open-multi-agent-kit 0.90.0 → 0.90.4

package/dist/core/mcp-public-presets.d.ts

@@ -0,0 +1,578 @@
+export type PublicMcpPresetKey = "context7" | "exa" | "githubReadOnly" | "astGrep" | "repomixCodeCompact" | "omkLlmlinguaCompress" | "doclingUnderstand" | "markitdownLite" | "firecrawlWebUnderstand" | "deepwikiRepoUnderstandCandidate" | "insaneSearchCandidate" | "playwrightSandboxed" | "microsoftLearn" | "officialReferenceSafePack";
+export type PublicMcpRisk = "R1" | "R2" | "R3";
+export type PublicMcpLicense = "Apache-2.0" | "Apache-2.0/MIT/CC-BY-4.0" | "MIT" | "Unspecified";
+export type PublicMcpImplementation = "candidate-wrapper" | "omk-owned" | "upstream-mcp";
+export type PublicMcpReadiness = "candidate" | "stable";
+export type PublicMcpUriScheme = "data" | "file" | "http" | "https";
+export type PublicMcpTransport = {
+    readonly type: "http";
+    readonly url: string;
+} | {
+    readonly type: "embedded-python-or-sidecar";
+    readonly package: string;
+} | {
+    readonly type: "local-package";
+    readonly package: string;
+    readonly args?: readonly string[];
+} | {
+    readonly type: "stdio";
+    readonly command: string;
+    readonly args: readonly string[];
+};
+export interface PublicMcpAuthPolicy {
+    readonly kind: "bearer" | "header" | "none";
+    readonly header?: string;
+    readonly secretRef?: string;
+}
+export interface PublicMcpSecretPolicy {
+    readonly required?: readonly string[];
+    readonly optional?: readonly string[];
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface PublicMcpToolPolicy {
+    readonly allow: readonly string[];
+    readonly conditionalAllow?: readonly string[];
+    readonly deny?: readonly string[];
+    readonly denyByDefault: boolean;
+    readonly denyMutations?: boolean;
+    readonly disabledByDefault?: readonly string[];
+    readonly gated?: readonly string[];
+    readonly requirePostconditions?: readonly string[];
+}
+export interface PublicMcpRuntimePolicy {
+    readonly absolutePathMustBeUnderWorkspace?: boolean;
+    readonly allowedUriSchemes?: readonly PublicMcpUriScheme[];
+    readonly authenticationBoundaryRequired?: boolean;
+    readonly blockMetadataIp?: boolean;
+    readonly blockHttpByDefault?: boolean;
+    readonly blockNetworkUrlsByDefault?: boolean;
+    readonly blockPrivateNetwork?: boolean;
+    readonly blockRemoteRepositoryByDefault?: boolean;
+    readonly cacheDocuments?: boolean;
+    readonly cacheable?: boolean;
+    readonly cacheMaterializedOutputs?: boolean;
+    readonly defaultCompressionRatio?: number;
+    readonly descriptorHashPinned?: boolean;
+    readonly distillBeforeMainContext?: boolean;
+    readonly disableAutoInstall?: boolean;
+    readonly domainAllowlistOptional?: boolean;
+    readonly denyYoutubeByDefault?: boolean;
+    readonly denyZipByDefault?: boolean;
+    readonly evidenceLedger?: boolean;
+    readonly filesystemRoot?: string;
+    readonly fileRoot?: string;
+    readonly forkContext?: boolean;
+    readonly ledger?: boolean;
+    readonly localFilesUnderWorkspaceOnly?: boolean;
+    readonly localOnly?: boolean;
+    readonly maxBrowserActions?: number;
+    readonly maxCompressionRatio?: number;
+    readonly maxInputBytes?: number;
+    readonly maxInputTokens?: number;
+    readonly maxOutputTokens?: number;
+    readonly maxResults?: number;
+    readonly maxUrlsPerTask?: number;
+    readonly markdownFullPageRequiresExplicitNeed?: boolean;
+    readonly mutationsRequireHumanGate?: boolean;
+    readonly mutationsRequirePostconditions?: boolean;
+    readonly noFilesystemReadExceptModelCache?: boolean;
+    readonly noNetwork?: boolean;
+    readonly noSecrets?: boolean;
+    readonly noShell?: boolean;
+    readonly outputGuard?: boolean;
+    readonly preferGrepBeforeFullRead?: boolean;
+    readonly preferIncrementalRead?: boolean;
+    readonly preferJsonExtraction?: boolean;
+    readonly privateRepoDeniedByDefault?: boolean;
+    readonly promptTaint?: "external-docs" | "external-web" | "browser";
+    readonly publicContentOnly?: boolean;
+    readonly publicReposOnly?: boolean;
+    readonly readOnly?: boolean;
+    readonly recordEvidence?: boolean;
+    readonly rejectIfCoverageBelow?: {
+        readonly hard: number;
+        readonly high: number;
+        readonly low: number;
+        readonly medium: number;
+    };
+    readonly requireCoverageVerification?: boolean;
+    readonly requireOriginAllowlistForScrape?: boolean;
+    readonly requiresExplicitPostconditions?: boolean;
+    readonly requiresOriginAllowlist?: boolean;
+    readonly requiresSandbox?: boolean;
+    readonly secretBrokerOnly?: boolean;
+    readonly secretScanRequired?: boolean;
+    readonly ssrfGuard?: boolean;
+    readonly workspaceReadOnly?: boolean;
+}
+export interface PublicMcpPreset {
+    readonly defaultEnabled?: boolean;
+    readonly id: string;
+    readonly key: PublicMcpPresetKey;
+    readonly license: PublicMcpLicense;
+    readonly notes: readonly string[];
+    readonly policy: PublicMcpRuntimePolicy;
+    readonly implementation?: PublicMcpImplementation;
+    readonly readiness?: PublicMcpReadiness;
+    readonly risk: PublicMcpRisk;
+    readonly sourceUrls: readonly string[];
+    readonly tools: PublicMcpToolPolicy;
+    readonly auth?: PublicMcpAuthPolicy;
+    readonly secrets?: PublicMcpSecretPolicy;
