mcp-google-multi 6.0.0-alpha.27 → 6.0.0-alpha.28

package/dist/executor.js

@@ -2,6 +2,7 @@ import { getClient } from './client.js';
 import { expandPath, isGoogleApiUrl } from './discovery-client.js';
 import { handleGoogleApiError } from './tools/_errors.js';
 import { scopeHintForMethod } from './scope-observability.js';
+import { checkOutboundForMethod } from './outbound-allowlist.js';
 export const MAX_RESPONSE_CHARS = 100_000;
 export function jsonResult(payload, isError = false) {
     const base = { content: [{ type: 'text', text: JSON.stringify(payload) }] };
@@ -29,6 +30,11 @@ export function resolveRequestBody(httpMethod, body) {
     return body ?? undefined;
 }
 export async function executeApiMethod(method, args, deps = {}) {
+    // Outbound allowlist: no-op when off; with it active, structured bodies are
+    // inspected for recipient fields and raw-compose methods are refused.
+    const outbound = checkOutboundForMethod(method.id, args.body, args.account);
+    if (outbound)
+        return outbound;
     if (args.queryParams?.alt === 'media') {
         return jsonResult({
             error: 'binary_unsupported',

package/dist/outbound-allowlist.d.ts

@@ -0,0 +1,34 @@
+export interface OutboundAllowlist {
+    entries: string[];
+    allows(email: string): boolean;
+}
+/** Parse GOOGLE_OUTBOUND_ALLOWLIST: comma-separated addresses and @domain
+ * suffixes ("a@b.com, @company.com"). null = feature off (nothing gated). */
+export declare function resolveOutboundAllowlist(env?: NodeJS.ProcessEnv): OutboundAllowlist | null;
+/** The addresses in `emails` the active allowlist rejects; [] when off. */
+export declare function outboundViolations(emails: string[], env?: NodeJS.ProcessEnv): string[];
+/** The standard error envelope for a blocked outbound target. */
+export declare function outboundDeniedEnvelope(kind: string, blocked: string[], account: string, env?: NodeJS.ProcessEnv): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
+/** Convenience: envelope when violations exist, else null. */
+export declare function checkOutbound(kind: string, emails: string[], account: string, env?: NodeJS.ProcessEnv): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+} | null;
+export declare function collectBodyRecipients(body: unknown): string[];
+/** Gate one escape-hatch/generated dispatch; envelope when blocked, else null. */
+export declare function checkOutboundForMethod(methodId: string, body: unknown, account: string, env?: NodeJS.ProcessEnv): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+} | null;

