@shield-agent/kya 0.1.14 → 0.1.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.mcp.json +1 -1
- package/LIMITATIONS.md +10 -7
- package/README.md +47 -34
- package/claude/claude_desktop_config.example.json +1 -1
- package/claude/run-stdio.mjs +10 -7
- package/dist/mcp/http.d.ts.map +1 -1
- package/dist/mcp/http.js +3 -5
- package/dist/mcp/http.js.map +1 -1
- package/dist/mcp/protocol.d.ts.map +1 -1
- package/dist/mcp/protocol.js +4 -7
- package/dist/mcp/protocol.js.map +1 -1
- package/gemini/settings.example.json +21 -0
- package/grok/README.md +44 -0
- package/manifest.json +22 -7
- package/mcp.json +1 -1
- package/openai/codex.config.example.toml +24 -0
- package/openai/responses-mcp.example.json +14 -0
- package/package.json +5 -2
- package/server.json +2 -2
package/.mcp.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"mcpServers": {
|
|
3
3
|
"shield-kya": {
|
|
4
4
|
"command": "npx",
|
|
5
|
-
"args": ["-
|
|
5
|
+
"args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
|
|
6
6
|
"env": {
|
|
7
7
|
"KYA_BASE_URL": "https://shield-agent.com",
|
|
8
8
|
"KYA_API_KEY": "${KYA_API_KEY}",
|
package/LIMITATIONS.md
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
# Known limitations
|
|
2
2
|
|
|
3
3
|
- This package does not scan a network or discover agents that never call evaluate.
|
|
4
|
-
- Offline `eval-tool --offline` and `dash --once --offline` use a
|
|
4
|
+
- Offline `eval-tool --offline` and `dash --once --offline` use a sample policy surface for demos. Production needs a real control plane (local free or hosted).
|
|
5
5
|
- Unsigned v1 passport JSON is observational. Signed v2 claims (`shield-kya-agent-passport-v2`, `shield-kya-session-claim-v1`) need the hosted control-plane key.
|
|
6
|
-
-
|
|
7
|
-
- `wrap` evaluates (and may open a pending ticket). It
|
|
6
|
+
- If a host never wraps tools, session shrink cannot stop it. Spawn without a control plane cannot be gated.
|
|
7
|
+
- `wrap` evaluates (and may open a pending ticket). It never executes the side effect. Offline wrap does not call the approval API.
|
|
8
8
|
- `invoke` authorizes on a live plane after Allow or APPROVED. It never runs the customer write in the CLI. There is no `--offline` invoke.
|
|
9
|
-
- The TUI (`dash`) is observational. Keys `a
|
|
9
|
+
- The TUI (`dash`) is observational. Keys `a` / `x` print the CLI decide hint; they do not APPROVE or REJECT.
|
|
10
10
|
- Human decide is `kya approve --id` / `kya reject --id` against `POST /api/v1/kya/approvals/{id}/approve|reject` (`kya.approve` scope).
|
|
11
|
-
-
|
|
12
|
-
- Dialog safety
|
|
11
|
+
- Shield KYA evaluate/approve is the only policy decision point (`ALLOW` / `DENY` / `REQUIRE_APPROVE`). Scanners, `--scorecard`, `harness.agentshield`, and the ORR CLI write evidence. They never ALLOW a side effect. AgentShield is opt-in (`--producer harness.agentshield` or `--agentshield-json`). The CLI never passes `--fix`, never starts MiniClaw, and never installs `ecc-agentshield`.
|
|
12
|
+
- Dialog safety belongs in a guardrails product.
|
|
13
13
|
- Multi-language in-process runtimes are out of scope.
|
|
14
14
|
- Use OPA if you need a general policy language.
|
|
15
15
|
- Multi-tenant density, private registries, ORR board ops, pin, and support are separate from the solo `npx` path.
|
|
@@ -18,5 +18,8 @@
|
|
|
18
18
|
- Showback USD is an estimate from a checked-in published rate table. Unknown models report tokens only. ORR / metrics never ALLOW, DENY, or kill on spend.
|
|
19
19
|
- `--usage` must sit inside `--path`. Usage rows drop secret-shaped strings and labels over 64/128 chars. Hosted ingest is merchant-scoped and length-capped the same way.
|
|
20
20
|
|
|
21
|
-
-
|
|
21
|
+
- The hosted Claude connector uses machine API keys (Bearer). It is a custom connector, not an Anthropic Directory listing. OAuth DCR is a later slice.
|
|
22
|
+
- OpenAI: Codex CLI and the Responses API use the same `/mcp` URL with a machine API key. ChatGPT Apps on chatgpt.com (Developer Mode) are deferred until OAuth DCR. ChatGPT cannot attach a local stdio server.
|
|
23
|
+
- Gemini CLI supports stdio and hosted `httpUrl` with a Bearer header. Gemini Enterprise / Spark custom MCP OAuth is out of scope.
