@ory/argus 1.5.3 → 1.6.0

package/assets/skills/ory-build-agent/SKILL.md

@@ -143,9 +143,9 @@ for await (const msg of stream) { /* standard handling */ }
 ```
 
 `canUseTool` only fires for tools the SDK controls. If the agent also
-registers MCP servers, wrap each MCP tool handler the same way — see the
-`@ory/argus` `parseClaudeCodeMcpTool` / `checkMcpPermission` helpers for an
-MCP-flavored version of the gate.
+registers MCP servers, gate each MCP tool handler the same way and pass
+`mcpTool` (from the `@ory/argus` `parseClaudeCodeMcpTool` or `parseMcpToolName`
+helpers) so the call is checked against the project's MCP server access.
 
 ### OpenAI Agents SDK
 
@@ -377,7 +377,7 @@ For full env-var coverage (including the user/agent split,
 - It does not generate the agent. The user owns the agent loop, tool
   catalog, and deployment shape. This skill only drops `@ory/argus` into
   whatever they already have.
-- It does not write permissions. Native-tool blocks and MCP grants are
+- It does not write permissions. Native-tool blocks and MCP server access are
   provisioned in the Ory Console (Agent Security); `@ory/argus` only reads
   them. The local seed writes no baseline native-tool grants.
 - It does not adapt one of the existing harness plugins (`@ory/claude-code`,

package/assets/skills/permissions-onboarding/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ory-permissions-onboarding
-description: Onboard native agent-tool authorization with default allow and explicit deny overrides. Covers connecting the plugin, reviewing allowed and blocked tools, writing blocks in the Ory Console, and promoting the project from observe to enforce. MCP and PermissionMode remain grant-based.
+description: Onboard native agent-tool authorization with default allow and explicit deny overrides. Covers connecting the plugin, reviewing allowed and blocked tools, writing blocks in the Ory Console, and promoting the project from observe to enforce. MCP servers use the same block model; PermissionMode remains grant-based.
 ---
 
 # Onboard Ory Permissions for Agent Tool Calls
@@ -9,7 +9,7 @@ Help the user connect Agent Security and roll out explicit native-tool blocks
 without treating missing grants as denials.
 
 **The plugin only reads permissions. It never writes them.** The permission
-model, native-tool blocks, MCP grants, and observe/enforce posture are managed
+model, native-tool blocks, MCP server access, and observe/enforce posture are managed
 in the **Ory Console** (Agent Security).
 
 Native policy is simple:
@@ -18,7 +18,8 @@ Native policy is simple:
 - Their `use` permit is `!blockedSubjects.includes(subject)`.
 - No matching block means allowed; a matching block means denied.
 - `observe` logs the block and proceeds; `enforce` vetoes the call.
-- MCP permissions and `PermissionMode#enforcedSubjects` remain grant-based.
+- MCP calls use the same model in `McpServer` and `McpTool`.
+- `PermissionMode#enforcedSubjects` remains grant-based.
 
 ## 1. Connect Agent Security
 
@@ -78,8 +79,10 @@ Blocks can also target the project, an agent credential, an agent session, a
 sub-agent credential, or a sub-agent spawn. Group/SubjectSet expansion is
 supported. A native deny is always an explicit block, never a missing grant.
 
-MCP is intentionally different: continue granting MCP server/tool access with
-its existing `users`/`use` and `invoke` relations.
+MCP calls are checked as `McpServer:<server>#use` and
+`McpTool:<server>:<tool>#use`, where `<server>` is the lowercased configured
+server name. Set Admin, Write, Read, or No access per well-known server in the
+Ory Console (Agent Security → Enforce → MCP servers); there is nothing to grant.