package/dist/outbound-allowlist.js

@@ -0,0 +1,108 @@
+// Opt-in outbound recipient allowlist for unattended deployments: a
+// prompt-injection blast-radius control (a hijacked agent cannot mail, invite
+// or share outside the operator's list), a safety feature first and an
+// enterprise checkbox second. FREE-core forever (ee-definition-v0 handoff).
+// Off by default: an unset/empty GOOGLE_OUTBOUND_ALLOWLIST gates nothing.
+/** Parse GOOGLE_OUTBOUND_ALLOWLIST: comma-separated addresses and @domain
+ * suffixes ("a@b.com, @company.com"). null = feature off (nothing gated). */
+export function resolveOutboundAllowlist(env = process.env) {
+    const raw = env.GOOGLE_OUTBOUND_ALLOWLIST;
+    if (raw === undefined || raw.trim() === '')
+        return null;
+    const entries = raw.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+    if (entries.length === 0)
+        return null;
+    const exact = new Set(entries.filter((e) => !e.startsWith('@')));
+    const domains = entries.filter((e) => e.startsWith('@'));
+    return {
+        entries,
+        allows(email) {
+            const a = email.trim().toLowerCase();
+            if (exact.has(a))
+                return true;
+            return domains.some((d) => a.endsWith(d));
+        },
+    };
+}
+/** The addresses in `emails` the active allowlist rejects; [] when off. */
+export function outboundViolations(emails, env = process.env) {
+    const list = resolveOutboundAllowlist(env);
+    if (!list)
+        return [];
+    return emails.map((e) => e.trim()).filter(Boolean).filter((e) => !list.allows(e));
+}
+/** The standard error envelope for a blocked outbound target. */
+export function outboundDeniedEnvelope(kind, blocked, account, env = process.env) {
+    const list = resolveOutboundAllowlist(env);
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({
+                    error: 'recipient_not_allowed',
+                    message: `${kind} blocked by the outbound allowlist: ${blocked.join(', ')}.`,
+                    hint: `GOOGLE_OUTBOUND_ALLOWLIST is active (${(list?.entries ?? []).join(', ')}). ` +
+                        'The operator must add the address (or its @domain) to the list, or unset the variable, to allow this target.',
+                    retriable: false,
+                    account,
+                }),
+            },
+        ],
+        isError: true,
+    };
+}
+/** Convenience: envelope when violations exist, else null. */
+export function checkOutbound(kind, emails, account, env = process.env) {
+    const blocked = outboundViolations(emails, env);
+    return blocked.length > 0 ? outboundDeniedEnvelope(kind, blocked, account, env) : null;
+}
+// Escape-hatch / generated-tool enforcement. Structured bodies are inspected
+// for the known recipient fields; RAW compose methods cannot be inspected
+// (base64 RFC 822), so with the allowlist active they are refused outright in
+// favor of the curated tools that enforce it.
+const RAW_SEND_METHODS = new Set(['gmail.users.messages.send', 'gmail.users.drafts.send', 'gmail.users.drafts.create', 'gmail.users.messages.insert', 'gmail.users.messages.import']);
+export function collectBodyRecipients(body) {
+    const out = [];
+    const walk = (v, depth) => {
+        if (!v || typeof v !== 'object' || depth > 4)
+            return;
+        if (Array.isArray(v)) {
+            for (const x of v)
+                walk(x, depth + 1);
+            return;
+        }
+        for (const [k, x] of Object.entries(v)) {
+            if ((k === 'emailAddress' || k === 'email') && typeof x === 'string' && x.includes('@'))
+                out.push(x);
+            else if (k === 'attendees' || k === 'permissions')
+                walk(x, depth + 1);
+            else if (typeof x === 'object')
+                walk(x, depth + 1);
+        }
+    };
+    walk(body, 0);
+    return out;
+}
+/** Gate one escape-hatch/generated dispatch; envelope when blocked, else null. */
+export function checkOutboundForMethod(methodId, body, account, env = process.env) {
+    if (!resolveOutboundAllowlist(env))
+        return null;
+    if (RAW_SEND_METHODS.has(methodId)) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: 'recipient_not_allowed',
+                        message: `${methodId} carries an uninspectable raw message while GOOGLE_OUTBOUND_ALLOWLIST is active.`,
+                        hint: 'Use gmail_send / gmail_create_draft, which enforce the allowlist on parsed recipients.',
+                        retriable: false,
+                        account,
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
+    return checkOutbound(`${methodId} recipient`, collectBodyRecipients(body), account, env);
+}

package/dist/tools/calendar.js

@@ -3,6 +3,7 @@ import { coerceArray, coerceBoolean } from './_coerce.js';
 import { calendar as calendarClient } from '@googleapis/calendar';
 import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
+import { checkOutbound } from '../outbound-allowlist.js';
 import { handleGoogleApiError } from './_errors.js';
 import { sliceClean } from '../trim.js';
 const accountEnum = accountAliasSchema.optional();
@@ -118,6 +119,11 @@ export function registerCalendarTools(server) {
         },
     }, async ({ account, summary, start, end, description, location, attendees, calendarId, allDay }) => {
         try {
+            if (attendees) {
+                const outbound = checkOutbound('calendar attendee', attendees.split(','), String(account));
+                if (outbound)
+                    return outbound;
+            }
             const auth = await getClient(account);
             const cal = calendarClient({ version: 'v3', auth });
             const event = { summary };
@@ -168,6 +174,11 @@ export function registerCalendarTools(server) {
         },
     }, async ({ account, eventId, summary, start, end, description, location, attendees, calendarId }) => {
         try {
+            if (attendees) {
+                const outbound = checkOutbound('calendar attendee', attendees.split(','), String(account));
+                if (outbound)
+                    return outbound;
+            }
             const auth = await getClient(account);
             const cal = calendarClient({ version: 'v3', auth });
             // Fetch the event first so a 404 surfaces before we attempt the patch.