|
|
24
|
+
- Grok (grok.com) custom connectors need a public HTTPS URL. Localhost and private IPs are rejected. If the UI only offers OAuth or no auth, use Codex, Gemini CLI, or the xAI SDK instead of turning auth off.
|
|
22
25
|
- Local HTTP MCP remains loopback-only. Do not bind it to a public interface.
|
package/README.md
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
# `@shield-agent/kya`
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
CLI and local MCP gate for Shield’s Know Your Agent path.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
If an agent can change a real system, it has to ask Shield first. You register the agent, wrap the tool, and get Allow, Hold, or Deny. Hold waits for a person. This package does not scan your network. Agents that never call evaluate stay invisible on purpose.
|
|
6
6
|
|
|
7
7
|
Walkthrough: [how you use it](https://shield-agent.com/how-kya-works#using).
|
|
8
8
|
|
|
@@ -10,12 +10,11 @@ Walkthrough: [how you use it](https://shield-agent.com/how-kya-works#using).
|
|
|
10
10
|
npx @shield-agent/kya@latest --help
|
|
11
11
|
```
|
|
12
12
|
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
- Creating an agent is a tool. `kya.agent.register` evaluates `REQUIRE_APPROVE` offline. Human mint modes (allow / break-glass / approve) live on the control plane.
|
|
13
|
+
It works with any host that speaks MCP or OpenAPI. Vertical packs are optional. Shield is the only policy decision point: this gate never auto-approves an irreversible side effect.
|
|
14
|
+
|
|
15
|
+
If `KYA_API_KEY` is empty against an authenticated plane, network commands exit non-zero. `eval-tool`, `wrap`, and `invoke` exit `0` on ALLOW, `4` on REQUIRE_APPROVE, and `1` on DENY or unknown, so a line like `eval-tool && write` cannot skip the gate.
|
|
16
|
+
|
|
17
|
+
`--offline` runs sample evaluate without a paid cloud (useful for DENY and REQUIRE_APPROVE demos). Creating an agent is itself a tool: offline, `kya.agent.register` comes back REQUIRE_APPROVE. Allow, break-glass, and approve mint modes live on the control plane.
|
|
19
18
|
|
|
20
19
|
## 15-minute path
|
|
21
20
|
|
|
@@ -34,7 +33,7 @@ npx @shield-agent/kya register-agent --name solo-builder --version-hash dev-loca
|
|
|
34
33
|
npx @shield-agent/kya eval-tool --tool-id org.sample.never.event --irreversible
|
|
35
34
|
npx @shield-agent/kya serve-mcp --stdio
|
|
36
35
|
|
|
37
|
-
# Terminal dashboard (free
|
|
36
|
+
# Terminal dashboard (free panes; --offline works without a key)
|
|
38
37
|
npx @shield-agent/kya dash --once --offline
|
|
39
38
|
```
|
|
40
39
|
|
|
@@ -51,14 +50,14 @@ Install hub: [https://shield-agent.com/install](https://shield-agent.com/install
|
|
|
51
50
|
approval + trail
|
|
52
51
|
```
|
|
53
52
|
|
|
54
|
-
Tag sessions with `KYA_HOST=ide` or `KYA_HOST=runtime`. Same
|
|
53
|
+
Tag sessions with `KYA_HOST=ide` or `KYA_HOST=runtime`. Same policy path either way.
|
|
55
54
|
|
|
56
55
|
## Environment
|
|
57
56
|
|
|
58
57
|
| Variable | Required | Meaning |
|
|
59
58
|
|----------|----------|---------|
|
|
60
59
|
| `KYA_BASE_URL` | Yes (network cmds) | Control plane origin |
|
|
61
|
-
| `KYA_API_KEY` | When auth is on | Bearer
|
|
60
|
+
| `KYA_API_KEY` | When auth is on | API key (or Bearer JWT for decide verbs) |
|
|
62
61
|
| `KYA_HOST` | No (default `ide`) | `ide` \| `runtime` |
|
|
63
62
|
| `KYA_AGENT_ID` | After register | Agent principal id |
|
|
64
63
|
| `KYA_MCP_PORT` | No (default `3920`) | HTTP MCP listen port |
|
|
@@ -71,16 +70,16 @@ Tag sessions with `KYA_HOST=ide` or `KYA_HOST=runtime`. Same sole PEP either way
|
|
|
71
70
|
|------|------|
|
|
72
71
|
| `kya.policy_evaluate` | `ALLOW` \| `DENY` \| `REQUIRE_APPROVE` |
|
|
73
72
|
| `kya.session_ingest` | Observe / raise-only risk |
|
|
74
|
-
| `kya.request_approval` | Open a human
|
|
73
|
+
| `kya.request_approval` | Open a human Hold. Does not execute the side effect |
|
|
75
74
|
|
|
76
|
-
MCP Registry: `server.json`
|
|
75
|
+
MCP Registry entry: `server.json` plus package `mcpName` `io.github.The-Pixel-Boys/shield-kya`.
