@usetorii/gateway 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Torii
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,116 @@
+# Torii Gateway
+
+The runtime side of [Torii](https://usetorii.dev). A small Node.js process that:
+
+- speaks **MCP** to your AI client (Claude Desktop, Cursor, your own app),
+- proxies tool calls to the real MCP servers you've registered,
+- enforces policies (block, ask-me-first),
+- streams audit + threat findings to the Torii backend, and
+- runs the local pieces of the consent flow.
+
+It pairs with a `TORII_API_KEY` you generate in the dashboard.
+
+## Install
+
+Pick one. Same binary, different package.
+
+### 1. npx (no install)
+```json
+// claude_desktop_config.json
+{
+  "mcpServers": {
+    "torii": {
+      "command": "npx",
+      "args": ["-y", "@usetorii/gateway"],
+      "env": { "TORII_API_KEY": "tok_..." }
+    }
+  }
+}
+```
+
+### 2. Native binary
+```bash
+# macOS / Linux (Homebrew)
+brew install scumfrog/tap/torii
+
+# Linux / macOS (curl)
+curl -fsSL https://usetorii.dev/install.sh | sh
+```
+
+Then in `claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "torii": {
+      "command": "torii",
+      "env": { "TORII_API_KEY": "tok_..." }
+    }
+  }
+}
+```
+
+### 3. Docker
+```bash
+docker pull ghcr.io/scumfrog/torii-gateway:latest
+```
+
+```json
+{
+  "mcpServers": {
+    "torii": {
+      "command": "docker",
+      "args": [
+        "run", "--rm", "-i",
+        "-e", "TORII_API_KEY",
+        "ghcr.io/scumfrog/torii-gateway:latest"
+      ],
+      "env": { "TORII_API_KEY": "tok_..." }
+    }
+  }
+}
+```
+
+## Configuration
+
+Without a `TORII_API_KEY`, the gateway looks for a local YAML config at:
+
+1. `$TORII_CONFIG` if set, else
+2. `~/.torii/config.yaml`
+
+See the [config schema](./src/core/config/schema.ts) for the full shape.
+
+When `TORII_API_KEY` is set, the gateway pulls its config from
+`https://api.usetorii.dev/v1/me/servers/config` so you can manage everything
+from the dashboard.
+
+## Local development
+
+```bash
+pnpm install
+pnpm run build
+node dist/index.js
+```
+
+## How distribution works
+
+- Tag a release: `git tag v0.x.y && git push --tags`.
+- `.github/workflows/release.yml` runs and:
+  - publishes `@usetorii/gateway` to npm (needs `NPM_TOKEN` secret),
+  - builds native binaries for macOS/Linux × x64/arm64 with `bun build --compile`,
+  - uploads them to a GitHub Release with SHA-256 checksums,
+  - builds and pushes a multi-arch Docker image to `ghcr.io/scumfrog/torii-gateway`,
+  - bumps the `homebrew-tap` formula (needs `HOMEBREW_TAP_TOKEN` secret).
+
+To bootstrap the secrets:
+
+```bash
+# in this repo
+gh secret set NPM_TOKEN -b "<from https://www.npmjs.com/settings/tokens>"
+gh secret set HOMEBREW_TAP_TOKEN -b "<a PAT with 'repo' scope on scumfrog/homebrew-tap>"
+```
+
+`GITHUB_TOKEN` is auto-injected by Actions for the GHCR push.
+
+## License
+
+MIT. See [LICENSE](./LICENSE).

package/dist/audit/index.d.ts

@@ -0,0 +1,5 @@
+import type { AuditEntry, SecurityFinding } from "../core/index.js";
+export type { AuditEntry };
+export declare function logCall(entry: AuditEntry): void;
+export declare function makeEntry(server: string, tool: string, args: unknown, result: unknown, startedAt: number, error?: unknown, blocked?: boolean, threatLevel?: string, findings?: SecurityFinding[]): AuditEntry;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpE,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,wBAAgB,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAY/C;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,OAAO,EACjB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,eAAe,EAAE,GAC3B,UAAU,CAaZ"}

