@mondaydotcomorg/atp-server 0.19.10 → 0.19.11

package/dist/search/index.d.ts

@@ -4,6 +4,7 @@ import type { SearchOptions, SearchResult, APIGroupConfig, AuthProvider, ScopeFi
  */
 export declare class SearchEngine {
     private index;
+    private apiGroups;
     /**
      * Creates a new SearchEngine instance.
      * @param apiGroups - Array of API group configurations to index
@@ -16,6 +17,7 @@ export declare class SearchEngine {
     private buildIndex;
     /**
      * Searches for API functions matching the query.
+     * Tool rules are automatically applied from the request scope.
      * @param options - Search options including query and filters
      * @param userId - Optional user ID for scope filtering
      * @param authProvider - Optional auth provider for checking user scopes

package/dist/search/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,MAAM,+BAA+B,CAAC;AAevC;;GAEG;AACH,qBAAa,YAAY;IACxB,OAAO,CAAC,KAAK,CAAyB;IAEtC;;;OAGG;gBACS,SAAS,CAAC,EAAE,cAAc,EAAE;IAMxC;;;OAGG;IACH,OAAO,CAAC,UAAU;IA0BlB;;;;;;;OAOG;IACG,MAAM,CACX,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,YAAY,EAC3B,oBAAoB,CAAC,EAAE,oBAAoB,GACzC,OAAO,CAAC,YAAY,EAAE,CAAC;IA+D1B;;;;;;;OAOG;YACW,WAAW;IAiCzB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAazB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,MAAM,+BAA+B,CAAC;AAgBvC;;GAEG;AACH,qBAAa,YAAY;IACxB,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,SAAS,CAAwB;IAEzC;;;OAGG;gBACS,SAAS,CAAC,EAAE,cAAc,EAAE;IAOxC;;;OAGG;IACH,OAAO,CAAC,UAAU;IA0BlB;;;;;;;;OAQG;IACG,MAAM,CACX,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,YAAY,EAC3B,oBAAoB,CAAC,EAAE,oBAAoB,GACzC,OAAO,CAAC,YAAY,EAAE,CAAC;IA6E1B;;;;;;;OAOG;YACW,WAAW;IAiCzB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAazB"}

package/dist/search/index.js

@@ -1,14 +1,17 @@
+import { filterApiGroups } from '../core/request-scope.js';
 /**
  * SearchEngine provides semantic and keyword-based search over available API functions.
  */
 export class SearchEngine {
     index = [];
+    apiGroups = [];
     /**
      * Creates a new SearchEngine instance.
      * @param apiGroups - Array of API group configurations to index
      */
     constructor(apiGroups) {
         if (apiGroups) {
+            this.apiGroups = apiGroups;
             this.buildIndex(apiGroups);
         }
     }
@@ -41,6 +44,7 @@ export class SearchEngine {
     }
     /**
      * Searches for API functions matching the query.
+     * Tool rules are automatically applied from the request scope.
      * @param options - Search options including query and filters
      * @param userId - Optional user ID for scope filtering
      * @param authProvider - Optional auth provider for checking user scopes
@@ -48,9 +52,21 @@ export class SearchEngine {
      * @returns Array of search results sorted by relevance
      */
     async search(options, userId, authProvider, scopeFilteringConfig) {
+        const allowedGroups = filterApiGroups(this.apiGroups);
+        const allowedTools = new Set();
+        for (const group of allowedGroups) {
+            if (group.functions) {
+                for (const func of group.functions) {
+                    allowedTools.add(`${group.name}:${func.name}`);
+                }
+            }
+        }
         const queryWords = this.extractKeywords(options.query);
         const results = [];
         for (const item of this.index) {
+            if (!allowedTools.has(`${item.apiGroup}:${item.functionName}`)) {
+                continue;
+            }
             if (options.apiGroups && !options.apiGroups.includes(item.apiGroup)) {
                 continue;
             }

