@ory/argus 1.5.3 → 1.7.0

package/dist/permissions.js

@@ -14,9 +14,8 @@
  *          tool through.
  *        - `enforce` — return `{ kind: "deny", … }` so the caller blocks.
  *   3. On a thrown {@link OryError}, inspects the classified code:
- *        - Infrastructure errors (`network_error`, `rate_limited`,
- *          `not_found`, `unknown`) — returns `{ kind: "fail_open", … }`.
- *          Callers should log and allow.
+ *        - Network, rate-limit and server failures deny in enforce mode;
+ *          observe mode remains permissive.
  *        - Auth-rejected check calls (`forbidden`, `session_inactive`,
  *          `session_aal2_required` — the check itself was rejected, so
  *          its result cannot be trusted) — in `enforce` mode returns
@@ -32,9 +31,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveCheckRelation = resolveCheckRelation;
 exports.applyPermissionMode = applyPermissionMode;
 exports.gateToolCall = gateToolCall;
+exports.gateMcpToolCall = gateMcpToolCall;
+exports.mostRestrictiveDecision = mostRestrictiveDecision;
 exports.decomposeAndCheck = decomposeAndCheck;
 exports.checkAndDecide = checkAndDecide;
 const bash_parser_js_1 = require("./bash-parser.js");
+const mcp_js_1 = require("./mcp.js");
 const config_js_1 = require("./config.js");
 const permission_mode_js_1 = require("./permission-mode.js");
 const read_credential_js_1 = require("./read-credential.js");
@@ -54,8 +56,7 @@ function resolveCheckRelation(relation) {
  * authentication/authorization reasons — an expired or misconfigured
  * agent credential, an inactive session, or a missing MFA step. The
  * check result cannot be trusted, so `enforce` mode denies instead of
- * failing open. Infrastructure errors (`network_error`, `rate_limited`,
- * `not_found`, `unknown`) keep the fail-open posture.
+ * failing open. Network and rate-limit failures are likewise untrusted.
  */
 const CHECK_UNTRUSTED_CODES = new Set([
     // The check reached Ory and was refused — an expired or misconfigured agent
@@ -69,7 +70,27 @@ const CHECK_UNTRUSTED_CODES = new Set([
     // cert problem silently downgraded an `enforce` project to `observe`, and
     // breaking TLS was sufficient to disable all tool gating (#218).
     "tls_error",
+    "network_error",
+    "rate_limited",
 ]);
+function isUntrustedCheckError(error) {
+    return !!error && (CHECK_UNTRUSTED_CODES.has(error.code) || (error.status !== undefined && error.status >= 500));
+}
+function isUnavailableCheckError(error) {
+    return error.code === "network_error" || error.code === "rate_limited" || (error.status !== undefined && error.status >= 500);
+}
+function rejectedCheckDecision(check, error, mode) {
+    const attrs = buildDecisionAttributes(mode, check.subjectId, check.subjectSet);
+    if (mode === "enforce") {
+        return {
+            kind: "deny",
+            result: { allowed: false, checkedAt: new Date().toISOString(), check },
+            mode: "enforce",
+            activityAttributes: { ...attrs, checkRejected: error.code },
+        };
+    }
+    return { kind: "fail_open", error, mode, activityAttributes: attrs };
+}
 /**
  * Max distinct command words checked per shell command (issue #76). A command
  * with more than this is pathological (no legitimate command runs 100+ distinct
@@ -248,10 +269,13 @@ async function gateToolCall(client, args) {
             namespace: args.check.namespace,
             object: args.check.object,
             principals: args.principals,
-        }),
+            strict: mode === "enforce",
+        }).catch((error) => ({ error })),
     ]);
     if (!blocked)
         return decision;
+    if ("error" in blocked)
+        return rejectedCheckDecision(args.check, blocked.error, mode);
     // Already denied on the user's own check — nothing to add to the outcome, but
     // the block is worth recording as the stronger reason it would not have run.
     if (decision.kind === "deny") {
@@ -284,6 +308,7 @@ async function batchNonShellGate(client, args) {
             object: args.check.object,
             relation: opl_js_1.RELATION_BLOCKED_SUBJECTS,
             ...ref,
+            ...(args.check.mcp ? { mcp: args.check.mcp } : {}),
         })),
     ];
     try {
@@ -313,15 +338,70 @@ async function batchNonShellGate(client, args) {
         }
         return applyBlockedDecision(client, args, mode, decision, blocked);
