@nimbus-dev/connectors 0.2.2 → 0.2.4

package/README.md

@@ -21,7 +21,9 @@ Run standalone, a connector gives you:
   parameters in front of you, and does nothing unless you approve.
 - **A write-scope allow-list**, enforced by the server and unreachable by the model.
 - **A mutation budget** per session, which caps a runaway agent loop.
-- **A local, hash-chained, append-only audit log**, when `NIMBUS_MCP_AUDIT_LOG` is set.
+- **A local, hash-chained, append-only audit log**, when `NIMBUS_MCP_AUDIT_LOG` is set — one file
+  can serve every connector you run, within the bounds
+  [Configuration](./docs/configuration.md#the-audit-log) lists.
 
 It does **not** give you the process sandbox, OS-keychain credential storage, the egress ledger, or
 owner-controlled consent. Those are properties of the Nimbus gateway and no published package can
@@ -62,8 +64,8 @@ Full matrix, versions tested, and the provenance of each claim:
 ```
 
 Credentials come from the environment. There is no Vault outside the gateway, so whoever writes this
-config holds the secret. Every variable, and the two behaviours that look like bugs and are not, are
-in [Configuration](./docs/configuration.md).
+config holds the secret. Every variable, and the three behaviours that look like bugs and are not,
+are in [Configuration](./docs/configuration.md).
 
 Each connector has its own README at `connectors/<id>/README.md`. Most list their tools and
 credentials, but some — `github`, `slack` and `jira` among them — are still only a short gateway

package/connectors/apple/src/server.ts

@@ -12,6 +12,7 @@
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { requireProcessEnv } from "../../../shared/mcp-tool-kit.ts";
 import {
   createAppleCalDavClient,
@@ -39,7 +40,10 @@ try {
   // non-fatal; listEvents/list tools will re-discover on demand
 }
 
-const server = new McpServer({ name: "nimbus-apple", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-apple", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerAppleTools(server, {
   client: createAppleImapClient(email, appPw),

package/connectors/athena/src/tools.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import {
   asArray,
-  cliArg,
+  awsCliArg,
   createCliJsonRunner,
   isRecord,
   strField,
@@ -12,8 +12,10 @@ import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connect
 
 /**
  * A catalog / database / table name passed as a value to the `aws athena` CLI.
- * Rejected at the schema boundary if it begins with `-` (argv flag smuggling) or
- * contains control characters.
+ * Rejected at the schema boundary (`awsCliArg`) if it begins with `-` (argv flag
+ * smuggling), contains control characters, or starts with a prefix that makes the
+ * CLI read the value from a file or a URL instead — `file://<path>` as a table name
+ * would send that file to AWS, and an error can quote it back.
  */
 
 /**
@@ -70,8 +72,8 @@ export function registerAthenaTools(reg: ZodToolRegistrar): void {
     "athena_list",
     "List Athena data catalogs, the databases in a catalog, or the tables in a database — METADATA ONLY. With no arguments, lists data catalogs (`aws athena list-data-catalogs`). With `catalog` set, lists that catalog's databases (`aws athena list-databases`). With `catalog` + `database` set, lists that database's table metadata (`aws athena list-table-metadata`) — each entry carries `Name`, `TableType`, `Columns`, and `PartitionKeys`. Never runs a query or returns row/cell data.",
     z.object({
-      catalog: cliArg.optional(),
-      database: cliArg.optional(),
+      catalog: awsCliArg.optional(),
+      database: awsCliArg.optional(),
     }),
     async (p) => {
       if (p.catalog === undefined) {
@@ -100,9 +102,9 @@ export function registerAthenaTools(reg: ZodToolRegistrar): void {
     "athena_get",
     "Fetch one Athena table's schema + METADATA (`aws athena get-table-metadata`). Returns the table object including `Columns` (column names + types only), `PartitionKeys`, `TableType`, `Parameters`, and timestamps. No cell values or query results are returned — schema/metadata only.",
     z.object({
-      catalog: cliArg,
-      database: cliArg,
-      table: cliArg,
+      catalog: awsCliArg,
+      database: awsCliArg,
+      table: awsCliArg,
     }),
     async (p) => {
       return jsonResult(
@@ -123,8 +125,8 @@ export function registerAthenaTools(reg: ZodToolRegistrar): void {
     "athena_search",
     "Substring search over Athena catalog, database, and table NAMES (case-insensitive) — METADATA ONLY. With no `catalog`, searches data-catalog names. With `catalog` set (no `database`), searches that catalog's database names. With `catalog` + `database` set, searches that database's table names. Returns a `{ matches: [...] }` envelope of metadata entries. Never runs a query or samples row data.",
     z.object({
-      catalog: cliArg.optional(),
-      database: cliArg.optional(),
+      catalog: awsCliArg.optional(),
+      database: awsCliArg.optional(),
       query: z.string().min(1),
     }),
     async (p) => {

package/connectors/aws/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerAwsTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-aws", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-aws", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerAwsTools(mcp);
 

package/connectors/aws/src/tools.ts

@@ -2,6 +2,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
+import { awsCliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -66,7 +67,7 @@ export function registerAwsTools(
   reg(
     "aws_ecs_service_list",
     "List ECS services in a cluster.",
-    z.object({ cluster: z.string().min(1) }),
+    z.object({ cluster: awsCliArg }),
     async (p) => jsonResult(await awsJson(["ecs", "list-services", "--cluster", p.cluster])),
   );
 
@@ -83,9 +84,9 @@ export function registerAwsTools(
     },
     "Update ECS service (e.g. new task definition).",
     z.object({
-      cluster: z.string().min(1),
-      service: z.string().min(1),
-      taskDefinition: z.string().min(1),
+      cluster: awsCliArg,
+      service: awsCliArg,
+      taskDefinition: awsCliArg,
     }),
     async (p) => {
       const cmd = [
@@ -114,7 +115,8 @@ export function registerAwsTools(
     },
     "Invoke a Lambda function.",
     z.object({
-      functionName: z.string().min(1),
+      functionName: awsCliArg,
+      // Written to a temp file the CLI is pointed at with file://, never passed as an argument.
