mcp-gov 1.3.2 → 2.0.0

package/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 All notable changes to mcp-gov will be documented in this file.
 
+## [2.0.0] - 2026-05-24
+
+Security-hardening release. Two changes are **breaking** — see Migration.
+
+### ⚠️ Breaking changes / Migration
+- **Audit log is now line-delimited JSON**, not pipe-delimited text. Anything
+  that parsed `[AUDIT] … | tool=… | …` must switch to reading one JSON object
+  per line: `{"type":"AUDIT","timestamp","status","tool","service","operation","project"}`.
+- **New installs are fail-closed.** Rules files generated by `mcp-gov-wrap` from
+  this version include `"defaultPolicy": "deny"` plus a complete per-service rule
+  set, so an operation matched by no rule is denied. Existing rules files are
+  **not** modified and keep the previous permissive (`allow`) default until you
+  add `"defaultPolicy": "deny"` yourself. To get the new posture on an existing
+  install, re-run `mcp-gov-wrap` against a fresh rules file or set the field.
+
+### Security
+- **Audit log injection fixed.** Audit records are now emitted as one JSON
+  object per line. JSON encoding escapes newlines, quotes and control
+  characters in client-controlled tool/service names, so a crafted name can no
+  longer forge a second `[AUDIT]` line or inject delimiter-shaped fields.
+- **Opt-in fail-closed policy.** Rules files now support a top-level
+  `"defaultPolicy"` of `"allow"` (default, backward compatible) or `"deny"`.
+  When `deny`, any operation not matched by an explicit rule is blocked instead
+  of allowed. `mcp-gov-wrap` now writes `"defaultPolicy": "deny"` into
+  newly-generated rules files and emits a complete rule set
+  (allow read/write, deny delete/execute/admin) for every service, so normal
+  traffic is unaffected. **Existing rules files are left unchanged** (they keep
+  the permissive default); add `"defaultPolicy": "deny"` to opt in.
+- **Dependency surface reduced.** `axios` and `dotenv` (used only by the
+  bundled example, not by the CLI or library) moved from `dependencies` to
+  `devDependencies`, removing their known advisories from the consumer-facing
+  install tree.
+- **Backup permissions tightened.** Config backups (which may contain secrets
+  copied from MCP configs) are now created with `0600` permissions, and
+  `*.backup-*` is gitignored.
+
+### Changed
+- **Audit log is now line-delimited JSON** instead of the previous
+  pipe-delimited text (`[AUDIT] … | tool=… | …`). Each line is a JSON object
+  `{"type":"AUDIT","timestamp","status","tool","service","operation","project"}`.
+  **Breaking for anything that parsed the old text format.**
+- **Unified rule loading.** Array (`rules: [...]`), legacy object
+  (`services: {...}`), and nested-map (`{ svc: { op } }`) rule shapes are now
+  normalized through one shared loader (`src/rules.js`) used by both the proxy
+  and `GovernedMCPServer`, removing duplicated per-format logic. All existing
+  shapes continue to work unchanged.
+- `GovernedMCPServer` now reads `defaultPolicy` from the rules object (the
+  documented location), falling back to the constructor config — previously it
+  only checked config, so a documented `defaultPolicy` was silently ignored.
+
+### Fixed
+- **Argument boundaries preserved when wrapping.** The proxy now receives the
+  target server's argv as a structured `--target-args` JSON array, so arguments
+  containing spaces (e.g. paths like `/Users/My Documents`) are no longer
+  re-split. The legacy whitespace-split of `--target` remains as a fallback for
+  configs wrapped by older versions.
+- Leading `~`/`~/` in the interactive CLI's path prompt is expanded correctly
+  (a `~` elsewhere in the path is left untouched).
+
+### Removed
+- Dead, unreachable `wrapServers`/`unwrapServers` helpers and their incorrect
+  `'claude-code'` format branch (the active code paths are unaffected).
+
+### Known issues
+- Operation classification is heuristic (substring match on the tool name) and
+  does not inspect tool arguments; a destructive tool named without a
+  destructive keyword is classified `write`. Use explicit per-service rules and
+  `"defaultPolicy": "deny"` for stronger control. Only `tools/call` is mediated.
+- `@modelcontextprotocol/sdk ^0.5.0` has known advisories; upgrading is a major
+  (1.x) change that requires migrating `src/index.js`. The CLI proxy path does
+  not depend on the SDK.
+
 ## [1.3.1] - 2026-01-24
 