 
 ## 4. Observe Before Enforcing
 

package/dist/adapters.d.ts

@@ -25,7 +25,7 @@ import { ensureAgentIdentity, ensureSubAgentIdentity, type SubAgentIdentity } fr
 import { ensureUserAuthenticated } from "./user-login.js";
 import { type ModeDecision, type PermissionDecision, type PrincipalBlockSubjects } from "./permissions.js";
 import { type DenialContext } from "./denial.js";
-import { type McpToolIdentifier } from "./mcp.js";
+import type { McpToolIdentifier } from "./mcp.js";
 import type { RuntimeCredential } from "./runtime-credential.js";
 export declare function resolveNamespace(): string;
 export interface HookContextOptions {

package/dist/adapters.js

@@ -43,7 +43,6 @@ const permission_mode_js_1 = require("./permission-mode.js");
 const tool_catalog_js_1 = require("./tool-catalog.js");
 const subject_js_1 = require("./subject.js");
 const denial_js_1 = require("./denial.js");
-const mcp_js_1 = require("./mcp.js");
 const tool_metadata_js_1 = require("./tool-metadata.js");
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTool";
@@ -408,6 +407,7 @@ function gateActivityAttributes(opts) {
             ? {
                 mcpServer: opts.mcpTool.serverName,
                 ...(opts.mcpTool.toolName ? { mcpTool: opts.mcpTool.toolName } : {}),
+                ...(opts.mcpTool.fingerprints?.length ? { mcpFingerprints: opts.mcpTool.fingerprints } : {}),
             }
             : {}),
         ...(opts.extraActivityAttributes ?? {}),
@@ -447,41 +447,38 @@ async function decideTool(client, opts) {
     }
     let outcome;
     try {
+        const nativeGate = () => (0, permissions_js_1.gateToolCall)(client, {
+            harness: opts.harness,
+            toolName: opts.toolName,
+            check,
+            activityAttributes: activityAttrs,
+            shellCommand: (0, tool_catalog_js_1.extractShellCommand)(opts.harness, opts.toolName, opts.toolArgs),
+            principals: opts.principals,
+        });
         if (opts.mcpTool) {
-            const mcpResult = await (0, mcp_js_1.checkMcpPermission)(client, opts.mcpTool, {
-                subject: subjectRef,
-                activityAttributes: activityAttrs,
-            });
-            const agentSubject = (0, subject_js_1.resolveAgentSubject)(client);
-            const subagentSubject = (0, subject_js_1.resolveSubAgentSubject)(opts.principals?.subAgentClientId);
-            const mode = await (0, permission_mode_js_1.warmPermissionModeCache)(client, subjectRef, {
-                additionalSubjects: [
-                    ...(agentSubject ? [{ scope: "agent", subject: agentSubject }] : []),
-                    ...(subagentSubject ? [{ scope: "subagent", subject: subagentSubject }] : []),
-                ],
-            });
-            outcome = (0, permissions_js_1.applyPermissionMode)(client, mcpResult.allowed, {
-                namespace: process.env.ORY_MCP_SERVER_NAMESPACE ?? "mcp_servers",
-                object: opts.mcpTool.serverName,
-                relation: "users",
-                ...subjectRef,
-                activityAttributes: {
-                    ...activityAttrs,
-                    mcpServer: opts.mcpTool.serverName,
-                    ...(opts.mcpTool.toolName ? { mcpTool: opts.mcpTool.toolName } : {}),
-                },
-                modeOverride: mode.mode,
-            });
-        }
-        else {
-            outcome = await (0, permissions_js_1.gateToolCall)(client, {
+            const mcpGate = (0, permissions_js_1.gateMcpToolCall)(client, {
                 harness: opts.harness,
                 toolName: opts.toolName,
-                check,
+                mcpTool: opts.mcpTool,
+                subject: subjectRef,
                 activityAttributes: activityAttrs,
-                shellCommand: (0, tool_catalog_js_1.extractShellCommand)(opts.harness, opts.toolName, opts.toolArgs),
                 principals: opts.principals,
             });
+            // A resource read is a native harness tool too, so a block on that tool
+            // still applies alongside the server's enablement and No access.