package/dist/search/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAqBA;;GAEG;AACH,MAAM,OAAO,YAAY;IAChB,KAAK,GAAsB,EAAE,CAAC;IAEtC;;;OAGG;IACH,YAAY,SAA4B;QACvC,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,SAA2B;QAC7C,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAEhB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;oBAE/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBACf,QAAQ,EAAE,KAAK,CAAC,IAAI;wBACpB,YAAY,EAAE,IAAI,CAAC,IAAI;wBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,SAAS;wBACT,QAAQ;wBACR,QAAQ,EAAE;4BACT,cAAc,EAAE,IAAI,CAAC,cAAc;4BACnC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa;4BAClC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM;yBACzB;qBACD,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACX,OAAsB,EACtB,MAAe,EACf,YAA2B,EAC3B,oBAA2C;QAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAmD,EAAE,CAAC;QAEnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,SAAS;YACV,CAAC;YAED,IAAI,oBAAoB,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAC3C,IAAI,EACJ,MAAM,EACN,YAAY,EACZ,oBAAoB,CACpB,CAAC;gBACF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpB,SAAS;gBACV,CAAC;YACF,CAAC;YAED,IAAI,KAAK,GAAG,CAAC,CAAC;YAEd,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC1E,KAAK,IAAI,GAAG,CAAC;YACd,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC3E,KAAK,IAAI,EAAE,CAAC;YACb,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,KAAK,IAAI,EAAE,CAAC;gBACb,CAAC;gBACD,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;YACF,CAAC;YAED,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE;wBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE,KAAK;qBACrB;oBACD,KAAK;iBACL,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACxB,IAAqB,EACrB,MAA0B,EAC1B,YAAsC,EACtC,MAA4B;QAE5B,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAEzC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;YACpC,CAAC;YAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEvF,OAAO,YAAY,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QACpC,CAAC;IACF,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,IAAY;QACnC,OAAO,IAAI;aACT,WAAW,EAAE;aACb,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,IAGzB;QACA,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,GAAG,KAA0B,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;CACD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D;;GAEG;AACH,MAAM,OAAO,YAAY;IAChB,KAAK,GAAsB,EAAE,CAAC;IAC9B,SAAS,GAAqB,EAAE,CAAC;IAEzC;;;OAGG;IACH,YAAY,SAA4B;QACvC,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,SAA2B;QAC7C,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAEhB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;oBAE/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBACf,QAAQ,EAAE,KAAK,CAAC,IAAI;wBACpB,YAAY,EAAE,IAAI,CAAC,IAAI;wBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,SAAS;wBACT,QAAQ;wBACR,QAAQ,EAAE;4BACT,cAAc,EAAE,IAAI,CAAC,cAAc;4BACnC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa;4BAClC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM;yBACzB;qBACD,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACX,OAAsB,EACtB,MAAe,EACf,YAA2B,EAC3B,oBAA2C;QAE3C,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBACpC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAmD,EAAE,CAAC;QAEnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;gBAChE,SAAS;YACV,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,SAAS;YACV,CAAC;YAED,IAAI,oBAAoB,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAC3C,IAAI,EACJ,MAAM,EACN,YAAY,EACZ,oBAAoB,CACpB,CAAC;gBACF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpB,SAAS;gBACV,CAAC;YACF,CAAC;YAED,IAAI,KAAK,GAAG,CAAC,CAAC;YAEd,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC1E,KAAK,IAAI,GAAG,CAAC;YACd,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC3E,KAAK,IAAI,EAAE,CAAC;YACb,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,KAAK,IAAI,EAAE,CAAC;gBACb,CAAC;gBACD,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;YACF,CAAC;YAED,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE;wBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE,KAAK;qBACrB;oBACD,KAAK;iBACL,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACxB,IAAqB,EACrB,MAA0B,EAC1B,YAAsC,EACtC,MAA4B;QAE5B,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAEzC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;YACpC,CAAC;YAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEvF,OAAO,YAAY,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QACpC,CAAC;IACF,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,IAAY;QACnC,OAAO,IAAI;aACT,WAAW,EAAE;aACb,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,IAGzB;QACA,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,GAAG,KAA0B,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mondaydotcomorg/atp-server",
-	"version": "0.19.10",
+	"version": "0.19.11",
 	"description": "Server implementation for Agent Tool Protocol",
 	"type": "module",
 	"main": "./dist/index.cjs",
@@ -49,11 +49,11 @@
 		"@babel/parser": "^7.26.0",
 		"@babel/traverse": "^7.26.0",
 		"@babel/types": "^7.26.0",
-		"@mondaydotcomorg/atp-compiler": "0.19.10",
-		"@mondaydotcomorg/atp-protocol": "0.19.9",
-		"@mondaydotcomorg/atp-provenance": "0.19.8",
-		"@mondaydotcomorg/atp-providers": "0.19.9",
-		"@mondaydotcomorg/atp-runtime": "0.19.8",
+		"@mondaydotcomorg/atp-compiler": "0.19.11",
+		"@mondaydotcomorg/atp-protocol": "0.19.10",
+		"@mondaydotcomorg/atp-provenance": "0.19.9",
+		"@mondaydotcomorg/atp-providers": "0.19.10",
+		"@mondaydotcomorg/atp-runtime": "0.19.9",
 		"@opentelemetry/api": "^1.9.0",
 		"@opentelemetry/auto-instrumentations-node": "^0.66.0",
 		"@opentelemetry/core": "^2.2.0",