       payloadJson: z.string().optional(),
     }),
     async (p) => {
@@ -167,7 +169,7 @@ export function registerAwsTools(
       scopeTargetOf: (p) => ({ kind: "instance", value: p.instanceIds }),
     },
     "Stop EC2 instances.",
-    z.object({ instanceIds: z.string().min(1) }),
+    z.object({ instanceIds: awsCliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["aws", "ec2", "stop-instances", "--instance-ids", p.instanceIds],
@@ -185,7 +187,7 @@ export function registerAwsTools(
       scopeTargetOf: (p) => ({ kind: "instance", value: p.instanceIds }),
     },
     "Start EC2 instances.",
-    z.object({ instanceIds: z.string().min(1) }),
+    z.object({ instanceIds: awsCliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["aws", "ec2", "start-instances", "--instance-ids", p.instanceIds],

package/connectors/azure/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerAzureTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-azure", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-azure", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerAzureTools(mcp);
 

package/connectors/azure/src/tools.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { azCliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -44,8 +45,8 @@ export function registerAzureTools(
     "azure_app_service_list",
     "List App Services in a resource group.",
     z.object({
-      subscriptionId: z.string().min(1),
-      resourceGroup: z.string().min(1),
+      subscriptionId: azCliArg,
+      resourceGroup: azCliArg,
     }),
     async (p) =>
       jsonResult(
@@ -69,9 +70,9 @@ export function registerAzureTools(
     },
     "Restart an App Service.",
     z.object({
-      subscriptionId: z.string().min(1),
-      resourceGroup: z.string().min(1),
-      name: z.string().min(1),
+      subscriptionId: azCliArg,
+      resourceGroup: azCliArg,
+      name: azCliArg,
     }),
     async (p) => {
       await runCliOkThrowing(
@@ -101,10 +102,10 @@ export function registerAzureTools(
     },
     "Scale an AKS node pool.",
     z.object({
-      subscriptionId: z.string().min(1),
-      resourceGroup: z.string().min(1),
-      clusterName: z.string().min(1),
-      poolName: z.string().min(1),
+      subscriptionId: azCliArg,
+      resourceGroup: azCliArg,
+      clusterName: azCliArg,
+      poolName: azCliArg,
       nodeCount: z.number().int().min(0),
     }),
     async (p) => {

package/connectors/bitbucket/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerBitbucketTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-bitbucket", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-bitbucket", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerBitbucketTools(server);
 

package/connectors/circleci/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerCircleciTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-circleci", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-circleci", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerCircleciTools(mcp);
 

package/connectors/cloud-logging/src/tools.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import {
+  cliArg,
   createCliJsonRunner,
   gcloudProjectArgs,
   isRecord,
@@ -8,7 +9,6 @@ import {
 import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { nimbusSpawn } from "../../../shared/nimbus-spawn.ts";
 import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
-import { assertSafeCliArg } from "../../../shared/safe-cli-arg.ts";
 
 /**
  * GCP Cloud Logging (Tier-3, no-row-data) MCP tool surface. ALL tools index log
@@ -75,15 +75,12 @@ export function registerCloudLoggingTools(reg: ZodToolRegistrar): void {
     "cloud_logging_get",
     "Fetch one Cloud Logging routing sink's configuration METADATA (`gcloud logging sinks describe <sink>`). Returns the sink's `name`, `destination`, `filter`, `description`, `disabled` flag, and create/update timestamps. No log-entry contents are returned — metadata only.",
     z.object({
-      sinkName: z.string().min(1),
+      // A bare positional to `gcloud logging sinks describe`, so it is refused here, at the
+      // schema, if gcloud would misread it: a value starting with "-" would be parsed as a flag.
+      sinkName: cliArg,
     }),
     async (p) => {
-      // `sinkName` is a bare positional to `gcloud logging sinks describe`; guard
-      // against argv flag smuggling (a value beginning with "-" would be parsed as
-      // a gcloud flag).
