@ory/mastra 1.5.2 → 1.6.0

package/README.md

@@ -36,6 +36,34 @@ import { withOry } from "@ory/mastra";
 const tools = withOry({ search, sendEmail });
 ```
 
+## MCP tools
+
+Tools from a [`@mastra/mcp`](https://mastra.ai/docs/tools-mcp/mcp-overview) `MCPClient` are gated
+as MCP tools: Agent Security checks `McpServer:<server>` and `McpTool:<server>:<tool>` and
+resolves the reported server name to its catalog entry.
+
+- `withOry` reads the server from the `mcpMetadata.serverName` the MCP client attaches to each
+  tool (the `servers` key), and strips the `<server>_` prefix from the tool id to check the
+  server's own tool name.
+- `beforeToolCall` receives only the tool name, which `MCPClient.listTools()` builds as
+  `<server>_<tool>`. The hooks cannot tell an MCP tool from a native one by name alone, so pass
+  the server names to identify them; the longest matching server wins:
+
+```ts
+const mcp = new MCPClient({ servers: { github: { url: new URL(githubUrl) } } });
+const agent = new Agent({
+  /* … */
+  tools: { search, ...(await mcp.listTools()) },
+  hooks: oryAgentHooks({ mcpServers: ["github"] }),
+});
+```
+
+Without `mcpServers`, the hooks gate MCP tools as native tools under their `<server>_<tool>`
+name. Name native tools so they do not start with a listed server name followed by `_`, or
+they are checked as that server's tools. `listToolsets()` keys tools by their unprefixed
+names, so the hooks cannot identify them; wrap those toolsets with `withOry`. Neither surface sees a server's URL or
+launch command, so no server fingerprints are reported.
+
 This package depends only on `@ory/argus` — not `@mastra/core`; tools and hook contexts are
 duck-typed so any Mastra v1 version works. Credentials come from the shared
 `~/.config/ory-agent-plugins/config.json`.

package/dist/index.d.ts

@@ -9,6 +9,10 @@
  *   - {@link withOry} — wraps each tool's `execute` directly (deny → throw), for callers who
  *     prefer per-tool wrapping or are on a Mastra version without the hooks API.
  *
+ * MCP tools from `@mastra/mcp` are gated as MCP tools (`McpServer` / `McpTool`). `withOry`
+ * reads the server from each tool's `mcpMetadata`; the hooks see only the tool name, so they
+ * identify `<server>_<tool>` names only for the servers listed in `mcpServers`.
+ *
  * The package has no `@mastra/core` dependency — tools/hook contexts are duck-typed.
  */
 import { OryAgentClient } from "@ory/argus";
@@ -20,6 +24,14 @@ export interface OryMastraOptions {
     projectUrl?: string;
     /** Whether a denied tool is hard-blocked. Default true. */
     canBlock?: boolean;
+    /**
+     * Names of the `MCPClient` servers whose tools the agent uses (the keys of `servers`, e.g.
+     * `Object.keys(mcp.servers)` or `["github"]`). `@mastra/mcp` names each tool
+     * `<server>_<tool>`, and the hooks receive only that name, so a tool name is gated as an MCP
+     * tool only when it starts with one of these servers followed by `_`; the longest match wins.
+     * `withOry` reads the server from the tool's `mcpMetadata` and uses this only as a fallback.
+     */
+    mcpServers?: Iterable<string>;
 }
 /**
  * Build the `{ beforeToolCall, afterToolCall }` hooks object for `new Agent({ hooks })`.
@@ -32,4 +44,4 @@ export declare function oryAgentHooks(options?: OryMastraOptions): OryMastraHook
  */
 export declare function withOry(tools: ToolSet, options?: OryMastraOptions): ToolSet;
 export { OryAgentClient, OryDenialError } from "@ory/argus";
-export type { OryMastraHooks, ToolSet, MastraTool, ToolHookBeforeContext, ToolHookAfterContext } from "./types.js";
+export type { OryMastraHooks, ToolSet, MastraTool, MastraMcpMetadata, ToolHookBeforeContext, ToolHookAfterContext, } from "./types.js";

package/dist/index.js

@@ -10,6 +10,10 @@
  *   - {@link withOry} — wraps each tool's `execute` directly (deny → throw), for callers who
  *     prefer per-tool wrapping or are on a Mastra version without the hooks API.
  *
+ * MCP tools from `@mastra/mcp` are gated as MCP tools (`McpServer` / `McpTool`). `withOry`
+ * reads the server from each tool's `mcpMetadata`; the hooks see only the tool name, so they
+ * identify `<server>_<tool>` names only for the servers listed in `mcpServers`.
