@thotischner/observability-mcp 3.8.3 → 3.9.0

package/dist/auth/credentials.d.ts

@@ -33,10 +33,21 @@
  *                  # tools list = no restriction). Unlisted keys see
  *                  # every registered tool — back-compat with the
  *                  # pre-Products world. See docs/products.md.
+ *   OMCP_KEY_TOOLS="agent=query_logs|get_service_health;ci=list_services"
+ *                  # optional per-key tool allow-list — same shape as
+ *                  # OMCP_KEY_SOURCES. When set, the credential's /mcp
+ *                  # tools/list (and dispatch) is scoped to exactly these
+ *                  # tool names. Composes with a bound Product by
+ *                  # INTERSECTION (most-restrictive wins). Unlisted keys
+ *                  # see every registered tool — back-compat. This is the
+ *                  # per-credential, source-symmetric counterpart to the
+ *                  # Product bundle: scope one API key to a few tools
+ *                  # without authoring a Product. See docs/products.md
+ *                  # ("Per-credential tool allow-list").
  *
- * Rich role-based access control (tools/services/lookback/read-only, the
- * full governance object) is intentionally NOT here — this is only the
- * authentication + identity + coarse source-scoping primitive.
+ * Rich role-based access control (services/lookback/read-only, the full
+ * governance object) is intentionally NOT here — this is the authentication
+ * + identity + coarse source/tool-scoping primitive.
  */
 export interface Credential {
     name: string;
@@ -58,6 +69,11 @@ export interface Credential {
      *  is filtered to the Product's `tools` allow-list. Resolved against
      *  the credential's tenant so cross-tenant Products don't leak. */
     productId?: string;
+    /** Per-credential tool allow-list (OMCP_KEY_TOOLS). When set, /mcp
+     *  tools/list and dispatch are scoped to these tool names; composes
+     *  with a bound Product by intersection (most-restrictive wins).
+     *  Undefined → no per-credential tool restriction (back-compat). */
+    allowedTools?: string[];
 }
 /** Parse credentials from env. Returns an empty list when unconfigured. */
 export declare function loadCredentials(env?: NodeJS.ProcessEnv): Credential[];

package/dist/auth/credentials.js

@@ -33,10 +33,21 @@
  *                  # tools list = no restriction). Unlisted keys see
  *                  # every registered tool — back-compat with the
  *                  # pre-Products world. See docs/products.md.
+ *   OMCP_KEY_TOOLS="agent=query_logs|get_service_health;ci=list_services"
+ *                  # optional per-key tool allow-list — same shape as
+ *                  # OMCP_KEY_SOURCES. When set, the credential's /mcp
+ *                  # tools/list (and dispatch) is scoped to exactly these
+ *                  # tool names. Composes with a bound Product by
+ *                  # INTERSECTION (most-restrictive wins). Unlisted keys
+ *                  # see every registered tool — back-compat. This is the
+ *                  # per-credential, source-symmetric counterpart to the
+ *                  # Product bundle: scope one API key to a few tools
+ *                  # without authoring a Product. See docs/products.md
+ *                  # ("Per-credential tool allow-list").
  *
- * Rich role-based access control (tools/services/lookback/read-only, the
- * full governance object) is intentionally NOT here — this is only the
- * authentication + identity + coarse source-scoping primitive.
+ * Rich role-based access control (services/lookback/read-only, the full
+ * governance object) is intentionally NOT here — this is the authentication
+ * + identity + coarse source/tool-scoping primitive.
  */
 import { parseKeyTenants } from "../tenancy/context.js";
 function parseKeySources(raw) {
@@ -84,6 +95,8 @@ export function loadCredentials(env = process.env) {
     const rawQueryNames = parseBypassSet(env.OMCP_KEY_RAW_QUERY);
     const keyTenants = parseKeyTenants(env.OMCP_KEY_TENANTS);
     const keyProducts = parseKeyProducts(env.OMCP_KEY_PRODUCTS);
+    // OMCP_KEY_TOOLS shares the OMCP_KEY_SOURCES grammar (`name=a|b;name2=c`).
+    const keyTools = parseKeySources(env.OMCP_KEY_TOOLS);
     const creds = [];
     for (const part of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
         const idx = part.indexOf(":");
@@ -99,6 +112,7 @@ export function loadCredentials(env = process.env) {
             allowRawQuery: rawQueryNames.has(name) || undefined,
             tenant: keyTenants.get(name) || undefined,
             productId: keyProducts.get(name) || undefined,
+            allowedTools: keyTools.get(name),
         });
     }
     return creds;

