@ory/amp 1.5.3 → 1.6.0

package/README.md

@@ -107,6 +107,8 @@ Amp gives the gate 10 seconds to answer and treats a slower gate as a reject, so
 
 The Ory skills land under `<project>/.agents/skills/`. `uninstall` removes the gate, the plugin, and the skills.
 
+**MCP servers.** Amp documents MCP tool names as `mcp__<server>__<tool>` ([Plugin API](https://ampcode.com/docs/plugin-api)). The plugin's `tool.call` handler checks a call with that name as `McpServer:<server>` and `McpTool:<server>:<tool>`, and the gate applies the same check when Amp's (undocumented) delegate payload carries that name; Agent Security resolves the reported server name to a cataloged server, and other tools keep the native check. By default, though, Amp does not send MCP tools to the model one by one: agents reach MCP servers through `code_exec` (with `tool_search`), and those calls arrive as a single `code_exec` tool call that names no server, so they are checked as the native `code_exec` tool. Only MCP tools an agent exposes directly carry the `mcp__` name. No fingerprints are sent, because Amp's payload does not say how a server is launched.
+
 </details>
 
 ## Connect to Ory Agent Security
@@ -129,7 +131,7 @@ npx -y -p @ory/amp ory-amp configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Amp's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Amp's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/permission.js

@@ -113,6 +113,9 @@ async function decideToolPermission(input, client) {
                 toolArgs: input.input ?? input.params ?? input.arguments ?? input.args,
                 subjectFallback: sessionId ? `session:${sessionId}` : undefined,
                 canBlock: true,
+                // Amp names MCP tools `mcp__<server>__<tool>` (ampcode.com/docs/plugin-api).
+                // MCP calls an agent makes inside `code_exec` arrive as `code_exec`.
+                mcpTool: (0, argus_1.parseMcpToolName)(toolName) ?? undefined,
             }), timeoutMs);
             if (raced === CHECK_TIMED_OUT) {
                 process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; allowing (fail-open)\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/amp",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -70,10 +70,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.6.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=22"