     }
-    catch {
+    catch (err) {
         const mode = args.modeOverride ?? (await (0, permission_mode_js_1.warmPermissionModeCache)(client, modeSubject, { additionalSubjects })).mode;
+        const error = err?.status !== undefined || err?.code === "network_error" || err?.code === "rate_limited"
+            ? err : client.classifyError(err);
+        if (isUnavailableCheckError(error))
+            return rejectedCheckDecision(args.check, error, mode);
         const [decision, blocked] = await Promise.all([
             checkAndDecide(client, args.check, { activityAttributes: args.activityAttributes, modeOverride: mode }),
-            findBlockedPrincipal(client, { namespace: args.check.namespace, object: args.check.object, principals: args.principals }),
+            findBlockedPrincipal(client, {
+                namespace: args.check.namespace,
+                object: args.check.object,
+                principals: args.principals,
+                mcp: args.check.mcp,
+                strict: mode === "enforce",
+            }).catch((error) => ({ error })),
         ]);
+        if (blocked && "error" in blocked)
+            return rejectedCheckDecision(args.check, blocked.error, mode);
         return applyBlockedDecision(client, args, mode, decision, blocked);
     }
 }
+/**
+ * Gate one MCP tool call against the Agent Security MCP namespaces.
+ *
+ * The call is checked twice with the native tool model: `McpServer:<server>`
+ * (No access blocks every tool on the server, cataloged or not) and
+ * `McpTool:<server>:<tool>` (Read and Write levels block tool tiers). Each check
+ * covers the user's `use` permit and every machine-principal block, so an MCP
+ * level set on the Project, an Identity, an Agent, or a Sub-Agent applies here.
+ * The server name is normalized to its lowercased form, matching the server
+ * catalog. The most restrictive outcome wins.
+ */
+async function gateMcpToolCall(client, args) {
+    await (0, read_credential_js_1.ensureReadCredential)(client, { harness: args.harness });
+    const serverName = (0, mcp_js_1.normalizeMcpServerName)(args.mcpTool.serverName);
+    const mcp = (0, mcp_js_1.mcpServerHint)(args.mcpTool);
+    // The tool is checked even when the harness reports no tool name: Agent
+    // Security checks an unnamed tool as Admin, so Read and Write still deny it.
+    // A resource read has no tool and is checked on the server alone.
+    const objects = [
+        { namespace: opl_js_1.MCP_SERVER_NAMESPACE, object: serverName },
+        ...(args.mcpTool.resource
+            ? []
+            : [{ namespace: opl_js_1.MCP_TOOL_NAMESPACE, object: (0, mcp_js_1.mcpToolObject)(serverName, args.mcpTool.toolName ?? "") }]),
+    ];
+    const decisions = await Promise.all(objects.map(({ namespace, object }) => batchNonShellGate(client, {
+        harness: args.harness,
+        toolName: args.toolName,
+        check: { namespace, object, relation: opl_js_1.PERMIT_USE, ...args.subject, mcp },
+        activityAttributes: args.activityAttributes,
+        modeOverride: args.modeOverride,
+        principals: args.principals,
+    })));
+    return mostRestrictiveDecision(decisions);
+}
+const DECISION_SEVERITY = {
+    allow: 0,
+    fail_open: 1,
+    observe: 2,
+    deny: 3,
+};
+function mostRestrictiveDecision(decisions) {
+    return decisions.reduce((current, next) => DECISION_SEVERITY[next.kind] > DECISION_SEVERITY[current.kind] ? next : current);
+}
 function applyBlockedDecision(client, args, mode, decision, blocked) {
     if (!blocked)
         return decision;
@@ -389,9 +469,9 @@ function applyPrincipalBlock(client, ctx) {
  * Aggregation: **any deny → deny** (naming the offending word); else any observe
  * → observe (pass through, per-word `permission.observe_deny` events recorded);
  * else allow. A too-complex / unparseable command is **fail-closed** in enforce
- * (deny + alert) and logged-then-passed in observe. A parser-unavailable or
- * infrastructure error is **fail-open** (top-level decision only) — availability
- * must not hinge on the parser.
+ * (deny + alert) and logged-then-passed in observe. A parser-unavailable
+ * condition falls back to the top-level decision. Network, rate-limit, and
+ * server failures in word checks deny in enforce mode.
  */
 async function decomposeAndCheck(client, args) {
