@metamynd/agentsafe-mcp-guard 0.3.3 → 0.3.5

package/README.md

@@ -80,6 +80,25 @@ server time, a pre-signing window rather than ordinary clock skew. `issuedAt` ma
 to the freshness window (network/processing delay) but lead by no more than 30 seconds (clock
 skew only).
 
+**0.3.4 — a mandate's currency check no longer lets a PROHIBITION be dodged by relabeling
+the currency.** A payAmount/cumulativeSpend constraint issued with a `unit` (currency) is
+only satisfied in that currency — correct for a PERMISSION (fail closed to deny on a
+mismatch), but a prohibition only fires when every one of its own constraints is satisfied,
+so the identical "mismatch → not satisfied" rule let a prohibition like `payAmount gteq 1000
+unit USD` be silently skipped by declaring any other currency, including a mere case
+difference (`'usd'` vs `'USD'`). The currency comparison is also now case-insensitive.
+
+**0.3.5 — a degraded claim now warns instead of only being silently tolerated.**
+`claimAuthorization()`'s per-field cross-checks each skip when the issuer's claim response
+omits that field — a deliberate, documented rolling-upgrade tolerance for a Service pinned
+against an older backend whose response predates one of these fields existing at all. That
+tolerance was never meant to also mask a REGRESSION on an otherwise-current backend: this
+version logs (`console.warn`) whenever a value-bearing request's claim response omits
+`agentDid`/`amount`/`currency`, or a request that signed a real `merchant` gets a claim
+response that omits it — the one place a future backend change could quietly re-open the
+confused-deputy gap this check exists to close, with nothing else here able to notice. The
+decision is unchanged (still tolerated, not blocked) — this is visibility, not a new refusal.
+
 ### Replay and cumulative spend (`requireAuthorization`)
 
 Re-evaluating policy per request (above) proves the request is well-formed and in-policy — it

package/agentsafe-mcp-guard.mjs

@@ -229,7 +229,19 @@ export function createMcpGuard({ serviceDid, serviceKey, issuerApi, fetchBundle,
         if (!claim.claimed) return { decision: 'block', reasonCode: claim.reasonCode };
         // The claim alone only proves SOME real, unclaimed authorization exists — it must also
         // be FOR this agent and these exact values, or a cheap legitimate hold's id could be
-        // presented to unlock a completely different, more expensive execution.
+        // presented to unlock a completely different, more expensive execution. Each check is
+        // skipped when the claim response omits that field — tolerated for a Service pinned
+        // against an older, not-yet-migrated issuer whose response predates the field (see
+        // backend markEffect()'s own note) — but a value-bearing request with a real signed
+        // amount/merchant omitted from the claim is exactly the "field genuinely absent vs.
+        // issuer regressed" ambiguity that note warns about, so it's surfaced rather than
+        // silently trusted: this is the ONE place a future backend change could quietly
+        // re-open the confused-deputy gap this claim exists to close, and nothing else here
+        // would notice.
+        if (claim.agentDid === undefined) console.warn('[mcp-guard] claim response omitted agentDid — binding degraded to "some valid unclaimed authorization exists"');
+        if (Number(amount) > 0 && claim.amount === undefined) console.warn('[mcp-guard] claim response omitted amount for a value-bearing request — amount binding degraded');
+        if (Number(amount) > 0 && claim.currency === undefined) console.warn('[mcp-guard] claim response omitted currency for a value-bearing request — currency binding degraded');
+        if (merchant && claim.merchant === undefined) console.warn('[mcp-guard] claim response omitted merchant for a request that signed one — merchant binding degraded');
         if (claim.agentDid !== undefined && claim.agentDid !== agentDid) return { decision: 'block', reasonCode: 'AUTHORIZATION_AGENT_MISMATCH' };
         if (claim.amount !== undefined && Number(claim.amount) !== Number(amount)) return { decision: 'block', reasonCode: 'AUTHORIZATION_AMOUNT_MISMATCH' };
         if (claim.currency !== undefined && claim.currency !== currency) return { decision: 'block', reasonCode: 'AUTHORIZATION_CURRENCY_MISMATCH' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-mcp-guard",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Zero-dependency trustless governance for the SERVICE side. An MCP server or API re-verifies a calling agent's signed request against the agent's own published policy \u00e2\u20ac\u201d so an agent that ignores its own guard still cannot make your service act.",
   "type": "module",
   "main": "./agentsafe-mcp-guard.mjs",

package/policy-core.mjs

@@ -351,13 +351,14 @@ function reasonFor(constraint) {
   if (!constraint) return "CONSTRAINT_FAILED";
   return REASON_BY_OPERAND[constraint.leftOperand] ?? `CONSTRAINT_FAILED:${constraint.leftOperand}`;
 }
-function constraintSatisfied(c, req) {
+function constraintSatisfied(c, req, strict) {
   const op = OPERATORS[c.operator];
   if (!op) return false;
   const left = Object.prototype.hasOwnProperty.call(req.values, c.leftOperand) ? req.values[c.leftOperand] : void 0;
-  if (!op(left, c.rightOperand)) return false;
-  if (c.unit && req.values["mm:currency"] !== c.unit) return false;
-  return true;
+  if (!c.unit) return op(left, c.rightOperand);
+  const currency = req.values["mm:currency"];
+  const unitMatches = typeof currency === "string" && currency.toUpperCase() === c.unit.toUpperCase();
+  return unitMatches ? op(left, c.rightOperand) : !strict;
 }
 function targetOf(rule, mandate) {
   return rule.target ?? mandate.target;
@@ -379,7 +380,7 @@ function evaluateMandate(mandate, req) {
   }
   for (const p of mandate.prohibition ?? []) {
     if (targetOf(p, mandate) !== req.target) continue;
-    const fires = (p.constraint ?? []).every((c) => constraintSatisfied(c, req));
+    const fires = (p.constraint ?? []).every((c) => constraintSatisfied(c, req, false));
     if (fires) {
       return {
         decision: p.enforcement ?? "block",
@@ -397,10 +398,10 @@ function evaluateMandate(mandate, req) {
     };
   }
   for (const p of perms) {
-    const failing = (p.constraint ?? []).find((c) => !constraintSatisfied(c, req));
+    const failing = (p.constraint ?? []).find((c) => !constraintSatisfied(c, req, true));
     if (!failing) return { decision: "allow", reasonCode: "AUTHORIZED" };
   }
-  const firstFail = (perms[0].constraint ?? []).find((c) => !constraintSatisfied(c, req));
+  const firstFail = (perms[0].constraint ?? []).find((c) => !constraintSatisfied(c, req, true));
   return {
     decision: firstFail?.onFail ?? "block",
     reasonCode: reasonFor(firstFail),