+    readonly servers?: readonly string[];
+    readonly transport?: PublicMcpTransport;
+}
+export interface PublicMcpObservedTool {
+    readonly name: string;
+    readonly descriptorHash: string;
+    readonly description: string;
+}
+export interface PublicMcpObservedServer {
+    readonly serverIdentity: string;
+    readonly tools: readonly PublicMcpObservedTool[];
+}
+export interface PublicMcpApprovedServer {
+    readonly serverIdentity: string;
+    readonly tools: Readonly<Record<string, string>>;
+}
+export type PublicMcpAdmissionStatus = "allow" | "quarantine";
+export interface PublicMcpAdmissionDecision {
+    readonly status: PublicMcpAdmissionStatus;
+    readonly reasons: readonly string[];
+}
+export type PublicMcpHashable = null | boolean | number | string | readonly PublicMcpHashable[] | {
+    readonly [key: string]: PublicMcpHashable;
+};
+export declare const PUBLIC_MCP_PRESETS: {
+    readonly context7: {
+        readonly id: "context7";
+        readonly key: "context7";
+        readonly license: "MIT";
+        readonly notes: readonly ["Documentation retrieval preset; optional API key only raises rate limits."];
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/upstash/context7"];
+        readonly transport: {
+            readonly type: "http";
+            readonly url: "https://mcp.context7.com/mcp";
+        };
+        readonly secrets: {
+            readonly optional: readonly ["CONTEXT7_API_KEY"];
+            readonly headers: {
+                readonly CONTEXT7_API_KEY: "secret-ref:context7";
+            };
+        };
+        readonly tools: {
+            readonly allow: readonly ["resolve-library-id", "query-docs"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly cacheable: true;
+            readonly maxOutputTokens: 6000;
+            readonly outputGuard: true;
+            readonly promptTaint: "external-docs";
+            readonly readOnly: true;
+        };
+    };
+    readonly exa: {
+        readonly id: "exa";
+        readonly key: "exa";
+        readonly license: "MIT";
+        readonly notes: readonly ["Run searches in forked context and return distilled output to the main task."];
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/exa-labs/exa-mcp-server"];
+        readonly transport: {
+            readonly type: "http";
+            readonly url: "https://mcp.exa.ai/mcp";
+        };
+        readonly auth: {
+            readonly kind: "header";
+            readonly header: "Authorization";
+            readonly secretRef: "secret-ref:exa_api_key";
+        };
+        readonly secrets: {
+            readonly optional: readonly ["EXA_API_KEY"];
+        };
+        readonly tools: {
+            readonly allow: readonly ["web_search_exa", "web_fetch_exa"];
+            readonly conditionalAllow: readonly ["web_search_advanced_exa"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly blockPrivateNetwork: true;
+            readonly distillBeforeMainContext: true;
+            readonly domainAllowlistOptional: true;
+            readonly forkContext: true;
+            readonly maxOutputTokens: 5000;
+            readonly maxResults: 10;
+            readonly ssrfGuard: true;
+        };
+    };
+    readonly githubReadOnly: {
+        readonly id: "github-readonly";
+        readonly key: "githubReadOnly";
+        readonly license: "MIT";
+        readonly notes: readonly ["Read-only GitHub MCP profile; mutation tools remain gated for future explicit workflows."];
+        readonly risk: "R2";
+        readonly sourceUrls: readonly ["https://github.com/github/github-mcp-server"];
+        readonly transport: {
+            readonly type: "http";
+            readonly url: "https://api.githubcopilot.com/mcp/";
+        };
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secretRef: "secret-ref:github_pat";
+        };
+        readonly secrets: {
+            readonly required: readonly ["GITHUB_PERSONAL_ACCESS_TOKEN"];
+        };
+        readonly tools: {
+            readonly allow: readonly ["actions_list", "get_file_contents", "issue_read", "list_issues", "list_pull_requests", "pull_request_read", "search_code", "search_issues", "search_pull_requests", "search_repositories"];
+            readonly denyByDefault: true;
+            readonly requirePostconditions: readonly ["add_comment_to_pending_review", "create_branch", "create_or_update_file", "create_pull_request", "delete_file", "issue_write", "merge_pull_request", "pull_request_review_write", "push_files", "update_pull_request", "update_pull_request_branch"];
+        };
+        readonly policy: {
+            readonly ledger: true;
+            readonly maxOutputTokens: 8000;
+            readonly mutationsRequireHumanGate: true;
+            readonly readOnly: true;
+            readonly secretBrokerOnly: true;
+        };
+    };
+    readonly astGrep: {
+        readonly id: "ast-grep";
+        readonly key: "astGrep";
+        readonly license: "MIT";
+        readonly notes: readonly ["Experimental upstream; pin descriptor and wrap execution before broad enablement."];
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/ast-grep/ast-grep-mcp"];
+        readonly transport: {
+            readonly type: "stdio";
+            readonly command: "uvx";
+            readonly args: readonly ["--from", "git+https://github.com/ast-grep/ast-grep-mcp", "ast-grep-server"];
