@orygn/opa-mcp 0.1.9 → 0.1.10

package/dist/lib/conftest-cli.js

@@ -0,0 +1,224 @@
+/**
+ * Wrapper around the optional `conftest` binary (policy testing for
+ * configuration files using Rego).
+ *
+ * Conftest is OPTIONAL -- only the `conftest_*` tools require it. All
+ * other tools work without Conftest installed. If absent, conftest tools
+ * return a structured `CONFTEST_NOT_FOUND` error with an install hint.
+ *
+ * Conftest exit codes:
+ *   0  -- all tests pass (or no failures, only warnings)
+ *   1  -- one or more test failures
+ *   2+ -- command error (bad args, policy not found, parse error, etc.)
+ *
+ * All structured output is obtained via `--output=json`; raw text output
+ * is never parsed.
+ */
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runBinary } from './subprocess.js';
+// ─── Parser → file extension map ─────────────────────────────────────────────
+const PARSER_TO_EXT = {
+    yaml: '.yaml',
+    json: '.json',
+    toml: '.toml',
+    hcl1: '.hcl',
+    hcl2: '.hcl',
+    ini: '.ini',
+    xml: '.xml',
+    dotenv: '.env',
+    cue: '.cue',
+    jsonnet: '.jsonnet',
+    properties: '.properties',
+    edn: '.edn',
+    hocon: '.conf',
+    // Dockerfile is a special case -- conftest detects by filename
+    dockerfile: '',
+};
+function parserToExt(parser) {
+    return PARSER_TO_EXT[parser.toLowerCase()] ?? `.${parser.toLowerCase()}`;
+}
+// ─── ConftestCli ──────────────────────────────────────────────────────────────
+/**
+ * Wrapper around the local `conftest` binary.
+ *
+ * Methods do not throw on conftest-side errors -- the exit code on the
+ * returned `SpawnResult` is the signal. Inline source is written to temp
+ * files/directories because conftest does not read from stdin.
+ */
+export class ConftestCli {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Verify the binary is present and return its version string. Returns
+     * null if the binary is unreachable or the version output is malformed.
+     */
+    async version(signal) {
+        const result = await this.run(['--version'], signal);
+        if (result.exitCode !== 0)
+            return null;
+        // conftest --version output: "conftest (version: 0.68.2)"
+        const match = /conftest\s*\(version:\s*([^)]+)\)/i.exec(result.stdout) ??
+            /v?(\d+\.\d+\.\d+\S*)/i.exec(result.stdout);
+        return match?.[1]?.trim() ?? null;
+    }
+    /**
+     * Run `conftest test` against one or more configuration files. Always
+     * uses `--output=json` so output is machine-readable.
+     *
+     * When `inlineConfig` or `inlinePolicy` are provided, temp files are
+     * created and cleaned up automatically. Temp file paths in the JSON
+     * output are replaced with `<inline>` before the result is returned so
+     * callers never see implementation-internal paths.
+     */
+    async test(input, signal) {
+        return this.withTempAssets({
+            inlineConfig: input.inlineConfig,
+            inlineConfigParser: input.inlineConfigParser,
+            inlinePolicy: input.inlinePolicy,
+        }, async ({ configPath, policyDir }) => {
+            const args = ['test', '--output=json', '--no-color'];
+            // Policy source
+            const effectivePolicyDir = policyDir ?? input.policy;
+            if (effectivePolicyDir)
+                args.push('--policy', effectivePolicyDir);
+            // Namespace
+            if (input.allNamespaces) {
+                args.push('--all-namespaces');
+            }
+            else if (input.namespace) {
+                args.push('--namespace', input.namespace);
+            }
+            // Data directories
+            for (const d of input.data ?? [])
+                args.push('--data', d);
+            // Flags
+            if (input.combine)
+                args.push('--combine');
+            if (input.failOnWarn)
+                args.push('--fail-on-warn');
+            // Config files (positional args, must come last)
+            const effectiveFiles = configPath ? [configPath] : (input.files ?? []);
+            args.push(...effectiveFiles);
+            const result = await this.run(args, signal);
+            return this.sanitizeOutput(result, configPath, policyDir);
+        });
+    }
+    /**
+     * Run `conftest verify` -- executes the `_test.rego` tests inside the
+     * policy directory to verify the policies themselves.
+     */
+    async verify(input, signal) {