     // The word checks do not depend on the top-level result until aggregation, so
@@ -411,7 +491,7 @@ async function decomposeAndCheck(client, args) {
         || parsed.words.length > MAX_SHELL_WORDS
         || (parsed.tooComplex && expectedMode === "enforce")
         ? undefined
-        : fetchShellWordResults(client, args, namespace, parsed.words, subject);
+        : fetchShellWordResults(client, { ...args, modeOverride: expectedMode }, namespace, parsed.words, subject);
     const [top, wordFetch] = await Promise.all([topPromise, wordsPromise]);
     // Top-level Bash denied (enforce) or unreachable → no point decomposing.
     if (top.kind === "deny" || top.kind === "fail_open")
@@ -486,10 +566,10 @@ async function decomposeAndCheck(client, args) {
     let sawObserve = false;
     let matchedBlocks = new Map();
     if (words.length > 0) {
-        const fetched = wordFetch ?? await fetchShellWordResults(client, args, namespace, words, subject);
+        const fetched = wordFetch ?? await fetchShellWordResults(client, { ...args, modeOverride: mode }, namespace, words, subject);
         if (!fetched.ok) {
             const oryErr = fetched.error;
-            if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
+            if (mode === "enforce" && isUntrustedCheckError(oryErr)) {
                 return {
                     kind: "deny",
                     result: { allowed: false, checkedAt: new Date().toISOString(), check: args.check },
@@ -670,6 +750,7 @@ async function fetchShellWordResults(client, args, namespace, words, subject) {
                     namespace,
                     objects: chunk,
                     principals: args.principals,
+                    strict: args.modeOverride === "enforce",
                 }),
             ]);
             return { ok: true, results: batch.results, blocked };
@@ -694,8 +775,8 @@ async function fetchShellWordResults(client, args, namespace, words, subject) {
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — infrastructure errors surface as a typed
- * `{ kind: "fail_open" }` decision, and auth-rejected check calls in
- * enforce mode as `{ kind: "deny" }` (see
+ * `{ kind: "fail_open" }` decision in observe mode, and untrusted or unavailable
+ * check calls in enforce mode as `{ kind: "deny" }` (see
  * {@link CHECK_UNTRUSTED_CODES}).
  */
 async function checkAndDecide(client, check, opts = {}) {
@@ -716,9 +797,8 @@ async function checkAndDecide(client, check, opts = {}) {
     }
     catch (err) {
         const oryErr = err;
-        if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
-            // The check call itself was rejected for auth reasons — the
-            // result cannot be trusted, so enforce mode must not fail open.
+        if (mode === "enforce" && isUntrustedCheckError(oryErr)) {
+            // The result cannot be trusted, so enforce mode must not fail open.
             client.logger.warn("permission.check_rejected", {
                 namespace: check.namespace,
                 object: check.object,
@@ -812,6 +892,8 @@ async function findBlockedPrincipal(client, args) {
         namespace: args.namespace,
         objects: [args.object],
         principals: args.principals,
+        mcp: args.mcp,
+        strict: args.strict,
     })).get(args.object);
 }
 async function findBlockedPrincipals(client, args) {
@@ -843,6 +925,7 @@ async function findBlockedPrincipals(client, args) {
                 object,
                 relation: opl_js_1.RELATION_BLOCKED_SUBJECTS,
                 ...ref,
+                ...(args.mcp ? { mcp: args.mcp } : {}),
             }))), { activityAttributes: { source: "principal_block", scope } });
             for (const [i, result] of batch.results.entries()) {
                 const object = args.objects[Math.floor(i / candidates.length)];
@@ -856,6 +939,9 @@ async function findBlockedPrincipals(client, args) {
             }
         }
         catch (err) {
+            const classified = err?.code ? err : client.classifyError(err);
+            if (args.strict && isUntrustedCheckError(classified))
+                throw classified;
             client.logger.debug("permission.principal_block.failed", {
                 scope,
                 note: `${scope} principal block read failed; falling open for that scope`,