+            if (opts.mcpTool.resource) {
+                const [mcp, native] = await Promise.all([mcpGate, nativeGate()]);
+                outcome =
+                    native.kind === "interactive" || native.kind === "not_connected"
+                        ? mcp
+                        : (0, permissions_js_1.mostRestrictiveDecision)([mcp, native]);
+            }
+            else {
+                outcome = await mcpGate;
+            }
+        }
+        else {
+            outcome = await nativeGate();
         }
     }
     catch (err) {

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "6d5a4dd670531925d1a0807d25406ccc4db24bf5",
-  "commitShort": "6d5a4dd6",
+  "commit": "ebcd620c5f7cb4a27f47fd98bcb50b3d11d92b2e",
+  "commitShort": "ebcd620c",
   "branch": "main",
-  "commitDate": "2026-10-22T14:21:25-07:00",
+  "commitDate": "2026-10-28T20:25:41-07:00",
   "dirty": false,
-  "builtAt": "2026-10-22T21:25:21.096Z"
+  "builtAt": "2026-10-29T03:28:58.821Z"
 }

package/dist/cli.js

@@ -126,7 +126,7 @@ function runConfigureCommand(binName, args) {
         console.log(`User subject ns:  ${resolved.userSubjectNamespace ?? "User (default)"} [${resolved.userSubjectNamespaceSource}]`);
         console.log("");
         if (resolved.security.connected) {
-            console.log("Sign-in and permission checks are running. Native-tool blocks, MCP grants,");
+            console.log("Sign-in and permission checks are running. Native-tool blocks, MCP server access,");
             console.log("and the observe/enforce posture are managed in the Ory Console (Agent Security).");
             console.log("");
             console.log("To disconnect (skills, commands, the local stack, and activity logging keep working):");

package/dist/client.js

@@ -60,6 +60,7 @@ function permissionCheckFromRequest(request) {
                 relation: request.subjectSetRelation ?? "",
             }
             : undefined,
+        ...(request.mcp ? { mcp: request.mcp } : {}),
     };
 }
 function permissionCheckFromTuple(tuple) {
@@ -69,6 +70,7 @@ function permissionCheckFromTuple(tuple) {
         relation: tuple.relation,
         subjectId: tuple.subject_id,
         subjectSet: tuple.subject_set,
+        ...(tuple.mcp ? { mcp: tuple.mcp } : {}),
     };
 }
 function httpError(status, message) {
@@ -215,6 +217,7 @@ class OryAgentClient {
                     object: check.object,
                     relation: check.relation,
                     principal: this.permissionPrincipal(check),
+                    ...(check.mcp ? { mcp: check.mcp } : {}),
                 })),
             };
             const response = await (0, runtime_credential_js_1.authenticatedRuntimeRequest)(credential, {
@@ -714,6 +717,7 @@ class OryAgentClient {
                 subjectSetNamespace: check.subjectSet?.namespace,
                 subjectSetObject: check.subjectSet?.object,
                 subjectSetRelation: check.subjectSet?.relation,
+                ...(check.mcp ? { mcp: check.mcp } : {}),
             });
             const data = response.data;
             const oryRequestId = extractOryRequestId(response.headers);
@@ -780,6 +784,7 @@ class OryAgentClient {
                                 relation: c.subjectSet.relation,
                             }
                             : undefined,
+                        ...(c.mcp ? { mcp: c.mcp } : {}),
                     })),
                 },
             });

package/dist/event-reporter.js

@@ -72,7 +72,7 @@ const BOOL_ATTRIBUTES = new Set([
     "alert", "blocked", "checkRejected", "hasError", "success",
     "enforceGranted", "proceed", "interactive",
 ]);
-const ARRAY_ATTRIBUTES = new Set(["shellWords", "shellDeniedWords", "warningsHashes"]);
+const ARRAY_ATTRIBUTES = new Set(["shellWords", "shellDeniedWords", "warningsHashes", "mcpFingerprints"]);
 const SAFE_STRING = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,254}$/;
 const HASH = /^[a-f0-9]{16}$/;
 const MAX_EVENT_AGE_MS = 24 * 60 * 60 * 1_000;

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { ensureUserAuthenticated, ensureAuthenticated, type UserLoginDecision, t