+        const args = ['verify', '--output=json', '--no-color'];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        if (input.namespace)
+            args.push('--namespace', input.namespace);
+        for (const d of input.data ?? [])
+            args.push('--data', d);
+        return this.run(args, signal);
+    }
+    /**
+     * Pull policies from a remote OCI or Git location into a local
+     * directory. Stdout is minimal; errors go to stderr.
+     */
+    async pull(input, signal) {
+        const args = ['pull', input.url];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        return this.run(args, signal);
+    }
+    /**
+     * Push the local policy bundle to a remote OCI registry. Uses
+     * credentials from the host environment (docker login, ORAS, etc.).
+     */
+    async push(input, signal) {
+        const args = ['push', input.repository];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        return this.run(args, signal);
+    }
+    /**
+     * Run `conftest` with the given argv. Tools should prefer the typed
+     * methods above; this is the escape hatch for unusual invocations.
+     */
+    async run(args, signal) {
+        const opts = {
+            args,
+            timeoutMs: this.config.subprocessTimeoutMs,
+        };
+        if (signal !== undefined)
+            opts.signal = signal;
+        return runBinary(this.config.conftestBinary, opts);
+    }
+    // ─── Internal: temp file / directory management ──────────────────────────
+    /**
+     * Create temp assets for inline inputs, run `fn`, then clean up.
+     * Returns whatever `fn` returns.
+     */
+    async withTempAssets(opts, fn) {
+        const temps = [];
+        const paths = {};
+        try {
+            if (opts.inlineConfig !== undefined) {
+                const ext = opts.inlineConfigParser === 'dockerfile'
+                    ? ''
+                    : parserToExt(opts.inlineConfigParser ?? 'yaml');
+                const basename = opts.inlineConfigParser === 'dockerfile' ? 'Dockerfile' : `config${ext}`;
+                // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
+                const tmpDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-'));
+                temps.push(tmpDir);
+                const configPath = join(tmpDir, basename);
+                await writeFile(configPath, opts.inlineConfig, 'utf8');
+                paths.configPath = configPath;
+            }
+            if (opts.inlinePolicy !== undefined) {
+                // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
+                const policyDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-policy-'));
+                temps.push(policyDir);
+                const policyFile = join(policyDir, 'policy.rego');
+                await writeFile(policyFile, opts.inlinePolicy, 'utf8');
+                paths.policyDir = policyDir;
+            }
+            return await fn(paths);
+        }
+        finally {
+            await Promise.all(temps.map((p) => rm(p, { recursive: true, force: true })));
+        }
+    }
+    /**
+     * Replace the temp inline-config path and temp inline-policy directory
+     * path in the stdout JSON with `<inline>` so callers never see
+     * implementation-internal temp paths.
+     *
+     * conftest emits paths inside a JSON array, so each backslash in the
+     * path is JSON-encoded as `\\`. We match the JSON-encoded form of the
+     * path to handle Windows paths correctly (forward slashes need no
+     * special treatment).
+     */
+    sanitizeOutput(result, configPath, policyDir) {
+        if (!configPath && !policyDir)
+            return result;
+        if (!result.stdout)
+            return result;
+        let stdout = result.stdout;
+        if (configPath) {
+            // JSON.stringify encodes backslashes as \\, so match the encoded form.
+            const jsonEncoded = JSON.stringify(configPath).slice(1, -1);
+            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline>');
+        }
+        if (policyDir) {
+            const jsonEncoded = JSON.stringify(policyDir).slice(1, -1);
+            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+            // Policy dir appears in conftest output as part of file paths.
+            // Replace the full dir prefix so the policy filename is preserved.
+            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline-policy>');
+        }
+        return { ...result, stdout };
+    }
+}
+//# sourceMappingURL=conftest-cli.js.map