package/src/core/config.ts

@@ -5,6 +5,7 @@ import type {
 	ProvenanceMode,
 	SecurityPolicy,
 	ScopeFilteringConfig,
+	ClientToolRules,
 } from '@mondaydotcomorg/atp-protocol';
 import type { ICompiler } from '@mondaydotcomorg/atp-compiler';
 
@@ -116,6 +117,20 @@ export interface ProvidersConfig {
 	auth?: AuthProvider;
 }
 
+/**
+ * Tool rules provider - extracts tool access rules from request context.
+ * This allows server-level configuration of tool filtering that automatically
+ * applies to all requests (explore, execute, etc.)
+ *
+ * @example
+ * // Extract rules from custom headers
+ * const toolRulesProvider = (ctx) => ({
+ *   blockApiGroups: ctx.headers['x-block-groups']?.split(','),
+ *   allowOnlyApiGroups: ctx.headers['x-allow-groups']?.split(','),
+ * });
+ */
+export type ToolRulesProvider = (ctx: RequestContext) => ClientToolRules | undefined;
+
 /**
  * Server configuration (user input - all fields optional)
  */
@@ -133,6 +148,11 @@ export interface ServerConfig {
 	/** Custom compiler implementation (optional, defaults to standard ATPCompiler) */
 	compiler?: ICompiler;
 	logger?: 'none' | 'debug' | 'info' | 'warn' | 'error' | Logger;
+	/**
+	 * Tool rules provider - extracts tool access rules from request context.
+	 * When configured, rules are automatically applied to all requests.
+	 */
+	toolRulesProvider?: ToolRulesProvider;
 }
 
 /**
@@ -172,6 +192,7 @@ export interface RequestContext {
 	logger: Logger;
 	status: number;
 	responseBody: unknown;
+	toolRules?: ClientToolRules;
 	throw(status: number, message: string): never;
 	assert(condition: boolean, message: string): asserts condition;
 	set(header: string, value: string): void;

