@mxf-dev/core 1.0.0 → 2.0.0

package/dist/protocols/mcp/providers/XaiMcpClient.d.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 import { BaseMcpClient } from './BaseMcpClient.js';

package/dist/protocols/mcp/providers/XaiMcpClient.js

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 import { BaseMcpClient } from './BaseMcpClient.js';

package/dist/protocols/mcp/security/HttpTargetGuard.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/BradA1878/model-exchange-framework
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * Result of checking a URL.
+ */
+export interface HttpTargetCheck {
+    /** Whether the fetch may proceed */
+    allowed: boolean;
+    /** Why it was refused — written for the model, so it can correct course */
+    reason?: string;
+    /** The addresses the hostname resolved to */
+    resolvedAddresses?: string[];
+}
+/**
+ * Check whether an agent-supplied URL may be fetched.
+ *
+ * @param rawUrl - The URL the tool was asked to fetch
+ * @returns Whether the fetch may proceed, and why not when it may not
+ */
+export declare function checkHttpTarget(rawUrl: string): Promise<HttpTargetCheck>;
+//# sourceMappingURL=HttpTargetGuard.d.ts.map

package/dist/protocols/mcp/security/HttpTargetGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpTargetGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/HttpTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyBH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAkHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA6F9E"}

package/dist/protocols/mcp/security/HttpTargetGuard.js

@@ -0,0 +1,227 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/BradA1878/model-exchange-framework
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * HttpTargetGuard.ts
+ *
+ * Decides whether an agent-supplied URL may be fetched from the server.
+ *
+ * The server sits inside the trust boundary: it can reach the MXF API on
+ * localhost:3001, Meilisearch, MongoDB, and — on a cloud host — the instance
+ * metadata endpoint at 169.254.169.254 that hands out IAM credentials. A tool
+ * that fetches an arbitrary URL on the model's behalf turns the server into a
+ * proxy across that boundary (server-side request forgery).
+ *
+ * This guard resolves the hostname and checks every address it resolves to, so a
+ * public name that points at 127.0.0.1 is caught as well as a literal IP.
+ *
+ * The guard fails closed: a target that cannot be resolved or cannot be parsed
+ * is refused, with an error saying why. It never silently skips the check.
+ */
+import { promises as dns } from 'dns';
+import { isIP } from 'net';
+import { allowPrivateHttpHosts } from './McpToolPolicy.js';
+/**
+ * IPv4 ranges the server must not be steered into.
+ * Each entry is [first octet-based CIDR, human name].
+ */
+const BLOCKED_IPV4_RANGES = [
+    { cidr: '0.0.0.0/8', name: '"this network"' },
+    { cidr: '10.0.0.0/8', name: 'RFC1918 private network' },
+    { cidr: '100.64.0.0/10', name: 'carrier-grade NAT' },
+    { cidr: '127.0.0.0/8', name: 'loopback' },
+    { cidr: '169.254.0.0/16', name: 'link-local / cloud instance metadata' },
+    { cidr: '172.16.0.0/12', name: 'RFC1918 private network' },
+    { cidr: '192.0.0.0/24', name: 'IETF protocol assignments' },
+    { cidr: '192.168.0.0/16', name: 'RFC1918 private network' },
+    { cidr: '198.18.0.0/15', name: 'benchmark network' },
+    { cidr: '224.0.0.0/4', name: 'multicast' },
+    { cidr: '240.0.0.0/4', name: 'reserved' }
+];
+/** Convert a dotted-quad IPv4 string to a 32-bit unsigned integer. */
+function ipv4ToInt(address) {
+    const octets = address.split('.');
+    if (octets.length !== 4) {
+        return null;
+    }
+    let value = 0;
+    for (const octet of octets) {
+        // Reject empty, non-numeric, or out-of-range octets rather than coercing.
+        if (!/^\d{1,3}$/.test(octet)) {
+            return null;
+        }
+        const num = Number(octet);
+        if (num > 255) {
+            return null;
+        }
+        value = (value << 8) | num;
+    }
+    // `>>> 0` forces the result back to unsigned — the shifts above produce a
+    // signed 32-bit int for addresses above 127.255.255.255.
+    return value >>> 0;
+}
+/** Is an IPv4 address inside the given CIDR block? */
+function ipv4InCidr(address, cidr) {
+    const [network, prefixText] = cidr.split('/');
+    const prefix = Number(prefixText);
+    const addressInt = ipv4ToInt(address);
+    const networkInt = ipv4ToInt(network);
+    if (addressInt === null || networkInt === null) {
+        return false;
+    }
+    // A /0 mask would shift by 32, which is a no-op in JS — handle it explicitly.
+    if (prefix === 0) {
+        return true;
+    }
+    const mask = (0xffffffff << (32 - prefix)) >>> 0;
+    return (addressInt & mask) === (networkInt & mask);
+}
+/**
+ * Is this address one the server must not be steered into?
+ *
