@ory/claude-code 1.5.2 → 1.6.0

package/README.md

@@ -78,6 +78,8 @@ Once you connect to Ory Agent Security, two more things happen automatically:
 
 If Ory is ever unreachable, the plugin gets out of the way and lets Claude keep working — so it can't lock you out.
 
+**MCP servers.** Claude Code names MCP tools `mcp__<server>__<tool>`, so each call is checked against both the server and the tool. The plugin reports the name Claude Code uses, and Ory Agent Security matches it to the MCP server it was configured for. For a server configured in the managed `managed-mcp.json`, the project `.mcp.json`, `~/.claude.json` (user or per-project servers), or an installed plugin's `.mcp.json` or `plugin.json` (`mcp__plugin_<plugin>_<server>__<tool>`), the plugin also sends hashed fingerprints of its launch command or URL, so a well-known server is recognized even under a custom name such as `gh`. Servers passed with `--mcp-config` are not visible to hooks and are matched by name only. Because Agent Security never lets a name override a fingerprint, a custom server named after a well-known one is governed as uncatalogued. Only each server's `command`, `args`, and `url` are read, and only their hashes are sent; `env` and `headers` are never read. claude.ai connectors (`mcp__claude_ai_<Name>__<tool>`) and Claude Desktop Cowork connectors named by UUID are matched on the service side from their name and tool. A server Agent Security cannot identify falls under its Uncatalogued servers level. `ReadMcpResourceTool` and `ListMcpResourcesTool` calls that name a server are checked against that server as well as the native tool, so a disabled or No access server's resources cannot be read; listing resources across every server is checked as the native tool only.
+
 ### See what's happening
 
 Everything the plugin does is observable out of the box:
@@ -121,7 +123,7 @@ npx -y -p @ory/claude-code ory-claude configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Claude's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Claude's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/handlers.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleHookEvent = handleHookEvent;
 const argus_1 = require("@ory/argus");
+const mcp_servers_js_1 = require("./mcp-servers.js");
 const HARNESS = "claude-code";
 function handleHookEvent(input, client, deps = {}) {
     const event = input.hook_event_name;
@@ -83,13 +84,17 @@ async function handlePreToolUse(input, client, deps) {
         toolName,
         toolArgs: input.tool_input,
         subjectFallback: `session:${input.session_id}`,
-        mcpTool: (0, argus_1.parseClaudeCodeMcpTool)(toolName) ?? undefined,
+        mcpTool: identifyMcpCall(toolName, input) ?? undefined,
         principals: actingSubagentPrincipals(input, client),
     });
     return result.blocked
         ? { decision: "block", reason: result.denialMessage }
         : {};
 }
+function identifyMcpCall(toolName, input) {
+    return ((0, mcp_servers_js_1.identifyClaudeCodeMcpTool)(toolName, input.cwd) ??
+        (0, mcp_servers_js_1.identifyClaudeCodeMcpResource)(toolName, input.tool_input, input.cwd));
+}
 function actingSubagentPrincipals(input, client) {
     const type = input.agent_type;
     if (!input.agent_id || !type)
@@ -141,7 +146,7 @@ async function handlePermissionRequest(input, client) {
         toolName,
         toolInput: input.tool_input,
     });
-    const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);
+    const mcpTool = identifyMcpCall(toolName, input);
     const result = await (0, argus_1.decideTool)(client, {
         harness: HARNESS,
         toolName,

