mindgraph-mcp 0.11.0 → 0.12.0

package/dist/cli.js

@@ -1546,6 +1546,99 @@ var init_generated_tools = __esm({
   }
 });
 
+// src/governance.ts
+function headers(apiKey, orgId) {
+  const value = {
+    authorization: `Bearer ${apiKey}`,
+    "content-type": "application/json"
+  };
+  if (orgId) value["x-mindgraph-org"] = orgId;
+  return value;
+}
+function unsupportedResponse(status, body) {
+  if (status === 404 || status === 405) return true;
+  if (status !== 400) return false;
+  const lower = body.toLowerCase();
+  return lower.includes("unknown governance action") || lower.includes("unknown action") || lower.includes("invalid_governance_action");
+}
+async function checkMcpGovernance(toolName, args, config) {
+  if (config.disabled || capability === "unsupported") return { allowed: true };
+  const fetchImpl = config.fetchImpl ?? fetch;
+  let response;
+  let body;
+  try {
+    response = await fetchImpl(`${config.baseUrl.replace(/\/$/, "")}/agent/governance`, {
+      method: "POST",
+      headers: headers(config.apiKey, config.orgId),
+      body: JSON.stringify({
+        action: "check",
+        act: "tool_invoke",
+        agent_id: String(args.agent_id || config.agentId),
+        target: { tool_name: toolName },
+        context: { adapter: "mindgraph-mcp" },
+        tier: "checkpoint"
+      })
+    });
+    body = await response.text();
+  } catch (error) {
+    return {
+      allowed: false,
+      message: `MindGraph governance could not establish permission: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  if (!response.ok) {
+    if (capability === "unknown" && unsupportedResponse(response.status, body)) {
+      capability = "unsupported";
+      return { allowed: true };
+    }
+    return {
+      allowed: false,
+      message: `MindGraph governance check failed (${response.status})`
+    };
+  }
+  capability = "supported";
+  let decision;
+  try {
+    decision = JSON.parse(body);
+  } catch {
+    return { allowed: false, message: "MindGraph governance returned an invalid decision" };
+  }
+  const obligations = Array.isArray(decision.obligations) ? decision.obligations : [];
+  const unknownDuty = obligations.find((obligation) => {
+    if (!obligation || typeof obligation !== "object") return true;
+    const duty = obligation.duty;
+    return typeof duty !== "string" || !KNOWN_DUTIES.has(duty);
+  });
+  if (unknownDuty) {
+    return {
+      allowed: false,
+      decision: String(decision.decision || "conditional"),
+      message: "MindGraph governance returned an obligation this adapter cannot safely enforce"
+    };
+  }
+  const verdict = String(decision.decision || "deny");
+  if (verdict === "permit") return { allowed: true };
+  const fired = Array.isArray(decision.fired_policies) ? decision.fired_policies : [];
+  const first = fired[0];
+  const policy = first && typeof first.name === "string" ? first.name : void 0;
+  const approvalUid = typeof decision.approval_uid === "string" ? decision.approval_uid : void 0;
+  return {
+    allowed: false,
+    decision: verdict,
+    approval_uid: approvalUid,
+    policy,
+    message: verdict === "conditional" ? `Approval is required${policy ? ` by policy ${policy}` : ""}${approvalUid ? ` (approval ${approvalUid})` : ""}` : `Denied by MindGraph governance${policy ? ` policy ${policy}` : ""}`
+  };
+}
+var capability, KNOWN_DUTIES;
+var init_governance = __esm({
+  "src/governance.ts"() {
+    "use strict";
+    capability = "unknown";
+    KNOWN_DUTIES = /* @__PURE__ */ new Set(["log", "require_approval"]);
+  }
+});
+
 // src/index.ts
 var src_exports = {};
 async function main() {
@@ -1565,6 +1658,7 @@ var init_src = __esm({
     import_mindgraph = require("mindgraph");
     init_tools();
     init_generated_tools();
+    init_governance();
     API_KEY = process.env.MINDGRAPH_API_KEY;
     BASE_URL = process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud";
     AGENT_ID = process.env.MINDGRAPH_AGENT_ID || "mcp";
@@ -1658,7 +1752,7 @@ Capture knowledge when the user shares something worth remembering:
     server = new import_server.Server(
       {
         name: "mindgraph",
-        version: "0.10.0"
+        version: "0.12.0"
       },
       {
         capabilities: {
@@ -1679,6 +1773,19 @@ Capture knowledge when the user shares something worth remembering:
       if (!toolArgs.agent_id) {
         toolArgs.agent_id = AGENT_ID;
       }
+      const governance = await checkMcpGovernance(name, toolArgs, {
+        baseUrl: BASE_URL,
+        apiKey: API_KEY,
+        orgId: ORG_ID,
+        agentId: AGENT_ID,
+        disabled: process.env.MINDGRAPH_GOVERNANCE === "off"
+      });
+      if (!governance.allowed) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: governance.message, ...governance }) }],
+          isError: true
+        };
+      }
       const generated = await getGeneratedTools(client);
       const desc = generated.byName.get(name);
       if (desc) {

package/dist/index.js

@@ -1514,6 +1514,93 @@ async function handleGeneratedTool(client2, desc, args) {
   }
 }
 