+        };
+        readonly tools: {
+            readonly allow: readonly ["dump_syntax_tree", "find_code", "find_code_by_rule", "test_match_code_rule"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly descriptorHashPinned: true;
+            readonly maxResults: 200;
+            readonly noShell: true;
+            readonly workspaceReadOnly: true;
+        };
+    };
+    readonly repomixCodeCompact: {
+        readonly defaultEnabled: true;
+        readonly id: "repomix-code-compact";
+        readonly implementation: "upstream-mcp";
+        readonly key: "repomixCodeCompact";
+        readonly license: "MIT";
+        readonly notes: readonly ["Codebase packing and compression preset; remote repository packing is disabled until a task explicitly opts in.", "Use grep/read against packed output before full-context attachment."];
+        readonly readiness: "stable";
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/yamadashy/repomix"];
+        readonly transport: {
+            readonly type: "stdio";
+            readonly command: "npx";
+            readonly args: readonly ["-y", "repomix", "--mcp"];
+        };
+        readonly tools: {
+            readonly allow: readonly ["attach_packed_output", "file_system_read_directory", "grep_repomix_output", "pack_codebase", "read_repomix_output"];
+            readonly disabledByDefault: readonly ["pack_remote_repository"];
+            readonly gated: readonly ["file_system_read_file"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly absolutePathMustBeUnderWorkspace: true;
+            readonly blockRemoteRepositoryByDefault: true;
+            readonly descriptorHashPinned: true;
+            readonly evidenceLedger: true;
+            readonly maxOutputTokens: 120000;
+            readonly outputGuard: true;
+            readonly preferGrepBeforeFullRead: true;
+            readonly preferIncrementalRead: true;
+            readonly secretScanRequired: true;
+            readonly workspaceReadOnly: true;
+        };
+    };
+    readonly omkLlmlinguaCompress: {
+        readonly defaultEnabled: true;
+        readonly id: "omk-llmlingua-compress";
+        readonly implementation: "omk-owned";
+        readonly key: "omkLlmlinguaCompress";
+        readonly license: "MIT";
+        readonly notes: readonly ["First-party wrapper target for LLMLingua-style prompt and context compression.", "System prompts, latest user turns, and tool schemas must stay outside lossy compression."];
+        readonly readiness: "stable";
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/microsoft/LLMLingua", "https://arxiv.org/abs/2403.12968"];
+        readonly transport: {
+            readonly type: "embedded-python-or-sidecar";
+            readonly package: "llmlingua";
+        };
+        readonly tools: {
+            readonly allow: readonly ["compress_context_items", "compress_messages", "compress_prompt", "compress_representation_candidate", "verify_compression_coverage"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly cacheMaterializedOutputs: true;
+            readonly defaultCompressionRatio: 3;
+            readonly evidenceLedger: true;
+            readonly localOnly: true;
+            readonly maxCompressionRatio: 8;
+            readonly maxInputTokens: 200000;
+            readonly noFilesystemReadExceptModelCache: true;
+            readonly noNetwork: true;
+            readonly outputGuard: true;
+            readonly rejectIfCoverageBelow: {
+                readonly hard: 0.95;
+                readonly high: 0.8;
+                readonly medium: 0.55;
+                readonly low: 0.3;
+            };
+            readonly requireCoverageVerification: true;
+        };
+    };
+    readonly doclingUnderstand: {
+        readonly defaultEnabled: true;
+        readonly id: "docling-understand";
+        readonly implementation: "upstream-mcp";
+        readonly key: "doclingUnderstand";
+        readonly license: "MIT";
+        readonly notes: readonly ["Structured document understanding preset for PDFs, Office files, tables, OCR, and layout-sensitive conversions.", "Parser attack surface requires sandboxing and workspace-only local file access."];
+        readonly readiness: "stable";
+        readonly risk: "R2";
+        readonly sourceUrls: readonly ["https://github.com/docling-project/docling", "https://github.com/docling-project/docling-mcp"];
+        readonly transport: {
+            readonly type: "stdio";
+            readonly command: "uvx";
+            readonly args: readonly ["--from=docling-mcp", "docling-mcp-server", "--transport", "stdio"];
+        };
+        readonly tools: {
+            readonly allow: readonly ["convert_document", "export_docling_document_to_json", "export_docling_document_to_markdown"];
+            readonly gated: readonly ["create_new_docling_document", "save_docling_document"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly blockNetworkUrlsByDefault: true;
+            readonly cacheDocuments: true;
+            readonly evidenceLedger: true;
+            readonly localFilesUnderWorkspaceOnly: true;
+            readonly maxInputBytes: 80000000;
+            readonly maxOutputTokens: 80000;
+            readonly outputGuard: true;
+            readonly requiresSandbox: true;
+        };
+    };