|
|
77
76
|
|
|
78
77
|
```json
|
|
79
78
|
{
|
|
80
79
|
"mcpServers": {
|
|
81
80
|
"shield-kya": {
|
|
82
81
|
"command": "npx",
|
|
83
|
-
"args": ["-
|
|
82
|
+
"args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
|
|
84
83
|
"env": {
|
|
85
84
|
"KYA_BASE_URL": "http://127.0.0.1:8090",
|
|
86
85
|
"KYA_API_KEY": "${KYA_API_KEY}",
|
|
@@ -99,26 +98,42 @@ npx @shield-agent/kya approve --id <approval-id>
|
|
|
99
98
|
npx @shield-agent/kya reject --id <approval-id>
|
|
100
99
|
```
|
|
101
100
|
|
|
102
|
-
`wrap` evaluates and may open a pending ticket. It never executes the side effect.
|
|
103
|
-
`invoke` asks the live plane to authorize after Allow or APPROVED. It does not run the write on this machine.
|
|
104
|
-
The TUI (`dash`) is observational. Keys `a`/`x` print this CLI. They do not decide.
|
|
101
|
+
`wrap` evaluates and may open a pending ticket. It never executes the side effect. `invoke` asks the live plane to authorize after Allow or APPROVED. It does not run the write on this machine. The TUI (`dash`) is observational: keys `a` / `x` print CLI hints and do not decide.
|
|
105
102
|
|
|
106
103
|
## Claude connector
|
|
107
104
|
|
|
108
105
|
**Desktop / Claude Code (local stdio):**
|
|
109
106
|
|
|
110
107
|
```bash
|
|
111
|
-
|
|
108
|
+
# Prefer a preinstalled package (no registry auto-install):
|
|
109
|
+
npx --no-install @shield-agent/kya@0.1.16 serve-mcp --stdio
|
|
110
|
+
# Or after npm i -g / local install:
|
|
111
|
+
kya serve-mcp --stdio
|
|
112
112
|
```
|
|
113
113
|
|
|
114
|
-
Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP settings, or use `.mcp.json` for Claude Code.
|
|
115
|
-
|
|
114
|
+
Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP settings, or use `.mcp.json` for Claude Code. Pack a Desktop extension with `npx @anthropic-ai/mcpb pack` (see `manifest.json`). That pack runs the packed `dist/cli.js`, not `npx -y`.
|
|
115
|
+
|
|
116
|
+
**Claude.ai / Cowork (hosted):** add a custom connector at `https://shield-agent.com/mcp` with request header `Authorization: Bearer <KYA_API_KEY>` (or `X-API-Key`). It is not Directory-listed yet (API-key auth, no OAuth DCR).
|
|
117
|
+
|
|
118
|
+
## OpenAI (Codex / Responses)
|
|
119
|
+
|
|
120
|
+
**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.1.16 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
|
|
121
|
+
|
|
122
|
+
**Responses API:** see `openai/responses-mcp.example.json` (`server_url` + `Authorization: Bearer <KYA_API_KEY>`).
|
|
123
|
+
|
|
124
|
+
**ChatGPT Apps (chatgpt.com):** deferred. Developer Mode wants OAuth. Use Codex until then.
|
|
125
|
+
|
|
126
|
+
## Gemini CLI
|
|
127
|
+
|
|
128
|
+
Merge `gemini/settings.example.json` into `~/.gemini/settings.json` or `.gemini/settings.json`. The `shield-kya` block is stdio. The `shield-kya-hosted` block uses `httpUrl` `https://shield-agent.com/mcp` and a Bearer header.
|
|
116
129
|
|
|
117
|
-
|
|
130
|
+
## Grok
|
|
131
|
+
|
|
132
|
+
Hosted custom connector: `https://shield-agent.com/mcp` (see `grok/README.md`). Grok rejects localhost. Prefer a Bearer machine key when the UI offers a request header. For a local agent host, use the same stdio launch as Claude/Codex/Gemini.
|
|
118
133
|
|
|
119
134
|
## Cursor plugin
|
|
120
135
|
|
|
121
|
-
`.cursor-plugin/plugin.json
|
|
136
|
+
The package includes `.cursor-plugin/plugin.json`, `mcp.json`, and a wrap skill. Public listing repo: https://github.com/The-Pixel-Boys/shield-kya
|
|
122
137
|
|
|
123
138
|
## ORR (reporting only)
|
|
124
139
|
|
|
@@ -128,11 +143,15 @@ npx @shield-agent/kya orr run --path . --out ./orr-report --scorecard ./scorecar
|
|
|
128
143
|
npx @shield-agent/kya orr run --path . --out ./orr-report --producer harness.agentshield --agentshield-json ./agentshield-report.json
|
|
129
144
|
```
|
|
130
145
|
|
|
131
|
-
ORR is a
|
|
146
|
+
ORR is a reporting board. Scanners, `--scorecard`, and `harness.agentshield` are evidence. They never ALLOW a high-stakes side effect, so they are not a second policy gate. AgentShield is optional and read-only: no `--fix`, no MiniClaw, no runtime hook. This package does not depend on `ecc-agentshield`. If you pass `--producer harness.agentshield` and have neither `--agentshield-json` nor an `agentshield` binary, ORR records a coverage gap and still exits 0. Explicit `--producer` always attempts; `--skip-optional-producers` only skips producers you did not ask for.