package/dist/lib/conftest-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AA2F9D,gFAAgF;AAEhF,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,GAAG,EAAE,MAAM;IACX,KAAK,EAAE,OAAO;IACd,+DAA+D;IAC/D,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAElD,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB;QAC5C,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,GAAG,GACP,IAAI,CAAC,kBAAkB,KAAK,YAAY;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;gBAC1F,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAElC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,uEAAuE;YACvE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/lib/tool-helpers.d.ts

@@ -30,7 +30,7 @@ import type { ToolEnvelope } from '../types.js';
  * subprocess exited normally (exitCode is a number) so the caller can
  * inspect the result.
  */
-export declare function mapSubprocessFailure(result: SpawnResult, binary: 'opa' | 'regal'): ToolEnvelope<never> | undefined;
+export declare function mapSubprocessFailure(result: SpawnResult, binary: 'opa' | 'regal' | 'conftest'): ToolEnvelope<never> | undefined;
 /**
  * Try to parse `text` as JSON. Returns `undefined` on failure so the
  * caller can fall back to a textual error envelope rather than throwing.

package/dist/lib/tool-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAqC,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AACD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,KAAK,GAAG,OAAO,GACtB,YAAY,CAAC,KAAK,CAAC,GAAG,SAAS,CAwBjC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAOrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;CAAE,CAU9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC,CASxB"}
+{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAqC,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AACD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,UAAU,GACnC,YAAY,CAAC,KAAK,CAAC,GAAG,SAAS,CA+BjC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAOrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;CAAE,CAU9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC,CASxB"}

package/dist/lib/tool-helpers.js

@@ -38,10 +38,16 @@ export function mapSubprocessFailure(result, binary) {
         });
     }
     if (result.exitCode === null) {
-        const code = binary === 'opa' ? 'OPA_BINARY_NOT_FOUND' : 'REGAL_NOT_FOUND';
+        const code = binary === 'opa'
+            ? 'OPA_BINARY_NOT_FOUND'
+            : binary === 'regal'
+                ? 'REGAL_NOT_FOUND'
+                : 'CONFTEST_NOT_FOUND';
         const hint = binary === 'opa'
             ? 'Install OPA (https://www.openpolicyagent.org/docs/latest/) or set OPA_BINARY to the absolute path of the binary.'
-            : 'Install Regal (https://docs.styra.com/regal) or set REGAL_BINARY to the absolute path of the binary.';
+            : binary === 'regal'
+                ? 'Install Regal (https://docs.styra.com/regal) or set REGAL_BINARY to the absolute path of the binary.'
+                : 'Install Conftest (https://www.conftest.dev/) or set CONFTEST_BINARY to the absolute path of the binary.';
         return err(code, `${binary} binary unreachable: ${result.stderr || 'spawn failed'}`, { hint });
     }
     if (result.timedOut) {

package/dist/lib/tool-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,MAAuB;IAEvB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,WAAW,EAAE,6CAA6C,EAAE;YACrE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAkB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC1F,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,kHAAkH;YACpH,CAAC,CAAC,sGAAsG,CAAC;QAC7G,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,wBAAwB,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CACR,SAAS,EACT,GAAG,MAAM,mEAAmE,EAC5E;YACE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAe,EACf,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,MAAoC;IAEpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,WAAW,EAAE,6CAA6C,EAAE;YACrE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,oBAAoB,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,kHAAkH;YACpH,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,sGAAsG;gBACxG,CAAC,CAAC,yGAAyG,CAAC;QAClH,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,wBAAwB,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CACR,SAAS,EACT,GAAG,MAAM,mEAAmE,EAC5E;YACE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAe,EACf,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAI/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBpE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAI/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAS7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBpE"}