+    readonly markitdownLite: {
+        readonly defaultEnabled: true;
+        readonly id: "markitdown-lite";
+        readonly implementation: "upstream-mcp";
+        readonly key: "markitdownLite";
+        readonly license: "MIT";
+        readonly notes: readonly ["Lightweight Markdown conversion fallback for local files and data URIs.", "HTTP, ZIP, and YouTube inputs stay blocked until a task explicitly needs them."];
+        readonly readiness: "stable";
+        readonly risk: "R2";
+        readonly sourceUrls: readonly ["https://github.com/microsoft/markitdown", "https://github.com/microsoft/markitdown/tree/main/packages/markitdown-mcp"];
+        readonly transport: {
+            readonly type: "stdio";
+            readonly command: "markitdown-mcp";
+            readonly args: readonly [];
+        };
+        readonly tools: {
+            readonly allow: readonly ["convert_to_markdown"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly allowedUriSchemes: readonly ["file", "data"];
+            readonly blockHttpByDefault: true;
+            readonly denyYoutubeByDefault: true;
+            readonly denyZipByDefault: true;
+            readonly evidenceLedger: true;
+            readonly fileRoot: "workspaceRoot";
+            readonly maxInputBytes: 30000000;
+            readonly maxOutputTokens: 50000;
+            readonly outputGuard: true;
+            readonly requiresSandbox: true;
+        };
+    };
+    readonly firecrawlWebUnderstand: {
+        readonly defaultEnabled: false;
+        readonly id: "firecrawl-web-understand";
+        readonly implementation: "upstream-mcp";
+        readonly key: "firecrawlWebUnderstand";
+        readonly license: "MIT";
+        readonly notes: readonly ["Opt-in live web understanding preset; search and scrape are the only default-admissible tools.", "Prefer JSON extraction over full-page Markdown to protect the context budget."];
+        readonly readiness: "stable";
+        readonly risk: "R2";
+        readonly sourceUrls: readonly ["https://github.com/firecrawl/firecrawl-mcp-server"];
+        readonly transport: {
+            readonly type: "http";
+            readonly url: "https://mcp.firecrawl.dev/v2/mcp";
+        };
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secretRef: "secret-ref:firecrawl_api_key";
+        };
+        readonly secrets: {
+            readonly optional: readonly ["FIRECRAWL_API_KEY", "FIRECRAWL_OAUTH_TOKEN"];
+        };
+        readonly tools: {
+            readonly allow: readonly ["firecrawl_scrape", "firecrawl_search"];
+            readonly disabledByDefault: readonly ["firecrawl_agent", "firecrawl_crawl", "firecrawl_interact", "firecrawl_monitor"];
+            readonly gated: readonly ["firecrawl_extract", "firecrawl_map", "firecrawl_research"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly blockMetadataIp: true;
+            readonly blockPrivateNetwork: true;
+            readonly distillBeforeMainContext: true;
+            readonly evidenceLedger: true;
+            readonly forkContext: true;
+            readonly markdownFullPageRequiresExplicitNeed: true;
+            readonly maxOutputTokens: 40000;
+            readonly maxUrlsPerTask: 10;
+            readonly outputGuard: true;
+            readonly preferJsonExtraction: true;
+            readonly requireOriginAllowlistForScrape: true;
+        };
+    };
+    readonly deepwikiRepoUnderstandCandidate: {
+        readonly defaultEnabled: false;
+        readonly id: "deepwiki-repo-understand";
+        readonly implementation: "candidate-wrapper";
+        readonly key: "deepwikiRepoUnderstandCandidate";
+        readonly license: "Unspecified";
+        readonly notes: readonly ["Candidate only until an official MCP endpoint, tool schema, auth model, and retention boundary are verified.", "Remote repository indexing is public-repo-only by default."];
+        readonly readiness: "candidate";
+        readonly risk: "R2";
+        readonly sourceUrls: readonly ["https://deepwiki.com/"];
+        readonly tools: {
+            readonly allow: readonly [];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly descriptorHashPinned: true;
+            readonly evidenceLedger: true;
+            readonly noSecrets: true;
+            readonly outputGuard: true;
+            readonly privateRepoDeniedByDefault: true;
+            readonly publicReposOnly: true;
+        };
+    };
+    readonly insaneSearchCandidate: {
+        readonly defaultEnabled: false;
+        readonly id: "insane-search-public-reader";
+        readonly implementation: "candidate-wrapper";
+        readonly key: "insaneSearchCandidate";
+        readonly license: "MIT";
+        readonly notes: readonly ["Candidate only: upstream is a Claude Code plugin, not a verified standalone MCP transport.", "Any OMK integration must be a sandboxed first-party wrapper around public-content reads, with auto-install disabled."];
+        readonly readiness: "candidate";
+        readonly risk: "R3";
+        readonly sourceUrls: readonly ["https://github.com/fivetaku/insane-search"];
+        readonly tools: {
+            readonly allow: readonly ["insane_search_public_read"];
+            readonly disabledByDefault: readonly ["insane_search_auto_install_dependencies"];