package/dist/auth/credentials.test.js

@@ -11,7 +11,7 @@ describe("single-tenant auth primitive", () => {
     it("parses name:token and bare token", () => {
         const creds = loadCredentials({ OMCP_API_KEYS: "ci:tok_abc, tok_bare " });
         assert.equal(creds.length, 2);
-        assert.deepEqual(creds[0], { name: "ci", token: "tok_abc", allowedSources: undefined, bypassRedaction: undefined, allowRawQuery: undefined, tenant: undefined, productId: undefined });
+        assert.deepEqual(creds[0], { name: "ci", token: "tok_abc", allowedSources: undefined, bypassRedaction: undefined, allowRawQuery: undefined, tenant: undefined, productId: undefined, allowedTools: undefined });
         assert.equal(creds[1].name, "key");
         assert.equal(creds[1].token, "tok_bare");
     });
@@ -23,6 +23,16 @@ describe("single-tenant auth primitive", () => {
         assert.deepEqual(creds[0].allowedSources, ["prom-prod", "loki-prod"]);
         assert.deepEqual(creds[1].allowedSources, ["prom-staging"]);
     });
+    it("parses per-key tool allow-list (OMCP_KEY_TOOLS)", () => {
+        const creds = loadCredentials({
+            OMCP_API_KEYS: "agent:tok1,ci:tok2,full:tok3",
+            OMCP_KEY_TOOLS: "agent=query_logs|get_service_health; ci=list_services",
+        });
+        assert.deepEqual(creds.find((c) => c.name === "agent")?.allowedTools, ["query_logs", "get_service_health"]);
+        assert.deepEqual(creds.find((c) => c.name === "ci")?.allowedTools, ["list_services"]);
+        // Unlisted key → undefined (no restriction, back-compat), not [].
+        assert.equal(creds.find((c) => c.name === "full")?.allowedTools, undefined);
+    });
     it("parses OMCP_KEY_BYPASS_REDACTION → flags only the listed names", () => {
         const creds = loadCredentials({
             OMCP_API_KEYS: "agent:tok1,ci:tok2,unprivileged:tok3",

package/dist/connectors/loader.d.ts

@@ -27,6 +27,7 @@ export declare class PluginLoader {
     private verify;
     private trustRootPath?;
     private trustRoot?;
+    private requireSignature;
     /** Optional HookRegistry — when set, the loader auto-registers
      *  every entry in `manifest.hooks[]` after the plugin loads, and
      *  unregisters them when a same-name plugin replaces it. Hooks
@@ -39,6 +40,7 @@ export declare class PluginLoader {
         verify?: boolean;
         trustRoot?: string;
         hookRegistry?: HookRegistry;
+        requireSignature?: boolean;
     });
     load(): Promise<void>;
     list(): LoadedConnector[];
@@ -49,6 +51,10 @@ export declare class PluginLoader {
     create(name: string): ObservabilityConnector | undefined;
     private loadBuiltins;
     private loadFilesystem;
+    /** A filesystem plugin failed the verification gate. In strict mode
+     *  (PLUGIN_REQUIRE_SIGNATURE) this throws to abort load(); otherwise it
+     *  warns and the caller skips the plugin (fail-closed but non-fatal). */
+    private gateFailure;
     private loadFilesystemPlugin;
     private register;
 }