|
|
147
|
+
|
|
148
|
+
## Cost showback (observe only)
|
|
149
|
+
|
|
150
|
+
`kya orr run --usage ./usage.json` (or `.kya/usage.json`) adds a showback section: tokens and estimated USD by agent and run. Subagents nest under `parentRunId`. That section is not a billing meter and not a policy gate. Hosted metrics show the same rollup when usage is ingested with a session.
|
|
132
151
|
|
|
133
|
-
## Enterprise (
|
|
152
|
+
## Enterprise (separate tier)
|
|
134
153
|
|
|
135
|
-
Pin, private registry, multi-tenant density, ORR board ops, and support are
|
|
154
|
+
Pin, private registry, multi-tenant density, ORR board ops, and support are not required for the day-1 `npx` path above.
|
|
136
155
|
|
|
137
156
|
## Develop
|
|
138
157
|
|
|
@@ -144,12 +163,6 @@ pnpm build
|
|
|
144
163
|
|
|
145
164
|
## Docs
|
|
146
165
|
|
|
147
|
-
- [
|
|
148
|
-
- [
|
|
149
|
-
-
|
|
150
|
-
- [Public baseline](../../public/kya-baseline/README.md)
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
## Cost showback (observe only)
|
|
154
|
-
|
|
155
|
-
`kya orr run --usage ./usage.json` (or `.kya/usage.json`) adds a **showback** section: tokens and estimated USD by agent/run. Subagents nest under `parentRunId`. This is **not** a billing meter and **not** a PEP. Hosted metrics show the same rollup when usage is ingested on session ingest.
|
|
166
|
+
- [Install hub](https://shield-agent.com/install)
|
|
167
|
+
- [How KYA works](https://shield-agent.com/how-kya-works)
|
|
168
|
+
- See also `LIMITATIONS.md` in this repo
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"mcpServers": {
|
|
3
3
|
"shield-kya": {
|
|
4
4
|
"command": "npx",
|
|
5
|
-
"args": ["-
|
|
5
|
+
"args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
|
|
6
6
|
"env": {
|
|
7
7
|
"KYA_BASE_URL": "https://shield-agent.com",
|
|
8
8
|
"KYA_API_KEY": "${KYA_API_KEY}",
|
package/claude/run-stdio.mjs
CHANGED
|
@@ -1,15 +1,18 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
/**
|
|
3
|
-
* MCPB entry stub.
|
|
4
|
-
* Running this file directly forwards to the published package.
|
|
3
|
+
* MCPB entry stub. Runs the packaged CLI — never npx (no registry redirect / lifecycle).
|
|
5
4
|
*/
|
|
6
5
|
import { spawn } from "node:child_process";
|
|
6
|
+
import { dirname, join } from "node:path";
|
|
7
|
+
import { fileURLToPath } from "node:url";
|
|
7
8
|
|
|
8
|
-
const
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
9
|
+
const root = join(dirname(fileURLToPath(import.meta.url)), "..");
|
|
10
|
+
const cli = join(root, "dist", "cli.js");
|
|
11
|
+
|
|
12
|
+
const child = spawn(process.execPath, [cli, "serve-mcp", "--stdio"], {
|
|
13
|
+
stdio: "inherit",
|
|
14
|
+
env: process.env,
|
|
15
|
+
});
|
|
13
16
|
child.on("exit", (code, signal) => {
|
|
14
17
|
if (signal) process.kill(process.pid, signal);
|
|
15
18
|
process.exit(code ?? 1);
|
package/dist/mcp/http.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAUzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAaD,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAUzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAaD,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAsC5E"}
|
package/dist/mcp/http.js
CHANGED
|
@@ -16,8 +16,9 @@ export function startHttpMcp(options) {
|
|
|
16
16
|
if (!LOOPBACK_HOSTS.has(listenHost)) {
|
|
17
17
|
return Promise.reject(new Error("HTTP MCP may only bind to loopback"));
|
|
18
18
|
}
|
|
19
|
-
|
|
20
|
-
|
|
19
|
+
// Use || so empty KYA_MCP_HTTP_TOKEN does not fail-open the privileged proxy.