package/dist/server.js

@@ -15,6 +15,7 @@ import { formatHelp, formatStartupBanner, formatVersion, parseCliArgs } from './
 import { loadConfig } from './config.js';
 import { SERVER_NAME, SERVER_VERSION } from './constants.js';
 import { initLogger, logger } from './lib/logger.js';
+import { ConftestCli } from './lib/conftest-cli.js';
 import { OpaCli } from './lib/opa-cli.js';
 import { RegalCli } from './lib/regal-cli.js';
 import { registerPrompts } from './prompts/index.js';
@@ -35,7 +36,7 @@ export function buildServer(config) {
         regalBinary: config.regalBinary,
     });
     const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, {
-        instructions: '43 tools split into six categories. rego_* authoring/analysis tools use the local opa binary -- no running OPA server required. rego_lint requires regal (REGAL_BINARY). opa_* server-management tools talk to a live OPA instance via OPA_URL; set OPA_TOKEN if the server requires bearer-token authentication. File-based tools require paths inside OPA_MCP_ALLOWED_PATHS; inline-source tools work without it. Start with rego_check + rego_lint for policy authoring, mcp_server_info to confirm which binaries are reachable.',
+        instructions: '47 tools split into seven categories. rego_* authoring/analysis tools use the local opa binary -- no running OPA server required. rego_lint requires regal (REGAL_BINARY). opa_* server-management tools talk to a live OPA instance via OPA_URL; set OPA_TOKEN if the server requires bearer-token authentication. conftest_* tools use the local conftest binary (CONFTEST_BINARY) to test configuration files (Kubernetes manifests, Terraform plans, Dockerfiles) against Rego policies. File-based tools require paths inside OPA_MCP_ALLOWED_PATHS; inline-source tools work without it. Start with rego_check + rego_lint for policy authoring, conftest_test for configuration file validation, mcp_server_info to confirm which binaries are reachable.',
     });
     registerTools(server, config);
     registerPrompts(server, config);
@@ -56,9 +57,11 @@ export function buildServer(config) {
 export async function runStartupSelfCheck(config) {
     const opa = new OpaCli(config);
     const regal = new RegalCli(config);
-    const [opaVersion, regalVersion] = await Promise.all([
+    const conftest = new ConftestCli(config);
+    const [opaVersion, regalVersion, conftestVersion] = await Promise.all([
         opa.version().catch(() => null),
         regal.version().catch(() => null),
+        conftest.version().catch(() => null),
     ]);
     if (opaVersion === null) {
         logger.warn('startup self-check: opa binary not reachable; rego_* tools will fail', {
@@ -78,6 +81,15 @@ export async function runStartupSelfCheck(config) {
     else {
         logger.info('startup self-check: regal OK', { version: regalVersion });
     }
+    if (conftestVersion === null) {
+        logger.warn('startup self-check: conftest binary not reachable; conftest_* tools will return CONFTEST_NOT_FOUND', {
+            conftestBinary: config.conftestBinary,
+            hint: 'set CONFTEST_BINARY to an absolute path, or ensure conftest is on PATH. Conftest is optional; only conftest_* tools require it.',
+        });
+    }
+    else {
+        logger.info('startup self-check: conftest OK', { version: conftestVersion });
+    }
 }
 /**
  * Entry-point flow: load config from env, build the server, connect

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EACV,sgBAAsgB;KACzgB,CACF,CAAC;IAEF,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;YAClF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,6LAA6L;SACpM,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kHAAkH;SACzH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAE1D,iEAAiE;IACjE,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,OAAO,CAAC,CAAC,CAAE,qCAAqC,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EACV,kuBAAkuB;KACruB,CACF,CAAC;IAEF,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;YAClF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,6LAA6L;SACpM,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kHAAkH;SACzH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,oGAAoG,EACpG;YACE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,IAAI,EAAE,iIAAiI;SACxI,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAE1D,iEAAiE;IACjE,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,OAAO,CAAC,CAAC,CAAE,qCAAqC,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/conftest/index.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerConftestTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/conftest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAK7E"}

package/dist/tools/conftest/index.js

@@ -0,0 +1,11 @@
+import { registerConftestPull } from './pull.js';
+import { registerConftestPush } from './push.js';
+import { registerConftestTest } from './test.js';
+import { registerConftestVerify } from './verify.js';
+export function registerConftestTools(server, config) {
+    registerConftestTest(server, config);
+    registerConftestVerify(server, config);
+    registerConftestPull(server, config);
+    registerConftestPush(server, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/conftest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/conftest/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/tools/conftest/pull.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface ConftestPullOutput {
+    /** The URL that was pulled. */
+    url: string;
+    /** The local directory where policies were written. */
+    policyDir: string;
+}
+export declare function registerConftestPull(server: McpServer, config: Config): void;
+//# sourceMappingURL=pull.d.ts.map

package/dist/tools/conftest/pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA0B9C,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAsD5E"}