+ * @returns the name of the matched range, or null when the address is fine
+ */
+function matchBlockedRange(address) {
+    const version = isIP(address);
+    if (version === 4) {
+        for (const range of BLOCKED_IPV4_RANGES) {
+            if (ipv4InCidr(address, range.cidr)) {
+                return range.name;
+            }
+        }
+        return null;
+    }
+    if (version === 6) {
+        const normalized = address.toLowerCase();
+        // IPv6 loopback
+        if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
+            return 'IPv6 loopback';
+        }
+        // Unspecified address
+        if (normalized === '::' || normalized === '0:0:0:0:0:0:0:0') {
+            return 'IPv6 unspecified address';
+        }
+        // Unique local addresses, fc00::/7
+        if (/^f[cd][0-9a-f]{2}:/.test(normalized)) {
+            return 'IPv6 unique local address';
+        }
+        // Link-local, fe80::/10
+        if (/^fe[89ab][0-9a-f]:/.test(normalized)) {
+            return 'IPv6 link-local address';
+        }
+        // IPv4-mapped (::ffff:127.0.0.1) — re-check the embedded IPv4 address,
+        // otherwise ::ffff:169.254.169.254 would walk straight past this guard.
+        const mapped = normalized.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+        if (mapped) {
+            return matchBlockedRange(mapped[1]);
+        }
+        return null;
+    }
+    return null;
+}
+/**
+ * Check whether an agent-supplied URL may be fetched.
+ *
+ * @param rawUrl - The URL the tool was asked to fetch
+ * @returns Whether the fetch may proceed, and why not when it may not
+ */
+export async function checkHttpTarget(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return {
+            allowed: false,
+            reason: `"${rawUrl}" is not a valid URL.`
+        };
+    }
+    // Only HTTP(S). file:, gopher:, ftp: and friends reach places an HTTP client
+    // has no business reaching.
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return {
+            allowed: false,
+            reason: `Protocol "${url.protocol}" is not allowed. Use http: or https:.`
+        };
+    }
+    // The operator can open this up for local development. Off by default.
+    if (allowPrivateHttpHosts()) {
+        return { allowed: true };
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    // A literal IP needs no DNS round trip.
+    if (isIP(hostname) !== 0) {
+        const blocked = matchBlockedRange(hostname);
+        if (blocked) {
+            return {
+                allowed: false,
+                reason: `Refusing to fetch ${hostname}: it is a ${blocked} address. ` +
+                    `This tool may only reach public internet hosts. ` +
+                    `Set MXF_HTTP_ALLOW_PRIVATE_HOSTS=true to permit private addresses.`,
+                resolvedAddresses: [hostname]
+            };
+        }
+        return { allowed: true, resolvedAddresses: [hostname] };
+    }
+    // "localhost" and anything under .localhost resolve to loopback by definition.
+    const lowerHost = hostname.toLowerCase();
+    if (lowerHost === 'localhost' || lowerHost.endsWith('.localhost')) {
+        return {
+            allowed: false,
+            reason: `Refusing to fetch ${hostname}: it is a loopback address. ` +
+                `This tool may only reach public internet hosts. ` +
+                `Set MXF_HTTP_ALLOW_PRIVATE_HOSTS=true to permit private addresses.`
+        };
+    }
+    // Resolve the name and check every address behind it. A public hostname can
+    // legitimately resolve to 127.0.0.1, and a malicious one will.
+    let addresses;
+    try {
+        const records = await dns.lookup(hostname, { all: true, verbatim: true });
+        addresses = records.map(record => record.address);
+    }
+    catch (error) {
+        // Fail closed. An unresolvable host is not a host we quietly try anyway.
+        return {
+            allowed: false,
+            reason: `Could not resolve "${hostname}": ` +
+                `${error instanceof Error ? error.message : String(error)}`
+        };
+    }
+    if (addresses.length === 0) {
+        return {
+            allowed: false,
+            reason: `"${hostname}" did not resolve to any address.`
+        };
+    }
+    for (const address of addresses) {
+        const blocked = matchBlockedRange(address);
+        if (blocked) {
+            return {
+                allowed: false,
+                reason: `Refusing to fetch ${hostname}: it resolves to ${address}, ` +
+                    `a ${blocked} address. This tool may only reach public internet hosts. ` +
+                    `Set MXF_HTTP_ALLOW_PRIVATE_HOSTS=true to permit private addresses.`,
+                resolvedAddresses: addresses
+            };
+        }
+    }
+    return { allowed: true, resolvedAddresses: addresses };
+}
+//# sourceMappingURL=HttpTargetGuard.js.map