package/src/core/request-scope.ts

@@ -0,0 +1,131 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type { ClientToolRules, APIGroupConfig, ToolMetadata } from '@mondaydotcomorg/atp-protocol';
+
+/**
+ * Request-scoped context accessible from anywhere in the call stack.
+ * This allows services to automatically access request-level configuration
+ * without explicit parameter passing.
+ */
+export interface RequestScopedContext {
+	toolRules?: ClientToolRules;
+}
+
+const asyncLocalStorage = new AsyncLocalStorage<RequestScopedContext>();
+
+/**
+ * Run a function within a request scope.
+ * All code executed within the callback can access the scoped context.
+ */
+export function runInRequestScope<T>(context: RequestScopedContext, fn: () => T): T {
+	return asyncLocalStorage.run(context, fn);
+}
+
+/**
+ * Get the current request-scoped tool rules.
+ * Returns undefined if not in a request scope or no rules are set.
+ */
+export function getRequestToolRules(): ClientToolRules | undefined {
+	return asyncLocalStorage.getStore()?.toolRules;
+}
+
+/**
+ * Get the full request-scoped context.
+ */
+export function getRequestScope(): RequestScopedContext | undefined {
+	return asyncLocalStorage.getStore();
+}
+
+/**
+ * Check if an API group is allowed based on tool rules.
+ */
+function isGroupAllowed(groupName: string, rules?: ClientToolRules): boolean {
+	if (!rules) return true;
+
+	if (rules.allowOnlyApiGroups && rules.allowOnlyApiGroups.length > 0) {
+		return rules.allowOnlyApiGroups.includes(groupName);
+	}
+
+	if (rules.blockApiGroups && rules.blockApiGroups.length > 0) {
+		return !rules.blockApiGroups.includes(groupName);
+	}
+
+	return true;
+}
+
+/**
+ * Check if a specific tool is allowed based on tool rules.
+ */
+function isToolAllowed(
+	toolName: string,
+	groupName: string,
+	metadata?: ToolMetadata,
+	rules?: ClientToolRules
+): boolean {
+	if (!rules) return true;
+
+	const fullName = `${groupName}.${toolName}`;
+
+	if (rules.allowOnlyTools && rules.allowOnlyTools.length > 0) {
+		return rules.allowOnlyTools.some((t) => t === toolName || t === fullName);
+	}
+
+	if (rules.blockTools && rules.blockTools.length > 0) {
+		if (rules.blockTools.some((t) => t === toolName || t === fullName)) {
+			return false;
+		}
+	}
+
+	if (metadata) {
+		if (
+			rules.blockOperationTypes &&
+			metadata.operationType &&
+			rules.blockOperationTypes.includes(metadata.operationType)
+		) {
+			return false;
+		}
+		if (
+			rules.blockSensitivityLevels &&
+			metadata.sensitivityLevel &&
+			rules.blockSensitivityLevels.includes(metadata.sensitivityLevel)
+		) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+/**
+ * Filter API groups based on tool rules.
+ * Returns a new array with only allowed groups and functions.
+ * Blocked tools simply don't exist in the result.
+ *
+ * @param apiGroups - All API groups to filter
+ * @param rules - Tool rules to apply (defaults to current request's rules)
+ */
+export function filterApiGroups(
+	apiGroups: APIGroupConfig[],
+	rules?: ClientToolRules
+): APIGroupConfig[] {
+	const effectiveRules = rules ?? getRequestToolRules();
+	if (!effectiveRules) return apiGroups;
+
+	return apiGroups
+		.filter((group) => isGroupAllowed(group.name, effectiveRules))
+		.map((group) => {
+			if (!group.functions) return group;
+
+			const filteredFunctions = group.functions.filter((func) =>
+				isToolAllowed(func.name, group.name, func.metadata, effectiveRules)
+			);
+
+			if (filteredFunctions.length === 0) return null;
+
+			return {
+				...group,
+				functions: filteredFunctions,
+			};
+		})
+		.filter((group): group is APIGroupConfig => group !== null);
+}
+

package/src/create-server.ts

@@ -22,6 +22,7 @@ import type {
 	Middleware,
 	RequestContext,
 	ResolvedServerConfig,
+	ToolRulesProvider,
 } from './core/config.js';
 import { MB, HOUR, MINUTE } from './core/config.js';
 import { ClientSessionManager } from './client-sessions.js';
@@ -74,6 +75,7 @@ export class AgentToolProtocolServer {
 	auditSink?: AuditSink;
 	compiler?: ICompiler;
 	private customLogger?: any;
+	private toolRulesProvider?: ToolRulesProvider;
 
 	constructor(config: ServerConfig = {}) {
 		const initialPolicies = config.execution?.securityPolicies ?? [];
@@ -138,6 +140,12 @@ export class AgentToolProtocolServer {
 			logger: config.logger ?? 'info',
 		};
 
