@mneme-ai/mcp 1.17.5 → 1.18.0

package/dist/mcp_primitives/resources.js

@@ -0,0 +1,112 @@
+/**
+ * MCP `resources` primitive — Mneme exposes 5 read-only views agents can
+ * fetch (and, eventually, subscribe to for change notifications):
+ *
+ *   • mneme://constitution                 — repo's auto-synthesized rules
+ *   • mneme://catalog                       — full tool catalog (JSON)
+ *   • mneme://catalog/{category}            — one category of tools
+ *   • mneme://atrophy/heatmap               — current atrophy snapshot
+ *   • mneme://passport/{email}              — engineer dossier
+ *   • mneme://chronicle/latest              — latest chaptered narrative
+ *   • mneme://aletheia/karma                — public tool reputation ledger
+ *
+ * v1.18.0 ships static / on-demand resources. Subscriptions + push updates
+ * (Mneme Whisper) land in v1.19.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { buildAllTools, groupByCategory } from "../tools/_registry.js";
+const STATIC_RESOURCES = [
+    {
+        uri: "mneme://catalog",
+        name: "Mneme tool catalog (full)",
+        mimeType: "application/json",
+        description: "Every Mneme tool: name, category, description, contract fields. Same data mneme.capabilities returns.",
+    },
+    {
+        uri: "mneme://constitution",
+        name: "Repo constitution (auto-synthesized rules)",
+        mimeType: "text/markdown",
+        description: "The rule library Mneme infers from this repo's regrets, atrophy, and security history.",
+    },
+    {
+        uri: "mneme://aletheia/karma",
+        name: "ALETHEIA tool reputation ledger",
+        mimeType: "application/json",
+        description: "Per-tool karma score (verified +1, hallucination -3, fuzz hit -2). Public + auditable.",
+    },
+];
+export function listResources(rt) {
+    const out = [...STATIC_RESOURCES];
+    for (const cat of groupByCategory().keys()) {
+        out.push({
+            uri: `mneme://catalog/${cat}`,
+            name: `Mneme tool catalog — ${cat}`,
+            mimeType: "application/json",
+            description: `Tools in the ${cat} category.`,
+        });
+    }
+    // Per-passport resources are listed lazily — listing every author would
+    // bloat the catalog. Agents fetch via mneme://passport/{email} directly.
+    out.push({
+        uri: "mneme://passport/{email}",
+        name: "Engineer passport (template URI)",
+        mimeType: "application/json",
+        description: "Replace {email} with an author's email to fetch their dossier (DNA + expertise + telepathy + influence + atrophy).",
+    });
+    // Suppress unused-runtime warning at compile time — kept for future use.
+    void rt;
+    return out;
+}
+export function readResource(rt, uri) {
+    if (uri === "mneme://catalog") {
+        const all = buildAllTools().map((t) => ({
+            name: t.name,
+            category: t.category,
+            description: t.description,
+            whenToUse: t.whenToUse ?? null,
+            inputSchema: t.inputSchema,
+            outputSchema: t.outputSchema ?? null,
+        }));
+        return { uri, mimeType: "application/json", text: JSON.stringify(all, null, 2) };
+    }
+    if (uri.startsWith("mneme://catalog/")) {
+        const cat = uri.slice("mneme://catalog/".length);
+        const tools = (groupByCategory().get(cat) ?? []).map((t) => ({
+            name: t.name,
+            description: t.description,
+            whenToUse: t.whenToUse ?? null,
+        }));
+        return { uri, mimeType: "application/json", text: JSON.stringify(tools, null, 2) };
+    }
+    if (uri === "mneme://constitution") {
+        const path = join(rt.meta.rootPath, ".mneme", "constitution.md");
+        if (existsSync(path)) {
+            return { uri, mimeType: "text/markdown", text: readFileSync(path, "utf8") };
+        }
+        return {
+            uri,
+            mimeType: "text/markdown",
+            text: "# Constitution not yet synthesized\n\n" +
+                "Run `mneme constitution synth` to derive a rule library from this repo's history.",
+        };
+    }
+    if (uri === "mneme://aletheia/karma") {
+        const path = join(rt.meta.rootPath, ".mneme", "aletheia", "karma.json");
+        if (existsSync(path)) {
+            return { uri, mimeType: "application/json", text: readFileSync(path, "utf8") };
+        }
+        return { uri, mimeType: "application/json", text: JSON.stringify({ tools: {} }, null, 2) };
+    }
+    if (uri.startsWith("mneme://passport/")) {
+        return {
+            uri,
+            mimeType: "application/json",
+            text: JSON.stringify({
+                note: "Passport resources are fetched on-demand from the index. Use the mneme.people.passport tool with the author's email — this URI is a placeholder for v1.19+ live binding.",
+            }, null, 2),
+        };
+    }
+    throw new Error(`unknown resource URI: ${uri}`);
+}
+//# sourceMappingURL=resources.js.map

