@openagentid/mcp 0.1.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/README.md +63 -161
- package/dist/client.cjs +3 -14
- package/dist/client.cjs.map +1 -1
- package/dist/client.d.cts +1 -1
- package/dist/client.d.ts +1 -1
- package/dist/client.js +3 -14
- package/dist/client.js.map +1 -1
- package/dist/index.cjs +123 -25
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +33 -1
- package/dist/index.d.ts +33 -1
- package/dist/index.js +122 -26
- package/dist/index.js.map +1 -1
- package/dist/server.cjs +53 -11
- package/dist/server.cjs.map +1 -1
- package/dist/server.d.cts +4 -0
- package/dist/server.d.ts +4 -0
- package/dist/server.js +53 -11
- package/dist/server.js.map +1 -1
- package/dist/types.cjs.map +1 -1
- package/dist/types.d.cts +12 -7
- package/dist/types.d.ts +12 -7
- package/dist/types.js.map +1 -1
- package/package.json +10 -7
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.2.0 — 2026-10-12
|
|
4
|
+
|
|
5
|
+
- Current SDK workspace adapters use real Ed25519 proofs with caller/tool/argument-bound challenges, receiver-owned scopes, replay and revocation checks. Raw wire requests are captured before schema parsing so defaults, transforms and stripped fields preserve binding. Client mutations run before signing; native MCP integration and stdio example cover the complete path.
|
|
6
|
+
|
|
3
7
|
All notable changes to `@openagent/mcp` are documented in this file.
|
|
4
8
|
|
|
5
9
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
package/README.md
CHANGED
|
@@ -1,170 +1,72 @@
|
|
|
1
1
|
# @openagentid/mcp
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Authenticated Model Context Protocol tools using the current OpenAgentID SDK.
|
|
4
|
+
Works with SDK `^0.7.2` and MCP SDK `^1.27.0`.
|
|
4
5
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
## Install
|
|
8
|
-
|
|
9
|
-
```bash
|
|
10
|
-
npm install @openagentid/mcp @modelcontextprotocol/sdk @openagentid/sdk
|
|
11
|
-
```
|
|
12
|
-
|
|
13
|
-
## Server: add auth to MCP in 3 lines
|
|
14
|
-
|
|
15
|
-
```ts
|
|
16
|
-
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
|
|
17
|
-
import { withOpenAgent } from '@openagentid/mcp';
|
|
18
|
-
import { agent } from './my-agent.js';
|
|
19
|
-
|
|
20
|
-
const server = new McpServer({ name: 'my-tools', version: '0.1.0' });
|
|
21
|
-
|
|
22
|
-
const authedServer = withOpenAgent(server, {
|
|
23
|
-
agent,
|
|
24
|
-
requireScopes: (toolName) => [`mcp:${toolName}:invoke`],
|
|
25
|
-
});
|
|
26
|
-
|
|
27
|
-
authedServer.registerTool(
|
|
28
|
-
'search_web',
|
|
29
|
-
{ description: 'search the web', inputSchema: { q: z.string() } },
|
|
30
|
-
async ({ q }) => ({ content: [{ type: 'text', text: `results for ${q}` }] }),
|
|
31
|
-
);
|
|
32
|
-
```
|
|
33
|
-
|
|
34
|
-
That is it. Every tool call now:
|
|
35
|
-
|
|
36
|
-
1. Pulls the identity envelope from `extra._meta.openagent.identity`.
|
|
37
|
-
2. Verifies it against your `IdentityVerifier` (OAS DID + Arsenal ACT + AEGIS policy).
|
|
38
|
-
3. Enforces the per-tool scopes returned by `requireScopes`.
|
|
39
|
-
4. Runs the optional `skillsPolicy` hook (consults SKILLS.md-style rules).
|
|
40
|
-
5. Runs the user's tool body.
|
|
41
|
-
6. Stamps `audit_id`, `verified_did`, and `scopes` into the response `_meta.openagent`.
|
|
42
|
-
|
|
43
|
-
## Client: sign every outbound call
|
|
44
|
-
|
|
45
|
-
```ts
|
|
46
|
-
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
|
|
47
|
-
import { withOpenAgentClient } from '@openagentid/mcp';
|
|
48
|
-
import { agent } from './my-agent.js';
|
|
49
|
-
|
|
50
|
-
const client = new Client({ name: 'my-agent', version: '0.1.0' });
|
|
51
|
-
const authedClient = withOpenAgentClient(client, {
|
|
52
|
-
agent,
|
|
53
|
-
audience: 'did:oas:vendor:tools-server',
|
|
54
|
-
});
|
|
55
|
-
|
|
56
|
-
await authedClient.callTool({
|
|
57
|
-
name: 'search_web',
|
|
58
|
-
arguments: { q: 'mcp' },
|
|
59
|
-
});
|
|
60
|
-
```
|
|
61
|
-
|
|
62
|
-
The interceptor wraps `callTool` only — `listTools`, `listResources`, `getPrompt`, and every other client method pass straight through.
|
|
63
|
-
|
|
64
|
-
## Hooks
|
|
65
|
-
|
|
66
|
-
`withOpenAgent` accepts three optional hooks plus the skills policy:
|
|
67
|
-
|
|
68
|
-
```ts
|
|
69
|
-
withOpenAgent(server, {
|
|
70
|
-
agent,
|
|
71
|
-
preCall: ({ toolName, identity }) => {
|
|
72
|
-
metrics.increment('mcp.tool.calls', { tool: toolName, did: identity.did });
|
|
73
|
-
},
|
|
74
|
-
postCall: ({ toolName, identity, durationMs, result }) => {
|
|
75
|
-
audit.write({ tool: toolName, did: identity.did, ms: durationMs });
|
|
76
|
-
},
|
|
77
|
-
onError: ({ toolName, identity, error }) => {
|
|
78
|
-
audit.writeError({ tool: toolName, did: identity?.did ?? null, error });
|
|
79
|
-
},
|
|
80
|
-
});
|
|
6
|
+
```sh
|
|
7
|
+
npm install @openagentid/sdk@^0.7.2 @openagentid/mcp@0.2.0 @modelcontextprotocol/sdk@^1.27.0 zod
|
|
81
8
|
```
|
|
82
9
|
|
|
83
|
-
##
|
|
10
|
+
## Run a real server and client
|
|
84
11
|
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
call.