+		// Store tool rules provider for automatic filtering
+		if (config.toolRulesProvider) {
+			this.toolRulesProvider = config.toolRulesProvider;
+			log.info('Tool rules provider configured');
+		}
+
 		if (config.providers) {
 			if (config.providers.cache) {
 				this.cacheProvider = config.providers.cache;
@@ -442,6 +450,7 @@ export class AgentToolProtocolServer {
 					middleware: this.middleware,
 					routeHandler: (ctx) => handleRoute(ctx, this),
 					sessionManager: this.sessionManager,
+					toolRulesProvider: this.toolRulesProvider,
 				},
 				this.responseHeaders
 			).catch((error) => {
@@ -704,6 +713,7 @@ export class AgentToolProtocolServer {
 					middleware: this.middleware,
 					routeHandler: (ctx) => handleRoute(ctx, this),
 					sessionManager: this.sessionManager,
+					toolRulesProvider: this.toolRulesProvider,
 				},
 				this.responseHeaders
 			);

package/src/executor/sandbox-builder.ts

@@ -2,8 +2,9 @@ import type {
 	ExecutionConfig,
 	APIGroupConfig,
 	ClientToolDefinition,
-	ToolMetadata,
+	ToolCallEvent,
 } from '@mondaydotcomorg/atp-protocol';
+import { filterApiGroups } from '../core/request-scope.js';
 import {
 	ToolOperationType,
 	ToolSensitivityLevel,
@@ -276,7 +277,9 @@ export class SandboxBuilder {
 	): Record<string, unknown> {
 		const api: Record<string, unknown> = {};
 
-		for (const group of this.apiGroups) {
+		const allowedGroups = filterApiGroups(this.apiGroups, config.toolRules);
+
+		for (const group of allowedGroups) {
 			if (group.functions) {
 				const groupObj = this.getOrCreateNestedGroup(api, group.name);
 
@@ -317,7 +320,6 @@ export class SandboxBuilder {
 							// Continue without cache
 						}
 
-						// In AST mode, recursively unwrap tainted primitives and register their provenance
 						if (
 							config.provenanceMode === ProvenanceMode.AST &&
 							input &&
@@ -331,7 +333,6 @@ export class SandboxBuilder {
 							function unwrapTaintedValues(obj: any, visited = new WeakSet<object>()): any {
 								if (obj === null || obj === undefined) return obj;
 
-								// Check if this is a wrapped tainted primitive
 								if (typeof obj === 'object' && '__tainted_value' in obj && '__prov_meta' in obj) {
 									const taintedVal = obj.__tainted_value;
 									const provMeta = obj.__prov_meta;
@@ -348,7 +349,6 @@ export class SandboxBuilder {
 										hasProvMeta: !!provMeta,
 									});
 
-									// Register the provenance so host-side checks can find it
 									if (provMeta && provMeta.source) {
 										registerProvenanceMetadata(
 											`tainted:${String(taintedVal)}`,
@@ -368,11 +368,9 @@ export class SandboxBuilder {
 										});
 									}
 
-									// Recursively unwrap in case taintedVal contains more wrapped values
 									return unwrapTaintedValues(taintedVal, visited);
 								}
 
-								// Recursively unwrap objects/arrays
 								if (typeof obj === 'object') {
 									if (visited.has(obj)) return obj;
 									visited.add(obj);
@@ -398,7 +396,6 @@ export class SandboxBuilder {
 							});
 						}
 