package/dist/connectors/loader.js

@@ -31,6 +31,15 @@ export class PluginLoader {
     verify;
     trustRootPath;
     trustRoot;
+    // Strict mode (PLUGIN_REQUIRE_SIGNATURE=true). Default OFF. When OFF, a
+    // filesystem plugin that fails the verification gate is silently SKIPPED
+    // (warn + continue) — the server still boots, just without that connector.
+    // When ON, a present-but-unverifiable plugin (missing manifest / missing
+    // or invalid signature / integrity mismatch), or a missing/unloadable trust
+    // root, is a HARD error that aborts load() — so an operator who demands
+    // signed connectors fails to start rather than silently running a reduced
+    // set. Implies verify (you cannot require signatures without verifying).
+    requireSignature;
     /** Optional HookRegistry — when set, the loader auto-registers
      *  every entry in `manifest.hooks[]` after the plugin loads, and
      *  unregisters them when a same-name plugin replaces it. Hooks
@@ -50,11 +59,24 @@ export class PluginLoader {
         this.disabled = new Set([...(opts.disabled ?? []), ...envDisabled]);
         this.verify = opts.verify ?? !/^(0|false|no|off)$/i.test(process.env.VERIFY_PLUGINS ?? "true");
         this.trustRootPath = opts.trustRoot ?? process.env.PLUGIN_TRUST_ROOT;
+        this.requireSignature =
+            opts.requireSignature ?? /^(1|true|yes|on)$/i.test(process.env.PLUGIN_REQUIRE_SIGNATURE ?? "");
+        // Requiring signatures implies verifying them — an operator who sets
+        // PLUGIN_REQUIRE_SIGNATURE=true but left VERIFY_PLUGINS=false meant the
+        // stricter posture; honour it rather than silently no-op.
+        if (this.requireSignature)
+            this.verify = true;
     }
     async load() {
         this.loadBuiltins();
         if (this.verify) {
             if (!this.trustRootPath) {
+                // In strict mode this is a misconfiguration — the operator demanded
+                // signed connectors but gave no way to verify them. Fail hard rather
+                // than silently degrade to builtins-only.
+                if (this.requireSignature) {
+                    throw new PluginVerificationError("PLUGIN_REQUIRE_SIGNATURE is on but PLUGIN_TRUST_ROOT is unset — cannot enforce signatures. Set a trust root or unset PLUGIN_REQUIRE_SIGNATURE.");
+                }
                 console.warn("VERIFY_PLUGINS is on but PLUGIN_TRUST_ROOT is unset — refusing to load any filesystem plugins (fail-closed). Builtins remain available.");
                 return;
             }
@@ -63,6 +85,9 @@ export class PluginLoader {
                 console.log("Plugin verification enabled; trust root loaded from %s", sanitizeForLog(this.trustRootPath));
             }
             catch (err) {
+                if (this.requireSignature) {
+                    throw new PluginVerificationError(`PLUGIN_REQUIRE_SIGNATURE is on but the trust root failed to load (${String(err)}) — cannot enforce signatures.`);
+                }
                 console.warn("VERIFY_PLUGINS is on but trust root failed to load (%s) — refusing to load any filesystem plugins (fail-closed). Builtins remain available.", sanitizeForLog(String(err)));
                 return;
             }
@@ -161,10 +186,23 @@ export class PluginLoader {
                 await this.loadFilesystemPlugin(pluginRoot);
             }
             catch (err) {
+                // In strict mode a verification failure must abort load() rather than
+                // be swallowed as a per-plugin warning — propagate it.
+                if (this.requireSignature && err instanceof PluginVerificationError)
+                    throw err;
                 console.warn("Failed to load plugin %s: %s", sanitizeForLog(entry), sanitizeForLog(String(err)));
             }
         }
     }
+    /** A filesystem plugin failed the verification gate. In strict mode
+     *  (PLUGIN_REQUIRE_SIGNATURE) this throws to abort load(); otherwise it