 ### Changed

package/LICENSE

@@ -1,21 +1,202 @@
-MIT License
-
-Copyright (c) 2026 Amr Hassan
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -11,6 +11,11 @@
 
 # MCP Governance System
 
+<p>
+  <img src="https://img.shields.io/github/package-json/v/hamr0/mcp-gov?label=version&color=2a4f8c" alt="version (auto from package.json)">
+  <img src="https://img.shields.io/badge/license-Apache%202.0-2a4f8c" alt="license: Apache 2.0">
+</p>
+
 </div>
 
 Permission control and audit logging for Model Context Protocol (MCP) servers.
@@ -46,7 +51,7 @@ mcp-gov
 ██║╚██╔╝██║ ██║      ██╔═══╝    ██║   ██║██║   ██║╚██╗ ██╔╝
 ██║ ╚═╝ ██║ ╚██████╗ ██║        ╚██████╔╝╚██████╔╝ ╚████╔╝
 ╚═╝     ╚═╝  ╚═════╝ ╚═╝         ╚═════╝  ╚═════╝   ╚═══╝
-                                                   v1.3.0
+                                                   v2.0.0
 
 Select action:
   1) Wrap MCP servers
@@ -131,6 +136,7 @@ Rules are auto-generated at `~/.mcp-gov/rules.json`:
 
 ```json
 {
+  "defaultPolicy": "deny",
   "rules": [
     {
       "service": "github",
@@ -147,10 +153,27 @@ Rules are auto-generated at `~/.mcp-gov/rules.json`:
 }
 ```
 
+`defaultPolicy` controls what happens when no rule matches a service/operation:
+
+- `"deny"` — fail-closed: only explicitly-allowed operations pass (recommended).
+  New rules files generated by `mcp-gov-wrap` use this and include a complete
+  allow/deny rule set per service, so normal read/write traffic is unaffected.
+- `"allow"` — fail-open: anything not explicitly denied passes. This is the
+  default when `defaultPolicy` is omitted, for backward compatibility. Existing
+  rules files keep this behavior until you add `"defaultPolicy": "deny"`.
+
+Two older rule shapes are still accepted and normalized internally: the legacy
+`{ "services": { svc: { "operations": { op: "allow"|"deny" } } } }` object, and
+the library's nested map `{ svc: { op: "allow"|"deny" } }` (used by
+`GovernedMCPServer`). `defaultPolicy` may be set at the top level of any of them.
+
 ## Audit Log Format
 
-```
-[AUDIT] 2026-01-24T10:30:45.123Z | DENIED | tool=delete_repo | service=github | operation=delete | project=/home/user/myproject
+Audit records are written one JSON object per line (so tool names can't forge
+or corrupt entries). Each record:
+
+```json
+{"type":"AUDIT","timestamp":"2026-01-24T10:30:45.123Z","status":"DENIED","tool":"delete_repo","service":"github","operation":"delete","project":"/home/user/myproject"}
 ```
 
 ## CLI Commands
@@ -168,6 +191,23 @@ mcp-gov-unwrap --config ~/.claude.json
 mcp-gov-proxy --service github --target "npx server" --rules ~/.mcp-gov/rules.json
 ```
 
+## Security Model & Limitations
+
+MCP-GOV is a useful guardrail, not a complete sandbox. Know what it does and
+does not protect:
+
+- **Operation type is inferred from the tool *name*** (keyword matching), and
+  tool **arguments are not inspected**. A destructive tool whose name contains no
+  destructive keyword is classified `write`. For stronger control, write
+  explicit per-service rules and set `"defaultPolicy": "deny"`.
+- **Only `tools/call` is mediated.** Other MCP methods (`resources/*`,
+  `prompts/*`, etc.) pass through unchecked.
+- **Config backups may contain secrets** (tokens copied from your MCP config).
+  They are written with `0600` permissions and are gitignored (`*.backup-*`),
+  but you should still clean them up.
+- Treat the audit log as a record, and the rules as advisory policy — not as a
+  hard security boundary against a fully adversarial MCP server.
+
 ## License
 
