kritya 0.8.11-beta → 0.8.12-beta

package/dist/mcp/client.js

@@ -7,6 +7,13 @@ import { McpAuthRequiredError } from "./oauth.js";
 import { missingVars } from "./servers.js";
 import { HttpTransport, StdioTransport } from "./transport.js";
 import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+import { checkToolsShape, serverFingerprint } from "../trust/mcpTrust.js";
+/**
+ * Thrown when a server's live tool shape no longer matches what was recorded
+ * the first time its config was trusted — see checkToolsShape.
+ */
+class McpShapeChangedError extends Error {
+}
 /**
  * Model Context Protocol client with two transports and no SDK dependency
  * (to keep the install lean):
@@ -716,6 +723,9 @@ export async function connectServer(name, cfg, trace) {
         });
         const listed = await conn.initialize();
         const specs = listed.tools;
+        const shape = checkToolsShape(serverFingerprint(cfg), specs, trace?.mcpTrustFile);
+        if (!shape.ok)
+            throw new McpShapeChangedError(name);
         connections.push(conn);
         // Reconnects re-derive names from scratch; releasing the old claims first
         // keeps a server from colliding with its own previous incarnation.
@@ -747,6 +757,19 @@ export async function connectServer(name, cfg, trace) {
             span.setAttribute("kritya.mcp_needs_auth", true);
             span.setStatus("OK");
         }
+        else if (err instanceof McpShapeChangedError) {
+            status.shapeChanged = true;
+            status.error =
+                `its tools no longer match what you approved — run "/mcp trust revoke ${name}" ` +
+                    `and restart kritya to review and re-approve it`;
+            span.setAttribute("kritya.mcp_shape_changed", true);
+            span.setStatus("ERROR", "tool shape changed");
+            trace?.audit?.logTool({
+                tool: "mcp_connect",
+                summary: `server "${name}" tool shape changed since approval`,
+                outcome: "error",
+            });
+        }
         else {
             status.error = err instanceof Error ? err.message : String(err);
             process.stderr.write(`kritya: MCP server "${name}" failed to start: ${status.error}\n`);

package/dist/trust/mcpTrust.js

@@ -41,6 +41,17 @@ export function serverFingerprint(cfg) {
     };
     return crypto.createHash("sha256").update(JSON.stringify(shape)).digest("hex");
 }
+/** Stable identity for a server's live tool list — what it actually does, not where it runs. */
+export function toolsShapeHash(tools) {
+    const shape = tools
+        .map((t) => ({
+        name: t.name,
+        description: t.description ?? "",
+        inputSchema: t.inputSchema ?? null,
+    }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+    return crypto.createHash("sha256").update(JSON.stringify(shape)).digest("hex");
+}
 function loadStore(storeFile) {
     try {
         const parsed = JSON.parse(fs.readFileSync(storeFile, "utf8"));
@@ -109,3 +120,29 @@ export function partitionByTrust(servers, storeFile = MCP_TRUST_FILE) {
     }
     return { trusted, pending };
 }
+/**
+ * Approving a server's *config* (command, url, env keys, ...) only promises
+ * the user reviewed where it runs and what it can reach — not what tools it
+ * actually exposes to the model, which a compromised or malicious server can
+ * change on any connection without touching its declared config at all. This
+ * compares a freshly-connected server's live tool shape (names, descriptions,
+ * input schemas) against what was recorded the first time its config was
+ * trusted.
+ *
+ * There is nothing to compare on that first connection (or after upgrading
+ * from a version that didn't record this), so it's recorded rather than
+ * flagged — otherwise every existing approval would start failing the moment
+ * this check shipped.
+ */
+export function checkToolsShape(fingerprint, tools, storeFile = MCP_TRUST_FILE) {
+    const entries = loadStore(storeFile);
+    const entry = entries.find((e) => e.fingerprint === fingerprint);
+    if (!entry)
+        return { ok: true, recorded: false };
+    const hash = toolsShapeHash(tools);
+    if (!entry.toolsHash) {
+        saveStore(storeFile, entries.map((e) => (e === entry ? { ...e, toolsHash: hash } : e)));
+        return { ok: true, recorded: true };
+    }
+    return { ok: entry.toolsHash === hash, recorded: false };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.11-beta",
+  "version": "0.8.12-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "publishConfig": {