@onyxsecurity/mcp-gateway 1.0.6 → 1.0.7

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { ProxyType } from "./mcp-gateway-C0vm3vT0.js";
 import http from "node:http";
 import { EventStore } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { JSONRPCMessage, ServerCapabilities } from "@modelcontextprotocol/sdk/types.js";
@@ -8,7 +9,6 @@ import { StreamableHTTPClientTransportOptions } from "@modelcontextprotocol/sdk/
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 
 //#region src/InMemoryEventStore.d.ts
-
 /**
  * Simple in-memory implementation of the EventStore interface for resumability
  * This is primarily intended for examples and testing, not for production use
@@ -40,12 +40,115 @@ declare class InMemoryEventStore implements EventStore {
   private getStreamIdFromEventId;
 }
 //#endregion
+//#region src/utils/getUserData.d.ts
+interface RemoteSessionCliArgs extends SessionCliArgs {
+  proxyType: "remote";
+  url: string;
+}
+interface SessionCliArgs {
+  proxyType: ProxyType;
+}
+interface SessionData {
+  clientAppName?: string;
+  deviceName?: string;
+  email?: string;
+  parentProcessId?: number;
+  parentProcessName?: string;
+  processId?: number;
+  proxyType: ProxyType;
+  remoteCliArgs?: RemoteSessionCliArgs;
+  stdioCliArgs?: StdioSessionCliArgs;
+}
+interface StdioSessionCliArgs extends SessionCliArgs {
+  args: string[];
+  command: string;
+  proxyType: "stdio";
+}
+/**
+ * Retrieve user data including email from ~/.claude.json and device name
+ */
+//#endregion
+//#region src/accessControl/client.d.ts
+interface AccessControlClientConfig {
+  apiKey: string;
+  headers: Record<string, string>;
+  sessionData: SessionData;
+  timeoutMs: number;
+  url: string;
+}
+interface AccessControlResponse {
+  action: "allow" | "block";
+  reason?: string;
+}
+/**
+ * Client for checking MCP server access control with backend API.
+ * Always fails open (allows) when backend is unreachable.
+ */
+declare class AccessControlClient {
+  private clientInfoBase64;
+  private config;
+  constructor(config: AccessControlClientConfig);
+  /**
+   * Authorize by querying the backend with full client info.
+   * Always fails open (allows) on any error.
+   *
+   * @returns Access control response
+   */
+  authorize(): Promise<AccessControlResponse>;
+  /**
+   * Compress and base64-encode client info for URL.
+   * Matches scanner pattern.
+   */
+  private getClientInfoBase64;
+  /**
+   * Send authorization request to backend with compressed client info in URL.
+   * Matches scanner URL pattern: ${url}/${apiKey}/mcp/${clientInfoBase64}
+   *
+   * @returns Access control response
+   * @throws Error if request fails
+   */
+  private sendAuthorizeRequest;
+}
+//#endregion
+//#region src/accessControl/authorizer.d.ts
+interface AccessControlConfig {
+  client?: AccessControlClient;
+  enabled: boolean;
+}
+/**
+ * Authorizes MCP servers based on access control configuration.
+ * Queries backend with full client info for authorization decisions.
+ */
+declare class AccessControlAuthorizer {
+  private client?;
+  private enabled;
+  private lastBlockReason?;
+  constructor(config: AccessControlConfig);
+  /**
+   * Get human-readable reason for why a server was blocked.
+   * Returns the reason from the last authorization check, or a default message.
+   *
+   * @returns Reason message
+   */
+  getBlockReason(): string;
+  /**
+   * Check if access is allowed by querying the backend.
+   * Always fails open (allows) if backend is unavailable or not configured.
+   * Stores the block reason from the backend for later retrieval.