-MIT
+Apache-2.0 — see [LICENSE](LICENSE).

package/bin/mcp-gov-proxy.js

@@ -12,6 +12,7 @@ import { createInterface } from 'node:readline';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { extractService, detectOperation } from '../src/operation-detector.js';
+import { normalizeRules, isAllowed } from '../src/rules.js';
 
 // Default audit log path
 const DEFAULT_AUDIT_LOG = join(homedir(), '.mcp-gov', 'audit.log');
@@ -32,6 +33,9 @@ function parseCliArgs() {
           type: 'string',
           short: 't',
         },
+        'target-args': {
+          type: 'string',
+        },
         rules: {
           type: 'string',
           short: 'r',
@@ -123,43 +127,6 @@ function loadRules(rulesPath) {
   }
 }
 
-/**
- * Check if operation is allowed based on rules
- * @param {object} rules - Loaded rules object
- * @param {string} service - Service name
- * @param {string} operation - Operation type
- * @returns {boolean} True if allowed, false if denied
- */
-function isOperationAllowed(rules, service, operation) {
-  // Support two rule formats:
-  // 1. Array format (from mcp-gov-wrap): { rules: [{service, operations[], permission}] }
-  // 2. Object format (legacy): { services: {service: {operations: {op: permission}}} }
-
-  // Try array format first (generated by mcp-gov-wrap)
-  if (rules.rules && Array.isArray(rules.rules)) {
-    for (const rule of rules.rules) {
-      if (rule.service === service && rule.operations && rule.operations.includes(operation)) {
-        return rule.permission !== 'deny';
-      }
-    }
-    // No matching rule found - default to allow
-    return true;
-  }
-
-  // Try object format (legacy)
-  if (!rules.services || !rules.services[service]) {
-    return true;
-  }
-
-  const serviceRules = rules.services[service];
-  if (!serviceRules.operations || !serviceRules.operations[operation]) {
-    return true;
-  }
-
-  const permission = serviceRules.operations[operation];
-  return permission !== 'deny';
-}
-
 /**
  * Create a JSON-RPC error response
  * @param {number|string} id - Request ID
@@ -182,17 +149,28 @@ function createErrorResponse(id, message) {
 let auditLogPath = null;
 
 /**
- * Log audit information to stderr and optionally to file
+ * Log audit information to stderr and optionally to file.
+ *
+ * Emitted as a single JSON object per line. Tool/service names originate from
+ * client-controlled JSON-RPC params; JSON encoding escapes newlines, quotes and
+ * control characters, so a crafted name cannot forge additional audit records
+ * or inject delimiter-shaped fields (closes the log-injection vector). The
+ * "type":"AUDIT" tag keeps lines greppable.
  * @param {string} toolName - Tool name
  * @param {string} service - Service name
  * @param {string} operation - Operation type
  * @param {boolean} allowed - Whether operation was allowed
  */
 function logAudit(toolName, service, operation, allowed) {
-  const timestamp = new Date().toISOString();
-  const status = allowed ? 'ALLOWED' : 'DENIED';
-  const projectPath = process.cwd();
-  const logLine = `[AUDIT] ${timestamp} | ${status} | tool=${toolName} | service=${service} | operation=${operation} | project=${projectPath}`;
+  const logLine = JSON.stringify({
+    type: 'AUDIT',
+    timestamp: new Date().toISOString(),
+    status: allowed ? 'ALLOWED' : 'DENIED',
+    tool: toolName,
+    service: service,
+    operation: operation,
+    project: process.cwd()
+  });
 
   // Always log to stderr
   console.error(logLine);
@@ -214,7 +192,7 @@ function logAudit(toolName, service, operation, allowed) {
  * @param {string} rulesPath - Path to rules.json file
  * @param {string} logPath - Path to audit log file (optional override)
  */
-function startProxy(serviceName, targetCommand, rulesPath, logPath) {
+function startProxy(serviceName, targetCommand, rulesPath, logPath, targetArgsJson) {
   // Set up audit logging - organize by service
   // Default: ~/.mcp-gov/logs/<service>.log
   if (logPath) {
@@ -231,13 +209,35 @@ function startProxy(serviceName, targetCommand, rulesPath, logPath) {
     mkdirSync(logDir, { recursive: true });
   }
 