+     *  warns and the caller skips the plugin (fail-closed but non-fatal). */
+    gateFailure(name, reason) {
+        if (this.requireSignature) {
+            throw new PluginVerificationError(`PLUGIN_REQUIRE_SIGNATURE: plugin ${name} ${reason} — refusing to start.`);
+        }
+        console.warn("VERIFY_PLUGINS: plugin %s %s — skipping (fail-closed)", sanitizeForLog(name), sanitizeForLog(reason));
+    }
     async loadFilesystemPlugin(pluginRoot) {
         const pkgPath = join(pluginRoot, "package.json");
         if (!existsSync(pkgPath))
@@ -180,18 +218,29 @@ export class PluginLoader {
             manifestPath = resolve(pluginRoot, marker.manifest);
             if (existsSync(manifestPath)) {
                 manifestBytes = readFileSync(manifestPath);
-                const raw = JSON.parse(manifestBytes.toString("utf8"));
+                // A present-but-malformed manifest (corrupt JSON / schema-invalid /
+                // name mismatch) is "present but cannot be verified" — under strict
+                // mode gateFailure() aborts startup, so the connector can't silently
+                // go missing; otherwise it warns + skips as before.
+                let raw;
+                try {
+                    raw = JSON.parse(manifestBytes.toString("utf8"));
+                }
+                catch (err) {
+                    this.gateFailure(marker.name, `has unparseable manifest.json (${String(err)})`);
+                    return;
+                }
                 const parsed = manifestSchema.safeParse(raw);
                 if (!parsed.success) {
                     const issues = parsed.error.issues
                         .map((i) => `${i.path.join(".")}: ${i.message}`)
                         .join("; ");
-                    console.warn("Plugin %s has invalid manifest.json — %s; skipping", sanitizeForLog(marker.name), sanitizeForLog(issues));
+                    this.gateFailure(marker.name, `has invalid manifest.json — ${issues}`);
                     return;
                 }
                 manifest = parsed.data;
                 if (manifest.name !== marker.name) {
-                    console.warn("Plugin %s package.json marker name does not match manifest.json (%s); skipping", sanitizeForLog(marker.name), sanitizeForLog(manifest.name));
+                    this.gateFailure(marker.name, `package.json marker name does not match manifest.json (${manifest.name})`);
                     return;
                 }
             }
@@ -208,12 +257,12 @@ export class PluginLoader {
         // against the trust root. Everything is local — airgapped-safe.
         if (this.verify) {
             if (!manifest || !manifestPath || !manifestBytes) {
-                console.warn("VERIFY_PLUGINS: plugin %s has no manifest.json — skipping (fail-closed)", sanitizeForLog(marker.name));
+                this.gateFailure(marker.name, "has no manifest.json");
                 return;
             }
             const sigPath = manifestPath + ".sig";
             if (!existsSync(sigPath)) {
-                console.warn("VERIFY_PLUGINS: plugin %s missing manifest signature %s — skipping (fail-closed)", sanitizeForLog(marker.name), sanitizeForLog(marker.manifest + ".sig"));
+                this.gateFailure(marker.name, `missing manifest signature ${marker.manifest + ".sig"}`);
                 return;
             }
             try {
@@ -222,7 +271,7 @@ export class PluginLoader {
             }
             catch (err) {
                 const detail = err instanceof PluginVerificationError ? err.message : String(err);
-                console.warn("VERIFY_PLUGINS: plugin %s failed verification (%s) — skipping (fail-closed)", sanitizeForLog(marker.name), sanitizeForLog(detail));
+                this.gateFailure(marker.name, `failed verification (${detail})`);
                 return;
             }
             console.log("VERIFY_PLUGINS: plugin %s signature + integrity OK", sanitizeForLog(marker.name));