|
|
20
|
+
const sharedSecret = options.sharedSecret ||
|
|
21
|
+
process.env.KYA_MCP_HTTP_TOKEN ||
|
|
21
22
|
randomBytes(24).toString("base64url");
|
|
22
23
|
const ctx = {
|
|
23
24
|
client: options.client,
|
|
@@ -136,9 +137,6 @@ function json(res, status, body) {
|
|
|
136
137
|
res.end(payload);
|
|
137
138
|
}
|
|
138
139
|
function authorizeMcp(req, res, sharedSecret) {
|
|
139
|
-
if (!sharedSecret) {
|
|
140
|
-
return true;
|
|
141
|
-
}
|
|
142
140
|
const presented = extractMcpToken(req);
|
|
143
141
|
if (!presented || !tokensEqual(presented, sharedSecret)) {
|
|
144
142
|
json(res, 401, {
|
package/dist/mcp/http.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,SAAS,GAGV,MAAM,eAAe,CAAC;AAqBvB;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,GAAG,GAAsB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9D,OAAO,CAAC;gBACN,MAAM;gBACN,IAAI;gBACJ,GAAG,EAAE,UAAU,UAAU,IAAI,IAAI,EAAE;gBACnC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBACjC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,GAAmB,EACnB,GAAsB,EACtB,YAAoB;IAEpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,eAAe,CAAC,IAAI;gBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;gBACH,IAAI,EAAE;oBACJ,cAAc,EAAE,6BAA6B;oBAC7C,aAAa,EAAE,6BAA6B;oBAC5C,GAAG,EAAE,MAAM;iBACZ;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAmB,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI;gBACf,CAAC,CAAE,aAAa,CAAC,IAAI,CAA6B;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;AACrC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,GAAmB,EACnB,YAAoB;IAEpB,
|
|
1
|
+
{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,SAAS,GAGV,MAAM,eAAe,CAAC;AAqBvB;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,8EAA8E;IAC9E,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,GAAG,GAAsB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9D,OAAO,CAAC;gBACN,MAAM;gBACN,IAAI;gBACJ,GAAG,EAAE,UAAU,UAAU,IAAI,IAAI,EAAE;gBACnC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBACjC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,GAAmB,EACnB,GAAsB,EACtB,YAAoB;IAEpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,eAAe,CAAC,IAAI;gBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;gBACH,IAAI,EAAE;oBACJ,cAAc,EAAE,6BAA6B;oBAC7C,aAAa,EAAE,6BAA6B;oBAC5C,GAAG,EAAE,MAAM;iBACZ;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAmB,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI;gBACf,CAAC,CAAE,aAAa,CAAC,IAAI,CAA6B;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;AACrC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,GAAmB,EACnB,YAAoB;IAEpB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,KAAK,EAAE,cAAc;YACrB,IAAI,EAAE,uDAAuD;SAC9D,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3D,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,QAAgB;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ,GAAG,MAAM,CAAC;IACtB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,QAAQ,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAOzC,eAAO,MAAM,eAAe;;;;;CAMlB,CAAC;AAEX,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,SAAS,EAAE,SAAS,UAAU,EAsEjC,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CAgBxB;
|
|
1
|
+
{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAOzC,eAAO,MAAM,eAAe;;;;;CAMlB,CAAC;AAEX,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,SAAS,EAAE,SAAS,UAAU,EAsEjC,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CAgBxB;AAiJD,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3D;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA0EjC"}
|
package/dist/mcp/protocol.js
CHANGED
|
@@ -106,7 +106,8 @@ async function callPolicyEvaluate(a, ctx) {
|
|
|
106
106
|
return textResult({ error: "action or toolId required" }, true);
|
|
107
107
|
}
|
|
108
108
|
const sample = findSampleTool(toolId);
|
|
109
|
-
|
|
109
|
+
// Dual-plane host is operator config — never tool-attacker-controlled.
|
|
110
|
+
const host = ctx.host;
|
|
110
111
|
const argsObj = a.args && typeof a.args === "object" && !Array.isArray(a.args)
|
|
111
112
|
? a.args
|
|
112
113
|
: {};
|
|
@@ -123,6 +124,7 @@ async function callPolicyEvaluate(a, ctx) {
|
|
|
123
124
|
approvalStatus: "NONE",
|
|
124
125
|
env: {
|
|
125
126
|
host,
|
|
127
|
+
sessionId: str(a.sessionId),
|
|
126
128
|
agentId: str(a.agentId) ?? ctx.agentId,
|
|
127
129
|
},
|
|
128
130
|
});
|
|
@@ -136,7 +138,7 @@ async function callSessionIngest(a, ctx) {
|
|
|
136
138
|
str(session.sessionId) ??
|
|
137
139
|
str(session.id) ??
|
|
138
140
|
randomUUID();
|
|
139
|
-
const host =
|
|
141
|
+
const host = ctx.host;
|
|
140
142
|
const riskLevel = str(a.riskLevel) ??
|
|
141
143
|
str(session.riskLevel) ??
|
|
142
144
|
str(session.riskHint) ??