package/dist/protocols/mcp/security/HttpTargetGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpTargetGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/HttpTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAc3D;;;GAGG;AACH,MAAM,mBAAmB,GAA0C;IAC/D,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7C,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE;IACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,sCAAsC,EAAE;IACxE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC3D,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC3D,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1C,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE;CAC5C,CAAC;AAEF,sEAAsE;AACtE,SAAS,SAAS,CAAC,OAAe;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,0EAA0E;QAC1E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAC1E,yDAAyD;IACzD,OAAO,KAAK,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,sDAAsD;AACtD,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,IAAI,CAAC;YACtB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,gBAAgB;QAChB,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAC;QAC3B,CAAC;QACD,sBAAsB;QACtB,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC1D,OAAO,0BAA0B,CAAC;QACtC,CAAC;QACD,mCAAmC;QACnC,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,2BAA2B,CAAC;QACvC,CAAC;QACD,wBAAwB;QACxB,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,yBAAyB,CAAC;QACrC,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACjF,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,MAAM,uBAAuB;SAC5C,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,aAAa,GAAG,CAAC,QAAQ,wCAAwC;SAC5E,CAAC;IACN,CAAC;IAED,uEAAuE;IACvE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;IAE7E,wCAAwC;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EACF,qBAAqB,QAAQ,aAAa,OAAO,YAAY;oBAC7D,kDAAkD;oBAClD,oEAAoE;gBACxE,iBAAiB,EAAE,CAAC,QAAQ,CAAC;aAChC,CAAC;QACN,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,+EAA+E;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChE,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EACF,qBAAqB,QAAQ,8BAA8B;gBAC3D,kDAAkD;gBAClD,oEAAoE;SAC3E,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,yEAAyE;QACzE,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EACF,sBAAsB,QAAQ,KAAK;gBACnC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,QAAQ,mCAAmC;SAC1D,CAAC;IACN,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EACF,qBAAqB,QAAQ,oBAAoB,OAAO,IAAI;oBAC5D,KAAK,OAAO,4DAA4D;oBACxE,oEAAoE;gBACxE,iBAAiB,EAAE,SAAS;aAC/B,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC"}