+   *
+   * @returns Promise resolving to true if allowed, false if blocked
+   */
+  isAllowed(): Promise<boolean>;
+}
+//#endregion
 //#region src/proxyServer.d.ts
 declare const proxyServer: ({
+  authorizer,
   client,
   server,
   serverCapabilities
 }: {
+  authorizer?: AccessControlAuthorizer;
   client: Client;
   server: Server;
   serverCapabilities: ServerCapabilities;

package/dist/index.js

@@ -1,2 +1,2 @@
-import{Client as e,InMemoryEventStore as t,SSEClientTransport as n,Server as r,StdioServerTransport as i,StreamableHTTPClientTransport as a,config as o,proxyServer as s,startHTTPServer as c}from"./stdio-7bVg-CUZ.js";let l=function(e){return e.HTTPStream=`HTTPStream`,e.SSE=`SSE`,e}({});const u=async({initStdioServer:t,initStreamClient:c,serverType:u,transportOptions:d={},url:f})=>{let p;switch(u){case l.SSE:p=new n(new URL(f),d);break;default:p=new a(new URL(f),d)}let m=c?await c():new e({name:`mcp-gateway`,version:o.appVersion},{capabilities:{}});await m.connect(p);let h=m.getServerVersion(),g=m.getServerCapabilities(),_=t?await t():new r(h,{capabilities:g}),v=new i;return await _.connect(v),await s({client:m,server:_,serverCapabilities:g}),_},d=(e,t)=>{let n=e.close.bind(e),r=e.onclose?.bind(e),i=e.onerror?.bind(e),a=e.onmessage?.bind(e),o=e.send.bind(e),s=e.start.bind(e);return e.close=async()=>(t({type:`close`}),n?.()),e.onclose=async()=>(t({type:`onclose`}),r?.()),e.onerror=async e=>(t({error:e,type:`onerror`}),i?.(e)),e.onmessage=async e=>(t({message:e,type:`onmessage`}),a?.(e)),e.send=async e=>(t({message:e,type:`send`}),o?.(e)),e.start=async()=>(t({type:`start`}),s?.()),e};export{t as InMemoryEventStore,l as ServerType,s as proxyServer,c as startHTTPServer,u as startStdioServer,d as tapTransport};
+import{Client as e,InMemoryEventStore as t,SSEClientTransport as n,Server as r,StdioServerTransport as i,StreamableHTTPClientTransport as a,config as o,proxyServer as s,startHTTPServer as c}from"./stdio-BzbVKxqR.js";let l=function(e){return e.HTTPStream=`HTTPStream`,e.SSE=`SSE`,e}({});const u=async({initStdioServer:t,initStreamClient:c,serverType:u,transportOptions:d={},url:f})=>{let p;switch(u){case l.SSE:p=new n(new URL(f),d);break;default:p=new a(new URL(f),d)}let m=c?await c():new e({name:`mcp-gateway`,version:o.appVersion},{capabilities:{}});await m.connect(p);let h=m.getServerVersion(),g=m.getServerCapabilities(),_=t?await t():new r(h,{capabilities:g}),v=new i;return await _.connect(v),await s({authorizer:void 0,client:m,server:_,serverCapabilities:g}),_},d=(e,t)=>{let n=e.close.bind(e),r=e.onclose?.bind(e),i=e.onerror?.bind(e),a=e.onmessage?.bind(e),o=e.send.bind(e),s=e.start.bind(e);return e.close=async()=>(t({type:`close`}),n?.()),e.onclose=async()=>(t({type:`onclose`}),r?.()),e.onerror=async e=>(t({error:e,type:`onerror`}),i?.(e)),e.onmessage=async e=>(t({message:e,type:`onmessage`}),a?.(e)),e.send=async e=>(t({message:e,type:`send`}),o?.