package/dist/mcp_primitives/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/mcp_primitives/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAgBvE,MAAM,gBAAgB,GAA0B;IAC9C;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,uGAAuG;KACrH;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,IAAI,EAAE,4CAA4C;QAClD,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,wFAAwF;KACtG;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,wFAAwF;KACtG;CACF,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,EAAe;IAC3C,MAAM,GAAG,GAA0B,CAAC,GAAG,gBAAgB,CAAC,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,mBAAmB,GAAG,EAAE;YAC7B,IAAI,EAAE,wBAAwB,GAAG,EAAE;YACnC,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,gBAAgB,GAAG,YAAY;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,IAAI,CAAC;QACP,GAAG,EAAE,0BAA0B;QAC/B,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,oHAAoH;KAClI,CAAC,CAAC;IACH,yEAAyE;IACzE,KAAK,EAAE,CAAC;IACR,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAe,EAAE,GAAW;IACvD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;SACrC,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,GAAY,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;SAC/B,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,eAAe;YACzB,IAAI,EACF,wCAAwC;gBACxC,mFAAmF;SACtF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;gBACE,IAAI,EACF,0KAA0K;aAC7K,EACD,IAAI,EACJ,CAAC,CACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/tools/_aletheia.d.ts

@@ -0,0 +1,82 @@
+/**
+ * ALETHEIA — open MCP security framework, reference impl in Mneme.
+ * (Greek ἀλήθεια — "the state of not being hidden, disclosure, truth".
+ * Pairs with Mneme/Memory: Memory + Truth = MCP defense.)
+ *
+ * Inspired by the Equixly assessment showing 43% of MCP servers have
+ * command-injection holes, 30% have SSRF, 22% allow arbitrary file
+ * access. Mneme adopts a biological-immune-system metaphor — atom and
+ * molecule architecture lets us EVOLVE defenses, not hard-code them.
+ *
+ * The ALETHEIA spec is intentionally portable. Other MCP server
+ * implementations can adopt the same tool names + semantics + response
+ * shapes; clients then get one consistent security surface across
+ * vendors. v1.18.0 ships:
+ *
+ *   • mneme.aletheia.honeypot       — register decoy "admin" tools any
+ *                                     legitimate AI would never call. ANY
+ *                                     call is logged + treated as attacker.
+ *   • mneme.aletheia.immune.scan    — Bayesian anomaly scan of recent calls
+ *                                     against the learned "normal" profile.
+ *   • mneme.aletheia.immune.train   — record a baseline of normal arg shapes
+ *                                     for future anomaly detection.
+ *   • mneme.aletheia.lint           — actively scan tool input args for
+ *                                     command injection, SSRF, path
+ *                                     traversal, and arbitrary-file-access
+ *                                     attempts (returns findings without
+ *                                     blocking — defense in depth, not
+ *                                     replacement of input validation).
+ *
+ * Honeypot tools live in the registry like any other tool but their
+ * handlers ALWAYS emit an alert + return a fake-but-plausible response
+ * to waste an attacker's time.
+ *
+ * The training data lives in `.mneme/immune/profile.json` — argument
+ * shape fingerprints + frequency, per tool. New calls compute a posterior:
+ *   P(legit | shape) = P(shape | legit) × P(legit) / P(shape)
+ * with Laplace smoothing. Posterior < 0.05 → ALERT (anomalous).
+ */
+import type { MnemeTool } from "./_types.js";
+/** Compute a stable shape fingerprint of an argument value — the SHAPE
+ *  (types, lengths, key sets) without the actual content. Two calls with