+// src/governance.ts
+var capability = "unknown";
+var KNOWN_DUTIES = /* @__PURE__ */ new Set(["log", "require_approval"]);
+function headers(apiKey, orgId) {
+  const value = {
+    authorization: `Bearer ${apiKey}`,
+    "content-type": "application/json"
+  };
+  if (orgId) value["x-mindgraph-org"] = orgId;
+  return value;
+}
+function unsupportedResponse(status, body) {
+  if (status === 404 || status === 405) return true;
+  if (status !== 400) return false;
+  const lower = body.toLowerCase();
+  return lower.includes("unknown governance action") || lower.includes("unknown action") || lower.includes("invalid_governance_action");
+}
+async function checkMcpGovernance(toolName, args, config) {
+  if (config.disabled || capability === "unsupported") return { allowed: true };
+  const fetchImpl = config.fetchImpl ?? fetch;
+  let response;
+  let body;
+  try {
+    response = await fetchImpl(`${config.baseUrl.replace(/\/$/, "")}/agent/governance`, {
+      method: "POST",
+      headers: headers(config.apiKey, config.orgId),
+      body: JSON.stringify({
+        action: "check",
+        act: "tool_invoke",
+        agent_id: String(args.agent_id || config.agentId),
+        target: { tool_name: toolName },
+        context: { adapter: "mindgraph-mcp" },
+        tier: "checkpoint"
+      })
+    });
+    body = await response.text();
+  } catch (error) {
+    return {
+      allowed: false,
+      message: `MindGraph governance could not establish permission: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  if (!response.ok) {
+    if (capability === "unknown" && unsupportedResponse(response.status, body)) {
+      capability = "unsupported";
+      return { allowed: true };
+    }
+    return {
+      allowed: false,
+      message: `MindGraph governance check failed (${response.status})`
+    };
+  }
+  capability = "supported";
+  let decision;
+  try {
+    decision = JSON.parse(body);
+  } catch {
+    return { allowed: false, message: "MindGraph governance returned an invalid decision" };
+  }
+  const obligations = Array.isArray(decision.obligations) ? decision.obligations : [];
+  const unknownDuty = obligations.find((obligation) => {
+    if (!obligation || typeof obligation !== "object") return true;
+    const duty = obligation.duty;
+    return typeof duty !== "string" || !KNOWN_DUTIES.has(duty);
+  });
+  if (unknownDuty) {
+    return {
+      allowed: false,
+      decision: String(decision.decision || "conditional"),
+      message: "MindGraph governance returned an obligation this adapter cannot safely enforce"
+    };
+  }
+  const verdict = String(decision.decision || "deny");
+  if (verdict === "permit") return { allowed: true };
+  const fired = Array.isArray(decision.fired_policies) ? decision.fired_policies : [];
+  const first = fired[0];
+  const policy = first && typeof first.name === "string" ? first.name : void 0;
+  const approvalUid = typeof decision.approval_uid === "string" ? decision.approval_uid : void 0;
+  return {
+    allowed: false,
+    decision: verdict,
+    approval_uid: approvalUid,
+    policy,
+    message: verdict === "conditional" ? `Approval is required${policy ? ` by policy ${policy}` : ""}${approvalUid ? ` (approval ${approvalUid})` : ""}` : `Denied by MindGraph governance${policy ? ` policy ${policy}` : ""}`
+  };
+}
+
 // src/index.ts
 var API_KEY = process.env.MINDGRAPH_API_KEY;
 var BASE_URL = process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud";
@@ -1608,7 +1695,7 @@ Capture knowledge when the user shares something worth remembering:
 var server = new import_server.Server(
   {
     name: "mindgraph",
-    version: "0.10.0"
+    version: "0.12.0"
   },
   {
     capabilities: {
@@ -1629,6 +1716,19 @@ server.setRequestHandler(import_types.CallToolRequestSchema, async (request) =>
   if (!toolArgs.agent_id) {
     toolArgs.agent_id = AGENT_ID;
   }
+  const governance = await checkMcpGovernance(name, toolArgs, {
+    baseUrl: BASE_URL,
+    apiKey: API_KEY,
+    orgId: ORG_ID,
+    agentId: AGENT_ID,
+    disabled: process.env.MINDGRAPH_GOVERNANCE === "off"
+  });
+  if (!governance.allowed) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: governance.message, ...governance }) }],
+      isError: true
+    };
+  }
   const generated = await getGeneratedTools(client);
   const desc = generated.byName.get(name);
   if (desc) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindgraph-mcp",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "MCP server for MindGraph — connect Claude Desktop, Claude Code, and any MCP client to your knowledge graph",
   "repository": {
     "type": "git",