@ory/antigravity 1.5.3 → 1.6.0

package/README.md

@@ -92,6 +92,8 @@ The plugin hooks into these Antigravity lifecycle events: `SessionStart` (check
 
 > **A note on how Antigravity blocks.** Antigravity blocks a tool unless the plugin explicitly says "allow" — so a crash, timeout, or missing answer *blocks* the tool. That's the opposite of most harnesses. To keep Ory from ever getting in your way, the plugin **always allows on any internal or network error**, so a transient Ory outage never wedges your tools. Native tools are allowed unless an explicit block matches.
 
+> **MCP tools (unverified).** Antigravity's hook payload for MCP calls is not documented. The plugin assumes they arrive as a `call_mcp_tool` tool whose arguments name the server and tool (`server_name` / `tool_name`, or the camel- and Pascal-case forms) and then checks `McpServer:<server>` and `McpTool:<server>:<tool>`. That shape has not been confirmed against a live Antigravity build. Any other MCP call shape — and a `call_mcp_tool` call without both names — is checked as an ordinary native tool, so MCP server and tool rules do not apply to it.
+
 ### See what's happening
 
 Everything the plugin does is observable out of the box:
@@ -135,7 +137,7 @@ npx -y -p @ory/antigravity ory-agy configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Antigravity's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Antigravity's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/handlers.js

@@ -69,6 +69,7 @@ async function handlePreToolUse(input, client) {
         harness: HARNESS,
         toolName,
         toolArgs: input.tool_input,
+        mcpTool: toolName === "call_mcp_tool" ? ((0, argus_1.parseMcpToolArgs)(input.tool_input) ?? undefined) : undefined,
         subjectFallback: `session:${input.session_id}`,
     });
     if (result.blocked) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/antigravity",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "Ory plugin for Google Antigravity: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/ory-agent-plugins/tree/main/packages/antigravity",
@@ -75,10 +75,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.6.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=22"