package/dist/post-install.d.ts

@@ -16,7 +16,7 @@
  * plugin logs activity locally and gates nothing. Nothing else changes either way.
  *
  * Everything *else* an Ory project needs to serve Agent Security — the login
- * OAuth2 client, the permission model, native-tool blocks, MCP grants,
+ * OAuth2 client, the permission model, native-tool blocks, MCP server access,
  * and the observe/enforce posture — is provisioned in the **Ory Console**
  * (Agent Security), by someone with access to the project. The plugin never
  * writes project configuration, which is why installing it needs only a

package/dist/post-install.js

@@ -17,7 +17,7 @@
  * plugin logs activity locally and gates nothing. Nothing else changes either way.
  *
  * Everything *else* an Ory project needs to serve Agent Security — the login
- * OAuth2 client, the permission model, native-tool blocks, MCP grants,
+ * OAuth2 client, the permission model, native-tool blocks, MCP server access,
  * and the observe/enforce posture — is provisioned in the **Ory Console**
  * (Agent Security), by someone with access to the project. The plugin never
  * writes project configuration, which is why installing it needs only a
@@ -112,7 +112,7 @@ async function runPostInstall(binName, _harness, args = []) {
     if (security.connected) {
         ui.success("Ory Agent Security is connected.");
         ui.hint("Sign-in and permission checks run on the next session.");
-        ui.hint("Native-tool blocks, MCP grants, and the observe/enforce posture are managed in the Ory Console (Agent Security).");
+        ui.hint("Native-tool blocks, MCP server access, and the observe/enforce posture are managed in the Ory Console (Agent Security).");
         ui.hint(`Inspect what this machine resolves with \`${binName} permissions status\`.`);
     }
     else {