+            readonly gated: readonly ["insane_search_browser_escalation"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly authenticationBoundaryRequired: true;
+            readonly blockMetadataIp: true;
+            readonly blockPrivateNetwork: true;
+            readonly disableAutoInstall: true;
+            readonly distillBeforeMainContext: true;
+            readonly evidenceLedger: true;
+            readonly forkContext: true;
+            readonly maxBrowserActions: 20;
+            readonly maxOutputTokens: 30000;
+            readonly outputGuard: true;
+            readonly publicContentOnly: true;
+            readonly requiresOriginAllowlist: true;
+            readonly requiresSandbox: true;
+        };
+    };
+    readonly playwrightSandboxed: {
+        readonly id: "playwright-sandboxed";
+        readonly key: "playwrightSandboxed";
+        readonly license: "Apache-2.0";
+        readonly notes: readonly ["Browser automation preset; enable only with sandbox and origin controls."];
+        readonly risk: "R3";
+        readonly sourceUrls: readonly ["https://github.com/microsoft/playwright-mcp"];
+        readonly transport: {
+            readonly type: "local-package";
+            readonly package: "@playwright/mcp";
+        };
+        readonly tools: {
+            readonly allow: readonly ["browser_close", "browser_click", "browser_navigate", "browser_snapshot", "browser_type", "browser_wait_for"];
+            readonly deny: readonly ["browser_console_messages", "browser_file_upload", "browser_pdf_save", "browser_press_key"];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly blockMetadataIp: true;
+            readonly blockPrivateNetwork: true;
+            readonly ledger: true;
+            readonly maxBrowserActions: 40;
+            readonly recordEvidence: true;
+            readonly requiresExplicitPostconditions: true;
+            readonly requiresOriginAllowlist: true;
+            readonly requiresSandbox: true;
+        };
+    };
+    readonly microsoftLearn: {
+        readonly id: "microsoft-learn";
+        readonly key: "microsoftLearn";
+        readonly license: "Unspecified";
+        readonly notes: readonly ["Microsoft official remote documentation endpoint from the Microsoft MCP catalog."];
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/microsoft/mcp"];
+        readonly transport: {
+            readonly type: "http";
+            readonly url: "https://learn.microsoft.com/api/mcp";
+        };
+        readonly tools: {
+            readonly allow: readonly ["*"];
+            readonly denyByDefault: true;
+            readonly denyMutations: true;
+        };
+        readonly policy: {
+            readonly cacheable: true;
+            readonly maxOutputTokens: 6000;
+            readonly outputGuard: true;
+            readonly promptTaint: "external-docs";
+            readonly readOnly: true;
+        };
+    };
+    readonly officialReferenceSafePack: {
+        readonly id: "official-reference-safe-pack";
+        readonly key: "officialReferenceSafePack";
+        readonly license: "Apache-2.0/MIT/CC-BY-4.0";
+        readonly notes: readonly ["Reference implementations only; wrap before production use."];
+        readonly risk: "R1";
+        readonly sourceUrls: readonly ["https://github.com/modelcontextprotocol/servers"];
+        readonly servers: readonly ["time", "memory", "sequential-thinking", "git-readonly"];
+        readonly tools: {
+            readonly allow: readonly [];
+            readonly denyByDefault: true;
+        };
+        readonly policy: {
+            readonly blockPrivateNetwork: true;
+            readonly descriptorHashPinned: true;
+            readonly filesystemRoot: "workspaceRoot";
+            readonly mutationsRequirePostconditions: true;
+        };
+    };
+};
+export declare const OMK_PUBLIC_CONTEXT_MCP_BUNDLE: {
+    readonly stableDefaults: readonly ["repomix-code-compact", "docling-understand", "markitdown-lite", "omk-llmlingua-compress"];
+    readonly optInResearchWeb: readonly ["firecrawl-web-understand"];
+    readonly candidatesNeedVerification: readonly ["deepwiki-repo-understand", "insane-search-public-reader"];
+    readonly internalRouters: readonly ["mcp-tool-rag-router"];
+};
+export declare function listPublicMcpPresets(): PublicMcpPreset[];
+export declare function canonicalMcpPolicyHash(value: PublicMcpHashable): string;
+export declare function canonicalPublicMcpServerIdentity(preset: PublicMcpPreset): string;
+export declare function admitPublicMcpServer(preset: PublicMcpPreset, observed: PublicMcpObservedServer, approved: PublicMcpApprovedServer | undefined): PublicMcpAdmissionDecision;
+export declare function detectMcpDescriptorPromptInjection(description: string): {
+    readonly score: number;
+};
+//# sourceMappingURL=mcp-public-presets.d.ts.map