package/dist/tools/drive.js

@@ -5,6 +5,7 @@ import { accountAliasSchema, getAccountSet } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
 import { openLocalReadStream, prepareLocalDest } from './_local-files.js';
+import { checkOutbound, outboundDeniedEnvelope, resolveOutboundAllowlist } from '../outbound-allowlist.js';
 import { isAllowed, writeDisabledResult } from '../write-control.js';
 import { capText } from '../trim.js';
 import * as fs from 'fs';
@@ -628,6 +629,25 @@ export function registerDriveTools(server) {
             expirationTime: z.string().optional().describe('RFC 3339 timestamp when access expires. Only valid for role="reader" or "commenter".'),
         },
     }, async ({ account, fileId, type, role, emailAddress, domain, sendNotification, emailMessage, transferOwnership, expirationTime }) => {
+        {
+            // Outbound allowlist (off unless GOOGLE_OUTBOUND_ALLOWLIST is set):
+            // user/group grantees must match; a domain share needs its exact
+            // "@domain" entry; "anyone" (link sharing) is refused while active.
+            const list = resolveOutboundAllowlist();
+            if (list) {
+                if ((type === 'user' || type === 'group') && emailAddress) {
+                    const outbound = checkOutbound('drive_share grantee', [emailAddress], String(account));
+                    if (outbound)
+                        return outbound;
+                }
+                else if (type === 'domain' && domain && !list.entries.includes(`@${domain.trim().toLowerCase()}`)) {
+                    return outboundDeniedEnvelope('drive_share domain grantee', [`@${domain}`], String(account));
+                }
+                else if (type === 'anyone') {
+                    return outboundDeniedEnvelope('drive_share grantee', ['anyone (link sharing)'], String(account));
+                }
+            }
+        }
         try {
             const auth = await getClient(account);
             const drive = driveClient({ version: 'v3', auth });

package/dist/tools/gmail.js

@@ -6,6 +6,7 @@ import { getClient } from '../client.js';
 import { handleGoogleApiError, mapGoogleError } from './_errors.js';
 import { buildReplyHeaders, composeRaw, renderMarkdown, htmlToMarkdown, HeaderInjectionError } from './gmail-mime.js';
 import { prepareLocalDest } from './_local-files.js';
+import { checkOutbound } from '../outbound-allowlist.js';
 import addressparser from 'nodemailer/lib/addressparser/index.js';
 import { lookup as lookupMime } from 'mime-types';
 import { configDir } from '../config-file.js';
@@ -643,6 +644,10 @@ export function registerGmailTools(server) {
             if (finalSubject === undefined) {
                 throw new GmailComposeError('E_MISSING_SUBJECT', '`subject` is required (or set replyToMessageId to derive it from the source).');
             }
+            // After derivation so reply-autofilled recipients are gated too.
+            const outbound = checkOutbound('gmail recipient', [...parseAddresses(finalTo), ...parseAddresses(finalCc ?? '')].map((a) => a.address), account);
+            if (outbound)
+                return outbound;
             const html = renderMarkdown(body, allowRawHtml === true);
             const files = await readAttachments(attachments, Buffer.byteLength(body ?? '') + Buffer.byteLength(html));
             const encoded = await composeRaw({
@@ -752,6 +757,10 @@ export function registerGmailTools(server) {
             if (finalSubject === undefined) {
                 throw new GmailComposeError('E_MISSING_SUBJECT', '`subject` is required (or set replyToMessageId to derive it from the source).');
             }
+            // After derivation so reply-autofilled recipients are gated too.
+            const outbound = checkOutbound('gmail recipient', [...parseAddresses(finalTo), ...parseAddresses(finalCc ?? '')].map((a) => a.address), account);
+            if (outbound)
+                return outbound;
             const html = renderMarkdown(body, allowRawHtml === true);
             const files = await readAttachments(attachments, Buffer.byteLength(body ?? '') + Buffer.byteLength(html));
             const encoded = await composeRaw({

package/dist/usage-metrics.js

@@ -38,7 +38,7 @@ export const KNOWN_ERROR_SLUGS = new Set([
     'insufficient_scope', 'internal', 'invalid_client', 'invalid_client_metadata',
     'invalid_grant', 'invalid_params', 'invalid_query', 'invalid_request',
     'invalid_scope', 'network_error', 'not_found', 'rate_limited',
-    'reauth_required', 'too_large', 'toolset_disabled', 'unknown_api',
+    'reauth_required', 'recipient_not_allowed', 'too_large', 'toolset_disabled', 'unknown_api',
     'unknown_method', 'unsupported_grant_type', 'unsupported_type',
     'untrusted_host', 'upstream_error', 'validation_error', 'write_disabled',
 ]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.27",
+  "version": "6.0.0-alpha.28",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",