package/dist/protocols/mcp/security/McpConfirmationManager.d.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 export interface ConfirmationRequest {

package/dist/protocols/mcp/security/McpConfirmationManager.js

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 /**

package/dist/protocols/mcp/security/McpSecurityConfig.d.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 export interface McpSecurityConfig {

package/dist/protocols/mcp/security/McpSecurityConfig.js

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 /**

package/dist/protocols/mcp/security/McpSecurityGuard.d.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 export interface SecurityContext {
@@ -41,7 +41,15 @@ export declare class McpSecurityGuard {
     private platform;
     private projectRoot;
     private allowedPaths;
-    constructor(projectRoot: string, additionalAllowedPaths?: string[]);
+    /**
+     * @param projectRoot - Root the guard confines filesystem access to
+     * @param additionalAllowedPaths - Extra paths outside the project root to permit
+     * @param platformOverride - Force the OS rule set. Command rules are OS-specific
+     *   (`apt-get` is blocked outright on Linux but unknown on macOS, for example), so
+     *   without this a test asserting one platform's rules passes on a developer's machine
+     *   and fails on a runner with a different OS. Production code should omit it.
+     */
+    constructor(projectRoot: string, additionalAllowedPaths?: string[], platformOverride?: NodeJS.Platform);
     /**
      * Validate a shell command for execution.
      *

package/dist/protocols/mcp/security/McpSecurityGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"McpSecurityGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AA+ID,qBAAa,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAgB;gBAExB,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,EAAE;IAOlE;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,uBAAuB;IA8DnF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmE7B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAUhB;;OAEG;IACH,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,oBAAoB;IAiFjG;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO;IAKxE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU;IAK/F;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAOvC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAahC;;OAEG;IACH,OAAO,CAAC,UAAU;CAcrB;AAOD,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAQvE"}
+{"version":3,"file":"McpSecurityGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AA+ID,qBAAa,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAgB;IAEpC;;;;;;;OAOG;gBACS,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,QAAQ;IAMtG;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,uBAAuB;IA8DnF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmE7B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAUhB;;OAEG;IACH,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,oBAAoB;IAiFjG;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO;IAKxE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU;IAK/F;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAOvC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAahC;;OAEG;IACH,OAAO,CAAC,UAAU;CAcrB;AAOD,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAQvE"}

package/dist/protocols/mcp/security/McpSecurityGuard.js

@@ -14,7 +14,7 @@
  * limitations under the License.
  *
  * @author Brad Anderson <BradA1878@pm.me>
- * @repository https://github.com/mxf-dev/mxf
+ * @repository https://github.com/BradA1878/model-exchange-framework
  * @documentation https://mxf-dev.github.io/mxf/
  */
 /**
@@ -171,8 +171,16 @@ export class McpSecurityGuard {
     platform;
     projectRoot;
     allowedPaths = [];
-    constructor(projectRoot, additionalAllowedPaths) {
-        this.platform = platform();
+    /**
+     * @param projectRoot - Root the guard confines filesystem access to
+     * @param additionalAllowedPaths - Extra paths outside the project root to permit
+     * @param platformOverride - Force the OS rule set. Command rules are OS-specific
+     *   (`apt-get` is blocked outright on Linux but unknown on macOS, for example), so
+     *   without this a test asserting one platform's rules passes on a developer's machine
+     *   and fails on a runner with a different OS. Production code should omit it.
+     */
+    constructor(projectRoot, additionalAllowedPaths, platformOverride) {
+        this.platform = platformOverride ?? platform();
         this.projectRoot = path.resolve(projectRoot);
         this.allowedPaths = [this.projectRoot, ...(additionalAllowedPaths || [])];
     }