+ *  the same shape but different content produce the same fingerprint. */
+export declare function shapeFingerprint(value: unknown): string;
+export interface SecurityFinding {
+    kind: "command-injection" | "ssrf" | "path-traversal" | "file-access" | "secret-leak";
+    severity: "low" | "medium" | "high" | "critical";
+    tool: string;
+    argPath: string;
+    match: string;
+    remediation: string;
+}
+export declare function lintArgValue(value: unknown, toolName: string, argPath?: string): SecurityFinding[];
+interface ImmuneProfile {
+    /** tool → fingerprint → count */
+    shapes: Record<string, Record<string, number>>;
+    /** tool → total observations */
+    totals: Record<string, number>;
+    trainedAt?: string;
+}
+export declare function readProfile(repoRoot: string): ImmuneProfile;
+export declare function writeProfile(repoRoot: string, p: ImmuneProfile): void;
+/** Update the profile with a new observation. Idempotent + best-effort. */
+export declare function recordObservation(repoRoot: string, tool: string, args: unknown): void;
+/** Bayesian posterior P(legit | observed shape) using Laplace smoothing.
+ *  Returns 1.0 for completely-trusted shapes, drops toward 0 for novel ones. */
+export declare function posteriorLegit(profile: ImmuneProfile, tool: string, args: unknown): number;
+export declare function logAlert(repoRoot: string, alert: Record<string, unknown>): void;
+export declare function readAlerts(repoRoot: string, limit?: number): Array<Record<string, unknown>>;
+export declare const honeypotTools: MnemeTool[];
+export declare const securityLintTool: MnemeTool;
+export declare const immuneScanTool: MnemeTool;
+export declare const immuneTrainTool: MnemeTool;
+export declare const immuneAlertsTool: MnemeTool;
+export type KarmaEvent = "verified" | "partially_verified" | "hallucination" | "fuzz-hit" | "invocation";
+/** Apply a karma event to a tool. Best-effort. Returns the new karma. */
+export declare function recordKarmaEvent(repoRoot: string, tool: string, event: KarmaEvent): number;
+export declare const aletheiaKarmaTool: MnemeTool;
+export declare const aletheiaFuzzTool: MnemeTool;
+/** Real (non-honeypot) ALETHEIA tools. */
+export declare const aletheiaTools: MnemeTool[];
+export {};
+//# sourceMappingURL=_aletheia.d.ts.map

package/dist/tools/_aletheia.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_aletheia.d.ts","sourceRoot":"","sources":["../../src/tools/_aletheia.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAS7C;;yEAEyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGvD;AAyBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,gBAAgB,GAAG,aAAa,GAAG,aAAa,CAAC;IACtF,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAgBD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,SAAM,GAAG,eAAe,EAAE,CAiE/F;AAID,UAAU,aAAa;IACrB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAQD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAQ3D;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,GAAG,IAAI,CAGrE;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAYrF;AAED;gFACgF;AAChF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAQ1F;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ/E;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAcxF;AAqCD,eAAO,MAAM,aAAa,EAAE,SAAS,EAMpC,CAAC;AAIF,eAAO,MAAM,gBAAgB,EAAE,SA8D9B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,SA6E5B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,SAyD7B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,SA8C9B,CAAC;AAwCF,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,oBAAoB,GAAG,eAAe,GAAG,UAAU,GAAG,YAAY,CAAC;AAUzG,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAyB1F;AAED,eAAO,MAAM,iBAAiB,EAAE,SAiE/B,CAAC;AA0DF,eAAO,MAAM,gBAAgB,EAAE,SA+H9B,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,aAAa,EAAE,SAAS,EAOpC,CAAC"}