mneme-ai 3.5.1 → 3.6.0

package/dist/commands/mcpgate.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `mneme mcpgate` (v3.6.0) — the local-first MCP gateway surface.
+ *   mcpgate decide --tool <t> [--args '<json>'] [--agent a]   → ALLOW / NEEDS-APPROVAL / BLOCK
+ *   mcpgate audit [--verify]                                   → the signed, offline-verifiable call ledger
+ * Every call through `gephyra serve` (HTTP MCP-proxy) and the matrix gRPC rail is gated + audited
+ * automatically; this CLI is for manual decisions + verifying the audit chain.
+ */
+import type { Command } from "commander";
+export declare function registerMcpgateCommands(program: Command): void;
+//# sourceMappingURL=mcpgate.d.ts.map

package/dist/commands/mcpgate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpgate.d.ts","sourceRoot":"","sources":["../../src/commands/mcpgate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmC9D"}

package/dist/commands/mcpgate.js

@@ -0,0 +1,77 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { mcpgate, notary } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+export function registerMcpgateCommands(program) {
+    const k = program.command("mcpgate").description("🛂 MCP GATEWAY — gate every agent tool-call (policy + behavioral risk + skill provenance → allow / needs-approval / block) and keep a SIGNED, offline-verifiable audit ledger. Local-first; the runtime perimeter a cloud gateway can't be.");
+    k.command("decide").description("Gate one tool-call.")
+        .requiredOption("--tool <t>", "tool name").option("--args <json>", "args JSON", "{}").option("--agent <a>", "agent id", "agent").option("--json", "emit JSON")
+        .action((o) => {
+        let args = {};
+        try {
+            args = JSON.parse(o.args ?? "{}");
+        }
+        catch { /* */ }
+        const cwd = process.cwd();
+        let policy = {};
+        try {
+            const pp = join(cwd, ".mneme", "mcpgate", "policy.json");
+            if (existsSync(pp))
+                policy = JSON.parse(readFileSync(pp, "utf8"));
+        }
+        catch { /* */ }
+        const v = mcpgate.gateCall({ tool: o.tool, agent: o.agent, args }, policy);
+        if (o.json) {
+            out(JSON.stringify(v, null, 2));
+            if (v.decision === "block")
+                process.exitCode = 2;
+            return;
+        }
+        const icon = v.decision === "block" ? "🔴" : v.decision === "needs-approval" ? "🟡" : "🟢";
+        out(`🛂 ${icon} ${v.decision.toUpperCase()} · ${o.tool} · risk ${v.risk} · args ${v.argsHash.slice(0, 12)}…`);
+        for (const r of v.reasons)
+            out(`   • ${r}`);
+        if (v.decision === "needs-approval")
+            out("   → route to the human: mneme pager request");
+        if (v.decision === "block")
+            process.exitCode = 2;
+    });
+    k.command("audit").description("Show + verify the call audit ledger (.mneme/mcpgate/audit.jsonl).")
+        .option("--verify", "verify the hash-chain + the NOTARY-signed head OFFLINE").option("--tail <n>", "show the last N frames", "10")
+        .action((o) => {
+        const dir = join(process.cwd(), ".mneme", "mcpgate");
+        const ledger = join(dir, "audit.jsonl");
+        if (!existsSync(ledger)) {
+            out("no audit ledger yet (no gated calls)");
+            return;
+        }
+        const frames = readFileSync(ledger, "utf8").trim().split("\n").filter(Boolean).map((l) => { try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        } }).filter(Boolean);
+        const tail = Math.max(1, parseInt(o.tail ?? "10", 10));
+        out(`🛂 MCP gateway audit — ${frames.length} call(s)`);
+        for (const f of frames.slice(-tail))
+            out(`   #${f.seq} ${f.decision === "block" ? "🔴" : f.decision === "needs-approval" ? "🟡" : "🟢"} ${f.tool} · ${f.agent} · risk ${f.risk} · args ${f.argsHash.slice(0, 10)}…`);
+        if (o.verify) {
+            const chain = mcpgate.verifyAuditChain(frames);
+            out(chain.ok ? `   ✓ chain VERIFIED — ${chain.frames} frames intact (offline, tamper-evident)` : `   ✗ chain BROKEN at #${chain.brokenAt}: ${chain.reason}`);
+            const headPath = join(dir, "audit.head.json");
+            if (existsSync(headPath)) {
+                try {
+                    const rec = JSON.parse(readFileSync(headPath, "utf8"));
+                    const v = notary.verifyReceipt(rec);
+                    const head = rec.payload?.frameId;
+                    const last = frames[frames.length - 1]?.frameId;
+                    out(v.valid ? `   ✓ signed head VALID (Ed25519, offline)${head === last ? " · points at the current tip" : " · ⚠ tip moved"}` : `   ✗ signed head INVALID: ${v.reason}`);
+                }
+                catch { /* */ }
+            }
+            if (!chain.ok)
+                process.exitCode = 2;
+        }
+    });
+}
+//# sourceMappingURL=mcpgate.js.map

package/dist/commands/mcpgate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpgate.js","sourceRoot":"","sources":["../../src/commands/mcpgate.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEjD,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,6OAA6O,CAAC,CAAC;IAEhS,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC;SACnD,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC7J,MAAM,CAAC,CAAC,CAAkE,EAAE,EAAE;QAC7E,IAAI,IAAI,GAAY,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAAC,IAAI,UAAU,CAAC,EAAE,CAAC;gBAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACrK,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9G,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,QAAQ,KAAK,gBAAgB;YAAE,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACzF,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,mEAAmE,CAAC;SAChG,MAAM,CAAC,UAAU,EAAE,wDAAwD,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,wBAAwB,EAAE,IAAI,CAAC;SACjI,MAAM,CAAC,CAAC,CAAsC,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC9F,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAyB,CAAC;QAC5L,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,0BAA0B,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACrN,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,MAAM,0CAA0C,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;oBAAC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;oBAAC,MAAM,IAAI,GAAI,GAAG,CAAC,OAAgC,EAAE,OAAO,CAAC;oBAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;oBAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4CAA4C,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAC1a,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6lNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8lNvD"}

package/dist/index.js

@@ -107,6 +107,7 @@ import { registerPagerCommands } from "./commands/pager.js";
 import { registerKeryxCommands } from "./commands/keryx.js";
 import { registerCompileCommands } from "./commands/compile.js";
 import { registerSkillscanCommands } from "./commands/skillscan.js";
+import { registerMcpgateCommands } from "./commands/mcpgate.js";
 import { registerAdamasCommands } from "./commands/adamas.js";
 import { registerPrismCommands } from "./commands/prism.js";
 import { registerGoldilocksCommands } from "./commands/goldilocks.js";
@@ -4781,6 +4782,7 @@ export async function run(argv) {
     registerKeryxCommands(program);
     registerCompileCommands(program);
     registerSkillscanCommands(program);
+    registerMcpgateCommands(program);
     registerAdamasCommands(program);
     registerPrismCommands(program);
     registerGoldilocksCommands(program);