|
|
12
|
+
The [complete stdio example](https://github.com/OpenAgentID/openagent-sdk/tree/main/examples/typescript/02-mcp-server)
|
|
13
|
+
creates real Ed25519 identities in separate signer and receiver workspaces,
|
|
14
|
+
starts a separate MCP server process, authenticates a tool call and verifies
|
|
15
|
+
unsigned and revoked callers are rejected. It needs no hosted account or API key.
|
|
90
16
|
|
|
91
|
-
```
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
} from '@openagentid/mcp';
|
|
97
|
-
|
|
98
|
-
const skillsPolicy = createSkillsPolicy({
|
|
99
|
-
store: new InMemorySkillsPolicyStore([
|
|
100
|
-
{ skillName: 'cook_dinner', dids: ['did:oas:org:kitchen:agent:alice'] },
|
|
101
|
-
{ skillName: 'order_pizza', dids: null }, // any verified caller
|
|
102
|
-
]),
|
|
103
|
-
});
|
|
104
|
-
|
|
105
|
-
withOpenAgent(server, { agent, skillsPolicy });
|
|
106
|
-
```
|
|
107
|
-
|
|
108
|
-
You can also write your own store that reads from `SKILLS.md` files, a
|
|
109
|
-
remote service, or AEGIS policy bundles — just implement the
|
|
110
|
-
`SkillsPolicyStore` interface.
|
|
111
|
-
|
|
112
|
-
## Errors
|
|
113
|
-
|
|
114
|
-
Every middleware-rejected call surfaces a typed error:
|
|
115
|
-
|
|
116
|
-
| Error | Code | When |
|
|
117
|
-
| ------------------------------ | -------- | ----------------------------------------------- |
|
|
118
|
-
| `MissingIdentityError` | `-32001` | `_meta.openagent.identity` was absent |
|
|
119
|
-
| `IdentityVerificationError` | `-32001` | The verifier rejected the envelope |
|
|
120
|
-
| `AuthorizationDeniedError` | `-32002` | Caller does not hold the required scopes |
|
|
121
|
-
| `SkillsPolicyDeniedError` | `-32003` | The skills policy hook returned `allow: false` |
|
|
122
|
-
|
|
123
|
-
All extend `OpenAgentMcpError`, which carries a `code`, `message`, and
|
|
124
|
-
optional `data` payload — ready for serialization through the JSON-RPC
|
|
125
|
-
error envelope the MCP SDK expects.
|
|
126
|
-
|
|
127
|
-
## Configuration reference
|
|
128
|
-
|
|
129
|
-
```ts
|
|
130
|
-
interface OpenAgentMcpConfig {
|
|
131
|
-
agent: Agent;
|
|
132
|
-
requireScopes?: (toolName: string, args: unknown) => readonly string[];
|
|
133
|
-
requireIdentity?: boolean; // default: true
|
|
134
|
-
skillsPolicy?: SkillsPolicyHook;
|
|
135
|
-
preCall?: PreCallHook;
|
|
136
|
-
postCall?: PostCallHook;
|
|
137
|
-
onError?: ErrorHook;
|
|
138
|
-
scopeFormat?: (toolName: string) => string;
|
|
139
|
-
}
|
|
17
|
+
```sh
|
|
18
|
+
git clone https://github.com/OpenAgentID/openagent-sdk.git
|
|
19
|
+
cd openagent-sdk/examples/typescript/02-mcp-server
|
|
20
|
+
npm install
|
|
21
|
+
npm start
|
|
140
22
|
```
|
|
141
23
|
|
|
142
|
-
##
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
The
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
`
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
-
|
|
163
|
-
|
|
164
|
-
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
24
|
+
## Current SDK adapters
|
|
25
|
+
|
|
26
|
+
`createWorkspaceMcpServer({ workspace, did, authorize })` returns an `agent`
|
|
27
|
+
for `withOpenAgent(server, { agent })` and an `issueChallenge` method.
|
|
28
|
+
Expose challenge issuance on your trusted MCP transport before wrapping the
|
|
29
|
+
server. `authorize(verifiedIdentity)` obtains scopes from your receiver policy.
|
|
30
|
+
Identity trust alone never grants tool access.
|
|
31
|
+
|
|
32
|
+
`createWorkspaceMcpClient({ workspace, did, audience, issueChallenge })` returns
|
|
33
|
+
an agent for `withOpenAgentClient(client, { agent })`. Its challenge callback
|
|
34
|
+
calls the receiver's challenge endpoint. The audience is explicit and must
|
|
35
|
+
match the receiver; no keys travel in request metadata.
|
|
36
|
+
|
|
37
|
+
The receiver binds each nonce to the DID, tool name and canonical JSON arguments.
|
|
38
|
+
The SDK verifies the signature, current trust, revocation and replay state. The
|
|
39
|
+
middleware then checks `mcp:<tool>:invoke` scopes and any configured skills policy.
|
|
40
|
+
Argument-changing `beforeCall` hooks run **before** signing. Custom verifiers
|
|
41
|
+
receive the original transmitted tool request as their third argument, captured
|
|
42
|
+
at the public MCP transport boundary before schema parsing. Authorization policies
|
|
43
|
+
and tool handlers receive the parsed arguments. Defaults, coercion, transforms and
|
|
44
|
+
unknown-field stripping therefore work without weakening request binding.
|
|
45
|
+
|
|
46
|
+
The workspace adapter is a single-process challenge coordinator backed by durable
|
|
47
|
+
SDK trust/replay state. Keep one adapter alive for the process lifetime. Restart
|
|
48
|
+
invalidates outstanding challenges. Distributed deployments should supply a
|
|
49
|
+
shared atomic challenge authority through the custom `Agent` contract. The standard MCP server transport
|
|
50
|
+
keeps raw request context isolated across asynchronous concurrent calls. Custom
|
|
51
|
+
server implementations without a transport use the arguments they pass directly
|
|
52
|
+
to the middleware callback.
|
|
53
|
+
|
|
54
|
+
## Policy and audit
|
|
55
|
+
|
|
56
|
+
- `requireScopes(toolName, args)` overrides the per-tool scope set.
|
|
57
|
+
- `scopeFormat(toolName)` customizes the default scope name.
|
|
58
|
+
- `createSkillsPolicy` rejects unlisted skill names and unauthorized DIDs.
|
|
59
|
+
- `preCall`, `postCall` and `onError` receive verified identity context.