+ *
  * The package has no `@mastra/core` dependency — tools/hook contexts are duck-typed.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -18,12 +22,24 @@ exports.oryAgentHooks = oryAgentHooks;
 exports.withOry = withOry;
 const argus_1 = require("@ory/argus");
 const HARNESS = "mastra";
+/** The MCP identity of a `@mastra/mcp` tool, from the `mcpMetadata` the MCP client attaches. */
+function mcpToolFromMetadata(tool, toolName) {
+    const serverName = tool.mcpMetadata?.serverName;
+    if (typeof serverName !== "string" || serverName === "")
+        return undefined;
+    const prefix = `${serverName}_`;
+    return {
+        serverName,
+        toolName: toolName.startsWith(prefix) && toolName.length > prefix.length ? toolName.slice(prefix.length) : toolName,
+    };
+}
 /**
  * Build the `{ beforeToolCall, afterToolCall }` hooks object for `new Agent({ hooks })`.
  */
 function oryAgentHooks(options = {}) {
     const client = options.client ?? argus_1.OryAgentClient.fromEnv(HARNESS);
     const canBlock = options.canBlock ?? true;
+    const mcpServers = options.mcpServers ? [...options.mcpServers] : undefined;
     const ensureSession = (0, argus_1.createSessionStarter)(client, {
         harness: HARNESS,
         projectUrl: options.projectUrl,
@@ -40,11 +56,13 @@ function oryAgentHooks(options = {}) {
                     projectUrl: options.projectUrl,
                 }).catch(() => undefined);
             }
+            const mcpTool = mcpServers ? (0, argus_1.parseMcpToolWithSeparator)(toolName, "_", mcpServers) : null;
             const result = await (0, argus_1.gate)(client, {
                 harness: HARNESS,
                 toolName,
                 toolArgs: ctx.input,
                 canBlock,
+                mcpTool: mcpTool ?? undefined,
             });
             if (result.kind === "deny" && result.blocked) {
                 return { proceed: false, output: result.denialMessage ?? "Ory: permission denied" };
@@ -64,6 +82,7 @@ function oryAgentHooks(options = {}) {
 function withOry(tools, options = {}) {
     const client = options.client ?? argus_1.OryAgentClient.fromEnv(HARNESS);
     const canBlock = options.canBlock ?? true;
+    const mcpServers = options.mcpServers ? [...options.mcpServers] : undefined;
     const ensureSession = (0, argus_1.createSessionStarter)(client, {
         harness: HARNESS,
         projectUrl: options.projectUrl,
@@ -75,6 +94,8 @@ function withOry(tools, options = {}) {
             continue;
         }
         const toolName = tool.id ?? key;
+        const mcpTool = mcpToolFromMetadata(tool, toolName) ??
+            (mcpServers ? (0, argus_1.parseMcpToolWithSeparator)(toolName, "_", mcpServers) ?? undefined : undefined);
         const originalExecute = tool.execute.bind(tool);
         wrapped[key] = {
             ...tool,
@@ -85,6 +106,7 @@ function withOry(tools, options = {}) {
                     toolName,
                     toolArgs: inputData,
                     canBlock,
+                    mcpTool,
                 });
                 if (result.blocked) {
                     throw new argus_1.OryDenialError({

package/dist/types.d.ts

@@ -25,9 +25,18 @@ export interface OryMastraHooks {
     beforeToolCall: (ctx: ToolHookBeforeContext) => Promise<void | ToolBeforeHookResult> | void | ToolBeforeHookResult;
     afterToolCall: (ctx: ToolHookAfterContext) => Promise<void> | void;
 }
+/** Server metadata `@mastra/mcp` attaches to the tools its `MCPClient` creates. */
+export interface MastraMcpMetadata {
+    /** The `MCPClient` `servers` key the tool came from. */
+    serverName?: string;
+    serverVersion?: string;
+    [key: string]: unknown;
+}
 /** A Mastra tool — duck-typed. `execute` takes `(inputData, context)` in v1. */
 export interface MastraTool {
     id?: string;
+    /** Present on tools from a `@mastra/mcp` `MCPClient`; the tool `id` is `<server>_<tool>`. */
+    mcpMetadata?: MastraMcpMetadata;
     execute?: (inputData: unknown, context?: unknown) => unknown;
     [key: string]: unknown;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/mastra",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "Ory Agent Security for Mastra — per-tool authorization, activity auditing, and identity propagation via agent tool-call hooks (or wrapping tool execute). Built on @ory/argus.",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -34,10 +34,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.2"
+    "@ory/argus": "1.6.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "scripts": {
     "build": "tsc",