package/dist/protocols/mcp/security/McpSecurityGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"McpSecurityGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAEtF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAyBhE;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACrB,MAAM,EAAE;QACJ,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;YAChD,uBAAuB;YACvB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW;YAC7C,kBAAkB;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,kBAAkB;YAClB,MAAM,EAAE,aAAa,EAAE,aAAa;YACpC,UAAU;YACV,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,sBAAsB;YACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;SAClC;QACD,UAAU,EAAE;YACR,wBAAwB;YACxB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;YAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YAC1C,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE;SACjD;KACJ;IACD,KAAK,EAAE;QACH,sCAAsC;QACtC,OAAO,EAAE;YACL,kBAAkB;YAClB,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;YACnD,uBAAuB;YACvB,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU;YACnD,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;YACjC,WAAW;YACX,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;YACnC,kBAAkB;YAClB,UAAU,EAAE,gBAAgB,EAAE,SAAS;YACvC,sBAAsB;YACtB,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;SACzC;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;SAC5C;KACJ;IACD,KAAK,EAAE;QACH,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO;YACxC,uBAAuB;YACvB,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW;YAClD,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC7B,mDAAmD;YACnD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;YACnD,kBAAkB;YAClB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YACrD,UAAU;YACV,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc;YAC9C,sBAAsB;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY;SAC5C;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;YACzC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;YAC5C,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;SACzC;KACJ;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAC9B,yBAAyB;IACzB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACtC,uBAAuB;IACvB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;IAC7B,kBAAkB;IAClB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;IACxC,qBAAqB;IACrB,SAAS,EAAE,SAAS,EAAE,UAAU;IAChC,yBAAyB;IACzB,YAAY,EAAE,aAAa,EAAE,aAAa;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG;IAClB,kBAAkB;IAClB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACpD,kBAAkB;IAClB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;IAC3C,qBAAqB;IACrB,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IACvC,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACjD,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACtD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IAC7B,0BAA0B;IAC1B,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI;IAC3D,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,YAAY,EAAE;QACV,MAAM,EAAE;YACJ,SAAS,EAAE,mBAAmB,EAAE,cAAc;YAC9C,UAAU,EAAE,WAAW,EAAE,iBAAiB;SAC7C;QACD,KAAK,EAAE;YACH,uBAAuB,EAAE,uBAAuB;YAChD,mBAAmB,EAAE,yBAAyB;YAC9C,iBAAiB,EAAE,sBAAsB;SAC5C;QACD,KAAK,EAAE;YACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;YAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;SAC5C;KACJ;IACD,kCAAkC;IAClC,cAAc,EAAE;QACZ,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC3C,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;QAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;KACrD;CACJ,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACjB,QAAQ,CAAkB;IAC1B,WAAW,CAAS;IACpB,YAAY,GAAa,EAAE,CAAC;IAEpC,YAAY,WAAmB,EAAE,sBAAiC;QAC9D,IAAI,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IAE9E,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACrD,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE5D,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,oBAAoB,EAAE,IAAI;gBAC1B,MAAM,EAAE,6FAA6F;gBACrG,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,eAAe;aAC5B,CAAC;QACN,CAAC;QAED,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;QAEhB,0EAA0E;QAC1E,IAAI,qBAAqB,GAA4B;YACjD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,eAAe;SAC5B,CAAC;QAEF,gDAAgD;QAChD,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,kDAAkD;gBAClD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;gBACpF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,cAAc,CAAC,UAAU,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAC1E,qBAAqB,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACvD,CAAC;QAED,OAAO,qBAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,qBAAqB,CACzB,gBAAwB,EACxB,qBAA6B,EAC7B,QAAyB;QAEzB,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,wCAAwC;QACxC,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,qCAAqC;YACrC,IAAI,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qCAAqC;oBAC7C,SAAS,EAAE,MAAM;iBACpB,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,SAAS,EAAE;oBAC1D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAyC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAE3G,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,OAAO,mBAAmB,IAAI,CAAC,QAAQ,EAAE;oBAC7D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,WAAW,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,oBAAoB,EAAE,IAAI;oBAC1B,MAAM,EAAE,YAAY,UAAU,CAAC,OAAO,yBAAyB;oBAC/D,SAAS,EAAE,UAAU,CAAC,SAAgB;iBACzC,CAAC;YACN,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,OAAO;YACH,OAAO,EAAE,IAAI;YACb,oBAAoB,EAAE,IAAI;YAC1B,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,QAAQ;SACtB,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,KAA8C;QAC3D,QAAQ,KAAK,EAAE,CAAC;YACZ,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,aAAqB,EAAE,SAAsC;QACtE,IAAI,CAAC;YACD,mBAAmB;YACnB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,mDAAmD;gBACnD,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;oBACnE,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yCAAyC;iBACpD,CAAC;YACN,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAuD,CAAC,IAAI,EAAE,CAAC;YACxH,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACjC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,aAAa,OAAO,aAAa;qBAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,0DAA0D;YAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAyD,CAAC,IAAI,EAAE,CAAC;gBAC9H,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;oBACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACrD,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAC7C,OAAO;4BACH,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,iCAAiC;4BAChE,MAAM,EAAE,SAAS,KAAK,MAAM;gCACxB,CAAC,CAAC,8BAA8B,SAAS,8BAA8B;gCACvE,CAAC,CAAC,SAAS;4BACf,YAAY;yBACf,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,yEAAyE;gBACzE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,+EAA+E;wBACvF,YAAY;qBACf,CAAC;gBACN,CAAC;YACL,CAAC;YAED,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,YAAY;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe,EAAE,OAAwB;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,OAAwB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAG;YACb,kBAAkB,EAAG,uBAAuB;YAC5C,aAAa,EAAQ,8BAA8B;YACnD,cAAc,EAAO,2BAA2B;YAChD,aAAa,EAAQ,gCAAgC;YACrD,eAAe,EAAM,sBAAsB;YAC3C,iBAAiB,CAAI,sBAAsB;SAC9C,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,OAAe;QAC9B,WAAW;QACX,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,+BAA+B;QAC/B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ;AAED;;GAEG;AACH,IAAI,qBAAqB,GAA4B,IAAI,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,WAAoB;IACjD,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxC,qBAAqB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"McpSecurityGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAEtF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAyBhE;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACrB,MAAM,EAAE;QACJ,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;YAChD,uBAAuB;YACvB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW;YAC7C,kBAAkB;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,kBAAkB;YAClB,MAAM,EAAE,aAAa,EAAE,aAAa;YACpC,UAAU;YACV,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,sBAAsB;YACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;SAClC;QACD,UAAU,EAAE;YACR,wBAAwB;YACxB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;YAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YAC1C,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE;SACjD;KACJ;IACD,KAAK,EAAE;QACH,sCAAsC;QACtC,OAAO,EAAE;YACL,kBAAkB;YAClB,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;YACnD,uBAAuB;YACvB,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU;YACnD,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;YACjC,WAAW;YACX,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;YACnC,kBAAkB;YAClB,UAAU,EAAE,gBAAgB,EAAE,SAAS;YACvC,sBAAsB;YACtB,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;SACzC;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;SAC5C;KACJ;IACD,KAAK,EAAE;QACH,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO;YACxC,uBAAuB;YACvB,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW;YAClD,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC7B,mDAAmD;YACnD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;YACnD,kBAAkB;YAClB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YACrD,UAAU;YACV,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc;YAC9C,sBAAsB;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY;SAC5C;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;YACzC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;YAC5C,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;SACzC;KACJ;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAC9B,yBAAyB;IACzB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACtC,uBAAuB;IACvB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;IAC7B,kBAAkB;IAClB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;IACxC,qBAAqB;IACrB,SAAS,EAAE,SAAS,EAAE,UAAU;IAChC,yBAAyB;IACzB,YAAY,EAAE,aAAa,EAAE,aAAa;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG;IAClB,kBAAkB;IAClB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACpD,kBAAkB;IAClB