-						// Re-attach provenance from hints before policy checks
 						const hintMap = getHintMap(executionId);
 						if (hintMap && hintMap.size > 0 && input && typeof input === 'object') {
 							try {
@@ -474,7 +471,29 @@ export class SandboxBuilder {
 							metadata: metadata,
 							requestContext: config.requestContext,
 						};
-						const result = await handler(input, handlerContext);
+						const toolCallStartTime = Date.now();
+						let result: unknown;
+						let toolCallError: Error | undefined;
+
+						try {
+							result = await handler(input, handlerContext);
+						} catch (error) {
+							toolCallError = error instanceof Error ? error : new Error(String(error));
+							throw error;
+						} finally {
+							if (config.onToolCall) {
+								const duration = Date.now() - toolCallStartTime;
+								config.onToolCall({
+									toolName: func.name,
+									apiGroup: group.name,
+									input,
+									output: toolCallError ? undefined : result,
+									error: toolCallError,
+									duration,
+									success: !toolCallError,
+								});
+							}
+						}
 
 						try {
 							storeAPICallResult({
@@ -489,7 +508,6 @@ export class SandboxBuilder {
 							logger.debug(`Failed to store result in callback history for ${operationName}`, {
 								error: cacheError instanceof Error ? cacheError.message : String(cacheError),
 							});
-							// Continue without caching
 						}
 
 						if (config.provenanceMode === ProvenanceMode.PROXY) {

package/src/explorer/index.ts

@@ -1,8 +1,10 @@
 import type { APIGroupConfig, CustomFunctionDef } from '@mondaydotcomorg/atp-protocol';
+import { filterApiGroups } from '../core/request-scope.js';
 
 interface TreeNode {
 	type: 'directory' | 'function';
 	name: string;
+	description?: string;
 	children?: Map<string, TreeNode>;
 	functionDef?: {
 		func: CustomFunctionDef;
@@ -13,7 +15,7 @@ interface TreeNode {
 interface ExploreDirectoryResult {
 	type: 'directory';
 	path: string;
-	items: Array<{ name: string; type: 'directory' | 'function' }>;
+	items: Array<{ name: string; type: 'directory' | 'function'; description?: string }>;
 }
 
 interface ExploreFunctionResult {
@@ -36,12 +38,69 @@ export type ExploreResult = ExploreDirectoryResult | ExploreFunctionResult;
  */
 export class ExplorerService {
 	private root: TreeNode;
+	private apiGroups: APIGroupConfig[];
 
 	constructor(apiGroups: APIGroupConfig[]) {
+		this.apiGroups = apiGroups;
 		this.root = { type: 'directory', name: '/', children: new Map() };
 		this.buildTree(apiGroups);
 	}
 
+	/**
+	 * Get filtering context based on current request's tool rules.
+	 * Returns sets for allowed items and all known items (for filtering).
+	 */
+	private getFilterContext(): {
+		allowedTypes: Set<string>;
+		allowedGroups: Set<string>;
+		allowedTools: Set<string>;
+		allGroups: Set<string>;
+	} {
+		const allowedGroups = filterApiGroups(this.apiGroups);
+
+		const context = {
+			allowedTypes: new Set<string>(),
+			allowedGroups: new Set<string>(),
+			allowedTools: new Set<string>(),
+			allGroups: new Set(this.apiGroups.map((g) => g.name)),
+		};
+
+		for (const group of allowedGroups) {
+			if (group.type !== 'graphql') {
+				context.allowedTypes.add(group.type);
+			}
+			context.allowedGroups.add(group.name);
+			if (group.functions) {
+				for (const func of group.functions) {
+					context.allowedTools.add(`${group.name}:${func.name}`);
+				}
+			}
+		}
+
+		return context;
+	}
+
+	/**
+	 * Check if a directory should be visible based on filter context.
+	 */
+	private isDirectoryAllowed(
+		name: string,
+		currentPath: string,
+		ctx: ReturnType<typeof this.getFilterContext>
+	): boolean {
+		const API_TYPES = ['openapi', 'mcp', 'custom', 'graphql'];
+
+		if (currentPath === '/' && API_TYPES.includes(name)) {
+			return ctx.allowedTypes.has(name) || ctx.allowedGroups.has(name);
+		}
+
+		if (ctx.allGroups.has(name)) {
+			return ctx.allowedGroups.has(name);
+		}
+
+		return true;
+	}
+
 	/**
 	 * Builds the virtual filesystem tree from API groups
 	 */
@@ -51,8 +110,12 @@ export class ExplorerService {
 