 export { resolveAgentCredentials, resolvePreprovisionedRuntimeContext, resolveRuntimeAgentCredentials, ensureAgentIdentity, ensureSubAgentIdentity, fetchClientCredentialsToken, registerAgentClient, loadAgentDynamicCredentials, loadAgentDynamicCredentialsByHarness, saveAgentDynamicCredentials, clearAgentDynamicCredentials, latestAgentRegistration, latestSubAgentSession, countAgentSessions, claimAgentDynamicCredentials, loadSubAgentDynamicCredentials, loadAllSubAgentDynamicCredentials, loadSubAgentDynamicCredentialsByHarness, saveSubAgentDynamicCredentials, clearSubAgentDynamicCredentials, clearSubAgentDynamicCredentialsForHarness, claimSubAgentDynamicCredentials, loadDelegationNodeId, resolvePreprovisionedRootDelegation, saveDelegationNodeId, loadRetiredCredentials, clearRetiredCredentials, retireAgentSessions, sessionRetention, revokeAgentDynamicClient, AGENT_TOKEN_EXPIRY_SKEW_SEC, DEFAULT_SESSION_RETENTION, type AgentRegistrationClaim, type AgentCredentials, type AgentCredentialKind, type ResolveAgentCredentialsOptions, type ResolveRuntimeAgentCredentialsOptions, type EnsureAgentIdentityOptions, type RegisterAgentClientArgs, type DelegationInput, type RevokeAgentClientResult, type SubAgentIdentity, type EnsureSubAgentIdentityOptions, } from "./agent-auth.js";
 export { ensureReadCredential, resetReadCredentialBackoff, READ_CREDENTIAL_RETRY_MS, type EnsureReadCredentialOptions, type ReadCredentialOutcome, } from "./read-credential.js";
 export { clearCredentialsForUninstall, resolveInstalledHarnesses, type ClearCredentialsOptions, type ClearCredentialsResult, } from "./uninstall.js";
-export { type SessionInfo, type OAuth2TokenInfo, type PermissionCheck, type PermissionResult, type BatchPermissionResult, type OryError, type OryErrorCode, } from "./types.js";
+export { type SessionInfo, type OAuth2TokenInfo, type McpServerHint, type PermissionCheck, type PermissionResult, type BatchPermissionResult, type OryError, type OryErrorCode, } from "./types.js";
 export { runConfigureCommand, runAgentCommand, printOryConfig, printEnvironment, printLogTail, printEnvHelp, isTtyAvailable, promptOnTty, promptForProjectUrl, interactiveConfigPrompt, } from "./cli.js";
 export { oryNpx } from "./cli-invocation.js";
 export { runPermissionsCommand } from "./permissions-cli.js";
@@ -29,12 +29,12 @@ export { renderMirrorBootstrap, type MirrorBootstrapKind, type MirrorBootstrapOp
 export { renderOrySkills, renderOryCommands, commandToSkill, commandToToml, commandToFrontmatterMarkdown, commandToPlainMarkdown, toSkillMarkdown, writeSkillTree, removeSkillDirs, ORY_SKILL_NAMES, ORY_COMMAND_SKILL_NAMES, ORY_COMMAND_SLUGS, type RenderedSkill, type RenderedCommand, type RenderProfileOptions, } from "./skills.js";
 export { runLocalCommand, } from "./local/index.js";
 export { runRegistryCommand, REGISTRY_URL } from "./registry/index.js";
-export { checkAndDecide, applyPermissionMode, gateToolCall, decomposeAndCheck, resolveCheckRelation, type PermissionDecision, type ModeDecision, type DecisionActivityAttributes, type CheckAndDecideOptions, type ApplyPermissionModeContext, type GateToolCallArgs, type PrincipalBlockSubjects, type ToolGateOutcome, type BlockReason, } from "./permissions.js";
+export { checkAndDecide, applyPermissionMode, gateToolCall, gateMcpToolCall, decomposeAndCheck, resolveCheckRelation, type PermissionDecision, type ModeDecision, type DecisionActivityAttributes, type CheckAndDecideOptions, type ApplyPermissionModeContext, type GateToolCallArgs, type PrincipalBlockSubjects, type ToolGateOutcome, type BlockReason, } from "./permissions.js";
 export { extractShellCommands, extractBashCommandWords, type ParsedShell, type ShellCommand, type ShellRedirect, type ShellAssignment, type BashParseResult, } from "./bash-parser.js";
-export { buildAgentSecurityOpl, renderToolNamespaceClass, renderDelegationNamespaceClass, renderPermissionModeNamespaceClass, renderAgentRoleNamespaceClass, renderEnrollmentNamespaceClass, renderPrincipalClass, renderOplImport, OPL_IMPORT_MODULE, OPL_IMPORT_SYMBOLS, PRINCIPAL_NAMESPACES, NODE_REFERENCE_NAMESPACES, AGENT_NODE_NAMESPACE, SUBAGENT_NODE_NAMESPACE, RELATION_USERS, RELATION_BLOCKED_SUBJECTS, RELATION_DELEGATES, RELATION_CREDENTIALS, RELATION_ENFORCED_SUBJECTS, RELATION_MEMBERS, RELATION_OPTED_OUT_SUBJECTS, PERMISSION_MODE_OBJECT, AUTO_ENROLL_OBJECT, PROJECT_POSTURE_OBJECT, PERMISSION_MODE_NAMESPACE, DELEGATION_NAMESPACE, AGENT_ROLE_NAMESPACE, ENROLLMENT_NAMESPACE, PERMIT_USE, DEFAULT_NAMESPACE, DEFAULT_SHELL_NAMESPACE, } from "./opl.js";