|
|
@@ -209,11 +211,6 @@ function str(v) {
|
|
|
209
211
|
return v;
|
|
210
212
|
return undefined;
|
|
211
213
|
}
|
|
212
|
-
function parseHost(raw, fallback) {
|
|
213
|
-
if (raw === "ide" || raw === "runtime")
|
|
214
|
-
return raw;
|
|
215
|
-
return fallback;
|
|
216
|
-
}
|
|
217
214
|
function isUuid(s) {
|
|
218
215
|
return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(s);
|
|
219
216
|
}
|
package/dist/mcp/protocol.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,6IAA6I;CACvI,CAAC;AAQX,MAAM,CAAC,MAAM,SAAS,GAA0B;IAC9C;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,+JAA+J;QACjK,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBAC3D,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;gBACrE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAChE,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC;iBAClD;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;gBAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC5B;YACD,QAAQ,EAAE,EAAE;SACb;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBAClD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC9D,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,WAAW,EACT,kFAAkF;oBACpF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;aACF;YACD,QAAQ,EAAE,EAAE;SACb;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,gGAAgG;QAClG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4DAA4D;iBAC1E;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAChC;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF;CACO,CAAC;AAcX,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,IAAyC,EACzC,GAAsB;IAEtB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,qBAAqB;gBACxB,OAAO,MAAM,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,KAAK,oBAAoB;gBACvB,OAAO,MAAM,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,KAAK,sBAAsB;gBACzB,OAAO,MAAM,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C;gBACE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,
|
|
1
|
+
{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,6IAA6I;CACvI,CAAC;AAQX,MAAM,CAAC,MAAM,SAAS,GAA0B;IAC9C;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,+JAA+J;QACjK,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBAC3D,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;gBACrE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAChE,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC;iBAClD;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;gBAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC5B;YACD,QAAQ,EAAE,EAAE;SACb;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBAClD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC9D,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,WAAW,EACT,kFAAkF;oBACpF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;aACF;YACD,QAAQ,EAAE,EAAE;SACb;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,gGAAgG;QAClG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4DAA4D;iBAC1E;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAChC;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF;CACO,CAAC;AAcX,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,IAAyC,EACzC,GAAsB;IAEtB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,qBAAqB;gBACxB,OAAO,MAAM,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,KAAK,oBAAoB;gBACvB,OAAO,MAAM,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,KAAK,sBAAsB;gBACzB,OAAO,MAAM,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C;gBACE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,OAAO,GACX,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAE,CAAC,CAAC,IAAgC;QACrC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;QAC/C,MAAM;QACN,MAAM,EAAE,MAAM;QACd,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,MAAM,EAAE,WAAW;QAChC,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK;QACxC,cAAc,EAAE,MAAM;QACtB,GAAG,EAAE;YACH,IAAI;YACJ,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;SACvC;KACF,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACrE,CAAC,CAAE,CAAC,CAAC,OAAmC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,SAAS,GACb,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACf,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GACb,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrB,KAAK,CAAC;IACR,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAE,CAAC,CAAC,QAAqB;QAC1B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAE,OAAO,CAAC,QAAqB;YAChC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GACV,CAAC,CAAC,OAA+C;QACjD,OAAO,CAAC,OAA+C;QACxD,CAAC,OAAO,CAAC,KAAK;YACZ,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC1B,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAC9C,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU;QAC1D,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,SAAS;QACT,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,UAAU,CACf;YACE,KAAK,EACH,+EAA+E;SAClF,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;IACrD,sDAAsD;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAEjE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;QAChD,OAAO;QACP,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM;QAC/B,MAAM;QACN,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,SAAS;KAC7C,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;QAChB,GAAG,QAAQ;QACX,IAAI,EAAE,6EAA6E;QACnF,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,OAAO,GAAG,KAAK;IAChD,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO;QACP,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,4EAA4E,CAAC,IAAI,CACtF,CAAC,CACF,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAmB,EACnB,GAAsB;IAEtB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,CAAC;QACH,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;wBAC3B,UAAU,EAAE;4BACV,IAAI,EAAE,eAAe,CAAC,IAAI;4BAC1B,OAAO,EAAE,eAAe,CAAC,OAAO;yBACjC;qBACF;iBACF,CAAC;YACJ,KAAK,2BAA2B,CAAC;YACjC,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC;YACd,KAAK,MAAM;gBACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5C,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,WAAW,EAAE,CAAC,CAAC,WAAW;4BAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;yBAC3B,CAAC,CAAC;qBACJ;iBACF,CAAC;YACJ,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAG/B,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjB,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE;wBACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE;qBAC7D,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC3E,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;qBACjC;iBACF,CAAC;YACJ,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE;iBACpE,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE;SACjC,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
{
|
|
2
|
+
"mcpServers": {
|
|
3
|
+
"shield-kya": {
|
|
4
|
+
"command": "npx",
|
|
5
|
+
"args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
|
|
6
|
+
"env": {
|
|
7
|
+
"KYA_BASE_URL": "https://shield-agent.com",
|
|
8
|
+
"KYA_API_KEY": "${KYA_API_KEY}",
|
|
9
|
+
"KYA_HOST": "ide"
|
|
10
|
+
},
|
|
11
|
+
"timeout": 30000
|
|
12
|
+
},
|
|
13
|
+
"shield-kya-hosted": {
|
|
14
|
+
"httpUrl": "https://shield-agent.com/mcp",
|
|
15
|
+
"headers": {
|
|
16
|
+
"Authorization": "Bearer ${KYA_API_KEY}"
|
|
17
|
+
},
|
|
18
|
+
"timeout": 30000
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
}
|
package/grok/README.md
ADDED
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
# Grok + Shield KYA
|
|
2
|
+
|
|
3
|
+
Same three MCP tools as Claude and Codex: `kya.policy_evaluate`, `kya.session_ingest`, `kya.request_approval`. Shield stays the only policy decision point. Tools never execute the write.