|
|
60
|
+
- Results include `_meta.openagent` with `verified_did`, scopes and an audit ID.
|
|
61
|
+
|
|
62
|
+
`requireIdentity: false` explicitly permits anonymous calls; do not enable it
|
|
63
|
+
on protected tools. Callbacks and bespoke `Agent` implementations are trusted
|
|
64
|
+
application configuration, not substitutes for signature verification.
|
|
65
|
+
|
|
66
|
+
## Migration from 0.1
|
|
67
|
+
|
|
68
|
+
The SDK's `OpenAgentInstance` was never the adapter's `Agent` interface. Use the
|
|
69
|
+
workspace factories or implement the declared signing/verifier contract. The
|
|
70
|
+
new factories make that conversion explicit and exercise the current SDK with
|
|
71
|
+
real keys. Existing custom adapters remain supported; bind the verifier's new
|
|
72
|
+
`request` argument to your signed request data.
|
package/dist/client.cjs
CHANGED
|
@@ -40,24 +40,13 @@ var ClientInterceptor = class {
|
|
|
40
40
|
wrapCallTool(original, thisArg) {
|
|
41
41
|
const interceptor = this;
|
|
42
42
|
return async function wrappedCallTool(params, ...rest) {
|
|
43
|
-
const
|
|
44
|
-
|
|
45
|
-
if (interceptor.beforeCall !== void 0) {
|
|
46
|
-
const replacement = await Promise.resolve(
|
|
47
|
-
interceptor.beforeCall(signed)
|
|
48
|
-
);
|
|
49
|
-
if (replacement !== void 0) {
|
|
50
|
-
toSend = {
|
|
51
|
-
...replacement,
|
|
52
|
-
_meta: replacement._meta ?? signed._meta
|
|
53
|
-
};
|
|
54
|
-
}
|
|
55
|
-
}
|
|
43
|
+
const replacement = await interceptor.beforeCall?.(params);
|
|
44
|
+
const toSend = await interceptor.signParams(replacement ?? params);
|
|
56
45
|
return original.call(thisArg, toSend, ...rest);
|
|
57
46
|
};
|
|
58
47
|
}
|
|
59
48
|
async signParams(params) {
|
|
60
|
-
const identity = await this.agent.signRequest(params.name, this.audience);
|
|
49
|
+
const identity = await this.agent.signRequest(params.name, this.audience, params.arguments);
|
|
61
50
|
const existingMeta = params._meta ?? {};
|
|
62
51
|
const existingOpenAgent = typeof existingMeta["openagent"] === "object" && existingMeta["openagent"] !== null ? existingMeta["openagent"] : {};
|
|
63
52
|
return {
|
package/dist/client.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";;;AAqEO,SAAS,mBAAA,CACd,QACA,MAAA,EACG;AACH,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACjD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,MAAA,CAAO,UAAU,IAAA,EAAM;AACvD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,KAAA,CAAM,WAAA,KAAgB,UAAA,EAAY;AAClD,IAAA,MAAM,IAAI,UAAU,qDAAqD,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,CAAkB,MAAM,CAAA;AAEhD,EAAA,OAAO,IAAI,MAAM,MAAA,EAAQ;AAAA,IACvB,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,QAAA,EAAU;AAC9B,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,UAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,QAAA,OAAO,WAAA,CAAY,YAAA;AAAA,UACjB,KAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,IAC1B;AAAA,GACD,CAAA;AACH;AAEA,IAAM,oBAAN,MAAwB;AAAA,EACL,KAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,MAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AACpB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,UAAA;AAAA,EAC3B;AAAA,EAEA,YAAA,CACE,UACA,OAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,IAAA;AACpB,IAAA,OAAO,eAAe,eAAA,CAEpB,MAAA,EAAA,GAKG,IAAA,EACe;
|
|
1
|
+
{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";;;AAqEO,SAAS,mBAAA,CACd,QACA,MAAA,EACG;AACH,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACjD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,MAAA,CAAO,UAAU,IAAA,EAAM;AACvD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,KAAA,CAAM,WAAA,KAAgB,UAAA,EAAY;AAClD,IAAA,MAAM,IAAI,UAAU,qDAAqD,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,CAAkB,MAAM,CAAA;AAEhD,EAAA,OAAO,IAAI,MAAM,MAAA,EAAQ;AAAA,IACvB,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,QAAA,EAAU;AAC9B,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,UAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,QAAA,OAAO,WAAA,CAAY,YAAA;AAAA,UACjB,KAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,IAC1B;AAAA,GACD,CAAA;AACH;AAEA,IAAM,oBAAN,MAAwB;AAAA,EACL,KAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,MAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AACpB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,UAAA;AAAA,EAC3B;AAAA,EAEA,YAAA,CACE,UACA,OAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,IAAA;AACpB,IAAA,OAAO,eAAe,eAAA,CAEpB,MAAA,EAAA,GAKG,IAAA,EACe;AAElB,MAAA,MAAM,WAAA,GAAc,MAAM,WAAA,CAAY,UAAA,GAAa,MAAM,CAAA;AACzD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,UAAA,CAAW,eAAe,MAAM,CAAA;AACjE,MAAA,OAAO,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,GAAG,IAAI,CAAA;AAAA,IAC/C,CAAA;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,MAAA,EAQtB;AACD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,OAAO,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,MAAA,CAAO,SAAS,CAAA;AAC1F,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,KAAA,IAAS,EAAC;AACtC,IAAA,MAAM,iBAAA,GACJ,OAAO,YAAA,CAAa,WAAW,CAAA,KAAM,QAAA,IACrC,YAAA,CAAa,WAAW,CAAA,KAAM,IAAA,GACzB,YAAA,CAAa,WAAW,IACzB,EAAC;AACP,IAAA,OAAO;AAAA,MACL,GAAG,MAAA;AAAA,MACH,KAAA,EAAO;AAAA,QACL,GAAG,YAAA;AAAA,QACH,SAAA,EAAW;AAAA,UACT,GAAG,iBAAA;AAAA,UACH;AAAA;AACF;AACF,KACF;AAAA,EACF;AACF,CAAA;AAOO,SAAS,kBAAkB,QAAA,EAKN;AAC1B,EAAA,OAAO;AAAA,IACL,SAAA,EAAW;AAAA,MACT,QAAA,EAAU;AAAA,QACR,KAAK,QAAA,CAAS,GAAA;AAAA,QACd,OAAO,QAAA,CAAS,KAAA;AAAA,QAChB,GAAI,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,QAAA,CAAS,KAAA,EAAM,GAAI,EAAC;AAAA,QAChE,GAAI,SAAS,OAAA,KAAY,MAAA,GACrB,EAAE,OAAA,EAAS,QAAA,CAAS,OAAA,EAAQ,GAC5B;AAAC;AACP;AACF,GACF;AACF","file":"client.cjs","sourcesContent":["/**\n * Client-side interceptor for @openagentid/mcp.