package/dist/connectors/loader.test.js

@@ -1,12 +1,49 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { generateKeyPairSync, sign as cryptoSign } from "node:crypto";
 import { PluginLoader } from "./loader.js";
+import { PluginVerificationError, sha256Integrity } from "./verify.js";
 function tmp() {
     return mkdtempSync(join(tmpdir(), "loader-default-"));
 }
+const ENTRY_SRC = "export default () => ({});\n";
+/** Write a public-key PEM trust root + return its path and the signing key. */
+function makeTrustRoot() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const dir = mkdtempSync(join(tmpdir(), "loader-trust-"));
+    const p = join(dir, "trust.pem");
+    writeFileSync(p, publicKey.export({ type: "spki", format: "pem" }));
+    return { path: p, privateKey };
+}
+/** Build a filesystem connector plugin dir under `pluginsDir`.
+ *  opts.manifest=false → no manifest.json; opts.sign omitted → no .sig;
+ *  opts.sign=key → a valid detached signature over the manifest bytes. */
+function makePlugin(pluginsDir, name, opts = {}) {
+    const root = join(pluginsDir, name);
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, "index.js"), ENTRY_SRC);
+    writeFileSync(join(root, "package.json"), JSON.stringify({ main: "index.js", observabilityMcp: { kind: "connector", name, manifest: "manifest.json" } }));
+    if (opts.manifest === false)
+        return;
+    const manifestPath = join(root, "manifest.json");
+    const manifestBytes = opts.rawManifest !== undefined
+        ? Buffer.from(opts.rawManifest)
+        : Buffer.from(JSON.stringify({
+            schemaVersion: 1,
+            name,
+            displayName: name,
+            version: "1.0.0",
+            description: `${name} test connector`,
+            signalTypes: ["metrics"],
+            integrity: opts.integrity ?? sha256Integrity(Buffer.from(ENTRY_SRC)),
+        }));
+    writeFileSync(manifestPath, manifestBytes);
+    if (opts.sign)
+        writeFileSync(manifestPath + ".sig", cryptoSign(null, manifestBytes, opts.sign));
+}
 function withEnv(overrides, fn) {
     const saved = {};
     for (const k of Object.keys(overrides)) {
@@ -87,3 +124,87 @@ test("PluginLoader.load(): builtins carry manifest metadata (description shows i
         assert.equal(c.manifest.name, name);
     }
 });
+// --- PLUGIN_REQUIRE_SIGNATURE (strict load-time enforcement) ---
+test("PluginLoader: PLUGIN_REQUIRE_SIGNATURE=true sets requireSignature and forces verify on", () => {
+    for (const v of ["true", "1", "yes", "On"]) {
+        // Even with VERIFY_PLUGINS=false, requiring signatures implies verifying.
+        withEnv({ PLUGIN_REQUIRE_SIGNATURE: v, VERIFY_PLUGINS: "false" }, () => {
+            const loader = new PluginLoader({ pluginsDir: tmp() });
+            assert.equal(loader["requireSignature"], true, `value ${v} should enable strict mode`);
+            assert.equal(loader["verify"], true, "requireSignature implies verify");
+        });
+    }
+    withEnv({ PLUGIN_REQUIRE_SIGNATURE: undefined }, () => {
+        assert.equal(new PluginLoader({ pluginsDir: tmp() })["requireSignature"], false, "default OFF");
+    });
+});
+test("strict mode: a plugin with no manifest ABORTS load() (hard fail, not skip)", async () => {
+    const dir = tmp();
+    makePlugin(dir, "unsigned-conn", { manifest: false });
+    const trust = makeTrustRoot();
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path, requireSignature: true });
+    await assert.rejects(() => loader.load(), PluginVerificationError);
+});
+test("strict mode: a plugin with manifest but missing .sig ABORTS load()", async () => {
+    const dir = tmp();
+    makePlugin(dir, "nosig-conn", { /* manifest yes, sign no */});
+    const trust = makeTrustRoot();
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path, requireSignature: true });
+    await assert.rejects(() => loader.load(), PluginVerificationError);
+});
+test("strict mode: missing trust root ABORTS load() (misconfiguration)", async () => {
+    const loader = new PluginLoader({ pluginsDir: tmp(), verify: true, trustRoot: undefined, requireSignature: true });
+    await assert.rejects(() => loader.load(), /PLUGIN_TRUST_ROOT is unset/);
+});
+test("NON-strict (default): the same unverifiable plugin is skipped, builtins still load", async () => {
+    const dir = tmp();
+    makePlugin(dir, "unsigned-conn", { manifest: false });
+    const trust = makeTrustRoot();
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path /* requireSignature default false */ });
+    await loader.load(); // must NOT throw
+    const names = loader.supportedTypes();
+    assert.ok(names.includes("prometheus"), "builtins still load");
+    assert.ok(!names.includes("unsigned-conn"), "unverifiable plugin skipped, not registered");
+});
+test("strict mode: a correctly-signed plugin loads without error", async () => {
+    const dir = tmp();
+    const trust = makeTrustRoot();
+    makePlugin(dir, "good-conn", { sign: trust.privateKey });
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path, requireSignature: true });
+    await loader.load(); // valid signature + integrity → no throw
+    assert.ok(loader.supportedTypes().includes("good-conn"), "signed plugin registered under strict mode");
+});
+// A present-but-malformed manifest is "present but cannot be verified" — strict
+// mode must hard-fail, not silently drop the connector.
+test("strict mode: unparseable manifest.json ABORTS load()", async () => {
+    const dir = tmp();
+    makePlugin(dir, "corrupt-conn", { rawManifest: "{ this is not valid json" });
+    const trust = makeTrustRoot();
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path, requireSignature: true });
+    await assert.rejects(() => loader.load(), PluginVerificationError);
+});
+test("strict mode: schema-invalid manifest.json ABORTS load()", async () => {
+    const dir = tmp();
+    // Missing required fields (displayName/version/signalTypes/...).
+    makePlugin(dir, "badschema-conn", { rawManifest: JSON.stringify({ schemaVersion: 1, name: "badschema-conn" }) });
+    const trust = makeTrustRoot();
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path, requireSignature: true });
+    await assert.rejects(() => loader.load(), PluginVerificationError);
+});
+test("strict mode: integrity mismatch ABORTS load() (signed manifest, wrong digest)", async () => {
+    const dir = tmp();
+    const trust = makeTrustRoot();
+    // Validly signed manifest, but its integrity does not match index.js.
+    makePlugin(dir, "tampered-conn", { sign: trust.privateKey, integrity: "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" });
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path, requireSignature: true });
+    await assert.rejects(() => loader.load(), PluginVerificationError);
+});
+test("NON-strict: a malformed manifest is still skipped (not fatal), builtins load", async () => {
+    const dir = tmp();
+    makePlugin(dir, "corrupt-conn", { rawManifest: "{ nope" });
+    const trust = makeTrustRoot();
+    const loader = new PluginLoader({ pluginsDir: dir, verify: true, trustRoot: trust.path /* non-strict */ });
+    await loader.load(); // must NOT throw
+    assert.ok(loader.supportedTypes().includes("prometheus"), "builtins still load");
+    assert.ok(!loader.supportedTypes().includes("corrupt-conn"), "malformed plugin skipped");
+});