|
|
4
|
+
|
|
5
|
+
## Hosted (grok.com)
|
|
6
|
+
|
|
7
|
+
1. Open [grok.com/connectors](https://grok.com/connectors).
|
|
8
|
+
2. **New Connector** → **Custom**.
|
|
9
|
+
3. Server URL: `https://shield-agent.com/mcp`.
|
|
10
|
+
4. Auth: machine API key as `Authorization: Bearer <KYA_API_KEY>` when the UI offers a request header / API key field. If the UI only offers OAuth or None, stop and use the xAI SDK or Codex/Gemini CLI instead. Do not turn auth off.
|
|
11
|
+
|
|
12
|
+
Grok rejects `localhost` / private IPs. A tunnel is fine for your own debugging. It is not something we ship or support as a product path.
|
|
13
|
+
|
|
14
|
+
## Hosted (xAI SDK)
|
|
15
|
+
|
|
16
|
+
```python
|
|
17
|
+
import os
|
|
18
|
+
from xai_sdk import Client
|
|
19
|
+
from xai_sdk.tools import mcp
|
|
20
|
+
|
|
21
|
+
client = Client(api_key=os.environ["XAI_API_KEY"])
|
|
22
|
+
chat = client.chat.create(
|
|
23
|
+
model="grok-4.6",
|
|
24
|
+
tools=[
|
|
25
|
+
mcp(
|
|
26
|
+
server_url="https://shield-agent.com/mcp",
|
|
27
|
+
# Pass Shield machine key however your SDK build accepts custom headers /
|
|
28
|
+
# authorization for remote MCP. Prefer Bearer <KYA_API_KEY>.
|
|
29
|
+
),
|
|
30
|
+
],
|
|
31
|
+
)
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
Confirm the current `mcp(...)` kwargs in [xAI remote MCP docs](https://docs.x.ai/docs/developers/tools/remote-mcp). The URL is always `https://shield-agent.com/mcp`.
|
|
35
|
+
|
|
36
|
+
## Local / OSS
|
|
37
|
+
|
|
38
|
+
There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
|
|
39
|
+
|
|
40
|
+
```bash
|
|
41
|
+
npx --no-install @shield-agent/kya@0.1.16 serve-mcp --stdio
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.
|
package/manifest.json
CHANGED
|
@@ -2,9 +2,9 @@
|
|
|
2
2
|
"manifest_version": "0.3",
|
|
3
3
|
"name": "shield-kya",
|
|
4
4
|
"display_name": "Shield KYA",
|
|
5
|
-
"version": "0.1.
|
|
5
|
+
"version": "0.1.16",
|
|
6
6
|
"description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
|
|
7
|
-
"long_description": "Local Claude Desktop extension that runs `
|
|
7
|
+
"long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
|
|
8
8
|
"author": {
|
|
9
9
|
"name": "Shield Agent",
|
|
10
10
|
"email": "it@shield-agent.com",
|
|
@@ -22,8 +22,12 @@
|
|
|
22
22
|
"type": "node",
|
|
23
23
|
"entry_point": "claude/run-stdio.mjs",
|
|
24
24
|
"mcp_config": {
|
|
25
|
-
"command": "
|
|
26
|
-
"args": [
|
|
25
|
+
"command": "node",
|
|
26
|
+
"args": [
|
|
27
|
+
"${__dirname}/dist/cli.js",
|
|
28
|
+
"serve-mcp",
|
|
29
|
+
"--stdio"
|
|
30
|
+
],
|
|
27
31
|
"env": {
|
|
28
32
|
"KYA_BASE_URL": "${user_config.base_url}",
|
|
29
33
|
"KYA_API_KEY": "${user_config.api_key}",
|
|
@@ -47,10 +51,21 @@
|
|
|
47
51
|
}
|
|
48
52
|
],
|
|
49
53
|
"tools_generated": false,
|
|
50
|
-
"keywords": [
|
|
54
|
+
"keywords": [
|
|
55
|
+
"kya",
|
|
56
|
+
"know-your-agent",
|
|
57
|
+
"policy",
|
|
58
|
+
"mcp",
|
|
59
|
+
"approval",
|
|
60
|
+
"claude"
|
|
61
|
+
],
|
|
51
62
|
"license": "MIT",
|
|
52
63
|
"compatibility": {
|
|
53
|
-
"platforms": [
|
|
64
|
+
"platforms": [
|
|
65
|
+
"darwin",
|
|
66
|
+
"win32",
|
|
67
|
+
"linux"
|
|
68
|
+
],
|
|
54
69
|
"runtimes": {
|
|
55
70
|
"node": ">=20.0.0"
|
|
56
71
|
}
|
|
@@ -66,7 +81,7 @@
|
|
|
66
81
|
"api_key": {
|
|
67
82
|
"type": "string",
|
|
68
83
|
"title": "API key",
|
|
69
|
-
"description": "Machine API key (sk_live_
|
|
84
|
+
"description": "Machine API key (sk_live_\u2026). Stored in the OS keychain.",
|
|
70
85
|
"sensitive": true,
|
|
71
86
|
"required": true
|
|
72
87
|
},
|
package/mcp.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"shield-kya": {
|
|
4
4
|
"description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
|
|
5
5
|
"command": "npx",
|
|
6
|
-
"args": ["-
|
|
6
|
+
"args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
|
|
7
7
|
"env": {
|
|
8
8
|
"KYA_BASE_URL": "${KYA_BASE_URL}",
|
|
9
9
|
"KYA_API_KEY": "${KYA_API_KEY}",
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# Codex CLI / IDE — Shield KYA MCP