package/dist/mcp-servers.d.ts

@@ -0,0 +1,26 @@
+import { type McpToolIdentifier } from "@ory/argus";
+/**
+ * Identify a Claude Code MCP tool call, with fingerprints of how the server is
+ * launched or reached when Claude Code's configuration describes it: the
+ * managed `managed-mcp.json`, the project `.mcp.json`, the user's
+ * `~/.claude.json` (user and per-project servers), and, for plugin servers
+ * (`plugin_<plugin>_<server>`), the installed plugin's `.mcp.json` or
+ * `plugin.json`. The hook payload carries only `mcp__<server>__<tool>`, so
+ * without fingerprints a server configured under an unrecognized name would
+ * resolve to the uncatalogued policy. Servers passed with `--mcp-config` are
+ * not visible to hooks and are identified by name only. Only each server's
+ * `command`, `args`, and `url` are read, and only their hashes leave the
+ * process; `env` and `headers` are never read.
+ */
+export declare function identifyClaudeCodeMcpTool(toolName: string, cwd: string | undefined, { managedConfigPath }?: {
+    managedConfigPath?: string;
+}): McpToolIdentifier | null;
+/**
+ * Identify a Claude Code tool call that reads resources from one MCP server,
+ * so the server's enablement and No access apply to it as they do to its
+ * tools. Listing resources across every server names no server and stays a
+ * native tool call only.
+ */
+export declare function identifyClaudeCodeMcpResource(toolName: string, toolInput: unknown, cwd: string | undefined, { managedConfigPath }?: {
+    managedConfigPath?: string;
+}): McpToolIdentifier | null;