package/dist/audit/index.js

@@ -0,0 +1,27 @@
+export function logCall(entry) {
+    process.stderr.write(JSON.stringify(entry) + "\n");
+    const apiUrl = process.env.TORII_API_URL;
+    const apiKey = process.env.TORII_API_KEY;
+    if (apiUrl && apiKey) {
+        fetch(`${apiUrl}/v1/audit/ingest`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Torii-Key": apiKey },
+            body: JSON.stringify({ entries: [entry] }),
+        }).catch(() => { });
+    }
+}
+export function makeEntry(server, tool, args, result, startedAt, error, blocked, threatLevel, findings) {
+    return {
+        ts: new Date().toISOString(),
+        server,
+        tool,
+        args_size: JSON.stringify(args ?? null).length,
+        result_size: JSON.stringify(result ?? null).length,
+        duration_ms: Date.now() - startedAt,
+        ...(error ? { error: String(error) } : {}),
+        ...(blocked !== undefined ? { blocked } : {}),
+        ...(threatLevel ? { threat_level: threatLevel } : {}),
+        ...(findings?.length ? { security_findings: findings } : {}),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,OAAO,CAAC,KAAiB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,EAAE;YACtE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,MAAe,EACf,SAAiB,EACjB,KAAe,EACf,OAAiB,EACjB,WAAoB,EACpB,QAA4B;IAE5B,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM;QAC9C,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM;QAClD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC"}

package/dist/core/config/loader.d.ts

@@ -0,0 +1,8 @@
+import type { ToriiConfig } from "../types.js";
+/**
+ * Resolves ${VAR_NAME} references in env values against process.env.
+ * Unknown variables are replaced with an empty string and a warning is logged.
+ */
+export declare function resolveEnv(env: Record<string, string>): Record<string, string>;
+export declare function loadConfig(): ToriiConfig;
+//# sourceMappingURL=loader.d.ts.map

package/dist/core/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/core/config/loader.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa/C;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAID,wBAAgB,UAAU,IAAI,WAAW,CAqCxC"}

package/dist/core/config/loader.js

@@ -0,0 +1,61 @@
+import { readFileSync, existsSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { parse as parseYaml } from "yaml";
+import { ToriiConfigSchema } from "./schema.js";
+// ── Path resolution ────────────────────────────────────────────────────────
+function getConfigPath() {
+    if (process.env.TORII_CONFIG) {
+        return resolve(process.env.TORII_CONFIG);
+    }
+    return join(homedir(), ".torii", "config.yaml");
+}
+// ── Env var interpolation ──────────────────────────────────────────────────
+/**
+ * Resolves ${VAR_NAME} references in env values against process.env.
+ * Unknown variables are replaced with an empty string and a warning is logged.
+ */
+export function resolveEnv(env) {
+    return Object.fromEntries(Object.entries(env).map(([key, value]) => {
+        const resolved = value.replace(/\$\{([^}]+)\}/g, (_, name) => {
+            const envValue = process.env[name];
+            if (envValue === undefined) {
+                process.stderr.write(`[torii] warn: env var ${name} referenced in config but not set in environment\n`);
+                return "";
+            }
+            return envValue;
+        });
+        return [key, resolved];
+    }));
+}
+// ── Loader ─────────────────────────────────────────────────────────────────
+export function loadConfig() {
+    const configPath = getConfigPath();
+    if (!existsSync(configPath)) {
+        throw new Error(`Config file not found: ${configPath}\n` +
+            `Create it or set TORII_CONFIG=/path/to/your/config.yaml`);
+    }
+    let raw;
+    try {
+        raw = readFileSync(configPath, "utf-8");
+    }
+    catch (err) {
+        throw new Error(`Failed to read config file at ${configPath}: ${err.message}`);
+    }
+    let data;
+    try {
+        data = parseYaml(raw);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse YAML in ${configPath}: ${err.message}`);
+    }
+    const result = ToriiConfigSchema.safeParse(data);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`Invalid config at ${configPath}:\n${issues}`);
+    }
+    return result.data;
+}
+//# sourceMappingURL=loader.js.map

package/dist/core/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/core/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,8EAA8E;AAE9E,SAAS,aAAa;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,GAA2B;IAE3B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,IAAI,oDAAoD,CAClF,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,IAAI;YACtC,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,iCAAiC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2BAA2B,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,MAAM,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}