+export { buildAgentSecurityOpl, renderToolNamespaceClass, renderDelegationNamespaceClass, renderPermissionModeNamespaceClass, renderAgentRoleNamespaceClass, renderEnrollmentNamespaceClass, renderPrincipalClass, renderOplImport, OPL_IMPORT_MODULE, OPL_IMPORT_SYMBOLS, PRINCIPAL_NAMESPACES, NODE_REFERENCE_NAMESPACES, AGENT_NODE_NAMESPACE, SUBAGENT_NODE_NAMESPACE, RELATION_USERS, RELATION_BLOCKED_SUBJECTS, RELATION_DELEGATES, RELATION_CREDENTIALS, RELATION_ENFORCED_SUBJECTS, RELATION_MEMBERS, RELATION_OPTED_OUT_SUBJECTS, PERMISSION_MODE_OBJECT, AUTO_ENROLL_OBJECT, PROJECT_POSTURE_OBJECT, PERMISSION_MODE_NAMESPACE, DELEGATION_NAMESPACE, AGENT_ROLE_NAMESPACE, ENROLLMENT_NAMESPACE, PERMIT_USE, DEFAULT_NAMESPACE, DEFAULT_SHELL_NAMESPACE, MCP_SERVER_NAMESPACE, MCP_TOOL_NAMESPACE, } from "./opl.js";
 export { HARNESS_TOOL_CATALOG, KNOWN_HARNESSES, ALL_TOOLS, getToolCatalog, INTERACTIVE_TOOL_CATALOG, getInteractiveToolCatalog, isInteractiveTool, SHELL_TOOL_CATALOG, getShellToolCatalog, isShellTool, SHELL_COMMAND_CATALOG, getShellCommandCatalog, resolveShellCommandNamespace, extractShellCommand, type KnownHarness, } from "./tool-catalog.js";
 export { classifyLifecycle, isUserFacingPhase, isToolExecutionPhase, HARNESS_LIFECYCLE_MAP, USER_FACING_PHASES, TOOL_EXECUTION_PHASES, type LifecyclePhase, } from "./lifecycle.js";
-export { parseClaudeCodeMcpTool, parseGeminiMcpTool, parseMcpToolGeneric, checkMcpPermission, type McpToolIdentifier, type McpPermissionCheckOptions, type McpPermissionResult, } from "./mcp.js";
+export { parseClaudeCodeMcpTool, parseGeminiMcpTool, parseMcpToolGeneric, parseMcpToolName, parseMcpToolArgs, parseMcpToolWithSeparator, normalizeMcpServerName, mcpToolObject, mcpFingerprint, mcpServerFingerprints, mcpServerHint, checkMcpPermission, type McpServerSource, type McpToolIdentifier, type McpPermissionCheckOptions, type McpPermissionResult, } from "./mcp.js";
 export { resolveUserSubject, runWithUserSubject, subjectLabel, resolveAgentSubject, resolveAgentSessionSubject, resolveSubAgentSubject, resolveSubAgentSpawnSubject, AGENT_NAMESPACE, SUBAGENT_NAMESPACE, SESSION_NAMESPACE, DEFAULT_USER_SUBJECT_NAMESPACE, type UserSubjectRef, } from "./subject.js";
 export { formatDenialMessage, formatDenialSummary, formatAlertMessage, formatAlertSummary, alertAttributes, shellDenialFields, OryDenialError, type DenialContext, type AlertAttributes, } from "./denial.js";
 export { summarizeToolInput, summarizeToolOutput, type ToolInputSummary, type ToolOutputSummary, } from "./tool-metadata.js";

package/dist/index.js

@@ -4,8 +4,9 @@ exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessTok
 exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentialsByHarness = exports.loadAllSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.claimAgentDynamicCredentials = exports.countAgentSessions = exports.latestSubAgentSession = exports.latestAgentRegistration = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentialsByHarness = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveRuntimeAgentCredentials = exports.resolvePreprovisionedRuntimeContext = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.toolHookTimeout = exports.sessionStartHookTimeout = exports.HOOK_TIMEOUT_MAX_MS = exports.TOOL_HOOK_WINDOW_MS = exports.SESSION_START_HOOK_WINDOW_MS = exports.describeDanglingRegistration = exports.findDanglingRegistration = exports.deregisterExternalRegistrations = exports.clearAllExternalRegistrations = exports.clearExternalRegistration = exports.recordExternalRegistration = exports.loadExternalRegistrations = exports.shouldPrintHelp = exports.wantsHelp = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = void 0;
 exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.runPostInstall = exports.runWatchCommand = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.resolveInstalledHarnesses = exports.clearCredentialsForUninstall = exports.READ_CREDENTIAL_RETRY_MS = exports.resetReadCredentialBackoff = exports.ensureReadCredential = exports.DEFAULT_SESSION_RETENTION = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.sessionRetention = exports.retireAgentSessions = exports.clearRetiredCredentials = exports.loadRetiredCredentials = exports.saveDelegationNodeId = exports.resolvePreprovisionedRootDelegation = exports.loadDelegationNodeId = exports.claimSubAgentDynamicCredentials = exports.clearSubAgentDynamicCredentialsForHarness = void 0;
 exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.renderMirrorBootstrap = exports.MCP_SERVER_PACKAGE = exports.defaultNpmInstaller = exports.describeRuntimeHealth = exports.checkRuntimeHealth = exports.pruneRuntimeStores = exports.removeRuntimeWiring = exports.getRuntimeWiring = exports.recordRuntimeWiring = exports.readRuntimeManifest = exports.getMcpShimPath = exports.getHookShimPath = exports.getShimDir = exports.getRuntimeStoreDir = exports.getRuntimeRoot = exports.moduleSpecifier = exports.requireHookCommand = exports.isOryRuntimeCommand = exports.mcpCommand = exports.hookCommand = exports.writeMcpShim = exports.writeHookShim = exports.resolveMcpRuntimeEntry = exports.resolveRuntimeEntry = exports.linkedRuntime = exports.materializeRuntime = exports.resolveRuntimeForInstall = exports.wireRuntime = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = void 0;
-exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = exports.decomposeAndCheck = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = void 0;
-exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = void 0;
+exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.MCP_TOOL_NAMESPACE = exports.MCP_SERVER_NAMESPACE = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = exports.decomposeAndCheck = exports.gateMcpToolCall = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = void 0;
+exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.mcpServerHint = exports.mcpServerFingerprints = exports.mcpFingerprint = exports.mcpToolObject = exports.normalizeMcpServerName = exports.parseMcpToolWithSeparator = exports.parseMcpToolArgs = exports.parseMcpToolName = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = void 0;
+exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var runtime_credential_js_1 = require("./runtime-credential.js");
@@ -244,6 +245,7 @@ var permissions_js_1 = require("./permissions.js");
 Object.defineProperty(exports, "checkAndDecide", { enumerable: true, get: function () { return permissions_js_1.checkAndDecide; } });
 Object.defineProperty(exports, "applyPermissionMode", { enumerable: true, get: function () { return permissions_js_1.applyPermissionMode; } });
 Object.defineProperty(exports, "gateToolCall", { enumerable: true, get: function () { return permissions_js_1.gateToolCall; } });
+Object.defineProperty(exports, "gateMcpToolCall", { enumerable: true, get: function () { return permissions_js_1.gateMcpToolCall; } });
 Object.defineProperty(exports, "decomposeAndCheck", { enumerable: true, get: function () { return permissions_js_1.decomposeAndCheck; } });
 Object.defineProperty(exports, "resolveCheckRelation", { enumerable: true, get: function () { return permissions_js_1.resolveCheckRelation; } });
 var bash_parser_js_1 = require("./bash-parser.js");
@@ -281,6 +283,8 @@ Object.defineProperty(exports, "ENROLLMENT_NAMESPACE", { enumerable: true, get:
 Object.defineProperty(exports, "PERMIT_USE", { enumerable: true, get: function () { return opl_js_1.PERMIT_USE; } });
 Object.defineProperty(exports, "DEFAULT_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.DEFAULT_NAMESPACE; } });
 Object.defineProperty(exports, "DEFAULT_SHELL_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.DEFAULT_SHELL_NAMESPACE; } });
+Object.defineProperty(exports, "MCP_SERVER_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.MCP_SERVER_NAMESPACE; } });
+Object.defineProperty(exports, "MCP_TOOL_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.MCP_TOOL_NAMESPACE; } });
 var tool_catalog_js_1 = require("./tool-catalog.js");
 Object.defineProperty(exports, "HARNESS_TOOL_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.HARNESS_TOOL_CATALOG; } });
 Object.defineProperty(exports, "KNOWN_HARNESSES", { enumerable: true, get: function () { return tool_catalog_js_1.KNOWN_HARNESSES; } });
@@ -307,6 +311,14 @@ var mcp_js_1 = require("./mcp.js");
 Object.defineProperty(exports, "parseClaudeCodeMcpTool", { enumerable: true, get: function () { return mcp_js_1.parseClaudeCodeMcpTool; } });
 Object.defineProperty(exports, "parseGeminiMcpTool", { enumerable: true, get: function () { return mcp_js_1.parseGeminiMcpTool; } });
 Object.defineProperty(exports, "parseMcpToolGeneric", { enumerable: true, get: function () { return mcp_js_1.parseMcpToolGeneric; } });
+Object.defineProperty(exports, "parseMcpToolName", { enumerable: true, get: function () { return mcp_js_1.parseMcpToolName; } });
+Object.defineProperty(exports, "parseMcpToolArgs", { enumerable: true, get: function () { return mcp_js_1.parseMcpToolArgs; } });