|
|
2
|
+
# Copy into ~/.codex/config.toml (or project .codex/config.toml in a trusted project).
|
|
3
|
+
# Docs: https://developers.openai.com/codex/mcp
|
|
4
|
+
#
|
|
5
|
+
# ChatGPT Apps (chatgpt.com Developer Mode) are deferred: that path wants OAuth.
|
|
6
|
+
# Use Codex here, or the hosted Responses API snippet in responses-mcp.example.json.
|
|
7
|
+
|
|
8
|
+
# --- Local stdio (OSS) ---
|
|
9
|
+
[mcp_servers.shield-kya]
|
|
10
|
+
command = "npx"
|
|
11
|
+
args = ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"]
|
|
12
|
+
startup_timeout_sec = 20
|
|
13
|
+
|
|
14
|
+
[mcp_servers.shield-kya.env]
|
|
15
|
+
KYA_BASE_URL = "https://shield-agent.com"
|
|
16
|
+
KYA_API_KEY = "replace-me"
|
|
17
|
+
KYA_HOST = "ide"
|
|
18
|
+
# KYA_AGENT_ID = "optional-after-register"
|
|
19
|
+
|
|
20
|
+
# --- Hosted Streamable HTTP (same three tools) ---
|
|
21
|
+
# [mcp_servers.shield-kya-hosted]
|
|
22
|
+
# url = "https://shield-agent.com/mcp"
|
|
23
|
+
# bearer_token_env_var = "KYA_API_KEY"
|
|
24
|
+
# startup_timeout_sec = 20
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
{
|
|
2
|
+
"comment": "OpenAI Responses API remote MCP — hosted Shield KYA. Replace YOUR_KYA_API_KEY. ChatGPT Apps (chatgpt.com) are deferred until OAuth DCR.",
|
|
3
|
+
"model": "gpt-5.6",
|
|
4
|
+
"tools": [
|
|
5
|
+
{
|
|
6
|
+
"type": "mcp",
|
|
7
|
+
"server_label": "shield-kya",
|
|
8
|
+
"server_url": "https://shield-agent.com/mcp",
|
|
9
|
+
"authorization": "Bearer YOUR_KYA_API_KEY",
|
|
10
|
+
"require_approval": "never"
|
|
11
|
+
}
|
|
12
|
+
],
|
|
13
|
+
"input": "Evaluate whether tool org.sample.data.write should proceed. Use the shield-kya policy tool. Do not invent an approval."
|
|
14
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@shield-agent/kya",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.16",
|
|
4
4
|
"description": "Know Your Agent light CLI + local MCP gate (provider-agnostic, zero vertical packs required).",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -31,7 +31,10 @@
|
|
|
31
31
|
"assets",
|
|
32
32
|
"skills",
|
|
33
33
|
"rules",
|
|
34
|
-
".cursor-plugin"
|
|
34
|
+
".cursor-plugin",
|
|
35
|
+
"openai",
|
|
36
|
+
"gemini",
|
|
37
|
+
"grok"
|
|
35
38
|
],
|
|
36
39
|
"homepage": "https://shield-agent.com/install",
|
|
37
40
|
"repository": {
|
package/server.json
CHANGED
|
@@ -7,12 +7,12 @@
|
|
|
7
7
|
"url": "https://github.com/The-Pixel-Boys/shield-kya",
|
|
8
8
|
"source": "github"
|
|
9
9
|
},
|
|
10
|
-
"version": "0.1.
|
|
10
|
+
"version": "0.1.16",
|
|
11
11
|
"packages": [
|
|
12
12
|
{
|
|
13
13
|
"registryType": "npm",
|
|
14
14
|
"identifier": "@shield-agent/kya",
|
|
15
|
-
"version": "0.1.
|
|
15
|
+
"version": "0.1.16",
|
|
16
16
|
"transport": {
|
|
17
17
|
"type": "stdio"
|
|
18
18
|
},
|