\n *\n * Adds an OpenAgent identity envelope (`_meta.openagent.identity`) to\n * outbound MCP `tools/call` requests so an authenticated server can\n * verify the caller. The interceptor wraps the MCP client's `callTool`\n * method via a JavaScript Proxy — the rest of the client surface (list\n * tools, list resources, prompts) is forwarded unchanged.\n *\n * Usage:\n *\n * ```ts\n * import { Client } from '@modelcontextprotocol/sdk/client/index.js';\n * import { withOpenAgentClient } from '@openagentid/mcp/client';\n *\n * const client = new Client({ name: 'my-agent', version: '0.1.0' });\n * const authedClient = withOpenAgentClient(client, { agent });\n *\n * await authedClient.callTool({ name: 'search_web', arguments: { q: 'mcp' } });\n * ```\n */\n\nimport { Agent } from './types.js';\n\n/**\n * Minimal MCP client surface used by the interceptor. Like the server\n * adapter, we describe just the methods we need to keep peer-dep\n * compatibility broad.\n */\nexport interface McpClientLike {\n callTool(\n params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n },\n ...rest: unknown[]\n ): Promise<unknown>;\n}\n\nexport interface OpenAgentClientConfig {\n /** The agent doing the calling — used to sign each request. */\n agent: Pick<Agent, 'did' | 'signRequest'>;\n /**\n * Optional audience DID. When set, it is passed to\n * {@link Agent.signRequest} so the proof can be bound to a specific\n * server. Most production deployments should set this.\n */\n audience?: string;\n /**\n * Optional hook fired before every outbound call. Use it for client-\n * side metrics or to mutate the params (e.g., add tracing headers).\n * Returning a value replaces the params.\n */\n beforeCall?: (params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n }) => Promise<\n | { name: string; arguments?: Record<string, unknown>; _meta?: Record<string, unknown> }\n | void\n > | { name: string; arguments?: Record<string, unknown>; _meta?: Record<string, unknown> }\n | void;\n}\n\n/**\n * Wrap an MCP client so every outbound `callTool` carries an OpenAgent\n * identity envelope.\n */\nexport function withOpenAgentClient<T extends McpClientLike>(\n client: T,\n config: OpenAgentClientConfig,\n): T {\n if (config === null || typeof config !== 'object') {\n throw new TypeError('OpenAgentClientConfig must be an object');\n }\n if (config.agent === undefined || config.agent === null) {\n throw new TypeError('OpenAgentClientConfig.agent is required');\n }\n if (typeof config.agent.signRequest !== 'function') {\n throw new TypeError('OpenAgentClientConfig.agent.signRequest is required');\n }\n\n const interceptor = new ClientInterceptor(config);\n\n return new Proxy(client, {\n get(target, property, receiver) {\n const value = Reflect.get(target, property, receiver);\n if (typeof value !== 'function') {\n return value;\n }\n if (property === 'callTool') {\n return interceptor.wrapCallTool(\n value as McpClientLike['callTool'],\n target,\n );\n }\n return value.bind(target);\n },\n }) as T;\n}\n\nclass ClientInterceptor {\n private readonly agent: Pick<Agent, 'did' | 'signRequest'>;\n private readonly audience: string | undefined;\n private readonly beforeCall: OpenAgentClientConfig['beforeCall'];\n\n constructor(config: OpenAgentClientConfig) {\n this.agent = config.agent;\n this.audience = config.audience;\n this.beforeCall = config.beforeCall;\n }\n\n wrapCallTool(\n original: McpClientLike['callTool'],\n thisArg: unknown,\n ): McpClientLike['callTool'] {\n const interceptor = this;\n return async function wrappedCallTool(\n this: unknown,\n params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n },\n ...rest: unknown[]\n ): Promise<unknown> {\n // Mutate first; the signature must cover the actual transmitted call.\n const replacement = await interceptor.beforeCall?.(params);\n const toSend = await interceptor.signParams(replacement ?? params);\n return original.call(thisArg, toSend, ...rest);\n };\n }\n\n private async signParams(params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n }): Promise<{\n name: string;\n arguments?: Record<string, unknown>;\n _meta: Record<string, unknown>;\n }> {\n const identity = await this.agent.signRequest(params.name, this.audience, params.arguments);\n const existingMeta = params._meta ?? {};\n const existingOpenAgent =\n typeof existingMeta['openagent'] === 'object' &&\n existingMeta['openagent'] !== null\n ? (existingMeta['openagent'] as Record<string, unknown>)\n : {};\n return {\n ...params,\n _meta: {\n ...existingMeta,\n openagent: {\n ...existingOpenAgent,\n identity,\n },\n },\n };\n }\n}\n\n/**\n * Helper for tests and tools that want to construct the identity\n * envelope manually without going through a full Agent. Returns a `_meta`\n * object that can be merged into a CallToolRequest's params.\n */\nexport function buildIdentityMeta(identity: {\n did: string;\n proof: string;\n nonce?: string;\n context?: Record<string, unknown>;\n}): Record<string, unknown> {\n return {\n openagent: {\n identity: {\n did: identity.did,\n proof: identity.proof,\n ...(identity.nonce !== undefined ? { nonce: identity.nonce } : {}),\n ...(identity.context !== undefined\n ? { context: identity.context }\n : {}),\n },\n },\n };\n}\n"]}