+Object.defineProperty(exports, "parseMcpToolWithSeparator", { enumerable: true, get: function () { return mcp_js_1.parseMcpToolWithSeparator; } });
+Object.defineProperty(exports, "normalizeMcpServerName", { enumerable: true, get: function () { return mcp_js_1.normalizeMcpServerName; } });
+Object.defineProperty(exports, "mcpToolObject", { enumerable: true, get: function () { return mcp_js_1.mcpToolObject; } });
+Object.defineProperty(exports, "mcpFingerprint", { enumerable: true, get: function () { return mcp_js_1.mcpFingerprint; } });
+Object.defineProperty(exports, "mcpServerFingerprints", { enumerable: true, get: function () { return mcp_js_1.mcpServerFingerprints; } });
+Object.defineProperty(exports, "mcpServerHint", { enumerable: true, get: function () { return mcp_js_1.mcpServerHint; } });
 Object.defineProperty(exports, "checkMcpPermission", { enumerable: true, get: function () { return mcp_js_1.checkMcpPermission; } });
 var subject_js_1 = require("./subject.js");
 Object.defineProperty(exports, "resolveUserSubject", { enumerable: true, get: function () { return subject_js_1.resolveUserSubject; } });

package/dist/logger.js

@@ -82,7 +82,7 @@ const SAFE_ACTIVITY_STRING_KEYS = new Set([
     "toolName",
     "trigger",
 ]);
-const SAFE_ACTIVITY_STRING_ARRAY_KEYS = new Set(["missing", "shellDeniedWords", "shellWords"]);
+const SAFE_ACTIVITY_STRING_ARRAY_KEYS = new Set(["mcpFingerprints", "missing", "shellDeniedWords", "shellWords"]);
 const SAFE_ACTIVITY_ID_KEYS = new Set(["oryRequestId"]);
 const SAFE_ACTIVITY_ERROR_CODES = new Set([
     "forbidden",

package/dist/mcp.d.ts

@@ -3,17 +3,37 @@
  *
  * Provides types, parsers, and permission check helpers for securing
  * MCP tool calls across all harness plugins. Each harness represents
- * MCP tools differently — parsers normalize them into McpToolIdentifier,
- * and checkMcpPermission runs server-level (and optionally tool-level)
- * Ory permission checks.
+ * MCP tools differently — parsers normalize them into McpToolIdentifier.
+ * Adapters pass that identifier to `gate`, which checks the McpServer and
+ * McpTool namespaces with the same block and mode semantics as native tools.
  */
 import type { OryAgentClient } from "./client.js";
 import type { UserSubjectRef } from "./subject.js";
+import type { McpServerHint } from "./types.js";
 export interface McpToolIdentifier {
     /** The MCP server name (e.g., "github", "slack", "postgres"). */
     serverName: string;
     /** The tool name within the server (e.g., "create_issue", "query"). */
     toolName: string;
+    /**
+     * Hashed server identifiers from {@link mcpServerFingerprints}, when the
+     * harness reports how the server is launched or reached.
+     */
+    fingerprints?: string[];
+    /**
+     * The call reads an MCP resource rather than calling a tool. Only the server
+     * is checked: enablement and No access apply, while tool tiers do not.
+     */
+    resource?: boolean;
+}
+/** How a harness reports launching or reaching one MCP server. */
+export interface McpServerSource {
+    /** Remote MCP server URL. */
+    url?: string;
+    /** Launch command, alone or with its arguments. */
+    command?: string;
+    /** Launch arguments, when the harness reports them separately. */
+    args?: readonly string[];
 }
 export interface McpPermissionCheckOptions {
     /**
@@ -22,11 +42,11 @@ export interface McpPermissionCheckOptions {
      * Build with `resolveUserSubject(client, fallback)`.
      */
     subject: UserSubjectRef;
-    /** Namespace for server-level checks. Default: "mcp_servers". */
+    /** Namespace for server-level checks. Default: "McpServer". */
     serverNamespace?: string;
-    /** Namespace for tool-level checks. Default: "mcp_tools". */
+    /** Namespace for tool-level checks. Default: "McpTool". */
     toolNamespace?: string;
-    /** Whether to also check tool-level permission. Default: false. */
+    /** Whether to also check the tool when its name is known. Default: true. */
     checkToolLevel?: boolean;
     /**
      * Attributes merged into the permission.check / permission.batch_check
@@ -56,21 +76,69 @@ export interface McpPermissionResult {
 export declare function parseClaudeCodeMcpTool(toolName: string): McpToolIdentifier | null;
 /**
  * Parse MCP context from Gemini CLI hook input.