package/dist/tools/conftest/pull.js

@@ -0,0 +1,83 @@
+/**
+ * `conftest_pull` -- download Rego policies from an OCI registry or
+ * other remote source into a local directory.
+ *
+ * Teams that publish policy bundles to a registry (e.g. ghcr.io or
+ * Docker Hub) use `conftest pull` to hydrate the local `policy/`
+ * directory before running `conftest test`. This tool exposes that
+ * workflow so an LLM can fetch the latest policies and immediately
+ * evaluate config files against them.
+ *
+ * The URL format follows conftest's conventions:
+ *   oci://ghcr.io/org/policies:tag
+ *   github.com/open-policy-agent/conftest//examples/playkube/policy
+ *
+ * Exit code mapping:
+ *   null  -- binary not found → CONFTEST_NOT_FOUND
+ *   0     -- pull succeeded
+ *   non-0 -- network / auth error
+ */
+import { z } from 'zod';
+import { ConftestCli } from '../../lib/conftest-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const ConftestPullInput = {
+    url: z
+        .string()
+        .min(1)
+        .describe('Policy URL to pull. Supported schemes: ' +
+        '`oci://registry/repo:tag` (OCI registry), ' +
+        '`github.com/org/repo//path` (GitHub subdirectory), ' +
+        '`git::https://example.com/repo//path` (generic Git). ' +
+        'See https://www.conftest.dev/sharing/ for the full URL syntax.'),
+    policy: z
+        .string()
+        .optional()
+        .describe('Local directory where the pulled policies will be written. ' +
+        'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
+        "Defaults to `./policy` (conftest's convention)."),
+};
+export function registerConftestPull(server, config) {
+    const conftest = new ConftestCli(config);
+    server.registerTool('conftest_pull', {
+        title: 'Conftest pull',
+        description: 'Download Rego policies from an OCI registry or Git repository into a local directory ' +
+            'using `conftest pull`. Use this to hydrate a local `policy/` directory before running ' +
+            '`conftest_test`. Requires `conftest` on PATH or `CONFTEST_BINARY` set. ' +
+            'The `policy` directory must be inside OPA_MCP_ALLOWED_PATHS.',
+        inputSchema: ConftestPullInput,
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, async (input, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // ── Path validation ──────────────────────────────────────────────
+            // The policy directory does not have to exist yet -- conftest will
+            // create it. Validate only that the parent is within allowed roots
+            // by validating the path itself (without mustExist).
+            if (input.policy !== undefined) {
+                const v = validatePaths([input.policy], config);
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, policy: v.resolved[0] };
+            }
+            // ── Run conftest pull ────────────────────────────────────────────
+            const result = await conftest.pull({ url: input.url, policy: input.policy }, signal);
+            const subprocessFailure = mapSubprocessFailure(result, 'conftest');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode === 0) {
+                return ok({
+                    url: input.url,
+                    policyDir: input.policy ?? 'policy',
+                });
+            }
+            const detail = result.stderr.trim() || result.stdout.trim();
+            return err('UNKNOWN_ERROR', `conftest pull failed with exit code ${result.exitCode}: ${detail}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
+        });
+    });
+}
+//# sourceMappingURL=pull.js.map

package/dist/tools/conftest/pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yCAAyC;QACvC,4CAA4C;QAC5C,qDAAqD;QACrD,uDAAuD;QACvD,gEAAgE,CACnE;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6DAA6D;QAC3D,0DAA0D;QAC1D,iDAAiD,CACpD;CACJ,CAAC;AASF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,wFAAwF;YACxF,yEAAyE;YACzE,8DAA8D;QAChE,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YAErF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/push.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface ConftestPushOutput {
+    /** The OCI repository the policies were pushed to. */
+    repository: string;
+    /** The local policy directory that was packaged and pushed. */
+    policyDir: string;
+}
+export declare function registerConftestPush(server: McpServer, config: Config): void;
+//# sourceMappingURL=push.d.ts.map

package/dist/tools/conftest/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAyB9C,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuD5E"}