(e)),e.start=async()=>(t({type:`start`}),s?.()),e};export{t as InMemoryEventStore,l as ServerType,s as proxyServer,c as startHTTPServer,u as startStdioServer,d as tapTransport};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["transport: SSEClientTransport | StreamableHTTPClientTransport"],"sources":["../src/startStdioServer.ts","../src/tapTransport.ts"],"sourcesContent":["import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport {\n\tSSEClientTransport,\n\ttype SSEClientTransportOptions,\n} from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport {\n\tStreamableHTTPClientTransport,\n\ttype StreamableHTTPClientTransportOptions,\n} from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\n\nimport { config } from \"./config/env.js\";\nimport { proxyServer } from \"./proxyServer.js\";\n\nexport enum ServerType {\n\tHTTPStream = \"HTTPStream\",\n\tSSE = \"SSE\",\n}\n\nexport const startStdioServer = async ({\n\tinitStdioServer,\n\tinitStreamClient,\n\tserverType,\n\ttransportOptions = {},\n\turl,\n}: {\n\tinitStdioServer?: () => Promise<Server>;\n\tinitStreamClient?: () => Promise<Client>;\n\tserverType: ServerType;\n\ttransportOptions?:\n\t\t| SSEClientTransportOptions\n\t\t| StreamableHTTPClientTransportOptions;\n\turl: string;\n}): Promise<Server> => {\n\tlet transport: SSEClientTransport | StreamableHTTPClientTransport;\n\tswitch (serverType) {\n\t\tcase ServerType.SSE:\n\t\t\ttransport = new SSEClientTransport(new URL(url), transportOptions);\n\t\t\tbreak;\n\t\tdefault:\n\t\t\ttransport = new StreamableHTTPClientTransport(\n\t\t\t\tnew URL(url),\n\t\t\t\ttransportOptions,\n\t\t\t);\n\t}\n\tconst streamClient = initStreamClient\n\t\t? await initStreamClient()\n\t\t: new Client(\n\t\t\t\t{\n\t\t\t\t\tname: \"mcp-gateway\",\n\t\t\t\t\tversion: config.appVersion,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tcapabilities: {},\n\t\t\t\t},\n\t\t\t);\n\n\tawait streamClient.connect(transport);\n\n\tconst serverVersion = streamClient.getServerVersion() as {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\n\tconst serverCapabilities = streamClient.getServerCapabilities() as {\n\t\tcapabilities: Record<string, unknown>;\n\t};\n\n\tconst stdioServer = initStdioServer\n\t\t? await initStdioServer()\n\t\t: new Server(serverVersion, {\n\t\t\t\tcapabilities: serverCapabilities,\n\t\t\t});\n\n\tconst stdioTransport = new StdioServerTransport();\n\n\tawait stdioServer.connect(stdioTransport);\n\n\tawait proxyServer({\n\t\tclient: streamClient,\n\t\tserver: stdioServer,\n\t\tserverCapabilities,\n\t});\n\n\treturn stdioServer;\n};\n","import { Transport } from \"@modelcontextprotocol/sdk/shared/transport.js\";\nimport { JSONRPCMessage } from \"@modelcontextprotocol/sdk/types.js\";\n\ntype TransportEvent =\n  | {\n      error: Error;\n      type: \"onerror\";\n    }\n  | {\n      message: JSONRPCMessage;\n      type: \"onmessage\";\n    }\n  | {\n      