package/dist/core/mcp-public-presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-public-presets.d.ts","sourceRoot":"","sources":["../../src/core/mcp-public-presets.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAC3B,UAAU,GACV,KAAK,GACL,gBAAgB,GAChB,SAAS,GACT,oBAAoB,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,gBAAgB,GAChB,wBAAwB,GACxB,iCAAiC,GACjC,uBAAuB,GACvB,qBAAqB,GACrB,gBAAgB,GAChB,2BAA2B,CAAC;AAE/B,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,0BAA0B,GAAG,KAAK,GAAG,aAAa,CAAC;AACjG,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG,WAAW,GAAG,cAAc,CAAC;AACzF,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,QAAQ,CAAC;AACxD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACxB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC;AAEL,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IACpD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC3D,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,oCAAoC,CAAC,EAAE,OAAO,CAAC;IACxD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,GAAG,cAAc,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAC/C,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC;IACnD,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,YAAY,CAAC;AAE9D,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,iBAAiB,GAC1B,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,iBAAiB,EAAE,GAC5B;IACA,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC;CACzC,CAAC;AAEL,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoeiC,CAAC;AAEjE,eAAO,MAAM,6BAA6B;;;;;CAKhC,CAAC;AAEX,wBAAgB,oBAAoB,IAAI,eAAe,EAAE,CAExD;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAEvE;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAMhF;AAED,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAC3C,0BAA0B,CA2C5B;AAED,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAclG","sourcesContent":["import { createHash } from \"node:crypto\";\n\nexport type PublicMcpPresetKey =\n\t| \"context7\"\n\t| \"exa\"\n\t| \"githubReadOnly\"\n\t| \"astGrep\"\n\t| \"repomixCodeCompact\"\n\t| \"omkLlmlinguaCompress\"\n\t| \"doclingUnderstand\"\n\t| \"markitdownLite\"\n\t| \"firecrawlWebUnderstand\"\n\t| \"deepwikiRepoUnderstandCandidate\"\n\t| \"insaneSearchCandidate\"\n\t| \"playwrightSandboxed\"\n\t| \"microsoftLearn\"\n\t| \"officialReferenceSafePack\";\n\nexport type PublicMcpRisk = \"R1\" | \"R2\" | \"R3\";\nexport type PublicMcpLicense = \"Apache-2.0\" | \"Apache-2.0/MIT/CC-BY-4.0\" | \"MIT\" | \"Unspecified\";\nexport type PublicMcpImplementation = \"candidate-wrapper\" | \"omk-owned\" | \"upstream-mcp\";\nexport type PublicMcpReadiness = \"candidate\" | \"stable\";\nexport type PublicMcpUriScheme = \"data\" | \"file\" | \"http\" | \"https\";\nexport type PublicMcpTransport =\n\t| {\n\t\t\treadonly type: \"http\";\n\t\t\treadonly url: string;\n\t  }\n\t| {\n\t\t\treadonly type: \"embedded-python-or-sidecar\";\n\t\t\treadonly package: string;\n\t  }\n\t| {\n\t\t\treadonly type: \"local-package\";\n\t\t\treadonly package: string;\n\t\t\treadonly args?: readonly string[];\n\t  }\n\t| {\n\t\t\treadonly type: \"stdio\";\n\t\t\treadonly command: string;\n\t\t\treadonly args: readonly string[];\n\t  };\n\nexport interface PublicMcpAuthPolicy {\n\treadonly kind: \"bearer\" | \"header\" | \"none\";\n\treadonly header?: string;\n\treadonly secretRef?: string;\n}\n\nexport interface PublicMcpSecretPolicy {\n\treadonly required?: readonly string[];\n\treadonly optional?: readonly string[];\n\treadonly headers?: Readonly<Record<string, string>>;\n}\n\nexport interface PublicMcpToolPolicy {\n\treadonly allow: readonly string[];\n\treadonly conditionalAllow?: readonly string[];\n\treadonly deny?: readonly string[];\n\treadonly denyByDefault: boolean;\n\treadonly denyMutations?: boolean;\n\treadonly disabledByDefault?: readonly string[];\n\treadonly gated?: readonly string[];\n\treadonly requirePostconditions?: readonly string[];\n}\n\nexport interface PublicMcpRuntimePolicy {\n\treadonly absolutePathMustBeUnderWorkspace?: boolean;\n\treadonly allowedUriSchemes?: readonly PublicMcpUriScheme[];\n\treadonly authenticationBoundaryRequired?: boolean;\n\treadonly blockMetadataIp?: boolean;\n\treadonly blockHttpByDefault?: boolean;\n\treadonly blockNetworkUrlsByDefault?: boolean;\n\treadonly blockPrivateNetwork?: boolean;\n\treadonly blockRemoteRepositoryByDefault?: boolean;\n\treadonly cacheDocuments?: boolean;\n\treadonly cacheable?: boolean;\n\treadonly cacheMaterializedOutputs?: boolean;\n\treadonly defaultCompressionRatio?: number;\n\treadonly descriptorHashPinned?: boolean;\n\treadonly distillBeforeMainContext?: boolean;\n\treadonly disableAutoInstall?: boolean;\n\treadonly domainAllowlistOptional?: boolean;\n\treadonly denyYoutubeByDefault?: boolean;\n\treadonly denyZipByDefault?: boolean;\n\treadonly evidenceLedger?: boolean;\n\treadonly filesystemRoot?: string;\n\treadonly fileRoot?: string;\n\treadonly forkContext?: boolean;\n\treadonly ledger?: boolean;\n\treadonly localFilesUnderWorkspaceOnly?: boolean;\n\treadonly localOnly?: boolean;\n\treadonly maxBrowserActions?: number;\n\treadonly maxCompressionRatio?: number;\n\treadonly maxInputBytes?: number;\n\treadonly maxInputTokens?: number;\n\treadonly maxOutputTokens?: number;\n\treadonly maxResults?: number;\n\treadonly maxUrlsPerTask?: number;\n\treadonly markdownFullPageRequiresExplicitNeed?: boolean;\n\treadonly mutationsRequireHumanGate?: boolean;\n\treadonly mutationsRequirePostconditions?: boolean;\n\treadonly noFilesystemReadExceptModelCache?: boolean;\n\treadonly noNetwork?: boolean;\n\treadonly noSecrets?: boolean;\n\treadonly noShell?: boolean;\n\treadonly outputGuard?: boolean;\n\treadonly preferGrepBeforeFullRead?: boolean;\n\treadonly preferIncrementalRead?: boolean;\n\treadonly preferJsonExtraction?: boolean;\n\treadonly privateRepoDeniedByDefault?: boolean;\n\treadonly promptTaint?: \"external-docs\" | \"external-web\" | \"browser\";\n\treadonly publicContentOnly?: boolean;\n\treadonly publicReposOnly?: boolean;\n\treadonly readOnly?: boolean;\n\treadonly recordEvidence?: boolean;\n\treadonly rejectIfCoverageBelow?: {\n\t\treadonly hard: number;\n\t\treadonly high: number;\n\t\treadonly low: number;\n\t\treadonly medium: number;\n\t};\n\treadonly requireCoverageVerification?: boolean;\n\treadonly requireOriginAllowlistForScrape?: boolean;\n\treadonly requiresExplicitPostconditions?: boolean;\n\treadonly requiresOriginAllowlist?: boolean;\n\treadonly requiresSandbox?: boolean;\n\treadonly secretBrokerOnly?: boolean;\n\treadonly secretScanRequired?: boolean;\n\treadonly ssrfGuard?: boolean;\n\treadonly workspaceReadOnly?: boolean;\n}\n\nexport interface PublicMcpPreset {\n\treadonly defaultEnabled?: boolean;\n\treadonly id: string;\n\treadonly key: PublicMcpPresetKey;\n\treadonly license: PublicMcpLicense;\n\treadonly notes: readonly string[];\n\treadonly policy: PublicMcpRuntimePolicy;\n\treadonly implementation?: PublicMcpImplementation;\n\treadonly readiness?: PublicMcpReadiness;\n\treadonly risk: PublicMcpRisk;\n\treadonly sourceUrls: readonly string[];\n\treadonly tools: PublicMcpToolPolicy;\n\treadonly auth?: PublicMcpAuthPolicy;\n\treadonly secrets?: PublicMcpSecretPolicy;\n\treadonly servers?: readonly string[];\n\treadonly transport?: PublicMcpTransport;\n}\n\nexport interface PublicMcpObservedTool {\n\treadonly name: string;\n\treadonly descriptorHash: string;\n\treadonly description: string;\n}\n\nexport interface PublicMcpObservedServer {\n\treadonly serverIdentity: string;\n\treadonly tools: readonly PublicMcpObservedTool[];\n}\n\nexport interface PublicMcpApprovedServer {\n\treadonly serverIdentity: string;\n\treadonly tools: Readonly<Record<string, string>>;\n}\n\nexport type PublicMcpAdmissionStatus = \"allow\" | \"quarantine\";\n\nexport interface PublicMcpAdmissionDecision {\n\treadonly status: PublicMcpAdmissionStatus;\n\treadonly reasons: readonly string[];\n}\n\nexport type PublicMcpHashable =\n\t| null\n\t| boolean\n\t| number\n\t| string\n\t| readonly PublicMcpHashable[]\n\t| {\n\t\t\treadonly [key: string]: PublicMcpHashable;\n\t  };\n\nexport const PUBLIC_MCP_PRESETS = {\n\tcontext7: {\n\t\tid: \"context7\",\n\t\tkey: \"context7\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\"Documentation retrieval preset; optional API key only raises rate limits.\"],\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/upstash/context7\"],\n\t\ttransport: {\n\t\t\ttype: \"http\",\n\t\t\turl: \"https://mcp.context7.com/mcp\",\n\t\t},\n\t\tsecrets: {\n\t\t\toptional: [\"CONTEXT7_API_KEY\"],\n\t\t\theaders: {\n\t\t\t\tCONTEXT7_API_KEY: \"secret-ref:context7\",\n\t\t\t},\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"resolve-library-id\", \"query-docs\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tcacheable: true,\n\t\t\tmaxOutputTokens: 6000,\n\t\t\toutputGuard: true,\n\t\t\tpromptTaint: \"external-docs\",\n\t\t\treadOnly: true,\n\t\t},\n\t},\n\texa: {\n\t\tid: \"exa\",\n\t\tkey: \"exa\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\"Run searches in forked context and return distilled output to the main task.\"],\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/exa-labs/exa-mcp-server\"],\n\t\ttransport: {\n\t\t\ttype: \"http\",\n\t\t\turl: \"https://mcp.exa.ai/mcp\",\n\t\t},\n\t\tauth: {\n\t\t\tkind: \"header\",\n\t\t\theader: \"Authorization\",\n\t\t\tsecretRef: \"secret-ref:exa_api_key\",\n\t\t},\n\t\tsecrets: {\n\t\t\toptional: [\"EXA_API_KEY\"],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"web_search_exa\", \"web_fetch_exa\"],\n\t\t\tconditionalAllow: [\"web_search_advanced_exa\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tblockPrivateNetwork: true,\n\t\t\tdistillBeforeMainContext: true,\n\t\t\tdomainAllowlistOptional: true,\n\t\t\tforkContext: true,\n\t\t\tmaxOutputTokens: 5000,\n\t\t\tmaxResults: 10,\n\t\t\tssrfGuard: true,\n\t\t},\n\t},\n\tgithubReadOnly: {\n\t\tid: \"github-readonly\",\n\t\tkey: \"githubReadOnly\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\"Read-only GitHub MCP profile; mutation tools remain gated for future explicit workflows.\"],\n\t\trisk: \"R2\",\n\t\tsourceUrls: [\"https://github.com/github/github-mcp-server\"],\n\t\ttransport: {\n\t\t\ttype: \"http\",\n\t\t\turl: \"https://api.githubcopilot.com/mcp/\",\n\t\t},\n\t\tauth: {\n\t\t\tkind: \"bearer\",\n\t\t\tsecretRef: \"secret-ref:github_pat\",\n\t\t},\n\t\tsecrets: {\n\t\t\trequired: [\"GITHUB_PERSONAL_ACCESS_TOKEN\"],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\n\t\t\t\t\"actions_list\",\n\t\t\t\t\"get_file_contents\",\n\t\t\t\t\"issue_read\",\n\t\t\t\t\"list_issues\",\n\t\t\t\t\"list_pull_requests\",\n\t\t\t\t\"pull_request_read\",\n\t\t\t\t\"search_code\",\n\t\t\t\t\"search_issues\",\n\t\t\t\t\"search_pull_requests\",\n\t\t\t\t\"search_repositories\",\n\t\t\t],\n\t\t\tdenyByDefault: true,\n\t\t\trequirePostconditions: [\n\t\t\t\t\"add_comment_to_pending_review\",\n\t\t\t\t\"create_branch\",\n\t\t\t\t\"create_or_update_file\",\n\t\t\t\t\"create_pull_request\",\n\t\t\t\t\"delete_file\",\n\t\t\t\t\"issue_write\",\n\t\t\t\t\"merge_pull_request\",\n\t\t\t\t\"pull_request_review_write\",\n\t\t\t\t\"push_files\",\n\t\t\t\t\"update_pull_request\",\n\t\t\t\t\"update_pull_request_branch\",\n\t\t\t],\n\t\t},\n\t\tpolicy: {\n\t\t\tledger: true,\n\t\t\tmaxOutputTokens: 8000,\n\t\t\tmutationsRequireHumanGate: true,\n\t\t\treadOnly: true,\n\t\t\tsecretBrokerOnly: true,\n\t\t},\n\t},\n\tastGrep: {\n\t\tid: \"ast-grep\",\n\t\tkey: \"astGrep\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\"Experimental upstream; pin descriptor and wrap execution before broad enablement.