package/dist/tools/conftest/push.js

@@ -0,0 +1,76 @@
+/**
+ * `conftest_push` -- publish a local Rego policy bundle to an OCI registry.
+ *
+ * Teams that centralize policies in a registry use `conftest push` to
+ * distribute them. The tool packages the local `policy/` directory as an
+ * OCI artifact and pushes it to the specified repository. Registry
+ * credentials are consumed from the host environment (docker login,
+ * ORAS keychain, REGISTRY_AUTH_FILE, etc.) -- they are never passed
+ * through the tool interface.
+ *
+ * Exit code mapping:
+ *   null  -- binary not found → CONFTEST_NOT_FOUND
+ *   0     -- push succeeded
+ *   non-0 -- push error (auth failure, network error, etc.)
+ */
+import { z } from 'zod';
+import { ConftestCli } from '../../lib/conftest-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const ConftestPushInput = {
+    repository: z
+        .string()
+        .min(1)
+        .describe('OCI repository URL to push policies to (e.g. `ghcr.io/my-org/policies:latest`). ' +
+        'Registry credentials must already be configured in the host environment ' +
+        '(via `docker login`, ORAS keychain, or REGISTRY_AUTH_FILE). ' +
+        'This tool does not accept or store registry credentials.'),
+    policy: z
+        .string()
+        .optional()
+        .describe('Path to the local directory containing Rego policies to push. ' +
+        'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS) and must exist. ' +
+        "Defaults to `./policy` (conftest's convention)."),
+};
+export function registerConftestPush(server, config) {
+    const conftest = new ConftestCli(config);
+    server.registerTool('conftest_push', {
+        title: 'Conftest push',
+        description: 'Package the local Rego policy directory as an OCI artifact and push it to a registry ' +
+            'using `conftest push`. Registry credentials must be pre-configured in the host ' +
+            'environment (docker login, ORAS keychain, etc.) -- this tool never handles credentials. ' +
+            'The `policy` directory must be inside OPA_MCP_ALLOWED_PATHS. ' +
+            'Requires `conftest` on PATH or `CONFTEST_BINARY` set.',
+        inputSchema: ConftestPushInput,
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+    }, async (input, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // ── Path validation ──────────────────────────────────────────────
+            if (input.policy !== undefined) {
+                const v = validatePaths([input.policy], config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                input = { ...input, policy: v.resolved[0] };
+            }
+            // ── Run conftest push ────────────────────────────────────────────
+            const result = await conftest.push({ repository: input.repository, policy: input.policy }, signal);
+            const subprocessFailure = mapSubprocessFailure(result, 'conftest');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode === 0) {
+                return ok({
+                    repository: input.repository,
+                    policyDir: input.policy ?? 'policy',
+                });
+            }
+            const detail = result.stderr.trim() || result.stdout.trim();
+            return err('UNKNOWN_ERROR', `conftest push failed with exit code ${result.exitCode}: ${detail}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
+        });
+    });
+}
+//# sourceMappingURL=push.js.map

package/dist/tools/conftest/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,kFAAkF;QAChF,0EAA0E;QAC1E,8DAA8D;QAC9D,0DAA0D,CAC7D;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,yEAAyE;QACzE,iDAAiD,CACpD;CACJ,CAAC;AASF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,iFAAiF;YACjF,0FAA0F;YAC1F,+DAA+D;YAC/D,uDAAuD;QACzD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EACtD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/test.d.ts

@@ -0,0 +1,21 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+import { type ConftestFileResult } from '../../lib/conftest-cli.js';
+export interface ConftestTestOutput {
+    /** `true` when no failures (and no warnings if `failOnWarn` was set). */
+    passed: boolean;
+    /** Per-file, per-namespace evaluation results. */
+    results: ConftestFileResult[];
+    summary: {
+        /** Number of files with zero failures and zero warnings. */
+        passed: number;
+        /** Number of files with at least one failure. */
+        failed: number;
+        /** Total number of warning messages across all files. */
+        warnings: number;
+        /** Total number of skipped rules across all files. */
+        skipped: number;
+    };
+}
+export declare function registerConftestTest(server: McpServer, config: Config): void;
+//# sourceMappingURL=test.d.ts.map

package/dist/tools/conftest/test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAiFjF,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,4DAA4D;QAC5D,MAAM,EAAE,MAAM,CAAC;QACf,iDAAiD;QACjD,MAAM,EAAE,MAAM,CAAC;QACf,yDAAyD;QACzD,QAAQ,EAAE,MAAM,CAAC;QACjB,sDAAsD;QACtD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA+G5E"}