message: JSONRPCMessage;\n      type: \"send\";\n    }\n  | {\n      type: \"close\";\n    }\n  | {\n      type: \"onclose\";\n    }\n  | {\n      type: \"start\";\n    };\n\nexport const tapTransport = (\n  transport: Transport,\n  eventHandler: (event: TransportEvent) => void,\n): Transport => {\n  const originalClose = transport.close.bind(transport);\n  const originalOnClose = transport.onclose?.bind(transport);\n  const originalOnError = transport.onerror?.bind(transport);\n  const originalOnMessage = transport.onmessage?.bind(transport);\n  const originalSend = transport.send.bind(transport);\n  const originalStart = transport.start.bind(transport);\n\n  transport.close = async () => {\n    eventHandler({\n      type: \"close\",\n    });\n\n    return originalClose?.();\n  };\n\n  transport.onclose = async () => {\n    eventHandler({\n      type: \"onclose\",\n    });\n\n    return originalOnClose?.();\n  };\n\n  transport.onerror = async (error: Error) => {\n    eventHandler({\n      error,\n      type: \"onerror\",\n    });\n\n    return originalOnError?.(error);\n  };\n\n  transport.onmessage = async (message: JSONRPCMessage) => {\n    eventHandler({\n      message,\n      type: \"onmessage\",\n    });\n\n    return originalOnMessage?.(message);\n  };\n\n  transport.send = async (message: JSONRPCMessage) => {\n    eventHandler({\n      message,\n      type: \"send\",\n    });\n\n    return originalSend?.(message);\n  };\n\n  transport.start = async () => {\n    eventHandler({\n      type: \"start\",\n    });\n\n    return originalStart?.();\n  };\n\n  return transport;\n};\n"],"mappings":"wNAeA,IAAY,EAAA,SAAA,EAAL,OACN,GAAA,WAAA,aACA,EAAA,IAAA,aAGD,MAAa,EAAmB,MAAO,CACtC,kBACA,mBACA,aACA,mBAAmB,EAAE,CACrB,SASsB,CACtB,IAAIA,EACJ,OAAQ,EAAR,CACC,KAAK,EAAW,IACf,EAAY,IAAI,EAAmB,IAAI,IAAI,EAAI,CAAE,EAAiB,CAClE,MACD,QACC,EAAY,IAAI,EACf,IAAI,IAAI,EAAI,CACZ,EACA,CAEH,IAAM,EAAe,EAClB,MAAM,GAAkB,CACxB,IAAI,EACJ,CACC,KAAM,cACN,QAAS,EAAO,WAChB,CACD,CACC,aAAc,EAAE,CAChB,CACD,CAEH,MAAM,EAAa,QAAQ,EAAU,CAErC,IAAM,EAAgB,EAAa,kBAAkB,CAK/C,EAAqB,EAAa,uBAAuB,CAIzD,EAAc,EACjB,MAAM,GAAiB,CACvB,IAAI,EAAO,EAAe,CAC1B,aAAc,EACd,CAAC,CAEE,EAAiB,IAAI,EAU3B,OARA,MAAM,EAAY,QAAQ,EAAe,CAEzC,MAAM,EAAY,CACjB,OAAQ,EACR,OAAQ,EACR,qBACA,CAAC,CAEK,GC3DK,GACX,EACA,IACc,CACd,IAAM,EAAgB,EAAU,MAAM,KAAK,EAAU,CAC/C,EAAkB,EAAU,SAAS,KAAK,EAAU,CACpD,EAAkB,EAAU,SAAS,KAAK,EAAU,CACpD,EAAoB,EAAU,WAAW,KAAK,EAAU,CACxD,EAAe,EAAU,KAAK,KAAK,EAAU,CAC7C,EAAgB,EAAU,MAAM,KAAK,EAAU,CAqDrD,MAnDA,GAAU,MAAQ,UAChB,EAAa,CACX,KAAM,QACP,CAAC,CAEK,KAAiB,EAG1B,EAAU,QAAU,UAClB,EAAa,CACX,KAAM,UACP,CAAC,CAEK,KAAmB,EAG5B,EAAU,QAAU,KAAO,KACzB,EAAa,CACX,QACA,KAAM,UACP,CAAC,CAEK,IAAkB,EAAM,EAGjC,EAAU,UAAY,KAAO,KAC3B,EAAa,CACX,UACA,KAAM,YACP,CAAC,CAEK,IAAoB,EAAQ,EAGrC,EAAU,KAAO,KAAO,KACtB,EAAa,CACX,UACA,KAAM,OACP,CAAC,CAEK,IAAe,EAAQ,EAGhC,EAAU,MAAQ,UAChB,EAAa,CACX,KAAM,QACP,CAAC,CAEK,KAAiB,EAGnB"}