-  // Load rules file
-  const rules = loadRules(rulesPath);
-
-  // Parse the target command (handle both "node server.js" and single commands)
-  const commandParts = targetCommand.split(/\s+/);
-  const command = commandParts[0];
-  const args = commandParts.slice(1);
+  // Load rules file and normalize to a single canonical form (handles array,
+  // legacy object, and nested-map shapes; carries defaultPolicy).
+  const normalizedRules = normalizeRules(loadRules(rulesPath));
+
+  // Determine the command and argv for the target server.
+  // Prefer the structured --target-args (a JSON array [command, ...args]) which
+  // preserves argument boundaries; fall back to whitespace-splitting --target
+  // for configs wrapped by older versions that did not emit --target-args.
+  let command;
+  let args;
+  if (targetArgsJson) {
+    let argv;
+    try {
+      argv = JSON.parse(targetArgsJson);
+    } catch (e) {
+      console.error(`Error parsing --target-args (expected JSON array): ${e.message}`);
+      process.exit(1);
+    }
+    if (!Array.isArray(argv) || argv.length === 0) {
+      console.error('Error: --target-args must be a non-empty JSON array [command, ...args]');
+      process.exit(1);
+    }
+    command = argv[0];
+    args = argv.slice(1);
+  } else {
+    const commandParts = targetCommand.split(/\s+/);
+    command = commandParts[0];
+    args = commandParts.slice(1);
+  }
 
   // Spawn the target MCP server
   const targetServer = spawn(command, args, {
@@ -285,7 +285,7 @@ function startProxy(serviceName, targetCommand, rulesPath, logPath) {
         const operation = detectOperation(toolName);
 
         // Check permissions
-        const allowed = isOperationAllowed(rules, service, operation);
+        const allowed = isAllowed(normalizedRules, service, operation);
 
         // Log audit information
         logAudit(toolName, service, operation, allowed);
@@ -356,7 +356,7 @@ function main() {
     process.exit(1);
   }
 
-  startProxy(args.service, args.target, args.rules, args.log);
+  startProxy(args.service, args.target, args.rules, args.log, args['target-args']);
 }
 
 main();

package/bin/mcp-gov-unwrap.js

@@ -6,7 +6,7 @@
  */
 
 import { parseArgs } from 'node:util';
-import { readFileSync, writeFileSync, existsSync, copyFileSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, copyFileSync, chmodSync } from 'node:fs';
 import { exec } from 'node:child_process';
 import { promisify } from 'node:util';
 
@@ -223,40 +223,15 @@ function createBackup(configPath) {
   const backupPath = `${configPath}.backup-${timestamp}`;
 
   copyFileSync(configPath, backupPath);
-
-  return backupPath;
-}
-
-/**
- * Unwrap wrapped servers in the config
- * @param {Object} config - Full config object with mcpServers
- * @param {string[]} wrappedNames - Names of servers to unwrap
- * @returns {Object} Modified config with unwrapped servers
- */
-function unwrapServers(config, wrappedNames) {
-  const modifiedConfig = JSON.parse(JSON.stringify(config.rawConfig));
-
-  // Get reference to mcpServers in the modified config
-  let mcpServers;
-  if (config.format === 'claude-code') {
-    mcpServers = modifiedConfig.projects.mcpServers;
-  } else {
-    mcpServers = modifiedConfig.mcpServers;
-  }
-
-  // Unwrap each wrapped server
-  for (const serverName of wrappedNames) {
-    const originalConfig = mcpServers[serverName];
-
-    try {
-      mcpServers[serverName] = unwrapServer(originalConfig);
-    } catch (error) {
-      console.warn(`Warning: Cannot unwrap ${serverName}: ${error.message}`);
-      // Skip this server, leave it as-is
-    }
+  // MCP configs frequently embed secrets (API tokens in `env`). Restrict the
+  // backup to owner-only so the copy does not widen exposure beyond the original.
+  try {
+    chmodSync(backupPath, 0o600);
+  } catch {
+    // Non-POSIX filesystems may not support chmod; the copy still succeeded.
   }
 
