@ory/amp 1.5.3 → 1.7.0

package/README.md

@@ -107,6 +107,8 @@ Amp gives the gate 10 seconds to answer and treats a slower gate as a reject, so
 
 The Ory skills land under `<project>/.agents/skills/`. `uninstall` removes the gate, the plugin, and the skills.
 
+**MCP servers.** Amp documents MCP tool names as `mcp__<server>__<tool>` ([Plugin API](https://ampcode.com/docs/plugin-api)). The plugin's `tool.call` handler checks a call with that name as `McpServer:<server>` and `McpTool:<server>:<tool>`, and the gate applies the same check when Amp's (undocumented) delegate payload carries that name; Agent Security resolves the reported server name to a cataloged server, and other tools keep the native check. By default, though, Amp does not send MCP tools to the model one by one: agents reach MCP servers through `code_exec` (with `tool_search`), and those calls arrive as a single `code_exec` tool call that names no server, so they are checked as the native `code_exec` tool. Only MCP tools an agent exposes directly carry the `mcp__` name. No fingerprints are sent, because Amp's payload does not say how a server is launched.
+
 </details>
 
 ## Connect to Ory Agent Security
@@ -129,7 +131,7 @@ npx -y -p @ory/amp ory-amp configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Amp's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Amp's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/permission.d.ts

@@ -17,13 +17,14 @@
  *
  * TIMEOUT: Amp enforces a 10-second delegate timeout. A delegate that does
  * not exit within 10s is treated as a reject, so a hanging Ory backend
- * would otherwise surface as a block. To keep infra failures fail-open,
+ * would otherwise surface as a block. To return a clear reason,
  * the permission check below is raced against a local deadline (default
  * 5000ms, override via ORY_AMP_CHECK_TIMEOUT_MS); on timeout the delegate
- * logs a warning to stderr and allows (exit 0), well inside Amp's window.
+ * rejects with a reason, well inside Amp's window. At that point the gate may
+ * not have resolved the applicable posture, so it conservatively blocks.
  *
- * Fail-open: any error — parse failure, network error, rate limit, crash —
- * resolves to exit 0 (allow). The delegate must never wedge the agent.
+ * Parse and unexpected delegate errors remain best-effort. Classified permission
+ * failures are handled by the shared gate and deny in enforce mode.
  *
  * Verified against the installed `amp` binary (delegate exit-code contract
  * and 10s timeout).

package/dist/permission.js

@@ -18,13 +18,14 @@
  *
  * TIMEOUT: Amp enforces a 10-second delegate timeout. A delegate that does
  * not exit within 10s is treated as a reject, so a hanging Ory backend
- * would otherwise surface as a block. To keep infra failures fail-open,
+ * would otherwise surface as a block. To return a clear reason,
  * the permission check below is raced against a local deadline (default
  * 5000ms, override via ORY_AMP_CHECK_TIMEOUT_MS); on timeout the delegate
- * logs a warning to stderr and allows (exit 0), well inside Amp's window.
+ * rejects with a reason, well inside Amp's window. At that point the gate may
+ * not have resolved the applicable posture, so it conservatively blocks.
  *
- * Fail-open: any error — parse failure, network error, rate limit, crash —
- * resolves to exit 0 (allow). The delegate must never wedge the agent.
+ * Parse and unexpected delegate errors remain best-effort. Classified permission
+ * failures are handled by the shared gate and deny in enforce mode.
  *
  * Verified against the installed `amp` binary (delegate exit-code contract
  * and 10s timeout).
@@ -39,7 +40,7 @@ const types_js_1 = require("./types.js");
 /**
  * Local deadline for the Ory permission check. Amp treats a delegate that
  * does not exit within 10s as a REJECT, so a hanging backend must be cut
- * off locally and resolved as allow (fail-open for infra failures). The
+ * off locally and resolved as a denial when posture is unknown. The
  * default leaves ample headroom inside Amp's 10s window.
  */
 const DEFAULT_CHECK_TIMEOUT_MS = 5000;
@@ -105,7 +106,7 @@ async function decideToolPermission(input, client) {
         client.logger.info("delegate.received", { toolName, sessionId });
         try {
             // Amp rejects delegates that exceed ten seconds, so retain a shorter
-            // local deadline that turns a hanging backend into an allow.
+            // local deadline so a hanging backend produces an explicit decision.
             const timeoutMs = resolveCheckTimeoutMs();
             const raced = await raceCheckDeadline((0, argus_1.gate)(client, {
                 harness: "amp",
@@ -113,11 +114,14 @@ async function decideToolPermission(input, client) {
                 toolArgs: input.input ?? input.params ?? input.arguments ?? input.args,
                 subjectFallback: sessionId ? `session:${sessionId}` : undefined,
                 canBlock: true,
+                // Amp names MCP tools `mcp__<server>__<tool>` (ampcode.com/docs/plugin-api).
+                // MCP calls an agent makes inside `code_exec` arrive as `code_exec`.
+                mcpTool: (0, argus_1.parseMcpToolName)(toolName) ?? undefined,
             }), timeoutMs);
             if (raced === CHECK_TIMED_OUT) {
-                process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; allowing (fail-open)\n`);
+                process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; blocking because posture is unknown\n`);
                 client.logger.warn("delegate.check_timeout", { toolName, timeoutMs });
-                return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
+                return { exitCode: types_js_1.AMP_DELEGATE_EXIT.REJECT, reason: "Ory permission check timed out; retry when Agent Security is available." };
             }
             return raced.blocked
                 ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/amp",
-  "version": "1.5.3",
+  "version": "1.7.0",
   "description": "Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -70,10 +70,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.7.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=22"