package/dist/context.d.ts

@@ -39,6 +39,12 @@ export interface RequestContext {
      *  Anonymous + Product-less credentials leave this unset and see
      *  every registered tool. */
     allowedTools?: string[];
+    /** Per-credential tool allow-list (OMCP_KEY_TOOLS) — a SEPARATE axis from
+     *  the Product `allowedTools`. The registration gate requires a tool to
+     *  pass BOTH (each via allowsTool, undefined = no restriction), so the two
+     *  compose by intersection without overloading the empty-list semantics.
+     *  Unset for anonymous + unscoped credentials. */
+    credentialTools?: string[];
     /** Correlates all tool calls within one transport request/session. */
     correlationId: string;
 }
@@ -59,6 +65,7 @@ export declare function principalContext(principalId: string, allowedSources?: s
     allowRawQuery?: boolean;
     tenant?: string;
     allowedTools?: string[];
+    credentialTools?: string[];
 }): RequestContext;
 /** Context for an authenticated management-plane (browser / OIDC /
  *  basic-auth) request. The session-derived tenant flows into tool
@@ -85,3 +92,14 @@ export declare function sessionContext(session: {
  *  Tool names are compared case-sensitively; the MCP spec is
  *  case-sensitive on `name`. */
 export declare function allowsTool(allowedTools: string[] | undefined, toolName: string): boolean;
+/** Combine two tool allow-lists into the effective (most-restrictive) one.
+ *  Both lists NARROW access, so the result is their intersection:
+ *    - either side undefined → the other side wins (an absent list means
+ *      "no restriction", so it can't tighten the other).
+ *    - both set → only tools present in BOTH survive (so a per-credential
+ *      OMCP_KEY_TOOLS list and a bound Product's `tools` list compose
+ *      without one silently widening the other; an empty intersection
+ *      means the credential can call nothing through that binding).
+ *  Used to fold the per-credential allow-list together with the Product
+ *  allow-list at request entry. */
+export declare function intersectAllowed(a: string[] | undefined, b: string[] | undefined): string[] | undefined;