|
package/dist/client.d.cts
CHANGED
|
@@ -36,7 +36,7 @@ interface McpClientLike {
|
|
|
36
36
|
}
|
|
37
37
|
interface OpenAgentClientConfig {
|
|
38
38
|
/** The agent doing the calling — used to sign each request. */
|
|
39
|
-
agent: Agent
|
|
39
|
+
agent: Pick<Agent, 'did' | 'signRequest'>;
|
|
40
40
|
/**
|
|
41
41
|
* Optional audience DID. When set, it is passed to
|
|
42
42
|
* {@link Agent.signRequest} so the proof can be bound to a specific
|
package/dist/client.d.ts
CHANGED
|
@@ -36,7 +36,7 @@ interface McpClientLike {
|
|
|
36
36
|
}
|
|
37
37
|
interface OpenAgentClientConfig {
|
|
38
38
|
/** The agent doing the calling — used to sign each request. */
|
|
39
|
-
agent: Agent
|
|
39
|
+
agent: Pick<Agent, 'did' | 'signRequest'>;
|
|
40
40
|
/**
|
|
41
41
|
* Optional audience DID. When set, it is passed to
|
|
42
42
|
* {@link Agent.signRequest} so the proof can be bound to a specific
|
package/dist/client.js
CHANGED
|
@@ -38,24 +38,13 @@ var ClientInterceptor = class {
|
|
|
38
38
|
wrapCallTool(original, thisArg) {
|
|
39
39
|
const interceptor = this;
|
|
40
40
|
return async function wrappedCallTool(params, ...rest) {
|
|
41
|
-
const
|
|
42
|
-
|
|
43
|
-
if (interceptor.beforeCall !== void 0) {
|
|
44
|
-
const replacement = await Promise.resolve(
|
|
45
|
-
interceptor.beforeCall(signed)
|
|
46
|
-
);
|
|
47
|
-
if (replacement !== void 0) {
|
|
48
|
-
toSend = {
|
|
49
|
-
...replacement,
|
|
50
|
-
_meta: replacement._meta ?? signed._meta
|
|
51
|
-
};
|
|
52
|
-
}
|
|
53
|
-
}
|
|
41
|
+
const replacement = await interceptor.beforeCall?.(params);
|
|
42
|
+
const toSend = await interceptor.signParams(replacement ?? params);
|
|
54
43
|
return original.call(thisArg, toSend, ...rest);
|
|
55
44
|
};
|
|
56
45
|
}
|
|
57
46
|
async signParams(params) {
|
|
58
|
-
const identity = await this.agent.signRequest(params.name, this.audience);
|
|
47
|
+
const identity = await this.agent.signRequest(params.name, this.audience, params.arguments);
|
|
59
48
|
const existingMeta = params._meta ?? {};
|
|
60
49
|
const existingOpenAgent = typeof existingMeta["openagent"] === "object" && existingMeta["openagent"] !== null ? existingMeta["openagent"] : {};
|
|
61
50
|
return {
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";AAqEO,SAAS,mBAAA,CACd,QACA,MAAA,EACG;AACH,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACjD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,MAAA,CAAO,UAAU,IAAA,EAAM;AACvD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,KAAA,CAAM,WAAA,KAAgB,UAAA,EAAY;AAClD,IAAA,MAAM,IAAI,UAAU,qDAAqD,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,CAAkB,MAAM,CAAA;AAEhD,EAAA,OAAO,IAAI,MAAM,MAAA,EAAQ;AAAA,IACvB,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,QAAA,EAAU;AAC9B,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,UAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,QAAA,OAAO,WAAA,CAAY,YAAA;AAAA,UACjB,KAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,IAC1B;AAAA,GACD,CAAA;AACH;AAEA,IAAM,oBAAN,MAAwB;AAAA,EACL,KAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,MAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AACpB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,UAAA;AAAA,EAC3B;AAAA,EAEA,YAAA,CACE,UACA,OAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,IAAA;AACpB,IAAA,OAAO,eAAe,eAAA,CAEpB,MAAA,EAAA,GAKG,IAAA,EACe;
|
|
1
|
+
{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";AAqEO,SAAS,mBAAA,CACd,QACA,MAAA,EACG;AACH,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACjD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,MAAA,CAAO,UAAU,IAAA,EAAM;AACvD,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,KAAA,CAAM,WAAA,KAAgB,UAAA,EAAY;AAClD,IAAA,MAAM,IAAI,UAAU,qDAAqD,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAI,iBAAA,CAAkB,MAAM,CAAA;AAEhD,EAAA,OAAO,IAAI,MAAM,MAAA,EAAQ;AAAA,IACvB,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,QAAA,EAAU;AAC9B,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,UAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,QAAA,OAAO,WAAA,CAAY,YAAA;AAAA,UACjB,KAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,IAC1B;AAAA,GACD,CAAA;AACH;AAEA,IAAM,oBAAN,MAAwB;AAAA,EACL,KAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,MAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AACpB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,UAAA;AAAA,EAC3B;AAAA,EAEA,YAAA,CACE,UACA,OAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,IAAA;AACpB,IAAA,OAAO,eAAe,eAAA,CAEpB,MAAA,EAAA,GAKG,IAAA,EACe;AAElB,MAAA,MAAM,WAAA,GAAc,MAAM,WAAA,CAAY,UAAA,GAAa,MAAM,CAAA;AACzD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,UAAA,CAAW,eAAe,MAAM,CAAA;AACjE,MAAA,OAAO,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,GAAG,IAAI,CAAA;AAAA,IAC/C,CAAA;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,MAAA,EAQtB;AACD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,OAAO,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,MAAA,CAAO,SAAS,CAAA;AAC1F,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,KAAA,IAAS,EAAC;AACtC,IAAA,MAAM,iBAAA,GACJ,OAAO,YAAA,CAAa,WAAW,CAAA,KAAM,QAAA,IACrC,YAAA,CAAa,WAAW,CAAA,KAAM,IAAA,GACzB,YAAA,CAAa,WAAW,IACzB,EAAC;AACP,IAAA,OAAO;AAAA,MACL,GAAG,MAAA;AAAA,MACH,KAAA,EAAO;AAAA,QACL,GAAG,YAAA;AAAA,QACH,SAAA,EAAW;AAAA,UACT,GAAG,iBAAA;AAAA,UACH;AAAA;AACF;AACF,KACF;AAAA,EACF;AACF,CAAA;AAOO,SAAS,kBAAkB,QAAA,EAKN;AAC1B,EAAA,OAAO;AAAA,IACL,SAAA,EAAW;AAAA,MACT,QAAA,EAAU;AAAA,QACR,KAAK,QAAA,CAAS,GAAA;AAAA,QACd,OAAO,QAAA,CAAS,KAAA;AAAA,QAChB,GAAI,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,QAAA,CAAS,KAAA,EAAM,GAAI,EAAC;AAAA,QAChE,GAAI,SAAS,OAAA,KAAY,MAAA,GACrB,EAAE,OAAA,EAAS,QAAA,CAAS,OAAA,EAAQ,GAC5B;AAAC;AACP;AACF,GACF;AACF","file":"client.js","sourcesContent":["/**\n * Client-side interceptor for @openagentid/mcp.