+{"version":3,"file":"index.js","names":["transport: SSEClientTransport | StreamableHTTPClientTransport"],"sources":["../src/startStdioServer.ts","../src/tapTransport.ts"],"sourcesContent":["import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport {\n\tSSEClientTransport,\n\ttype SSEClientTransportOptions,\n} from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport {\n\tStreamableHTTPClientTransport,\n\ttype StreamableHTTPClientTransportOptions,\n} from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\n\nimport { config } from \"./config/env.js\";\nimport { proxyServer } from \"./proxyServer.js\";\n\nexport enum ServerType {\n\tHTTPStream = \"HTTPStream\",\n\tSSE = \"SSE\",\n}\n\nexport const startStdioServer = async ({\n\tinitStdioServer,\n\tinitStreamClient,\n\tserverType,\n\ttransportOptions = {},\n\turl,\n}: {\n\tinitStdioServer?: () => Promise<Server>;\n\tinitStreamClient?: () => Promise<Client>;\n\tserverType: ServerType;\n\ttransportOptions?:\n\t\t| SSEClientTransportOptions\n\t\t| StreamableHTTPClientTransportOptions;\n\turl: string;\n}): Promise<Server> => {\n\tlet transport: SSEClientTransport | StreamableHTTPClientTransport;\n\tswitch (serverType) {\n\t\tcase ServerType.SSE:\n\t\t\ttransport = new SSEClientTransport(new URL(url), transportOptions);\n\t\t\tbreak;\n\t\tdefault:\n\t\t\ttransport = new StreamableHTTPClientTransport(\n\t\t\t\tnew URL(url),\n\t\t\t\ttransportOptions,\n\t\t\t);\n\t}\n\tconst streamClient = initStreamClient\n\t\t? await initStreamClient()\n\t\t: new Client(\n\t\t\t\t{\n\t\t\t\t\tname: \"mcp-gateway\",\n\t\t\t\t\tversion: config.appVersion,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tcapabilities: {},\n\t\t\t\t},\n\t\t\t);\n\n\tawait streamClient.connect(transport);\n\n\tconst serverVersion = streamClient.getServerVersion() as {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\n\tconst serverCapabilities = streamClient.getServerCapabilities() as {\n\t\tcapabilities: Record<string, unknown>;\n\t};\n\n\tconst stdioServer = initStdioServer\n\t\t? await initStdioServer()\n\t\t: new Server(serverVersion, {\n\t\t\t\tcapabilities: serverCapabilities,\n\t\t\t});\n\n\tconst stdioTransport = new StdioServerTransport();\n\n\tawait stdioServer.connect(stdioTransport);\n\n\tawait proxyServer({\n\t\tauthorizer: undefined,\n\t\tclient: streamClient,\n\t\tserver: stdioServer,\n\t\tserverCapabilities,\n\t});\n\n\treturn stdioServer;\n};\n","import { Transport } from \"@modelcontextprotocol/sdk/shared/transport.js\";\nimport { JSONRPCMessage } from \"@modelcontextprotocol/sdk/types.js\";\n\ntype TransportEvent =\n  | {\n      error: Error;\n      type: \"onerror\";\n    }\n  | {\n      message: JSONRPCMessage;\n      type: \"onmessage\";\n    }\n  | {\n      message: JSONRPCMessage;\n      type: \"send\";\n    }\n  | {\n      type: \"close\";\n    }\n  | {\n      type: \"onclose\";\n    }\n  | {\n      type: \"start\";\n    };\n\nexport const tapTransport = (\n  transport: Transport,\n  eventHandler: (event: TransportEvent) => void,\n): Transport => {\n  const originalClose = transport.close.bind(transport);\n  const originalOnClose = transport.onclose?.bind(transport);\n  const originalOnError = transport.onerror?.bind(transport);\n  const originalOnMessage = transport.onmessage?.bind(transport);\n  const originalSend = transport.send.bind(transport);\n  const originalStart = transport.start.bind(transport);\n\n  transport.close = async () => {\n    eventHandler({\n      type: \"close\",\n    });\n\n    return originalClose?.();\n  };\n\n  transport.onclose = async () => {\n    eventHandler({\n      type: \"onclose\",\n    });\n\n    return originalOnClose?.();\n  };\n\n  transport.onerror = async (error: Error) => {\n    eventHandler({\n      error,\n      type: \"onerror\",\n    });\n\n    return originalOnError?.(error);\n  };\n\n  transport.onmessage = async (message: JSONRPCMessage) => {\n    eventHandler({\n      message,\n      type: \"onmessage\",\n    });\n\n    return originalOnMessage?.(message);\n  };\n\n  transport.send = async (message: JSONRPCMessage) => {\n    eventHandler({\n      message,\n      type: \"send\",\n    });\n\n    return originalSend?.(message);\n  };\n\n  transport.start = async () => {\n    eventHandler({\n      type: \"start\",\n    });\n\n    return originalStart?.();\n  };\n\n  return transport;\n};\n"],"mappings":"wNAeA,IAAY,EAAA,SAAA,EAAL,OACN,GAAA,WAAA,aACA,EAAA,IAAA,aAGD,MAAa,EAAmB,MAAO,CACtC,kBACA,mBACA,aACA,mBAAmB,EAAE,CACrB,SASsB,CACtB,IAAIA,EACJ,OAAQ,EAAR,CACC,KAAK,EAAW,IACf,EAAY,IAAI,EAAmB,IAAI,IAAI,EAAI,CAAE,EAAiB,CAClE,MACD,QACC,EAAY,IAAI,EACf,IAAI,IAAI,EAAI,CACZ,EACA,CAEH,IAAM,EAAe,EAClB,MAAM,GAAkB,CACxB,IAAI,EACJ,CACC,KAAM,cACN,QAAS,EAAO,WAChB,CACD,CACC,aAAc,EAAE,CAChB,CACD,CAEH,MAAM,EAAa,QAAQ,EAAU,CAErC,IAAM,EAAgB,EAAa,kBAAkB,CAK/C,EAAqB,EAAa,uBAAuB,CAIzD,EAAc,EACjB,MAAM,GAAiB,CACvB,IAAI,EAAO,EAAe,CAC1B,aAAc,EACd,CAAC,CAEE,EAAiB,IAAI,EAW3B,OATA,MAAM,EAAY,QAAQ,EAAe,CAEzC,MAAM,EAAY,CACjB,WAAY,IAAA,GACZ,OAAQ,EACR,OAAQ,EACR,qBACA,CAAC,CAEK,GC5DK,GACX,EACA,IACc,CACd,IAAM,EAAgB,EAAU,MAAM,KAAK,EAAU,CAC/C,EAAkB,EAAU,SAAS,KAAK,EAAU,CACpD,EAAkB,EAAU,SAAS,KAAK,EAAU,CACpD,EAAoB,EAAU,WAAW,KAAK,EAAU,CACxD,EAAe,EAAU,KAAK,KAAK,EAAU,CAC7C,EAAgB,EAAU,MAAM,KAAK,EAAU,CAqDrD,MAnDA,GAAU,MAAQ,UAChB,EAAa,CACX,KAAM,QACP,CAAC,CAEK,KAAiB,EAG1B,EAAU,QAAU,UAClB,EAAa,CACX,KAAM,UACP,CAAC,CAEK,KAAmB,EAG5B,EAAU,QAAU,KAAO,KACzB,EAAa,CACX,QACA,KAAM,UACP,CAAC,CAEK,IAAkB,EAAM,EAGjC,EAAU,UAAY,KAAO,KAC3B,EAAa,CACX,UACA,KAAM,YACP,CAAC,CAEK,IAAoB,EAAQ,EAGrC,EAAU,KAAO,KAAO,KACtB,EAAa,CACX,UACA,KAAM,OACP,CAAC,CAEK,IAAe,EAAQ,EAGhC,EAAU,MAAQ,UAChB,EAAa,CACX,KAAM,QACP,CAAC,CAEK,KAAiB,EAGnB"}

package/dist/mcp-gateway-C0vm3vT0.d.ts

@@ -0,0 +1,5 @@
+//#region src/bin/mcp-gateway.d.ts
+type ProxyType = "remote" | "stdio";
+//#endregion
+export { ProxyType };
+//# sourceMappingURL=mcp-gateway-C0vm3vT0.d.ts.map