package/dist/testing.d.ts

@@ -5,7 +5,7 @@
  * common assertion patterns so that harness plugin tests focus on
  * harness-specific behavior rather than duplicating boilerplate.
  */
-import { vi } from "vitest";
+import { type Mock } from "vitest";
 import { OryAgentClient } from "./client.js";
 import type { ActivityEntry } from "./logger.js";
 import type { PermissionMode } from "./config.js";
@@ -13,8 +13,8 @@ export { runHarnessContractSuite, type HarnessContractAdapter, type ContractCont
 export interface SdkLazySessionContractAdapter {
     name: string;
     harness: string;
-    createSessionStarterMock: ReturnType<typeof vi.fn>;
-    ensureSessionMock: ReturnType<typeof vi.fn>;
+    createSessionStarterMock: Mock;
+    ensureSessionMock: Mock;
     createSubject(client: OryAgentClient, projectUrl?: string): {
         invoke(index: number): Promise<unknown>;
     };
@@ -40,7 +40,7 @@ export declare function createMockClient(overrides?: Partial<ConstructorParamete
 export declare function spyRecordDelegation(client: OryAgentClient, result?: {
     nodeId: string;
     delegationChain: string[];
-}): import("vitest").Mock<(input: import("./client.js").RecordDelegationInput, options?: {
+}): Mock<(input: import("./client.js").RecordDelegationInput, options?: {
     fetchImpl?: typeof fetch;
     activityAttributes?: Record<string, unknown>;
     agentToken?: string;
@@ -52,7 +52,7 @@ export declare function spyRecordDelegation(client: OryAgentClient, result?: {
  * Stub an internal API instance method on the client.
  * Returns a vi.fn mock so callers can assert on calls.
  */
-export declare function stubApi<K extends "frontend" | "oauth2" | "permission">(client: OryAgentClient, api: K, method: string, impl: (...args: unknown[]) => unknown): ReturnType<typeof vi.fn>;
+export declare function stubApi<K extends "frontend" | "oauth2" | "permission">(client: OryAgentClient, api: K, method: string, impl: (...args: unknown[]) => unknown): Mock;
 /** Successful session verification response (wraps Ory API shape). */
 export declare const MOCK_SESSION_RESPONSE: {
     data: {
@@ -76,7 +76,6 @@ export declare const MOCK_SESSION_RESPONSE: {
 /** Inactive session (same shape, active: false). */
 export declare const MOCK_INACTIVE_SESSION_RESPONSE: {
     data: {
-        active: boolean;
         id: string;
         authenticated_at: string;
         expires_at: string;
@@ -91,6 +90,7 @@ export declare const MOCK_INACTIVE_SESSION_RESPONSE: {
                 email: string;
             };
         };
+        active: boolean;
     };
 };
 /** Successful OAuth2 token introspection response. */
@@ -238,19 +238,19 @@ export declare function disconnectSecurity(which?: "neither" | "no-client-id" |
  */
 export declare function clearOryEnv(): void;
 /** Stub verifySession to succeed. */
-export declare function stubSessionSuccess(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubSessionSuccess(client: OryAgentClient): Mock;
 /** Stub verifySession to return inactive. */
-export declare function stubSessionInactive(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubSessionInactive(client: OryAgentClient): Mock;
 /** Stub verifySession to throw a network error. */
-export declare function stubSessionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubSessionNetworkError(client: OryAgentClient): Mock;
 /** Stub verifySession to throw MFA required. */
-export declare function stubSessionMfaRequired(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubSessionMfaRequired(client: OryAgentClient): Mock;
 /** Stub verifySession to throw session_inactive. */
-export declare function stubSessionExpired(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubSessionExpired(client: OryAgentClient): Mock;
 /** Stub introspectToken to succeed. */
-export declare function stubOAuth2Success(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubOAuth2Success(client: OryAgentClient): Mock;
 /** Stub introspectToken to return inactive. */
-export declare function stubOAuth2Inactive(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubOAuth2Inactive(client: OryAgentClient): Mock;
 /**
  * Set the mode the server-read stub reports. Also clears the in-memory
  * permission-mode cache so the new value takes effect immediately (tests run
@@ -258,26 +258,38 @@ export declare function stubOAuth2Inactive(client: OryAgentClient): import("vite
  */
 export declare function setTestPermissionMode(mode: PermissionMode): void;
 /** Stub checkPermission to allow. */
-export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
-    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").MockInstance<import("../../../node_modules/vitest/dist/chunks/config.d.QBNYCgFU.js", { with: { "resolution-mode": "import" } }).v> & {
+    (...args: any[]): any;
+    new (...args: any[]): any;
+} & {} & {
+    batch: Mock;
 };
 /** Stub checkPermission to deny (the tool check; the mode check still answers `currentTestMode`). */
-export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
-    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").MockInstance<import("../../../node_modules/vitest/dist/chunks/config.d.QBNYCgFU.js", { with: { "resolution-mode": "import" } }).v> & {
+    (...args: any[]): any;
+    new (...args: any[]): any;
+} & {} & {
+    batch: Mock;
 };
 /** Stub checkPermission to throw a network error. */
-export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
-    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").MockInstance<import("../../../node_modules/vitest/dist/chunks/config.d.QBNYCgFU.js", { with: { "resolution-mode": "import" } }).v> & {
+    (...args: any[]): any;
+    new (...args: any[]): any;
+} & {} & {
+    batch: Mock;
 };
 /** Stub checkPermission to throw a rate-limit error. */
-export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
-    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").MockInstance<import("../../../node_modules/vitest/dist/chunks/config.d.QBNYCgFU.js", { with: { "resolution-mode": "import" } }).v> & {
+    (...args: any[]): any;
+    new (...args: any[]): any;
+} & {} & {
+    batch: Mock;
 };
-/** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */
-export declare function stubMcpAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
-/** Stub checkPermission to deny (server-only MCP check). */
-export declare function stubMcpServerDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
-/** Stub batchCheckPermission: server allowed, tool denied. */
-export declare function stubMcpToolDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
-/** Stub checkPermission to throw network error (MCP fail-open). */
-export declare function stubMcpNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+/** Stub MCP checks so the server and the tool are both allowed. */
+export declare function stubMcpAllowed(client: OryAgentClient): Mock;
+/** Stub MCP checks so the server is denied (No access). */
+export declare function stubMcpServerDenied(client: OryAgentClient): Mock;
+/** Stub MCP checks so the server is allowed but the tool is denied (its tier is blocked). */
+export declare function stubMcpToolDenied(client: OryAgentClient): Mock;
+/** Stub MCP checks to throw a network error (MCP fail-open). */
+export declare function stubMcpNetworkError(client: OryAgentClient): Mock;

