+    tab_close: 'tab_close',
+    // navigation (mutation-gated)
+    navigate: 'navigate',
+    back: 'back',
+    forward: 'forward',
+    reload: 'reload',
+    // interaction (mutation-gated)
+    click: 'click',
+    type: 'type',
+    select_option: 'type',
+    press: 'press',
+    hover: 'hover',
+    scroll: 'scroll',
+    fill_form: 'type',
+    // reads (domain-gated only)
+    screenshot: 'screenshot',
+    get_text: 'get_text',
+    get_html: 'get_html',
+    snapshot: 'get_text',
+    get_cookies: 'get_text',
+    extract_links: 'get_text',
+    read_as_markdown: 'get_text',
+    auth_check: 'get_text',
+    wait_for: 'wait_for',
+    frames_list: 'frames_list',
+    print_pdf: 'print_pdf',
+    // capability-gated
+    eval: 'eval',
+    download_file: 'download_file',
+    upload_file: 'upload_file',
+    console_logs: 'observers',
+    network_log: 'observers',
+    dialogs: 'observers',
+};
+/**
+ * Would `method` be refused on EVERY page under this policy?
+ *
+ * Runs the REAL `evaluatePolicy` — the same function the gate and the extension
+ * router run, so this can never disagree with them — but with the domain
+ * allowlist widened to `*`. Only the capability gates (eval / downloads /
+ * uploads / observers / mutations) can then reject, which is exactly the
+ * question we want: a tool blocked merely because the current tab is off the
+ * allowlist stays advertised, since another tab may well be on it.
+ */
+function isCapabilityDenied(method, policy) {
+    return !(0, policy_2.evaluatePolicy)('https://probe.invalid/', method, { ...policy, allowDomains: ['*'] }).ok;
+}
+/**
+ * Is `name` usable at all under `policy`? Undefined policy = advertise
+ * everything (tests and any caller that builds a server without one).
+ */
+function isToolPolicyUsable(name, policy) {
+    if (!policy)
+        return true;
+    const method = TOOL_GATE[name];
+    if (!method)
+        return true;
+    return !isCapabilityDenied(method, policy);
+}
+/**
+ * The switchable capabilities, the flag that turns each on, and which wire
+ * methods it covers. `probe` is any one method it gates, fed to the real
+ * `isCapabilityDenied` so this can never disagree with the catalog filter.
+ */
+const CAPABILITIES = [
+    { capability: 'mutations', flag: '--enable-mutations', probe: 'click', covers: policy_2.isMutatingMethod },
+    { capability: 'eval', flag: '--unsafe-enable-eval', probe: 'eval', covers: (m) => m === 'eval' },
+    { capability: 'downloads', flag: '--enable-downloads', probe: 'download_file', covers: (m) => m === 'download_file' },
+    { capability: 'uploads', flag: '--enable-uploads', probe: 'upload_file', covers: (m) => m === 'upload_file' },
+    { capability: 'observers', flag: '--enable-observers', probe: 'observers', covers: (m) => m === 'observers' },
+];
+/**
+ * Which capabilities the policy has switched off, the flag for each, and the
+ * tools that left the catalog because of it. Surfaced by `chrome_status`: once
+ * `navigate` is hidden the model cannot learn about it from a POLICY_DENIED
+ * any more, so without this it would tell the user it "can't browse" instead
+ * of naming the one flag that fixes it. Tools already cut by `--tools` are not
+ * listed, since the flag would not bring them back.