-      return jsonResult(
-        await gcloudLogging(["sinks", "describe", assertSafeCliArg(p.sinkName, "sinkName")]),
-      );
+      return jsonResult(await gcloudLogging(["sinks", "describe", p.sinkName]));
     },
   );
 

package/connectors/cloudwatch/src/tools.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import {
   asArray,
-  cliArg,
+  awsCliArg,
   createCliJsonRunner,
   isRecord,
   strField,
@@ -12,8 +12,9 @@ import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connect
 
 /**
  * A log-group name / prefix passed as a value to the `aws logs` CLI. Rejected at
- * the schema boundary if it begins with `-` (argv flag smuggling) or contains
- * control characters.
+ * the schema boundary (`awsCliArg`) if it begins with `-` (argv flag smuggling),
+ * contains control characters, or starts with a prefix that makes the CLI read the
+ * value from a file or a URL instead.
  */
 
 /**
@@ -65,7 +66,7 @@ export function registerCloudwatchTools(reg: ZodToolRegistrar): void {
     "cloudwatch_list",
     "List CloudWatch log GROUPS — METADATA ONLY (`aws logs describe-log-groups`). Each entry carries `logGroupName`, `arn`, `creationTime`, `retentionInDays`, `storedBytes`, and `metricFilterCount`. Optionally filter by a `prefix` on the log-group name. Never fetches log-event contents / row data.",
     z.object({
-      prefix: cliArg.optional(),
+      prefix: awsCliArg.optional(),
     }),
     async (p) => {
       const args = ["describe-log-groups", "--limit", LIMIT];
@@ -80,7 +81,7 @@ export function registerCloudwatchTools(reg: ZodToolRegistrar): void {
     "cloudwatch_get",
     "Fetch one CloudWatch log group's METADATA plus a stream summary. Returns the matching `describe-log-groups` entry (name, ARN, retention, stored bytes, metric-filter count) and the group's `describe-log-streams` METADATA (stream names, last-event timestamps, stored bytes) ordered by last activity. No log-event contents are returned — metadata only.",
     z.object({
-      logGroupName: cliArg,
+      logGroupName: awsCliArg,
     }),
     async (p) => {
       const group = await logsCli([

package/connectors/confluence/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerConfluenceTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-confluence", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-confluence", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerConfluenceTools(server);
 

package/connectors/fastmail/src/server.ts

@@ -1,9 +1,13 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { createFetchJmapClient } from "./jmap-client.ts";
 import { registerFastmailTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-fastmail", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-fastmail", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 registerFastmailTools(server, createFetchJmapClient());
 
 await server.connect(new StdioServerTransport());

package/connectors/gcp/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGcpTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-gcp", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-gcp", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGcpTools(mcp);
 

package/connectors/gcp/src/tools.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { gcloudEnv } from "../../../shared/cli-json-kit.ts";
+import { cliArg, gcloudEnv } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -40,7 +40,7 @@ export function registerGcpTools(
   reg(
     "gcp_cloud_run_service_list",
     "List Cloud Run services in a region.",
-    z.object({ projectId: z.string().min(1), region: z.string().min(1) }),
+    z.object({ projectId: cliArg, region: cliArg }),
     async (p) =>
       jsonResult(
         await gcloudJson([
@@ -62,10 +62,10 @@ export function registerGcpTools(
     },
     "Deploy a container image to Cloud Run.",
     z.object({
-      projectId: z.string().min(1),
-      region: z.string().min(1),
-      service: z.string().min(1),
-      image: z.string().min(1),
+      projectId: cliArg,
+      region: cliArg,
+      service: cliArg,
+      image: cliArg,
     }),
     async (p) => {
       await runCliOkThrowing(
@@ -94,11 +94,11 @@ export function registerGcpTools(
     },
     "Restart a GKE deployment rollout via kubectl (uses current cluster credentials).",
     z.object({
-      projectId: z.string().min(1),
-      location: z.string().min(1),
-      cluster: z.string().min(1),
-      namespace: z.string().min(1),
-      deployment: z.string().min(1),
+      projectId: cliArg,
+      location: cliArg,
+      cluster: cliArg,
+      namespace: cliArg,
+      deployment: cliArg,
     }),
     async (p) => {
       await runCliOkThrowing(

package/connectors/github/src/server.ts

@@ -1,10 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGithubTools } from "./tools.ts";
 
 const server = new McpServer(
   { name: "nimbus-github", version: "0.1.0" },
   {
+    capabilities: CONSENT_SERVER_CAPABILITIES,
     // Machine-readable security tiering, so a client can surface it rather than relying on a
     // human having read the NOTICE file.
     instructions:

package/connectors/github-actions/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGithubActionsTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-github-actions", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-github-actions", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGithubActionsTools(mcp);
 

package/connectors/gitlab/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGitlabTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-gitlab", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-gitlab", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGitlabTools(server);
 

package/connectors/gmail/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGmailTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-gmail", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-gmail", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGmailTools(server);
 

package/connectors/google-drive/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGoogleDriveTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-google-drive", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-google-drive", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGoogleDriveTools(server);
 

package/connectors/iac/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerIacTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-iac", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-iac", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerIacTools(mcp);