package/dist/mcp-servers.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identifyClaudeCodeMcpTool = identifyClaudeCodeMcpTool;
+exports.identifyClaudeCodeMcpResource = identifyClaudeCodeMcpResource;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const argus_1 = require("@ory/argus");
+/** `~/.claude.json` holds history too; skip it rather than parse a very large file per call. */
+const MAX_CONFIG_BYTES = 10 * 1024 * 1024;
+/**
+ * Identify a Claude Code MCP tool call, with fingerprints of how the server is
+ * launched or reached when Claude Code's configuration describes it: the
+ * managed `managed-mcp.json`, the project `.mcp.json`, the user's
+ * `~/.claude.json` (user and per-project servers), and, for plugin servers
+ * (`plugin_<plugin>_<server>`), the installed plugin's `.mcp.json` or
+ * `plugin.json`. The hook payload carries only `mcp__<server>__<tool>`, so
+ * without fingerprints a server configured under an unrecognized name would
+ * resolve to the uncatalogued policy. Servers passed with `--mcp-config` are
+ * not visible to hooks and are identified by name only. Only each server's
+ * `command`, `args`, and `url` are read, and only their hashes leave the
+ * process; `env` and `headers` are never read.
+ */
+function identifyClaudeCodeMcpTool(toolName, cwd, { managedConfigPath = managedMcpConfigPath() } = {}) {
+    const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);
+    return mcpTool ? withFingerprints(mcpTool, cwd, managedConfigPath) : null;
+}
+/** Claude Code's tools that read MCP resources, which name their server in the tool input. */
+const RESOURCE_TOOLS = new Set(["ReadMcpResourceTool", "ListMcpResourcesTool"]);
+/**
+ * Identify a Claude Code tool call that reads resources from one MCP server,
+ * so the server's enablement and No access apply to it as they do to its
+ * tools. Listing resources across every server names no server and stays a
+ * native tool call only.
+ */
+function identifyClaudeCodeMcpResource(toolName, toolInput, cwd, { managedConfigPath = managedMcpConfigPath() } = {}) {
+    if (!RESOURCE_TOOLS.has(toolName) || !toolInput || typeof toolInput !== "object")
+        return null;
+    const server = toolInput.server;
+    if (typeof server !== "string" || server.trim() === "")
+        return null;
+    // Tool names carry the server name with every character outside
+    // [A-Za-z0-9_-] replaced (`plugin:figma:figma` becomes `plugin_figma_figma`),
+    // so report and look it up in that form.
+    const serverName = server.trim().replace(/[^A-Za-z0-9_-]/g, "_");
+    return withFingerprints({ serverName, toolName: "", resource: true }, cwd, managedConfigPath);
+}
+function withFingerprints(mcpTool, cwd, managedConfigPath) {
+    const source = configuredServerSource(mcpTool.serverName, cwd, managedConfigPath);
+    if (!source)
+        return mcpTool;
+    const fingerprints = (0, argus_1.mcpServerFingerprints)({
+        url: typeof source.url === "string" ? source.url : undefined,
+        command: typeof source.command === "string" ? source.command : undefined,
+        args: Array.isArray(source.args) ? source.args.filter((arg) => typeof arg === "string") : undefined,
+    });
+    return fingerprints.length > 0 ? { ...mcpTool, fingerprints } : mcpTool;
+}
+function configuredServerSource(server, cwd, managedConfigPath) {
+    const configDir = process.env.CLAUDE_CONFIG_DIR;
+    const userConfig = readJson(node_path_1.default.join(configDir ?? (0, node_os_1.homedir)(), ".claude.json"));
+    const candidates = [
+        // Managed servers take precedence: a managed config gives administrators exclusive control.
+        managedConfigPath ? mcpServersOf(readJson(managedConfigPath)) : undefined,
+        cwd ? mcpServersOf(readJson(node_path_1.default.join(cwd, ".mcp.json"))) : undefined,
+        cwd ? userConfig?.projects?.[cwd]?.mcpServers : undefined,
+        userConfig?.mcpServers,
+    ];
+    for (const servers of candidates) {
+        const entry = serverEntry(servers, server);
+        if (entry)
+            return entry;
+    }
+    return pluginServerSource(server, node_path_1.default.join(configDir ?? node_path_1.default.join((0, node_os_1.homedir)(), ".claude"), "plugins"));
+}
+/**
+ * Find a plugin server, which Claude Code names `plugin_<plugin>_<server>`, in
+ * the configuration of the installed plugin. Plugin names may contain `_`, so
+ * the installed plugin names decide where the server name starts.
+ */
+function pluginServerSource(server, pluginsDir) {
+    if (!server.startsWith("plugin_"))
+        return undefined;
+    const installed = readJson(node_path_1.default.join(pluginsDir, "installed_plugins.json"))
+        ?.plugins;
+    if (!installed || typeof installed !== "object")
+        return undefined;
+    for (const [id, installs] of Object.entries(installed)) {
+        const plugin = id.split("@")[0];
+        const prefix = `plugin_${plugin}_`;
+        if (!server.startsWith(prefix) || !Array.isArray(installs))
+            continue;
+        const name = server.slice(prefix.length);
+        for (const install of installs) {
+            if (typeof install?.installPath !== "string")
+                continue;
+            const root = install.installPath;
+            const manifest = readJson(node_path_1.default.join(root, ".claude-plugin", "plugin.json"));
+            const declared = typeof manifest?.mcpServers === "string"
+                ? mcpServersOf(readJson(node_path_1.default.resolve(root, manifest.mcpServers)))
+                : manifest?.mcpServers;
+            const entry = serverEntry(declared, name) ?? serverEntry(mcpServersOf(readJson(node_path_1.default.join(root, ".mcp.json"))), name);
+            if (entry)
+                return entry;
+        }
+    }
+    return undefined;
+}
+/** The managed MCP configuration Claude Code reads on this platform. */
+function managedMcpConfigPath() {
+    switch (process.platform) {
+        case "darwin":
+            return "/Library/Application Support/ClaudeCode/managed-mcp.json";
+        case "win32":
+            return node_path_1.default.join(process.env.ProgramFiles ?? "C:\\Program Files", "ClaudeCode", "managed-mcp.json");
+        case "linux":
+            return "/etc/claude-code/managed-mcp.json";
+        default:
+            return undefined;
+    }
+}
+/** The servers of an MCP config file, which nests them under `mcpServers` or lists them at the top level. */
+function mcpServersOf(config) {
+    if (!config || typeof config !== "object")
+        return undefined;
+    return config.mcpServers ?? config;
+}
+function serverEntry(servers, server) {
+    if (!servers || typeof servers !== "object" || !Object.hasOwn(servers, server))
+        return undefined;
+    const entry = servers[server];
+    return entry && typeof entry === "object" ? entry : undefined;
+}
+function readJson(file) {
+    try {
+        if ((0, node_fs_1.statSync)(file).size > MAX_CONFIG_BYTES)
+            return undefined;
+        return JSON.parse((0, node_fs_1.readFileSync)(file, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/claude-code",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "Ory plugin for Claude Code: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/claude-plugins/tree/master/plugins/ory-agent-plugin",
@@ -78,7 +78,7 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.2"
+    "@ory/argus": "1.6.0"
   },
   "engines": {
     "node": ">=22"