 			const groupFolder =
 				group.type === 'graphql'
-					? this.ensureDirectory(this.root, group.name)
-					: this.ensureDirectory(this.ensureDirectory(this.root, group.type), group.name);
+					? this.ensureDirectory(this.root, group.name, group.description)
+					: this.ensureDirectory(
+							this.ensureDirectory(this.root, group.type),
+							group.name,
+							group.description
+						);
 
 			for (const func of group.functions) {
 				const segments = this.extractSegments(func, group);
@@ -128,15 +191,17 @@ export class ExplorerService {
 	/**
 	 * Ensures a directory exists at the given path
 	 */
-	private ensureDirectory(parent: TreeNode, name: string): TreeNode {
+	private ensureDirectory(parent: TreeNode, name: string, description?: string): TreeNode {
 		if (!parent.children) {
 			parent.children = new Map();
 		}
 
 		let child = parent.children.get(name);
 		if (!child) {
-			child = { type: 'directory', name, children: new Map() };
+			child = { type: 'directory', name, description, children: new Map() };
 			parent.children.set(name, child);
+		} else if (description && !child.description) {
+			child.description = description;
 		}
 
 		return child;
@@ -163,9 +228,12 @@ export class ExplorerService {
 	}
 
 	/**
-	 * Explores the filesystem at the given path
+	 * Explores the filesystem at the given path.
+	 * Tool rules are automatically applied from the request scope.
+	 * @param path - The path to explore
 	 */
 	explore(path: string): ExploreResult | null {
+		const ctx = this.getFilterContext();
 		const normalizedPath = this.normalizePath(path);
 		const segments = normalizedPath === '/' ? [] : normalizedPath.split('/').filter((s) => s);
 
@@ -181,10 +249,27 @@ export class ExplorerService {
 		}
 
 		if (current.type === 'directory') {
-			const items: Array<{ name: string; type: 'directory' | 'function' }> = [];
+			const items: Array<{ name: string; type: 'directory' | 'function'; description?: string }> =
+				[];
 			if (current.children) {
 				for (const [name, node] of current.children) {
-					items.push({ name, type: node.type });
+					// Filter directories and functions based on tool rules
+					if (node.type === 'directory') {
+						if (!this.isDirectoryAllowed(name, currentPath, ctx)) continue;
+					} else if (node.type === 'function' && node.functionDef) {
+						if (!ctx.allowedTools.has(`${node.functionDef.group}:${name}`)) continue;
+					}
+
+					const item: { name: string; type: 'directory' | 'function'; description?: string } = {
+						name,
+						type: node.type,
+					};
+					if (node.description) {
+						item.description = node.description;
+					} else if (node.type === 'function' && node.functionDef?.func.description) {
+						item.description = node.functionDef.func.description;
+					}
+					items.push(item);
 				}
 			}
 			items.sort((a, b) => {
@@ -205,6 +290,11 @@ export class ExplorerService {
 			}
 
 			const { func, group } = current.functionDef;
+
+			if (!ctx.allowedTools.has(`${group}:${func.name}`)) {
+				return null;
+			}
+
 			const definition = this.generateFunctionDefinition(func, group);
 
 			return {

package/src/handlers/definitions.handler.ts

@@ -1,13 +1,16 @@
 import type { APIGroupConfig } from '@mondaydotcomorg/atp-protocol';
 import { APIAggregator } from '../aggregator/index.js';
+import { filterApiGroups } from '../core/request-scope.js';
 
 export async function getDefinitions(apiGroups: APIGroupConfig[]): Promise<unknown> {
-	const aggregator = new APIAggregator(apiGroups);
+	const filteredGroups = filterApiGroups(apiGroups);
+
+	const aggregator = new APIAggregator(filteredGroups);
 	const typescript = await aggregator.generateTypeScript();
 
 	return {
 		typescript,
-		apiGroups: apiGroups.map((g) => g.name),
+		apiGroups: filteredGroups.map((g) => g.name),
 		version: '1.0.0',
 	};
 }