\n *\n * Adds an OpenAgent identity envelope (`_meta.openagent.identity`) to\n * outbound MCP `tools/call` requests so an authenticated server can\n * verify the caller. The interceptor wraps the MCP client's `callTool`\n * method via a JavaScript Proxy — the rest of the client surface (list\n * tools, list resources, prompts) is forwarded unchanged.\n *\n * Usage:\n *\n * ```ts\n * import { Client } from '@modelcontextprotocol/sdk/client/index.js';\n * import { withOpenAgentClient } from '@openagentid/mcp/client';\n *\n * const client = new Client({ name: 'my-agent', version: '0.1.0' });\n * const authedClient = withOpenAgentClient(client, { agent });\n *\n * await authedClient.callTool({ name: 'search_web', arguments: { q: 'mcp' } });\n * ```\n */\n\nimport { Agent } from './types.js';\n\n/**\n * Minimal MCP client surface used by the interceptor. Like the server\n * adapter, we describe just the methods we need to keep peer-dep\n * compatibility broad.\n */\nexport interface McpClientLike {\n callTool(\n params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n },\n ...rest: unknown[]\n ): Promise<unknown>;\n}\n\nexport interface OpenAgentClientConfig {\n /** The agent doing the calling — used to sign each request. */\n agent: Pick<Agent, 'did' | 'signRequest'>;\n /**\n * Optional audience DID. When set, it is passed to\n * {@link Agent.signRequest} so the proof can be bound to a specific\n * server. Most production deployments should set this.\n */\n audience?: string;\n /**\n * Optional hook fired before every outbound call. Use it for client-\n * side metrics or to mutate the params (e.g., add tracing headers).\n * Returning a value replaces the params.\n */\n beforeCall?: (params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n }) => Promise<\n | { name: string; arguments?: Record<string, unknown>; _meta?: Record<string, unknown> }\n | void\n > | { name: string; arguments?: Record<string, unknown>; _meta?: Record<string, unknown> }\n | void;\n}\n\n/**\n * Wrap an MCP client so every outbound `callTool` carries an OpenAgent\n * identity envelope.\n */\nexport function withOpenAgentClient<T extends McpClientLike>(\n client: T,\n config: OpenAgentClientConfig,\n): T {\n if (config === null || typeof config !== 'object') {\n throw new TypeError('OpenAgentClientConfig must be an object');\n }\n if (config.agent === undefined || config.agent === null) {\n throw new TypeError('OpenAgentClientConfig.agent is required');\n }\n if (typeof config.agent.signRequest !== 'function') {\n throw new TypeError('OpenAgentClientConfig.agent.signRequest is required');\n }\n\n const interceptor = new ClientInterceptor(config);\n\n return new Proxy(client, {\n get(target, property, receiver) {\n const value = Reflect.get(target, property, receiver);\n if (typeof value !== 'function') {\n return value;\n }\n if (property === 'callTool') {\n return interceptor.wrapCallTool(\n value as McpClientLike['callTool'],\n target,\n );\n }\n return value.bind(target);\n },\n }) as T;\n}\n\nclass ClientInterceptor {\n private readonly agent: Pick<Agent, 'did' | 'signRequest'>;\n private readonly audience: string | undefined;\n private readonly beforeCall: OpenAgentClientConfig['beforeCall'];\n\n constructor(config: OpenAgentClientConfig) {\n this.agent = config.agent;\n this.audience = config.audience;\n this.beforeCall = config.beforeCall;\n }\n\n wrapCallTool(\n original: McpClientLike['callTool'],\n thisArg: unknown,\n ): McpClientLike['callTool'] {\n const interceptor = this;\n return async function wrappedCallTool(\n this: unknown,\n params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n },\n ...rest: unknown[]\n ): Promise<unknown> {\n // Mutate first; the signature must cover the actual transmitted call.\n const replacement = await interceptor.beforeCall?.(params);\n const toSend = await interceptor.signParams(replacement ?? params);\n return original.call(thisArg, toSend, ...rest);\n };\n }\n\n private async signParams(params: {\n name: string;\n arguments?: Record<string, unknown>;\n _meta?: Record<string, unknown>;\n }): Promise<{\n name: string;\n arguments?: Record<string, unknown>;\n _meta: Record<string, unknown>;\n }> {\n const identity = await this.agent.signRequest(params.name, this.audience, params.arguments);\n const existingMeta = params._meta ?? {};\n const existingOpenAgent =\n typeof existingMeta['openagent'] === 'object' &&\n existingMeta['openagent'] !== null\n ? (existingMeta['openagent'] as Record<string, unknown>)\n : {};\n return {\n ...params,\n _meta: {\n ...existingMeta,\n openagent: {\n ...existingOpenAgent,\n identity,\n },\n },\n };\n }\n}\n\n/**\n * Helper for tests and tools that want to construct the identity\n * envelope manually without going through a full Agent. Returns a `_meta`\n * object that can be merged into a CallToolRequest's params.\n */\nexport function buildIdentityMeta(identity: {\n did: string;\n proof: string;\n nonce?: string;\n context?: Record<string, unknown>;\n}): Record<string, unknown> {\n return {\n openagent: {\n identity: {\n did: identity.did,\n proof: identity.proof,\n ...(identity.nonce !== undefined ? { nonce: identity.nonce } : {}),\n ...(identity.context !== undefined\n ? { context: identity.context }\n : {}),\n },\n },\n };\n}\n"]}