-  return modifiedConfig;
+  return backupPath;
 }
 
 /**

package/bin/mcp-gov-wrap.js

@@ -6,7 +6,7 @@
  */
 
 import { parseArgs } from 'node:util';
-import { readFileSync, writeFileSync, existsSync, copyFileSync, mkdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, copyFileSync, mkdirSync, chmodSync } from 'node:fs';
 import { exec, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { resolve, dirname, join } from 'node:path';
@@ -249,27 +249,33 @@ function detectUnwrappedServers(mcpServers) {
  * @returns {Object} Wrapped server configuration
  */
 function wrapServer(serverName, serverConfig, rulesPath) {
-  // Build target command from original config
-  let targetCommand = serverConfig.command || '';
+  const originalArgs = Array.isArray(serverConfig.args) ? serverConfig.args : [];
 
-  // Append original args if they exist
-  if (serverConfig.args && Array.isArray(serverConfig.args)) {
-    targetCommand += ' ' + serverConfig.args.join(' ');
+  // Build the human-readable target string (command + args). Kept for backward
+  // compatibility and display; the proxy uses --target-args for execution.
+  let targetCommand = serverConfig.command || '';
+  if (originalArgs.length > 0) {
+    targetCommand += ' ' + originalArgs.join(' ');
   }
-
   targetCommand = targetCommand.trim();
 
+  // Authoritative argv passed to the proxy as a JSON array: [command, ...args].
+  // This preserves argument boundaries (e.g. paths containing spaces) that the
+  // whitespace-joined --target string cannot represent.
+  const targetArgv = [serverConfig.command || '', ...originalArgs];
+
   // Create wrapped configuration
   const wrappedConfig = {
     command: 'mcp-gov-proxy',
     args: [
       '--service', serverName,
       '--target', targetCommand,
+      '--target-args', JSON.stringify(targetArgv),
       '--rules', rulesPath
     ],
     _original: {
       command: serverConfig.command,
-      args: serverConfig.args || []
+      args: originalArgs
     }
   };
 
@@ -301,35 +307,15 @@ function createBackup(configPath) {
   const backupPath = `${configPath}.backup-${timestamp}`;
 
   copyFileSync(configPath, backupPath);
-
-  return backupPath;
-}
-
-/**
- * Wrap unwrapped servers in the config
- * @param {Object} config - Full config object with mcpServers
- * @param {string[]} unwrappedNames - Names of servers to wrap
- * @param {string} rulesPath - Absolute path to rules.json
- * @returns {Object} Modified config with wrapped servers
- */
-function wrapServers(config, unwrappedNames, rulesPath) {
-  const modifiedConfig = JSON.parse(JSON.stringify(config.rawConfig));
-
-  // Get reference to mcpServers in the modified config
-  let mcpServers;
-  if (config.format === 'claude-code') {
-    mcpServers = modifiedConfig.projects.mcpServers;
-  } else {
-    mcpServers = modifiedConfig.mcpServers;
-  }
-
-  // Wrap each unwrapped server
-  for (const serverName of unwrappedNames) {
-    const originalConfig = mcpServers[serverName];
-    mcpServers[serverName] = wrapServer(serverName, originalConfig, rulesPath);
+  // MCP configs frequently embed secrets (API tokens in `env`). Restrict the
+  // backup to owner-only so the copy does not widen exposure beyond the original.
+  try {
+    chmodSync(backupPath, 0o600);
+  } catch {
+    // Non-POSIX filesystems may not support chmod; the copy still succeeded.
   }
 
-  return modifiedConfig;
+  return backupPath;
 }
 
 /**
@@ -426,45 +412,25 @@ function generateDefaultRules(serviceName, tools) {
     admin: 'deny'
   };
 
