@metamynd/agentsafe-mcp-guard 0.1.0 → 0.1.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@metamynd/agentsafe-mcp-guard",
-  "version": "0.1.0",
-  "description": "Zero-dependency trustless governance for the SERVICE side. An MCP server or API re-verifies a calling agent's signed request against the agent's own published policy — so an agent that ignores its own guard still cannot make your service act.",
+  "version": "0.1.2",
+  "description": "Zero-dependency trustless governance for the SERVICE side. An MCP server or API re-verifies a calling agent's signed request against the agent's own published policy \u00e2\u20ac\u201d so an agent that ignores its own guard still cannot make your service act.",
   "type": "module",
   "main": "./agentsafe-mcp-guard.mjs",
   "module": "./agentsafe-mcp-guard.mjs",
@@ -49,8 +49,13 @@
   "author": "MetaMynd",
   "license": "MIT",
   "homepage": "https://metamynd.ai/en/developers/spec",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Metamynd/agentsafe-guard.git",
+    "directory": "packages/agentsafe-mcp-guard"
+  },
   "bugs": {
-    "url": "https://metamynd.ai/en/support/contact"
+    "url": "https://github.com/Metamynd/agentsafe-guard/issues"
   },
   "publishConfig": {
     "access": "public"

package/policy-core.mjs

@@ -334,6 +334,13 @@ function constraintSatisfied(c, req) {
 function targetOf(rule, mandate) {
   return rule.target ?? mandate.target;
 }
+function isAuthorityFailure(result) {
+  return result.matched?.kind === "expiry" || result.matched?.kind === "no-permission";
+}
+function authorityFailure(mandate, target, now) {
+  const result = evaluateMandate(mandate, { target, now, values: {} });
+  return isAuthorityFailure(result) ? { ...result, decision: "block" } : null;
+}
 function evaluateMandate(mandate, req) {
   const now = toTime(req.now);
   if (mandate.validFrom && now < toTime(mandate.validFrom)) {
@@ -402,14 +409,14 @@ function evaluate(input) {
       reasonCode = code;
     }
   };
+  const m = input.mandate && input.mandateRequest ? evaluateMandate(input.mandate, input.mandateRequest) : null;
+  const authority = m !== null && isAuthorityFailure(m);
+  if (m && authority) consider(m.decision, m.reasonCode);
   const std = evaluateBoundStandards(input.standards ?? [], input.context);
   if (std.decision !== "allow") consider(std.decision, std.reasonCode ?? "STANDARD_RULE");
   const sop = evaluateBoundStandards(input.sops ?? [], input.context);
   if (sop.decision !== "allow") consider(sop.decision, sop.reasonCode ?? "SOP_RULE");
-  if (input.mandate && input.mandateRequest) {
-    const m = evaluateMandate(input.mandate, input.mandateRequest);
-    if (m.decision !== "allow") consider(m.decision, m.reasonCode);
-  }
+  if (m && !authority && m.decision !== "allow") consider(m.decision, m.reasonCode);
   return { decision, reasonCode, authorizationId: null, remaining: null, proofRef: null };
 }
 
@@ -472,12 +479,14 @@ export {
   applyHold,
   applySignedLast,
   asOperatingMode,
+  authorityFailure,
   buildAuthMessage,
   canAuthorize,
   evaluate,
   evaluateBoundStandards,
   evaluateMandate,
   evaluateStandardRules,
+  isAuthorityFailure,
   isOperatingMode,
   moleculeFires,
   moreRestrictive,