@ory/cloudflare-agents 1.5.3 → 1.7.0

package/README.md

@@ -64,8 +64,18 @@ export class MyAgent extends AIChatAgent<Env> {
 }
 ```
 
-To gate MCP tools too, include them where you assemble the wrapped tool map:
-`withOry({ getWeather, ...this.mcp.getAITools() }, { client: this.ory })`.
+To gate MCP tools too, include them where you assemble the wrapped tool map and pass the
+agent's MCP client manager:
+`withOry({ getWeather, ...this.mcp.getAITools() }, { client: this.ory, mcp: this.mcp })`.
+
+With `mcp`, each `getAITools()` entry is gated as an MCP tool: Agent Security checks
+`McpServer:<server>` and `McpTool:<server>:<tool>` under the name given to `addMcpServer`, and
+the server URL's host is hashed into a fingerprint (Durable Object binding servers report
+none). The wrapper attributes a `tool_<serverId>_<tool>` key by rebuilding the keys of the
+manager's connected tools (`listTools()`), never by splitting the key, and resolves it on each
+call so servers that connect later are recognized. Without `mcp`, the tool objects carry no
+server metadata, so MCP tools are gated as native tools under their `tool_<serverId>_<tool>`
+key.
 
 In a multi-user Worker, attribute each call to the acting user with `subjectFromOptions` — a
 non-empty return value takes precedence over the client's user principal and env overrides

package/dist/index.d.ts

@@ -12,7 +12,7 @@
  *   import { withOry } from "@ory/cloudflare-agents";
  *   const result = streamText({
  *     model, messages,
- *     tools: withOry({ ...this.tools, ...this.mcp.getAITools() }),
+ *     tools: withOry({ ...this.tools, ...this.mcp.getAITools() }, { mcp: this.mcp }),
  *   });
  *
  * Depends only on `@ory/argus` — the `ai` / `agents` packages are not dependencies; tools are
@@ -25,6 +25,23 @@ export interface AiTool {
     [key: string]: unknown;
 }
 export type ToolSet = Record<string, AiTool>;
+/**
+ * The parts of the Agents SDK `MCPClientManager` (`this.mcp`) used to attribute
+ * `getAITools()` entries to their servers — duck-typed.
+ */
+export interface McpClientManagerLike {
+    /** Connected servers' tools, each tagged with its server id. */
+    listTools(): ReadonlyArray<{
+        name: string;
+        serverId: string;
+    }>;
+    /** Stored servers: id, the name given to `addMcpServer`, and the server URL. */
+    listServers(): ReadonlyArray<{
+        id: string;
+        name: string;
+        server_url?: string | null;
+    }>;
+}
 export interface WithOryOptions {
     /**
      * Client to use. Defaults to `OryAgentClient.fromEnv("cloudflare-agents")`. On the Workers
@@ -45,6 +62,13 @@ export interface WithOryOptions {
      * the principal / env chain.
      */
     subjectFromOptions?: (options: unknown) => string | undefined;
+    /**
+     * The agent's MCP client manager (`this.mcp`). With it, tools from `this.mcp.getAITools()`
+     * are gated as MCP tools under the server name given to `addMcpServer`, with its URL host
+     * hashed into a fingerprint. Without it, they are gated as native tools under their
+     * `tool_<serverId>_<tool>` key.
+     */
+    mcp?: McpClientManagerLike;
 }
 /**
  * Wrap every tool in `tools` so its `execute` is gated through Ory. Tools without an

package/dist/index.js

@@ -13,7 +13,7 @@
  *   import { withOry } from "@ory/cloudflare-agents";
  *   const result = streamText({
  *     model, messages,
- *     tools: withOry({ ...this.tools, ...this.mcp.getAITools() }),
+ *     tools: withOry({ ...this.tools, ...this.mcp.getAITools() }, { mcp: this.mcp }),
  *   });
  *
  * Depends only on `@ory/argus` — the `ai` / `agents` packages are not dependencies; tools are
@@ -24,6 +24,28 @@ exports.OryDenialError = exports.OryAgentClient = void 0;
 exports.withOry = withOry;
 const argus_1 = require("@ory/argus");
 const HARNESS = "cloudflare-agents";
+/** The tool-map key `MCPClientManager.getAITools()` gives one server tool. */
+function aiToolKey(serverId, toolName) {
+    return `tool_${serverId.replace(/-/g, "")}_${toolName}`;
+}
+/**
+ * Attribute a `getAITools()` key to its server by rebuilding each connected tool's key, so
+ * server ids and tool names containing `_` never need to be split.
+ */
+function identifyMcpTool(key, mcp) {
+    if (!key.startsWith("tool_"))
+        return undefined;
+    const tool = mcp.listTools().find((candidate) => aiToolKey(candidate.serverId, candidate.name) === key);
+    if (!tool)
+        return undefined;
+    const server = mcp.listServers().find((candidate) => candidate.id === tool.serverId);
+    const fingerprints = (0, argus_1.mcpServerFingerprints)({ url: server?.server_url ?? undefined });
+    return {
+        serverName: server?.name || tool.serverId,
+        toolName: tool.name,
+        ...(fingerprints.length > 0 ? { fingerprints } : {}),
+    };
+}
 /**
  * Wrap every tool in `tools` so its `execute` is gated through Ory. Tools without an
  * `execute` (client-side / provider-defined) are passed through untouched. Apply it to the
@@ -49,11 +71,14 @@ function withOry(tools, options = {}) {
                 await ensureSession();
                 // A per-call subject wins over the client principal / env overrides.
                 const subjectOverride = options.subjectFromOptions?.(callOptions);
+                // Resolved per call: MCP servers connect after the wrapped tool set is built.
+                const mcpTool = options.mcp ? identifyMcpTool(name, options.mcp) : undefined;
                 const result = await (0, argus_1.runWithUserSubject)(subjectOverride, () => (0, argus_1.gate)(client, {
                     harness: HARNESS,
                     toolName: name,
                     toolArgs: input,
                     canBlock,
+                    mcpTool,
                 }));
                 if (result.blocked) {
                     throw new argus_1.OryDenialError({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/cloudflare-agents",
-  "version": "1.5.3",
+  "version": "1.7.0",
   "description": "Ory Agent Security for the Cloudflare Agents SDK — per-tool authorization, activity auditing, and identity propagation by wrapping the AI SDK tools passed to streamText. Built on @ory/argus.",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -35,10 +35,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.7.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "scripts": {
     "build": "tsc",