-  if (tools.length === 0) {
-    // No tools discovered, create service-level rules
-    for (const [operation, permission] of Object.entries(safeDefaults)) {
-      if (permission === 'deny') {
-        rules.push({
-          service: serviceName,
-          operations: [operation],
-          permission: permission,
-          reason: `${operation.charAt(0).toUpperCase() + operation.slice(1)} operations denied by default for safety`
-        });
-      }
-    }
-  } else {
-    // Create rules based on discovered tools
-    const toolsByOperation = { read: [], write: [], delete: [], execute: [], admin: [] };
-
-    tools.forEach(toolName => {
-      const operation = detectOperation(toolName);
-      if (toolsByOperation[operation]) {
-        toolsByOperation[operation].push(toolName);
-      }
-    });
-
-    // Create rules for each operation type that has tools
-    for (const [operation, permission] of Object.entries(safeDefaults)) {
-      if (toolsByOperation[operation].length > 0) {
-        const rule = {
-          service: serviceName,
-          operations: [operation],
-          permission: permission
-        };
-
-        if (permission === 'deny') {
-          rule.reason = `${operation.charAt(0).toUpperCase() + operation.slice(1)} operations denied by default for safety`;
-        }
+  // Always emit an explicit rule for every operation type, regardless of which
+  // tools were discovered. This keeps the generated rule set complete so a
+  // `defaultPolicy: "deny"` file never accidentally blocks ordinary read/write
+  // traffic, and it states the intended posture explicitly rather than relying
+  // on a fallthrough default. Discovered tool names are still used (below, by
+  // the caller's logging) but do not change the safe-default policy.
+  void tools;
+  for (const [operation, permission] of Object.entries(safeDefaults)) {
+    const rule = {
+      service: serviceName,
+      operations: [operation],
+      permission: permission
+    };
 
-        rules.push(rule);
-      }
+    if (permission === 'deny') {
+      rule.reason = `${operation.charAt(0).toUpperCase() + operation.slice(1)} operations denied by default for safety`;
     }
+
+    rules.push(rule);
   }
 
   return rules;
@@ -515,10 +481,13 @@ async function ensureRulesExist(rulesPath, mcpServers) {
       console.log(`  ✓ Added ${rules.length} rule(s) for ${serverName}`);
     }
 
-    // Merge with existing rules
+    // Merge with existing rules. Preserve the existing file's defaultPolicy
+    // verbatim (including its absence) so updating an existing install never
+    // silently changes its fail-open/fail-closed posture.
     const mergedRules = {
       _comment: 'Auto-generated governance rules. Edit as needed.',
       _location: rulesPath,
+      ...(existingRules.defaultPolicy ? { defaultPolicy: existingRules.defaultPolicy } : {}),
       rules: [...existingRules.rules, ...newRules]
     };
 
@@ -540,6 +509,7 @@ async function ensureRulesExist(rulesPath, mcpServers) {
       const emptyRules = {
         _comment: 'Auto-generated governance rules. Add servers and run again.',
         _location: rulesPath,
+        defaultPolicy: 'deny',
         rules: []
       };
       writeFileSync(rulesPath, JSON.stringify(emptyRules, null, 2) + '\n');
@@ -563,10 +533,14 @@ async function ensureRulesExist(rulesPath, mcpServers) {
       }
     }
 
-    // Create rules file
+    // Create rules file. New installs are fail-closed by default: anything not
+    // matched by an explicit rule below is denied (the generated rules cover
+    // read/write/delete/execute/admin for every service, so normal traffic is
+    // unaffected). Set "defaultPolicy": "allow" to restore the permissive mode.
     const rulesData = {
       _comment: 'Auto-generated governance rules. Edit as needed.',
       _location: rulesPath,
+      defaultPolicy: 'deny',
       rules: allRules
     };
 

package/bin/mcp-gov.js

@@ -92,7 +92,8 @@ async function handleWrap() {
       continue;
     }
 
-    path = input.startsWith('~') ? input.replace('~', homedir()) : input;
+    // Expand a leading ~ or ~/ only; do not touch a ~ elsewhere in the path.
+    path = input.replace(/^~(?=$|\/)/, homedir());
 
     if (existsSync(path)) {
       break;
@@ -124,7 +125,8 @@ async function handleUnwrap() {
       continue;
     }
 
