@ory/cline 1.5.3 → 1.7.0

package/README.md

@@ -95,6 +95,26 @@ npx -y -p @ory/cline ory-cline permissions   # native allowed/blocked state and
 
 Then a denied tool is actually blocked and Cline shows why.
 
+### MCP servers
+
+Cline 3 names an MCP tool `<server>__<tool>`, replacing runs of characters
+outside `[a-zA-Z0-9_-]` with `_` and truncating names over 128 characters with
+a hash suffix (verified against cline@3.0.29, `@cline/core` 0.0.51
+`defaultMcpToolNameTransform`). The plugin checks such a call as
+`McpServer:<server>` and `McpTool:<server>:<tool>`; Agent Security resolves
+the reported name to a cataloged server. To split server names that contain
+`__`, it reads the server keys (only the keys) from Cline's MCP settings file:
+`CLINE_MCP_SETTINGS_PATH`, else
+`~/.cline/data/settings/cline_mcp_settings.json` (honoring `CLINE_DATA_DIR`
+and `CLINE_DIR`). A tool from a server not listed there, such as one a Cline
+plugin registers, is split at its first `__`. Cline's native tools contain no
+`__` and keep the native check. The legacy `use_mcp_tool` tool is still
+recognized by its `server_name` and `tool_name` arguments.
+
+Limits: the hook payload does not say how a server is launched, and the plugin
+reads only server keys from the settings file, so no fingerprints are sent. A
+truncated tool name reports the truncated, hash-suffixed tool part.
+
 ## Connect to Ory Agent Security
 
 Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
@@ -115,7 +135,7 @@ npx -y -p @ory/cline ory-cline configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Cline's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Cline's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/handlers.js

@@ -1,8 +1,97 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleHookEvent = handleHookEvent;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const argus_1 = require("@ory/argus");
 const HARNESS = "cline";
+/**
+ * Identify an MCP tool call.
+ *
+ * Cline 3 names an MCP tool `<server>__<tool>` (`defaultMcpToolNameTransform`
+ * in @cline/core 0.0.51, shipped with cline@3.0.29): runs of characters outside
+ * `[a-zA-Z0-9_-]` become `_`, and a name over 128 characters is truncated and
+ * suffixed with a hash. The configured server keys split a server name that
+ * itself contains `__`; otherwise the first `__` splits it. No Cline 3 native
+ * tool name contains `__`. The legacy `use_mcp_tool` tool carries the server
+ * and tool in its arguments.
+ */
+function identifyMcpTool(toolName, toolArgs) {
+    if (toolName === "use_mcp_tool")
+        return (0, argus_1.parseMcpToolArgs)(toolArgs) ?? undefined;
+    if (!toolName.includes("__"))
+        return undefined;
+    const servers = configuredMcpServers();
+    const configured = (0, argus_1.parseMcpToolWithSeparator)(toolName, "__", servers.keys());
+    if (configured)
+        return { serverName: servers.get(configured.serverName), toolName: configured.toolName };
+    return (0, argus_1.parseMcpToolWithSeparator)(toolName, "__") ?? undefined;
+}
+/**
+ * The server keys in Cline's MCP settings file, keyed by the sanitized prefix
+ * Cline puts on their tools. Path resolution mirrors @cline/shared
+ * `resolveMcpSettingsPath`: `CLINE_MCP_SETTINGS_PATH`, else
+ * `<CLINE_DATA_DIR | (CLINE_DIR | ~/.cline)/data>/settings/cline_mcp_settings.json`.
+ * Only the `mcpServers` keys are read; server definitions are ignored.
+ */
+function configuredMcpServers() {
+    const servers = new Map();
+    try {
+        const settings = JSON.parse(fs.readFileSync(mcpSettingsPath(), "utf-8"));
+        if (settings.mcpServers && typeof settings.mcpServers === "object" && !Array.isArray(settings.mcpServers)) {
+            for (const name of Object.keys(settings.mcpServers)) {
+                if (name.trim() !== "")
+                    servers.set(name.replace(/[^a-zA-Z0-9_-]+/g, "_"), name);
+            }
+        }
+    }
+    catch {
+        // Missing or unreadable settings: fall back to the first `__` split.
+    }
+    return servers;
+}
+function mcpSettingsPath() {
+    const explicit = process.env.CLINE_MCP_SETTINGS_PATH?.trim();
+    if (explicit)
+        return explicit;
+    const dataDir = process.env.CLINE_DATA_DIR?.trim() ||
+        path.join(process.env.CLINE_DIR?.trim() || path.join(process.env.HOME?.trim() || os.homedir(), ".cline"), "data");
+    return path.join(dataDir, "settings", "cline_mcp_settings.json");
+}
 /**
  * Route a Cline file-hook event to Ory. Cline blocks a `tool_call` with
  * `{ cancel: true, errorMessage }`.
@@ -39,6 +128,7 @@ async function handleHookEvent(input, client, deps = {}) {
                     harness: HARNESS,
                     toolName,
                     toolArgs,
+                    mcpTool: identifyMcpTool(toolName, toolArgs),
                     subjectFallback: `session:${input.taskId}`,
                     principals: actingSubagentPrincipals(input),
                 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/cline",
-  "version": "1.5.3",
+  "version": "1.7.0",
   "description": "Ory plugin for Cline: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -69,10 +69,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.7.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=22"