|
package/dist/index.cjs
CHANGED
|
@@ -1,5 +1,8 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
+
var async_hooks = require('async_hooks');
|
|
4
|
+
var crypto = require('crypto');
|
|
5
|
+
|
|
3
6
|
// src/errors.ts
|
|
4
7
|
var McpErrorCode = {
|
|
5
8
|
/** -32600 — request was malformed at the JSON-RPC layer. */
|
|
@@ -98,12 +101,47 @@ function formatCause(cause) {
|
|
|
98
101
|
// src/types.ts
|
|
99
102
|
var defaultScopeFormat = (toolName) => `mcp:${toolName}:invoke`;
|
|
100
103
|
var defaultRequireScopes = (toolName) => [defaultScopeFormat(toolName)];
|
|
104
|
+
function installRequestBoundary(server) {
|
|
105
|
+
const context = new async_hooks.AsyncLocalStorage();
|
|
106
|
+
const wrap = (handler, transport) => (message, ...extra) => {
|
|
107
|
+
let request;
|
|
108
|
+
if (message && typeof message === "object" && "method" in message && message.method === "tools/call" && "params" in message && message.params && typeof message.params === "object" && "name" in message.params && typeof message.params.name === "string") {
|
|
109
|
+
request = {
|
|
110
|
+
toolName: message.params.name,
|
|
111
|
+
args: structuredClone("arguments" in message.params ? message.params.arguments : void 0)
|
|
112
|
+
};
|
|
113
|
+
}
|
|
114
|
+
return context.run(request, () => handler.call(transport, message, ...extra));
|
|
115
|
+
};
|
|
116
|
+
const existing = server.server?.transport;
|
|
117
|
+
if (existing && typeof existing === "object") {
|
|
118
|
+
const transport = existing;
|
|
119
|
+
if (transport.onmessage) transport.onmessage = wrap(transport.onmessage, transport);
|
|
120
|
+
}
|
|
121
|
+
const connect = server.connect;
|
|
122
|
+
if (connect) {
|
|
123
|
+
server.connect = async function(transport, ...options) {
|
|
124
|
+
if (!transport || typeof transport !== "object") throw new TypeError("MCP transport is required");
|
|
125
|
+
const wrapped = new Proxy(transport, {
|
|
126
|
+
set(target, key, value) {
|
|
127
|
+
return Reflect.set(target, key, key === "onmessage" && typeof value === "function" ? wrap(value, target) : value, target);
|
|
128
|
+
},
|
|
129
|
+
get(target, key) {
|
|
130
|
+
const value = Reflect.get(target, key, target);
|
|
131
|
+
return typeof value === "function" ? value.bind(target) : value;
|
|
132
|
+
}
|
|
133
|
+
});
|
|
134
|
+
await connect.call(this, wrapped, ...options);
|
|
135
|
+
};
|
|
136
|
+
}
|
|
137
|
+
return context;
|
|
138
|
+
}
|
|
101
139
|
|
|
102
140
|
// src/server.ts
|
|
103
141
|
var TOOL_REGISTRATION_METHODS = ["tool", "registerTool"];
|
|
104
142
|
function withOpenAgent(server, config) {
|
|
105
143
|
validateConfig(config);
|
|
106
|
-
const middleware = new ToolMiddleware(config);
|
|
144
|
+
const middleware = new ToolMiddleware(config, installRequestBoundary(server));
|
|
107
145
|
return new Proxy(server, {
|
|
108
146
|
get(target, property, receiver) {
|
|
109
147
|
const value = Reflect.get(target, property, receiver);
|
|
@@ -161,22 +199,24 @@ function findCallbackIndex(args) {
|
|
|
161
199
|
return -1;
|
|
162
200
|
}
|
|
163
201
|
var ToolMiddleware = class {
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
requireIdentity;
|
|
167
|
-
skillsPolicy;
|
|
168
|
-
preCall;
|
|
169
|
-
postCall;
|
|
170
|
-
onError;
|
|
171
|
-
constructor(config) {
|
|
202
|
+
constructor(config, requests) {
|
|
203
|
+
this.requests = requests;
|
|
172
204
|
this.agent = config.agent;
|
|
173
|
-
this.requireScopes = config.requireScopes ?? defaultRequireScopes;
|
|
205
|
+
this.requireScopes = config.requireScopes ?? (config.scopeFormat ? (tool) => [config.scopeFormat(tool)] : defaultRequireScopes);
|
|
174
206
|
this.requireIdentity = config.requireIdentity ?? true;
|
|
175
207
|
this.skillsPolicy = config.skillsPolicy;
|
|
176
208
|
this.preCall = config.preCall;
|
|
177
209
|
this.postCall = config.postCall;
|
|
178
210
|
this.onError = config.onError;
|
|
179
211
|
}
|
|
212
|
+
requests;
|
|
213
|
+
agent;
|
|
214
|
+
requireScopes;
|
|
215
|
+
requireIdentity;
|
|
216
|
+
skillsPolicy;
|
|
217
|
+
preCall;
|
|
218
|
+
postCall;
|
|
219
|
+
onError;
|
|
180
220
|
wrap(toolName, userCallback) {
|
|
181
221
|
const middleware = this;
|
|
182
222
|
return async function wrappedCallback(...callbackArgs) {
|
|
@@ -224,9 +264,12 @@ var ToolMiddleware = class {
|
|
|
224
264
|
const requiredScopes = this.requireScopes(toolName, args);
|
|
225
265
|
let identity;
|
|
226
266
|
try {
|
|
267
|
+
const inbound = this.requests.getStore();
|
|
268
|
+
if (inbound && inbound.toolName !== toolName) throw new Error("MCP request/tool binding mismatch");
|
|
227
269
|
identity = await this.agent.verifier.verify(
|
|
228
270
|
identityEnvelope,
|
|
229
|
-
requiredScopes
|
|
271
|
+
requiredScopes,
|
|
272
|
+
inbound ?? { toolName, args }
|
|
230
273
|
);
|
|
231
274
|
} catch (cause) {
|
|
232
275
|
throw new IdentityVerificationError(toolName, cause);
|
|
@@ -371,24 +414,13 @@ var ClientInterceptor = class {
|
|
|
371
414
|
wrapCallTool(original, thisArg) {
|
|
372
415
|
const interceptor = this;
|
|
373
416
|
return async function wrappedCallTool(params, ...rest) {
|
|
374
|
-
const
|
|
375
|
-
|
|
376
|
-
if (interceptor.beforeCall !== void 0) {
|
|
377
|
-
const replacement = await Promise.resolve(