-    path = input.startsWith('~') ? input.replace('~', homedir()) : input;
+    // Expand a leading ~ or ~/ only; do not touch a ~ elsewhere in the path.
+    path = input.replace(/^~(?=$|\/)/, homedir());
 
     if (existsSync(path)) {
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-gov",
-  "version": "1.3.2",
+  "version": "2.0.0",
   "description": "MCP Governance System - Permission control and audit logging for Model Context Protocol servers",
   "type": "module",
   "main": "src/index.js",
@@ -12,8 +12,9 @@
   },
   "scripts": {
     "example:github": "node examples/github/server.js",
-    "test": "node test/proxy.test.js && node test/wrapper.test.js && node test/unwrap.test.js && node test/platform.test.js && node test/integration.test.js && node test/multi-service.test.js && node test/performance.test.js && node test/service-param.test.js",
+    "test": "node test/rules.test.js && node test/proxy.test.js && node test/wrapper.test.js && node test/unwrap.test.js && node test/platform.test.js && node test/integration.test.js && node test/multi-service.test.js && node test/performance.test.js && node test/service-param.test.js",
     "test:all": "npm test",
+    "test:rules": "node test/rules.test.js",
     "test:proxy": "node test/proxy.test.js",
     "test:wrapper": "node test/wrapper.test.js",
     "test:unwrap": "node test/unwrap.test.js",
@@ -43,17 +44,17 @@
     "audit"
   ],
   "author": "hamr0",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "homepage": "https://github.com/hamr0/mcp-gov#readme",
   "bugs": {
     "url": "https://github.com/hamr0/mcp-gov/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^0.5.0",
-    "axios": "^1.6.0",
-    "dotenv": "^16.0.0"
+    "@modelcontextprotocol/sdk": "^0.5.0"
   },
   "devDependencies": {
-    "@types/node": "^25.0.10"
+    "@types/node": "^25.0.10",
+    "axios": "^1.12.0",
+    "dotenv": "^16.0.0"
   }
 }

package/src/index.js

@@ -7,6 +7,7 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { parseToolName } from './operation-detector.js';
+import { normalizeRules, isAllowed } from './rules.js';
 
 /**
  * @typedef {Object} ServerConfig
@@ -40,6 +41,13 @@ export class GovernedMCPServer {
   constructor(config, rules = {}) {
     this.config = config;
     this.rules = rules;
+    // Normalize whatever rule shape was passed (nested-map, legacy object, or
+    // array) into one canonical form, sharing the same matcher as the proxy.
+    // defaultPolicy is read from the rules object first (the documented
+    // location), falling back to the config object; defaults to 'allow' for
+    // backward compatibility.
+    this.normalizedRules = normalizeRules(rules, config.defaultPolicy);
+    this.defaultPolicy = this.normalizedRules.defaultPolicy;
     this.tools = new Map(); // Store tool definitions and handlers
     this.server = new Server(
       {
@@ -137,21 +145,7 @@ export class GovernedMCPServer {
    */
   checkPermission(toolName) {
     const { service, operation } = parseToolName(toolName);
-
-    // Check if service has rules
-    if (!this.rules[service]) {
-      // Default to 'allow' if no rule exists (permissive for POC)
-      return true;
-    }
-
-    // Check operation permission
-    const permission = this.rules[service][operation];
-    if (permission === 'deny') {
-      return false;
-    }
-
-    // Default to allow
-    return true;
+    return isAllowed(this.normalizedRules, service, operation);
   }
 