package/dist/context.js

@@ -27,6 +27,7 @@ export function principalContext(principalId, allowedSources, opts = {}) {
         allowRawQuery: opts.allowRawQuery || undefined,
         tenant: normaliseTenant(opts.tenant),
         allowedTools: opts.allowedTools && opts.allowedTools.length > 0 ? opts.allowedTools : undefined,
+        credentialTools: opts.credentialTools && opts.credentialTools.length > 0 ? opts.credentialTools : undefined,
         correlationId: randomUUID(),
     };
 }
@@ -64,3 +65,21 @@ export function allowsTool(allowedTools, toolName) {
         return true;
     return allowedTools.includes(toolName);
 }
+/** Combine two tool allow-lists into the effective (most-restrictive) one.
+ *  Both lists NARROW access, so the result is their intersection:
+ *    - either side undefined → the other side wins (an absent list means
+ *      "no restriction", so it can't tighten the other).
+ *    - both set → only tools present in BOTH survive (so a per-credential
+ *      OMCP_KEY_TOOLS list and a bound Product's `tools` list compose
+ *      without one silently widening the other; an empty intersection
+ *      means the credential can call nothing through that binding).
+ *  Used to fold the per-credential allow-list together with the Product
+ *  allow-list at request entry. */
+export function intersectAllowed(a, b) {
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    const bSet = new Set(b);
+    return a.filter((t) => bSet.has(t));
+}

package/dist/context.test.js

@@ -1,6 +1,6 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { allowsTool, defaultContext, principalContext } from "./context.js";
+import { allowsTool, intersectAllowed, defaultContext, principalContext } from "./context.js";
 test("allowsTool — undefined allow-list = no Product binding = every tool allowed", () => {
     assert.equal(allowsTool(undefined, "list_sources"), true);
     assert.equal(allowsTool(undefined, "query_logs"), true);
@@ -15,6 +15,44 @@ test("allowsTool — non-empty allow-list gates by exact match", () => {
     assert.equal(allowsTool(allow, "query_logs"), false);
     assert.equal(allowsTool(allow, "get_topology"), false);
 });
+// intersectAllowed folds a per-credential list (OMCP_KEY_TOOLS) with a Product
+// list — most-restrictive wins.
+test("intersectAllowed — either side undefined returns the other (no widening)", () => {
+    assert.equal(intersectAllowed(undefined, undefined), undefined);
+    assert.deepEqual(intersectAllowed(["a", "b"], undefined), ["a", "b"]);
+    assert.deepEqual(intersectAllowed(undefined, ["a", "b"]), ["a", "b"]);
+});
+test("intersectAllowed — both set → intersection only", () => {
+    assert.deepEqual(intersectAllowed(["query_logs", "list_services"], ["query_logs", "get_topology"]), ["query_logs"]);
+    // Disjoint → empty list: the credential can call nothing through that binding.
+    assert.deepEqual(intersectAllowed(["query_logs"], ["get_topology"]), []);
+    // Order follows the first (credential) list.
+    assert.deepEqual(intersectAllowed(["b", "a"], ["a", "b"]), ["b", "a"]);
+});
+// The registration gate ANDs two independent allowsTool axes (Product +
+// per-credential OMCP_KEY_TOOLS). This is what makes disjoint lists deny
+// everything WITHOUT routing through an overloaded empty intersection — an
+// empty `[]` would be read by allowsTool as "allow all", which is why the two
+// axes are kept separate rather than pre-intersected into one list.
+function passesGate(productTools, credTools, name) {
+    return allowsTool(productTools, name) && allowsTool(credTools, name);
+}
+test("two-axis gate — disjoint Product and credential lists deny every tool", () => {
+    // Product allows get_topology; credential allows only query_logs → nothing passes.
+    assert.equal(passesGate(["get_topology"], ["query_logs"], "query_logs"), false);
+    assert.equal(passesGate(["get_topology"], ["query_logs"], "get_topology"), false);
+});
+test("two-axis gate — credential list narrows within an unrestricted Product axis", () => {
+    assert.equal(passesGate(undefined, ["query_logs"], "query_logs"), true);
+    assert.equal(passesGate(undefined, ["query_logs"], "get_topology"), false);
+});
+test("two-axis gate — overlapping lists allow only the overlap", () => {
+    const product = ["query_logs", "get_topology", "list_services"];
+    const cred = ["query_logs", "list_services"];
+    assert.equal(passesGate(product, cred, "query_logs"), true);
+    assert.equal(passesGate(product, cred, "list_services"), true);
+    assert.equal(passesGate(product, cred, "get_topology"), false); // in Product, not in credential
+});
 test("allowsTool — case-sensitive (matches MCP spec)", () => {
     const allow = ["list_sources"];
     assert.equal(allowsTool(allow, "List_Sources"), false);