package/dist/testing.js

@@ -553,25 +553,47 @@ function stubPermissionRateLimited(client) {
     return Object.assign(check, { batch });
 }
 // ─── MCP Stub Presets ─────────────────────────────────────────────
-/** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */
-function stubMcpAllowed(client) {
+/**
+ * Answer MCP gate checks tuple by tuple: the `McpServer` and `McpTool` use
+ * permits get the given answers, mode checks answer `currentTestMode`, block
+ * probes find no block, and any other use permit is allowed.
+ */
+function stubMcpDecision(client, answers) {
     ensurePermissionCredential(client);
-    stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_ALLOWED));
-    return stubApi(client, "permission", "batchCheckPermission", () => Promise.resolve(exports.BATCH_BOTH_ALLOWED));
+    const answer = (tuple) => {
+        if (tuple.object === opl_js_1.PERMISSION_MODE_OBJECT && tuple.relation === opl_js_1.RELATION_ENFORCED_SUBJECTS) {
+            return currentTestMode === "enforce";
+        }
+        if (tuple.relation === "blockedSubjects")
+            return false;
+        if (tuple.namespace === "McpServer")
+            return answers.server;
+        if (tuple.namespace === "McpTool")
+            return answers.tool;
+        return true;
+    };
+    stubApi(client, "permission", "checkPermission", (params) => Promise.resolve(answer(params) ? exports.PERMISSION_ALLOWED : exports.PERMISSION_DENIED));
+    return stubApi(client, "permission", "batchCheckPermission", (request) => {
+        const tuples = request
+            .batchCheckPermissionBody?.tuples ?? [];
+        return Promise.resolve({ data: { results: tuples.map((tuple) => ({ allowed: answer(tuple) })) } });
+    });
+}
+/** Stub MCP checks so the server and the tool are both allowed. */
+function stubMcpAllowed(client) {
+    return stubMcpDecision(client, { server: true, tool: true });
 }
-/** Stub checkPermission to deny (server-only MCP check). */
+/** Stub MCP checks so the server is denied (No access). */
 function stubMcpServerDenied(client) {
-    ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_DENIED));
+    return stubMcpDecision(client, { server: false, tool: true });
 }
-/** Stub batchCheckPermission: server allowed, tool denied. */
+/** Stub MCP checks so the server is allowed but the tool is denied (its tier is blocked). */
 function stubMcpToolDenied(client) {
-    ensurePermissionCredential(client);
-    stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_ALLOWED));
-    return stubApi(client, "permission", "batchCheckPermission", () => Promise.resolve(exports.BATCH_SERVER_ALLOWED_TOOL_DENIED));
+    return stubMcpDecision(client, { server: true, tool: false });
 }
-/** Stub checkPermission to throw network error (MCP fail-open). */
+/** Stub MCP checks to throw a network error (MCP fail-open). */
 function stubMcpNetworkError(client) {
     ensurePermissionCredential(client);
+    stubApi(client, "permission", "batchCheckPermission", () => Promise.reject(makeNetworkError()));
     return stubApi(client, "permission", "checkPermission", () => Promise.reject(makeNetworkError()));
 }

package/dist/types.d.ts

@@ -32,6 +32,19 @@ export interface PermissionCheck {
         object: string;
         relation: string;
     };
+    /**
+     * The MCP server an `McpServer` or `McpTool` check targets, as the harness
+     * reported it. Agent Security resolves it to the catalog server it checks.
+     */
+    mcp?: McpServerHint;
+}
+export interface McpServerHint {
+    /** The server name as the harness reports it. */
+    server: string;
+    /** The MCP tool name as the server defines it. */
+    tool?: string;
+    /** Hashed server identifiers from {@link mcpServerFingerprints}. */
+    fingerprints?: string[];
 }
 export interface PermissionResult {
     allowed: boolean;
@@ -50,8 +63,7 @@ export type OryErrorCode = "session_inactive" | "session_aal2_required" | "forbi
 /**
  * TLS/certificate verification failed — an expired, self-signed, or otherwise
  * untrusted certificate on the project host. Distinct from `network_error`
- * because the posture differs: a socket-level blip is a transport failure and
- * fails open, whereas a certificate failure means we cannot establish *who we
+ * because a certificate failure means we cannot establish *who we
  * are talking to*, so the check result cannot be trusted at all. It is also
  * precisely the failure an active network attacker produces, so under
  * `enforce` it denies rather than passing the tool through.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.5.3",
+  "version": "1.7.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -62,10 +62,10 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/client": "^1.22.37",
+    "@ory/client": "^1.22.66",
     "@vscode/tree-sitter-wasm": "^0.3.1",
-    "open": "^11.0.0",
-    "web-tree-sitter": "^0.26.11"
+    "open": "^11.0.4",
+    "web-tree-sitter": "^0.27.1"
   },
   "engines": {
     "node": ">=22"