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;IAC3C,qBAAqB;IACrB,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IACvC,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACjD,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACtD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IAC7B,0BAA0B;IAC1B,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI;IAC3D,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,YAAY,EAAE;QACV,MAAM,EAAE;YACJ,SAAS,EAAE,mBAAmB,EAAE,cAAc;YAC9C,UAAU,EAAE,WAAW,EAAE,iBAAiB;SAC7C;QACD,KAAK,EAAE;YACH,uBAAuB,EAAE,uBAAuB;YAChD,mBAAmB,EAAE,yBAAyB;YAC9C,iBAAiB,EAAE,sBAAsB;SAC5C;QACD,KAAK,EAAE;YACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;YAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;SAC5C;KACJ;IACD,kCAAkC;IAClC,cAAc,EAAE;QACZ,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC3C,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;QAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;KACrD;CACJ,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACjB,QAAQ,CAAkB;IAC1B,WAAW,CAAS;IACpB,YAAY,GAAa,EAAE,CAAC;IAEpC;;;;;;;OAOG;IACH,YAAY,WAAmB,EAAE,sBAAiC,EAAE,gBAAkC;QAClG,IAAI,CAAC,QAAQ,GAAG,gBAAgB,IAAI,QAAQ,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACrD,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE5D,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,oBAAoB,EAAE,IAAI;gBAC1B,MAAM,EAAE,6FAA6F;gBACrG,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,eAAe;aAC5B,CAAC;QACN,CAAC;QAED,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;QAEhB,0EAA0E;QAC1E,IAAI,qBAAqB,GAA4B;YACjD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,eAAe;SAC5B,CAAC;QAEF,gDAAgD;QAChD,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,kDAAkD;gBAClD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;gBACpF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,cAAc,CAAC,UAAU,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAC1E,qBAAqB,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACvD,CAAC;QAED,OAAO,qBAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,qBAAqB,CACzB,gBAAwB,EACxB,qBAA6B,EAC7B,QAAyB;QAEzB,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,wCAAwC;QACxC,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,qCAAqC;YACrC,IAAI,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qCAAqC;oBAC7C,SAAS,EAAE,MAAM;iBACpB,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,SAAS,EAAE;oBAC1D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAyC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAE3G,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,OAAO,mBAAmB,IAAI,CAAC,QAAQ,EAAE;oBAC7D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,WAAW,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,oBAAoB,EAAE,IAAI;oBAC1B,MAAM,EAAE,YAAY,UAAU,CAAC,OAAO,yBAAyB;oBAC/D,SAAS,EAAE,UAAU,CAAC,SAAgB;iBACzC,CAAC;YACN,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,OAAO;YACH,OAAO,EAAE,IAAI;YACb,oBAAoB,EAAE,IAAI;YAC1B,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,QAAQ;SACtB,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,KAA8C;QAC3D,QAAQ,KAAK,EAAE,CAAC;YACZ,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,aAAqB,EAAE,SAAsC;QACtE,IAAI,CAAC;YACD,mBAAmB;YACnB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,mDAAmD;gBACnD,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;oBACnE,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yCAAyC;iBACpD,CAAC;YACN,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAuD,CAAC,IAAI,EAAE,CAAC;YACxH,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACjC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,aAAa,OAAO,aAAa;qBAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,0DAA0D;YAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAyD,CAAC,IAAI,EAAE,CAAC;gBAC9H,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;oBACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACrD,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAC7C,OAAO;4BACH,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,iCAAiC;4BAChE,MAAM,EAAE,SAAS,KAAK,MAAM;gCACxB,CAAC,CAAC,8BAA8B,SAAS,8BAA8B;gCACvE,CAAC,CAAC,SAAS;4BACf,YAAY;yBACf,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,yEAAyE;gBACzE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,+EAA+E;wBACvF,YAAY;qBACf,CAAC;gBACN,CAAC;YACL,CAAC;YAED,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,YAAY;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe,EAAE,OAAwB;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,OAAwB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAG;YACb,kBAAkB,EAAG,uBAAuB;YAC5C,aAAa,EAAQ,8BAA8B;YACnD,cAAc,EAAO,2BAA2B;YAChD,aAAa,EAAQ,gCAAgC;YACrD,eAAe,EAAM,sBAAsB;YAC3C,iBAAiB,CAAI,sBAAsB;SAC9C,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,OAAe;QAC9B,WAAW;QACX,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,+BAA+B;QAC/B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ;AAED;;GAEG;AACH,IAAI,qBAAqB,GAA4B,IAAI,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,WAAoB;IACjD,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxC,qBAAqB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}