- * Gemini provides server info via the `mcp_context` field.
+ *
+ * Gemini provides server info via the `mcp_context` field: the configured
+ * `server_name`, the server's own `tool_name` (the hook `tool_name` is the
+ * prefixed `mcp_<server>_<tool>` form), and how the server is launched or
+ * reached (`command`, `args`, `url`).
  */
 export declare function parseGeminiMcpTool(toolName: string, mcpContext?: Record<string, unknown>): McpToolIdentifier | null;
+/**
+ * Parse a `<server><separator><tool>` tool name, as Goose (`__`), OpenClaw
+ * (`__`), Cline (`__`), and OpenCode (`_`) build them. With `servers`, the
+ * longest configured server name that prefixes the tool name wins, so server
+ * names containing the separator split correctly and native tools without a
+ * server prefix return null. Without `servers`, the first separator splits.
+ */
+export declare function parseMcpToolWithSeparator(toolName: string, separator: string, servers?: Iterable<string>): McpToolIdentifier | null;
 /**
  * Generic MCP tool parser for harnesses that use a `mcp:<server>:<tool>`
  * convention. Returns null if the tool ID doesn't start with the prefix.
  */
 export declare function parseMcpToolGeneric(toolId: string, mcpPrefix?: string): McpToolIdentifier | null;
 /**
- * Check MCP server-level (and optionally tool-level) permissions.
+ * The hash Agent Security matches against cataloged server identifiers: the
+ * first 16 hex characters of the SHA-256 of the trimmed, lowercased identifier.
+ */
+export declare function mcpFingerprint(identifier: string): string;
+/**
+ * Hash the identifiers that recognize an MCP server whatever it is named: the
+ * remote URL host, the package a runner launches (`npx -y @playwright/mcp@1`
+ * yields `@playwright/mcp`), or the container image (`ghcr.io/github/github-mcp-server`).
+ * Only hashes leave the process; paths, arguments, and credentials are never sent.
+ */
+export declare function mcpServerFingerprints(source: McpServerSource): string[];
+/** The `mcp` hint Agent Security resolves an MCP check's server from. */
+export declare function mcpServerHint(mcpTool: McpToolIdentifier): McpServerHint;
+/**
+ * Normalize a configured MCP server name to the reported `McpServer` object:
+ * trimmed and lowercased. Agent Security resolves it, with the check's `mcp`
+ * hint, to the catalog server it enforces.
+ */
+export declare function normalizeMcpServerName(serverName: string): string;
+/** The `McpTool` object for one call: `<server>:<tool>`. */
+export declare function mcpToolObject(serverName: string, toolName: string): string;
+/**
+ * Parse a harness MCP tool name in either the `mcp__<server>__<tool>` form
+ * (Claude Code, Claude Agent SDK, Codex) or the `mcp:<server>:<tool>` form
+ * (OpenCode, OpenClaw, and older Codex builds).
+ */
+export declare function parseMcpToolName(toolName: string): McpToolIdentifier | null;
+/**
+ * Parse the arguments of a generic "call an MCP tool" harness tool, such as
+ * Cline's `use_mcp_tool` (`{ server_name, tool_name, arguments }`). Returns null
+ * unless both a server and a tool name are present.
+ */
+export declare function parseMcpToolArgs(toolArgs: unknown): McpToolIdentifier | null;
+/**
+ * Check the user's MCP `use` permits without machine-principal blocks or mode.
  *
- * Server check: namespace=mcp_servers, object=<serverName>, relation=use
- * Tool check:   namespace=mcp_tools,   object=<server>:<tool>, relation=invoke
+ * Server check: `McpServer:<server>#use`. Tool check, when the tool name is
+ * known and `checkToolLevel` is not false: `McpTool:<server>:<tool>#use`. The
+ * server name is normalized with {@link normalizeMcpServerName}.
  *
- * The subject is whatever the caller resolved (SubjectSet or direct ID).
+ * Harness adapters should pass `mcpTool` to `gate` / `decideTool` instead, which
+ * also applies Agent, Sub-Agent, and Project blocks and the permission mode.
  * Throws on API errors — callers handle fail-open behavior.
  */
 export declare function checkMcpPermission(client: OryAgentClient, mcpTool: McpToolIdentifier, options: McpPermissionCheckOptions): Promise<McpPermissionResult>;