|
|
378
|
-
interceptor.beforeCall(signed)
|
|
379
|
-
);
|
|
380
|
-
if (replacement !== void 0) {
|
|
381
|
-
toSend = {
|
|
382
|
-
...replacement,
|
|
383
|
-
_meta: replacement._meta ?? signed._meta
|
|
384
|
-
};
|
|
385
|
-
}
|
|
386
|
-
}
|
|
417
|
+
const replacement = await interceptor.beforeCall?.(params);
|
|
418
|
+
const toSend = await interceptor.signParams(replacement ?? params);
|
|
387
419
|
return original.call(thisArg, toSend, ...rest);
|
|
388
420
|
};
|
|
389
421
|
}
|
|
390
422
|
async signParams(params) {
|
|
391
|
-
const identity = await this.agent.signRequest(params.name, this.audience);
|
|
423
|
+
const identity = await this.agent.signRequest(params.name, this.audience, params.arguments);
|
|
392
424
|
const existingMeta = params._meta ?? {};
|
|
393
425
|
const existingOpenAgent = typeof existingMeta["openagent"] === "object" && existingMeta["openagent"] !== null ? existingMeta["openagent"] : {};
|
|
394
426
|
return {
|
|
@@ -503,6 +535,70 @@ function combineSkillsPolicies(first, second) {
|
|
|
503
535
|
return Promise.resolve(second(input));
|
|
504
536
|
};
|
|
505
537
|
}
|
|
538
|
+
function canonical(value) {
|
|
539
|
+
if (value === null || typeof value !== "object") {
|
|
540
|
+
const text = JSON.stringify(value);
|
|
541
|
+
if (text === void 0) throw new TypeError("MCP arguments must be JSON values");
|
|
542
|
+
return text;
|
|
543
|
+
}
|
|
544
|
+
if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
|
|
545
|
+
return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
|
|
546
|
+
}
|
|
547
|
+
function digest(toolName, args) {
|
|
548
|
+
return crypto.createHash("sha256").update(canonical({ toolName, args: args ?? {} })).digest("hex");
|
|
549
|
+
}
|
|
550
|
+
function createWorkspaceMcpServer(options) {
|
|
551
|
+
const pending = /* @__PURE__ */ new Map();
|
|
552
|
+
let issuing = 0;
|
|
553
|
+
const max = options.maxPendingChallenges ?? 1e3;
|
|
554
|
+
if (!Number.isSafeInteger(max) || max < 1) throw new TypeError("Invalid pending challenge limit");
|
|
555
|
+
return {
|
|
556
|
+
async issueChallenge(request) {
|
|
557
|
+
for (const [nonce, value] of pending) if (value.expiresAt <= Date.now() / 1e3) pending.delete(nonce);
|
|
558
|
+
if (pending.size + issuing >= max) throw new Error("MCP challenge capacity reached");
|
|
559
|
+
const binding = digest(request.toolName, request.args);
|
|
560
|
+
issuing += 1;
|
|
561
|
+
try {
|
|
562
|
+
const challenge = await options.workspace.issueChallenge(request.did);
|
|
563
|
+
pending.set(challenge.nonce, { did: request.did, digest: binding, expiresAt: challenge.expiresAt });
|
|
564
|
+
return challenge;
|
|
565
|
+
} finally {
|
|
566
|
+
issuing -= 1;
|
|
567
|
+
}
|
|
568
|
+
},
|
|
569
|
+
agent: {
|
|
570
|
+
did: options.did,
|
|
571
|
+
verifier: {
|
|
572
|
+
async verify(envelope, _scopes, request) {
|
|
573
|
+
const nonce = envelope.nonce;
|
|
574
|
+
const binding = nonce ? pending.get(nonce) : void 0;
|
|
575
|
+
if (!binding || !nonce || !request || binding.did !== envelope.did || binding.expiresAt <= Date.now() / 1e3 || binding.digest !== digest(request.toolName, request.args)) {
|
|
576
|
+
throw new Error("MCP challenge does not match this caller and tool request");
|
|
577
|
+
}
|
|
578
|
+
pending.delete(nonce);
|
|
579
|
+
const proof = JSON.parse(envelope.proof);
|
|
580
|
+
const identity = await options.workspace.verify(proof, { nonce });
|
|
581
|
+
if (identity.did !== envelope.did) throw new Error("MCP identity DID mismatch");
|
|
582
|
+
const scopes = [...await options.authorize(identity)];
|
|
583
|
+
if (!scopes.every((scope) => typeof scope === "string")) throw new TypeError("Invalid authorized scopes");
|
|
584
|
+
return { did: identity.did, scopes, auditId: crypto.randomUUID(), claims: { identity } };
|
|
585
|
+
}
|
|
586
|
+
}
|
|
587
|
+
}
|
|
588
|
+
};
|
|
589
|
+
}
|
|
590
|
+
function createWorkspaceMcpClient(options) {
|
|
591
|
+
return {
|
|
592
|
+
did: options.did,
|
|
593
|
+
async signRequest(toolName, audience, args) {
|
|
594
|
+
if (audience !== void 0 && audience !== options.audience) throw new Error("MCP audience mismatch");
|
|
595
|
+
const challenge = await options.issueChallenge({ did: options.did, toolName, ...args ? { args } : {} });
|
|
596
|
+
if (challenge.audience !== options.audience || challenge.expiresAt <= Date.now() / 1e3) throw new Error("Invalid MCP receiver challenge");
|
|
597
|
+
const proof = await options.workspace.prove(options.did, { audience: options.audience, nonce: challenge.nonce });
|
|
598
|
+
return { did: options.did, proof: JSON.stringify(proof), nonce: challenge.nonce };
|
|
599
|
+
}
|
|
600
|
+
};
|
|
601
|
+
}
|
|
506
602
|
|
|
507
603
|
exports.ANONYMOUS_IDENTITY = ANONYMOUS_IDENTITY;
|
|
508
604
|
exports.AuthorizationDeniedError = AuthorizationDeniedError;
|
|
@@ -516,6 +612,8 @@ exports.SkillsPolicyDeniedError = SkillsPolicyDeniedError;
|
|
|
516
612
|
exports.buildIdentityMeta = buildIdentityMeta;
|
|
517
613
|
exports.combineSkillsPolicies = combineSkillsPolicies;
|
|
518
614
|
exports.createSkillsPolicy = createSkillsPolicy;
|
|
615
|
+
exports.createWorkspaceMcpClient = createWorkspaceMcpClient;
|
|
616
|
+
exports.createWorkspaceMcpServer = createWorkspaceMcpServer;
|
|
519
617
|
exports.defaultRequireScopes = defaultRequireScopes;
|
|
520
618
|
exports.defaultScopeFormat = defaultScopeFormat;
|
|
521
619
|
exports.withOpenAgent = withOpenAgent;
|