package/dist/protocols/mcp/security/McpToolPolicy.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/BradA1878/model-exchange-framework
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * Base commands agents are permitted to run via shell_execute.
+ *
+ * Read from MXF_SHELL_ALLOWED_COMMANDS. An empty list means no allowlist is
+ * configured: the McpSecurityGuard's block rules and confirmation prompts remain
+ * the control, exactly as before. This is a config-supplied allowlist, so a model
+ * cannot widen it by passing arguments.
+ */
+export declare function getShellAllowedCommands(): string[];
+/**
+ * Is a command allowlist configured at all?
+ */
+export declare function hasShellAllowlist(): boolean;
+/**
+ * Build the environment a shell child process receives.
+ *
+ * Least privilege: start from the small base set above, add any names the
+ * operator explicitly opted into via MXF_SHELL_ENV_PASSTHROUGH, then add the
+ * caller's own explicit variables. The server's secrets are never copied in.
+ *
+ * This mirrors what ExternalMcpServerManager already does when it spawns an
+ * external MCP server.
+ *
+ * @param explicitEnv - Variables the caller wants the child to see
+ * @returns The complete environment for the child process
+ */
+export declare function buildShellChildEnv(explicitEnv?: Record<string, string>): Record<string, string>;
+/**
+ * Should shell_execute run commands inside the Docker sandbox?
+ *
+ * Off by default: the sandbox requires Docker and the mxf/shell-executor image,
+ * and turning it on changes where commands run. When it is on and Docker is
+ * missing, execution fails — it never silently falls back to the host.
+ */
+export declare function isShellSandboxEnabled(): boolean;
+/**
+ * The directory tree agents are allowed to work in.
+ *
+ * Returns undefined when MXF_WORKSPACE_ROOT is not set. Callers that hand out
+ * filesystem reach must treat that as fatal — see {@link requireWorkspaceRoot}.
+ * There is deliberately no default: the previous default was the user's home
+ * directory, which put ~/.ssh, ~/.aws and ~/.mxf/config.json inside the agents'
+ * reach.
+ */
+export declare function getWorkspaceRoot(): string | undefined;
+/**
+ * The workspace root, or a thrown error explaining how to set it.
+ *
+ * @throws Error when MXF_WORKSPACE_ROOT is not configured
+ */
+export declare function requireWorkspaceRoot(consumer: string): string;
+/**
+ * May api_fetch reach loopback and private-network addresses?
+ *
+ * Default false. When false, api_fetch refuses localhost, RFC1918 ranges, and
+ * the cloud metadata endpoint — otherwise an agent could use the server as a
+ * proxy into the MXF API itself, Meilisearch, or a cloud instance's credentials.
+ *
+ * Turn on only for local development against services on your own machine.
+ */
+export declare function allowPrivateHttpHosts(): boolean;
+//# sourceMappingURL=McpToolPolicy.d.ts.map

package/dist/protocols/mcp/security/McpToolPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpToolPolicy.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpToolPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkFH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}