mcp-for-i 0.1.8 → 0.1.10

package/README.md

@@ -156,3 +156,4 @@ npm run release:patch -- --no-push
 - Main repo: [ashishthomas2202/mcp-for-i](https://github.com/ashishthomas2202/mcp-for-i)
 - Skills repo: [ashishthomas2202/mcp-for-i-skills](https://github.com/ashishthomas2202/mcp-for-i-skills)
 - Docs: `docs/`
+- Full capability guide: `docs/capabilities.md`

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import crypto from "crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
@@ -6,7 +7,8 @@ import { getTools, handleTool } from "./mcp/tools.js";
 import { McpContext } from "./mcp/context.js";
 import { log } from "./mcp/logger.js";
 import { validateToolInput } from "./mcp/validation.js";
-const server = new Server({ name: "mcp-for-i", version: "0.1.7" }, { capabilities: { tools: {} } });
+import { appendAuditRecord } from "./mcp/audit.js";
+const server = new Server({ name: "mcp-for-i", version: "0.1.8" }, { capabilities: { tools: {} } });
 const ctx = new McpContext();
 const tools = getTools();
 const toolMap = new Map(tools.map(tool => [tool.name, tool]));
@@ -15,6 +17,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
+    const correlationId = crypto.randomUUID();
+    const startedAt = Date.now();
     try {
         const toolDef = toolMap.get(name);
         if (!toolDef)
@@ -23,16 +27,40 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         if (errors.length > 0) {
             throw new Error(`Invalid arguments: ${errors.join("; ")}`);
         }
-        log("info", "tool.call", { name, args: redactSensitive(args || {}) });
+        const redactedArgs = redactSensitive(args || {});
+        log("info", "tool.call", { name, correlationId, args: redactedArgs });
         const result = await handleTool(ctx, name, args || {});
-        log("debug", "tool.result", { name });
+        const durationMs = Date.now() - startedAt;
+        log("debug", "tool.result", { name, correlationId, durationMs });
+        await safeAppendAudit({
+            tool: name,
+            status: "ok",
+            args: redactedArgs,
+            connectionName: resolveConnectionName(name, args || {}, ctx.activeName),
+            approve: Boolean(args && typeof args === "object" && args.approve),
+            durationMs,
+            correlationId,
+            resultSummary: summarizeResult(result)
+        });
         return result;
     }
     catch (err) {
-        log("error", "tool.error", { name, error: err?.message || String(err) });
+        const durationMs = Date.now() - startedAt;
+        const errorMessage = err?.message || String(err);
+        log("error", "tool.error", { name, correlationId, durationMs, error: errorMessage });
+        await safeAppendAudit({
+            tool: name,
+            status: "error",
+            args: redactSensitive(args || {}),
+            connectionName: resolveConnectionName(name, args || {}, ctx.activeName),
+            approve: Boolean(args && typeof args === "object" && args.approve),
+            durationMs,
+            correlationId,
+            error: errorMessage
+        });
         return {
             isError: true,
-            content: [{ type: "text", text: err?.message || String(err) }]
+            content: [{ type: "text", text: errorMessage }]
         };
     }
 });
@@ -57,3 +85,28 @@ function redactSensitive(input) {
     }
     return input;
 }
+function summarizeResult(result) {
+    const contentCount = Array.isArray(result?.content) ? result.content.length : 0;
+    return {
+        isError: Boolean(result?.isError),
+        contentCount,
+        hasStructuredContent: typeof result?.structuredContent !== "undefined"
+    };
+}
+function resolveConnectionName(tool, args, activeName) {
+    if (args?.connectionName)
+        return String(args.connectionName);
+    if (tool === "ibmi.connect" && args?.name)
+        return String(args.name);
+    return activeName;
+}
+async function safeAppendAudit(input) {
+    if (process.env.MCP_FOR_I_AUDIT_ENABLED === "0")
+        return;
+    try {
+        await appendAuditRecord(input);
+    }
+    catch (err) {
+        log("warn", "audit.append.failed", { error: err?.message || String(err) });
+    }
+}