   /**

package/src/rules.js

@@ -0,0 +1,116 @@
+/**
+ * Rules loading and normalization.
+ *
+ * Historically three rule shapes existed across the proxy and the library:
+ *   1. Array format (generated by mcp-gov-wrap):
+ *        { defaultPolicy?, rules: [{ service, operations: [...], permission }] }
+ *   2. Legacy object format:
+ *        { defaultPolicy?, services: { svc: { operations: { op: 'allow'|'deny' } } } }
+ *   3. SDK nested-map (GovernedMCPServer / examples):
+ *        { svc: { op: 'allow'|'deny' }, defaultPolicy? }
+ *
+ * `normalizeRules` accepts any of these and produces a single canonical form,
+ * so callers share one matcher (`isAllowed`) instead of duplicating per-format
+ * logic. `defaultPolicy` is preserved (default 'allow' for backward compat).
+ */
+
+/**
+ * @typedef {'allow'|'deny'} Permission
+ * @typedef {{ defaultPolicy: Permission, services: Record<string, Record<string, Permission>> }} NormalizedRules
+ */
+
+/**
+ * Top-level keys that are metadata, never service names, in the nested-map
+ * shape. `defaultPolicy` is our keyword and `_*` is the comment convention;
+ * `services`/`rules` are NOT reserved here because format detection already
+ * routes the structural variants away, so a nested-map service may legitimately
+ * be named "services" or "rules" without being silently dropped.
+ */
+function isReservedKey(key) {
+  return key === 'defaultPolicy' || key.startsWith('_');
+}
+
+/**
+ * True only for the legacy { svc: { operations: { op: perm } } } shape, i.e. a
+ * `services` object whose entries wrap an `operations` map. This prevents a
+ * nested-map rules object with a service literally named "services" (e.g.
+ * { services: { read: "deny" } }) from being misdetected as legacy and dropped.
+ * @param {any} services
+ * @returns {boolean}
+ */
+function looksLikeLegacy(services) {
+  if (!services || typeof services !== 'object' || Array.isArray(services)) return false;
+  return Object.values(services).some(
+    (cfg) => cfg && typeof cfg === 'object' && cfg.operations && typeof cfg.operations === 'object'
+  );
+}
+
+/**
+ * Normalize any supported rules shape into a canonical
+ * { defaultPolicy, services: { svc: { op: permission } } } form.
+ * @param {any} raw - Parsed rules object (any supported format)
+ * @param {Permission} [fallbackDefaultPolicy] - Used when `raw` has no defaultPolicy
+ * @returns {NormalizedRules}
+ */
+export function normalizeRules(raw, fallbackDefaultPolicy) {
+  /** @type {NormalizedRules} */
+  const out = { defaultPolicy: 'allow', services: {} };
+
+  if (!raw || typeof raw !== 'object') {
+    out.defaultPolicy = fallbackDefaultPolicy === 'deny' ? 'deny' : 'allow';
+    return out;
+  }
+
+  // Rules-level defaultPolicy takes precedence over any caller fallback.
+  const policy = raw.defaultPolicy || fallbackDefaultPolicy;
+  out.defaultPolicy = policy === 'deny' ? 'deny' : 'allow';
+
+  const setOp = (service, op, permission) => {
+    if (!service || (permission !== 'allow' && permission !== 'deny')) return;
+    if (!out.services[service]) out.services[service] = {};
+    out.services[service][op] = permission;
+  };
+
+  if (Array.isArray(raw.rules)) {
+    // Format 1: array of { service, operations[], permission }
+    for (const rule of raw.rules) {
+      if (!rule || !rule.service || !Array.isArray(rule.operations)) continue;
+      for (const op of rule.operations) setOp(rule.service, op, rule.permission);
+    }
+  } else if (looksLikeLegacy(raw.services)) {
+    // Format 2: legacy { services: { svc: { operations: { op: perm } } } }
+    for (const [service, cfg] of Object.entries(raw.services)) {
+      const ops = cfg && cfg.operations;
+      if (ops && typeof ops === 'object') {
+        for (const [op, perm] of Object.entries(ops)) setOp(service, op, perm);
+      }
+    }
+  } else {
+    // Format 3: SDK nested-map { svc: { op: perm } } (skip metadata keys)
+    for (const [service, cfg] of Object.entries(raw)) {
+      if (isReservedKey(service)) continue;
+      if (cfg && typeof cfg === 'object') {
+        for (const [op, perm] of Object.entries(cfg)) setOp(service, op, perm);
+      }
+    }
+  }
+
+  return out;
+}
+
+/**
+ * Decide whether an operation is permitted against normalized rules.
+ * An explicit allow/deny for the service+operation wins; otherwise the
+ * normalized defaultPolicy applies (allow unless set to 'deny').
+ * @param {NormalizedRules} normalized
+ * @param {string} service
+ * @param {string} operation
+ * @returns {boolean}
+ */
+export function isAllowed(normalized, service, operation) {
+  const svc = normalized.services[service];
+  const permission = svc && svc[operation];
+  if (permission === 'allow') return true;
+  if (permission === 'deny') return false;
+  return normalized.defaultPolicy !== 'deny';
+}