+ */
+function disabledCapabilities(policy) {
+    const out = [];
+    for (const c of CAPABILITIES) {
+        if (!isCapabilityDenied(c.probe, policy))
+            continue;
+        const hiddenTools = enabledToolNames().filter((n) => {
+            const m = TOOL_GATE[n];
+            return m != null && c.covers(m);
+        });
+        if (hiddenTools.length > 0)
+            out.push({ capability: c.capability, flag: c.flag, hiddenTools });
+    }
+    return out;
+}
+/** The `chrome_status` fields describing switched-off capabilities, or nothing. */
+function capabilityStatus(policy) {
+    const off = disabledCapabilities(policy);
+    if (off.length === 0)
+        return {};
+    return {
+        disabledCapabilities: off,
+        capabilityHint: 'These tools are not available in this session because their capability is off. ' +
+            'If the user asks for one of them, tell them to add the listed flag to the chrome-mcp ' +
+            'command in their MCP config and restart the client.',
+    };
+}
 /** The names actually advertised, in catalog order. */
 function enabledToolNames() {
     return exports.TOOL_NAMES.filter(isToolEnabled);
@@ -927,11 +1065,12 @@ exports.TOOL_HANDLERS = {
             ...(path ? {} : { note: 'no active task workspace, so the PDF was not saved to disk' }),
         });
     },
-    chrome_status: async () => {
+    chrome_status: async (_a, ctx) => {
         const profiles = profileBridge ? { profiles: profileBridge.pairedProfiles() } : {};
+        const capabilities = capabilityStatus(ctx.policy);
         try {
             const ex = await (0, manager_1.getManager)().ensureReady();
-            return (0, envelopes_1.jsonResult)({ ...ex.status(), ...profiles });
+            return (0, envelopes_1.jsonResult)({ ...ex.status(), ...profiles, ...capabilities });
         }
         catch (err) {
             return (0, envelopes_1.jsonResult)({
@@ -940,6 +1079,7 @@ exports.TOOL_HANDLERS = {
                 detail: errMessage(err),
                 activeProfile: (0, workspace_1.peekActiveWorkspace)()?.profile ?? 'default',
                 ...profiles,
+                ...capabilities,
             });
         }
     },
@@ -1169,24 +1309,41 @@ function assertNoDrift() {
     for (const n of handlers)
         if (!defs.has(n))
             throw new Error(`handler "${n}" has no advertised definition`);
+    // A tool with no TOOL_GATE entry would silently be treated as always-usable,
+    // so a new tool must declare the method it gates on (or `null`) explicitly.
+    for (const n of defs) {
+        if (!(n in TOOL_GATE))
+            throw new Error(`tool "${n}" has no TOOL_GATE entry (declare its wire method, or null)`);
+    }
 }
 // ---------------------------------------------------------------------------
 // Wiring
 // ---------------------------------------------------------------------------
-function registerTools(server) {
+function registerTools(server, policy) {
     assertNoDrift();
     // Register each tool with its zod `inputSchema`. The SDK advertises it in
     // `tools/list` and validates arguments before invoking the handler, which
     // just routes back through `dispatchToolCall` — our never-throw firewall that
     // applies the rate limit, executor readiness, policy gate, and history log.
+    const policyDropped = [];
     for (const d of exports.TOOL_DEFINITIONS) {
         if (!isToolEnabled(d.name))
             continue;
+        // A tool the policy has switched off can only ever answer POLICY_DENIED.
+        // Don't pay for its schema on every turn, and don't invite a wasted call.
+        if (!isToolPolicyUsable(d.name, policy)) {
+            policyDropped.push(d.name);
+            continue;
+        }
         server.registerTool(d.name, { description: d.description, inputSchema: d.inputSchema }, async (args) => dispatchToolCall(d.name, args));
     }
     const advertised = enabledToolNames();
     if (advertised.length < exports.TOOL_NAMES.length) {
         (0, log_1.logErr)(`--tools: advertising ${advertised.length} of ${exports.TOOL_NAMES.length} tools (${advertised.join(', ')})`);
     }
+    if (policyDropped.length > 0) {
+        (0, log_1.logErr)(`policy: ${policyDropped.length} tool(s) not advertised because the capability is off ` +
+            `(${policyDropped.join(', ')}) — enable them with the matching flag to get them back.`);
+    }
 }
 //# sourceMappingURL=tools.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mehmoodqureshi/chrome-mcp",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",