package/dist/index.js

@@ -9,7 +9,7 @@ import { z } from "zod";
 import { loadConfig, saveConfig, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_SETTINGS } from "./config/loader.js";
 import { ConnectorRegistry, getSupportedTypes } from "./connectors/registry.js";
 import { isTopologyProvider } from "./connectors/interface.js";
-import { defaultContext, principalContext, sessionContext, allowsTool } from "./context.js";
+import { defaultContext, principalContext, sessionContext, allowsTool, intersectAllowed } from "./context.js";
 import { parseKeyTenants, isMultiTenantConfigured } from "./tenancy/context.js";
 import { enforceEntitledAccess, enterpriseGateStatus, enterpriseGateInfo, enterprisePolicyView, enterpriseCatalogView, enterpriseAuditTail, authorizeAdmin, updateRbacPolicy, updateCatalog, inspectEnforceEntitled, featureEntitled, entitledFeatures, } from "./enterprise-gate.js";
 import { loadCredentials, credentialsConfigured, extractToken, resolveToken, } from "./auth/credentials.js";
@@ -382,8 +382,13 @@ async function main() {
         // reaches the caller. When no hooks are registered (the default in
         // the OSS demo) the wrapper is a thin pass-through.
         const registerTool = ((name, ...rest) => {
-            if (!allowsTool(ctx.allowedTools, name))
+            // Two independent allow-list axes must BOTH pass: the Product binding
+            // (ctx.allowedTools, OMCP_KEY_PRODUCTS) and the per-credential list
+            // (ctx.credentialTools, OMCP_KEY_TOOLS). Either undefined = no restriction
+            // on that axis; disjoint non-empty lists therefore deny every tool.
+            if (!allowsTool(ctx.allowedTools, name) || !allowsTool(ctx.credentialTools, name)) {
                 return undefined;
+            }
             if (rest.length > 0 && typeof rest[rest.length - 1] === "function") {
                 const originalHandler = rest[rest.length - 1];
                 const wrappedHandler = wrapToolHandler(hookRegistry, { principal: ctx.principalId, tenant: ctx.tenant || "default", target: name }, originalHandler);
@@ -1849,6 +1854,7 @@ async function main() {
                 productId: c.productId,
                 bypassRedaction: !!c.bypassRedaction,
                 allowedSources: c.allowedSources,
+                allowedTools: c.allowedTools,
             });
         }
         // OIDC groups → role mappings.
@@ -3670,6 +3676,11 @@ async function main() {
             allowRawQuery: cred.allowRawQuery,
             tenant: cred.tenant,
             allowedTools,
+            // Per-credential tool allow-list (OMCP_KEY_TOOLS) — a SEPARATE axis from
+            // the Product one. The registration gate requires a tool to pass BOTH,
+            // so disjoint lists deny everything without overloading the empty-list
+            // "allow all" semantics allowsTool uses for the Product axis.
+            credentialTools: cred.allowedTools,
         });
     }
     app.post("/mcp", async (req, res) => {
@@ -3741,14 +3752,6 @@ async function main() {
     // registerTool gate, so the surface a /mcp/v/<slug> client sees is
     // strictly product.tools (intersected with any pre-existing
     // allowedTools the credential already carries).
-    function intersectAllowed(a, b) {
-        if (!a)
-            return b;
-        if (!b)
-            return a;
-        const bSet = new Set(b);
-        return a.filter((t) => bSet.has(t));
-    }
     async function resolveVirtualProduct(req, res, baseCtx) {
         const slug = req.params.slug;
         if (!slug || typeof slug !== "string") {
@@ -3911,6 +3914,7 @@ async function main() {
                 allowRawQuery: cred.allowRawQuery,
                 tenant: cred.tenant,
                 allowedTools,
+                credentialTools: cred.allowedTools,
             }),
             selectedSubprotocol,
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thotischner/observability-mcp",
-  "version": "3.8.3",
+  "version": "3.9.0",
   "description": "Unified observability gateway for AI agents — one MCP server for Prometheus, Loki, and any backend",
   "type": "module",
   "license": "Apache-2.0",