package/dist/mcp/audit.js

@@ -0,0 +1,339 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+import { getConfigDir } from "../config/store.js";
+let appendQueue = Promise.resolve();
+export async function appendAuditRecord(input) {
+    const paths = resolveAuditPaths();
+    await fs.mkdir(paths.dir, { recursive: true });
+    let created;
+    appendQueue = appendQueue.then(async () => {
+        const prevHash = await readHeadHash(paths.headPath);
+        const nowIso = new Date().toISOString();
+        const redactedArgs = redactSensitive(input.args);
+        const argsHash = sha256Hex(stableStringify(redactedArgs));
+        const base = {
+            version: 1,
+            id: crypto.randomUUID(),
+            at: nowIso,
+            tool: input.tool,
+            status: input.status,
+            connectionName: input.connectionName,
+            approve: input.approve,
+            durationMs: input.durationMs,
+            correlationId: input.correlationId,
+            argsHash,
+            args: redactedArgs,
+            error: input.error,
+            resultSummary: input.resultSummary,
+            prevHash
+        };
+        const hash = sha256Hex(`${prevHash}|${stableStringify(base)}`);
+        const record = { ...base, hash };
+        await fs.appendFile(paths.logPath, `${JSON.stringify(record)}\n`, "utf8");
+        await fs.writeFile(paths.headPath, hash, "utf8");
+        created = record;
+    });
+    await appendQueue;
+    return created;
+}
+export async function listAuditRecords(filter = {}) {
+    const paths = resolveAuditPaths();
+    const limit = clampNumber(filter.limit, 200, 1, 5000);
+    const entries = await readAuditRecords(paths.logPath);
+    const sinceMs = filter.since ? Date.parse(filter.since) : Number.NaN;
+    const hasSince = Number.isFinite(sinceMs);
+    const filtered = entries.filter(entry => {
+        if (filter.tool && entry.tool !== filter.tool)
+            return false;
+        if (filter.status && entry.status !== filter.status)
+            return false;
+        if (filter.connectionName && (entry.connectionName || "") !== filter.connectionName)
+            return false;
+        if (filter.correlationId && entry.correlationId !== filter.correlationId)
+            return false;
+        if (hasSince && Date.parse(entry.at) < sinceMs)
+            return false;
+        return true;
+    });
+    const newestFirst = filtered.reverse().slice(0, limit);
+    return {
+        records: newestFirst,
+        total: filtered.length,
+        limit
+    };
+}
+export async function verifyAuditChain() {
+    const paths = resolveAuditPaths();
+    const records = await readAuditRecords(paths.logPath);
+    let previous = "";
+    let failures = 0;
+    const failureDetails = [];
+    for (const record of records) {
+        if (record.prevHash !== previous) {
+            failures += 1;
+            failureDetails.push({ id: record.id, reason: "prevHash mismatch" });
+            previous = record.hash;
+            continue;
+        }
+        const base = {
+            version: record.version,
+            id: record.id,
+            at: record.at,
+            tool: record.tool,
+            status: record.status,
+            connectionName: record.connectionName,
+            approve: record.approve,
+            durationMs: record.durationMs,
+            correlationId: record.correlationId,
+            argsHash: record.argsHash,
+            args: record.args,
+            error: record.error,
+            resultSummary: record.resultSummary,
+            prevHash: record.prevHash
+        };
+        const expected = sha256Hex(`${record.prevHash}|${stableStringify(base)}`);
+        if (expected !== record.hash) {
+            failures += 1;
+            failureDetails.push({ id: record.id, reason: "hash mismatch" });
+        }
+        previous = record.hash;
+    }
+    const headHash = await readHeadHash(paths.headPath);
+    const headMatches = records.length === 0 ? headHash === "" : headHash === records[records.length - 1].hash;
+    if (!headMatches) {
+        failures += 1;
+        failureDetails.push({ id: "HEAD", reason: "head hash mismatch" });
+    }
+    return {
+        ok: failures === 0,
+        records: records.length,
+        failures,
+        details: failureDetails.slice(0, 50),
+        headHash
+    };
+}
+export async function exportAuditRecords(options) {
+    const paths = resolveAuditPaths();
+    const format = normalizeExportFormat(options.format);
+    const outputPath = path.resolve(String(options.outputPath));
+    const filter = options.filter || {};
+    const listing = await listAuditRecords({
+        ...filter,
+        limit: filter.limit ?? 5000
+    });
+    const records = [...listing.records].reverse();
+    await fs.mkdir(path.dirname(outputPath), { recursive: true });
+    if (format === "json") {
+        await fs.writeFile(outputPath, JSON.stringify(records, null, 2), "utf8");
+    }
+    else if (format === "csv") {
+        const header = [
+            "id",
+            "at",
+            "tool",
+            "status",
+            "connectionName",
+            "approve",
+            "durationMs",
+            "correlationId",
+            "argsHash",
+            "prevHash",
+            "hash",
+            "error"
+        ];
+        const lines = [header.join(",")];
+        for (const row of records) {
+            const values = [
+                row.id,
+                row.at,
+                row.tool,
+                row.status,
+                row.connectionName || "",
+                String(Boolean(row.approve)),
+                String(row.durationMs),
+                row.correlationId,
+                row.argsHash,
+                row.prevHash,
+                row.hash,
+                row.error || ""
+            ];
+            lines.push(values.map(csvEscape).join(","));
+        }
+        await fs.writeFile(outputPath, `${lines.join("\n")}\n`, "utf8");
+    }
+    else {
+        const payload = records.map(row => JSON.stringify(row)).join("\n");
+        await fs.writeFile(outputPath, payload.length > 0 ? `${payload}\n` : "", "utf8");
+    }
+    return {
+        ok: true,
+        outputPath,
+        format,
+        exported: records.length,
+        sourcePath: paths.logPath
+    };
+}
+export async function purgeAuditRecords(options) {
+    const beforeIso = String(options.before || "").trim();
+    const cutoff = Date.parse(beforeIso);
+    if (!Number.isFinite(cutoff)) {
+        throw new Error(`Invalid before timestamp: ${options.before}`);
+    }
+    const paths = resolveAuditPaths();
+    await fs.mkdir(paths.dir, { recursive: true });
+    const records = await readAuditRecords(paths.logPath);
+    const keep = records.filter(record => Date.parse(record.at) >= cutoff);
+    const purgeCount = records.length - keep.length;
+    const dryRun = Boolean(options.dryRun);
+    if (dryRun || purgeCount === 0) {
+        return {
+            ok: true,
+            dryRun,
+            before: new Date(cutoff).toISOString(),
+            total: records.length,
+            purged: purgeCount,
+            remaining: keep.length
+        };
+    }
+    await queueWrite(async () => {
+        const rebuilt = rebuildAuditChain(keep);
+        const payload = rebuilt.map(row => JSON.stringify(row)).join("\n");
+        await fs.writeFile(paths.logPath, payload.length > 0 ? `${payload}\n` : "", "utf8");
+        const headHash = rebuilt.length > 0 ? rebuilt[rebuilt.length - 1].hash : "";
+        await fs.writeFile(paths.headPath, headHash, "utf8");
+    });
+    return {
+        ok: true,
+        dryRun: false,
+        before: new Date(cutoff).toISOString(),
+        total: records.length,
+        purged: purgeCount,
+        remaining: keep.length
+    };
+}
+function resolveAuditPaths() {
+    const explicit = process.env.MCP_FOR_I_AUDIT_LOG_PATH;
+    const logPath = explicit && explicit.trim().length > 0
+        ? path.resolve(explicit)
+        : path.join(getConfigDir(), "audit", "tool-audit.jsonl");
+    const dir = path.dirname(logPath);
+    return {
+        dir,
+        logPath,
+        headPath: path.join(dir, "tool-audit.head")
+    };
+}
+async function readAuditRecords(logPath) {
+    try {
+        const raw = await fs.readFile(logPath, "utf8");
+        return raw
+            .split(/\r?\n/)
+            .map(line => line.trim())
+            .filter(Boolean)
+            .map(line => JSON.parse(line));
+    }
+    catch {
+        return [];
+    }
+}
+async function readHeadHash(headPath) {
+    try {
+        const raw = await fs.readFile(headPath, "utf8");
+        return raw.trim();
+    }
+    catch {
+        return "";
+    }
+}
+async function queueWrite(work) {
+    appendQueue = appendQueue.then(async () => {
+        await work();
+    });
+    await appendQueue;
+}
+function rebuildAuditChain(records) {
+    let previous = "";
+    const rebuilt = [];
+    for (const record of records) {
+        const base = {
+            version: record.version,
+            id: record.id,
+            at: record.at,
+            tool: record.tool,
+            status: record.status,
+            connectionName: record.connectionName,
+            approve: record.approve,
+            durationMs: record.durationMs,
+            correlationId: record.correlationId,
+            argsHash: record.argsHash,
+            args: record.args,
+            error: record.error,
+            resultSummary: record.resultSummary,
+            prevHash: previous
+        };
+        const hash = sha256Hex(`${previous}|${stableStringify(base)}`);
+        const next = { ...base, hash };
+        rebuilt.push(next);
+        previous = hash;
+    }
+    return rebuilt;
+}
+function normalizeExportFormat(format) {
+    const normalized = String(format || "jsonl").trim().toLowerCase();
+    if (normalized === "json" || normalized === "csv" || normalized === "jsonl") {
+        return normalized;
+    }
+    throw new Error(`Unsupported export format: ${format}`);
+}
+function csvEscape(value) {
+    if (value.includes(",") || value.includes("\"") || value.includes("\n")) {
+        return `"${value.replace(/"/g, "\"\"")}"`;
+    }
+    return value;
+}
+function clampNumber(value, fallback, min, max) {
+    const n = Number(value);
+    if (!Number.isFinite(n))
+        return fallback;
+    if (n < min)
+        return min;
+    if (n > max)
+        return max;
+    return Math.floor(n);
+}
+function sha256Hex(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}
+function stableStringify(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(v => stableStringify(v)).join(",")}]`;
+    const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
+    const props = entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
+    return `{${props.join(",")}}`;
+}
+function redactSensitive(input) {
+    const secrets = ["password", "passphrase", "secret", "token", "apikey", "apiKey", "authorization"];
+    if (Array.isArray(input)) {
+        return input.map(redactSensitive);
+    }
+    if (typeof input === "object" && input !== null) {
+        const out = {};
+        for (const [key, value] of Object.entries(input)) {
+            const lower = key.toLowerCase();
+            if (secrets.some(secret => lower.includes(secret.toLowerCase()))) {
+                out[key] = "***REDACTED***";
+            }
+            else {
+                out[key] = redactSensitive(value);
+            }
+        }
+        return out;
+    }
+    if (typeof input === "string" && input.length > 1000) {
+        return `${input.substring(0, 1000)}...(truncated)`;
+    }
+    return input;
+}