\"],\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/ast-grep/ast-grep-mcp\"],\n\t\ttransport: {\n\t\t\ttype: \"stdio\",\n\t\t\tcommand: \"uvx\",\n\t\t\targs: [\"--from\", \"git+https://github.com/ast-grep/ast-grep-mcp\", \"ast-grep-server\"],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"dump_syntax_tree\", \"find_code\", \"find_code_by_rule\", \"test_match_code_rule\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tdescriptorHashPinned: true,\n\t\t\tmaxResults: 200,\n\t\t\tnoShell: true,\n\t\t\tworkspaceReadOnly: true,\n\t\t},\n\t},\n\trepomixCodeCompact: {\n\t\tdefaultEnabled: true,\n\t\tid: \"repomix-code-compact\",\n\t\timplementation: \"upstream-mcp\",\n\t\tkey: \"repomixCodeCompact\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\n\t\t\t\"Codebase packing and compression preset; remote repository packing is disabled until a task explicitly opts in.\",\n\t\t\t\"Use grep/read against packed output before full-context attachment.\",\n\t\t],\n\t\treadiness: \"stable\",\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/yamadashy/repomix\"],\n\t\ttransport: {\n\t\t\ttype: \"stdio\",\n\t\t\tcommand: \"npx\",\n\t\t\targs: [\"-y\", \"repomix\", \"--mcp\"],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\n\t\t\t\t\"attach_packed_output\",\n\t\t\t\t\"file_system_read_directory\",\n\t\t\t\t\"grep_repomix_output\",\n\t\t\t\t\"pack_codebase\",\n\t\t\t\t\"read_repomix_output\",\n\t\t\t],\n\t\t\tdisabledByDefault: [\"pack_remote_repository\"],\n\t\t\tgated: [\"file_system_read_file\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tabsolutePathMustBeUnderWorkspace: true,\n\t\t\tblockRemoteRepositoryByDefault: true,\n\t\t\tdescriptorHashPinned: true,\n\t\t\tevidenceLedger: true,\n\t\t\tmaxOutputTokens: 120_000,\n\t\t\toutputGuard: true,\n\t\t\tpreferGrepBeforeFullRead: true,\n\t\t\tpreferIncrementalRead: true,\n\t\t\tsecretScanRequired: true,\n\t\t\tworkspaceReadOnly: true,\n\t\t},\n\t},\n\tomkLlmlinguaCompress: {\n\t\tdefaultEnabled: true,\n\t\tid: \"omk-llmlingua-compress\",\n\t\timplementation: \"omk-owned\",\n\t\tkey: \"omkLlmlinguaCompress\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\n\t\t\t\"First-party wrapper target for LLMLingua-style prompt and context compression.\",\n\t\t\t\"System prompts, latest user turns, and tool schemas must stay outside lossy compression.\",\n\t\t],\n\t\treadiness: \"stable\",\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/microsoft/LLMLingua\", \"https://arxiv.org/abs/2403.12968\"],\n\t\ttransport: {\n\t\t\ttype: \"embedded-python-or-sidecar\",\n\t\t\tpackage: \"llmlingua\",\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\n\t\t\t\t\"compress_context_items\",\n\t\t\t\t\"compress_messages\",\n\t\t\t\t\"compress_prompt\",\n\t\t\t\t\"compress_representation_candidate\",\n\t\t\t\t\"verify_compression_coverage\",\n\t\t\t],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tcacheMaterializedOutputs: true,\n\t\t\tdefaultCompressionRatio: 3,\n\t\t\tevidenceLedger: true,\n\t\t\tlocalOnly: true,\n\t\t\tmaxCompressionRatio: 8,\n\t\t\tmaxInputTokens: 200_000,\n\t\t\tnoFilesystemReadExceptModelCache: true,\n\t\t\tnoNetwork: true,\n\t\t\toutputGuard: true,\n\t\t\trejectIfCoverageBelow: {\n\t\t\t\thard: 0.95,\n\t\t\t\thigh: 0.8,\n\t\t\t\tmedium: 0.55,\n\t\t\t\tlow: 0.3,\n\t\t\t},\n\t\t\trequireCoverageVerification: true,\n\t\t},\n\t},\n\tdoclingUnderstand: {\n\t\tdefaultEnabled: true,\n\t\tid: \"docling-understand\",\n\t\timplementation: \"upstream-mcp\",\n\t\tkey: \"doclingUnderstand\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\n\t\t\t\"Structured document understanding preset for PDFs, Office files, tables, OCR, and layout-sensitive conversions.\",\n\t\t\t\"Parser attack surface requires sandboxing and workspace-only local file access.\",\n\t\t],\n\t\treadiness: \"stable\",\n\t\trisk: \"R2\",\n\t\tsourceUrls: [\"https://github.com/docling-project/docling\", \"https://github.com/docling-project/docling-mcp\"],\n\t\ttransport: {\n\t\t\ttype: \"stdio\",\n\t\t\tcommand: \"uvx\",\n\t\t\targs: [\"--from=docling-mcp\", \"docling-mcp-server\", \"--transport\", \"stdio\"],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"convert_document\", \"export_docling_document_to_json\", \"export_docling_document_to_markdown\"],\n\t\t\tgated: [\"create_new_docling_document\", \"save_docling_document\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tblockNetworkUrlsByDefault: true,\n\t\t\tcacheDocuments: true,\n\t\t\tevidenceLedger: true,\n\t\t\tlocalFilesUnderWorkspaceOnly: true,\n\t\t\tmaxInputBytes: 80_000_000,\n\t\t\tmaxOutputTokens: 80_000,\n\t\t\toutputGuard: true,\n\t\t\trequiresSandbox: true,\n\t\t},\n\t},\n\tmarkitdownLite: {\n\t\tdefaultEnabled: true,\n\t\tid: \"markitdown-lite\",\n\t\timplementation: \"upstream-mcp\",\n\t\tkey: \"markitdownLite\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\n\t\t\t\"Lightweight Markdown conversion fallback for local files and data URIs.\",\n\t\t\t\"HTTP, ZIP, and YouTube inputs stay blocked until a task explicitly needs them.\",\n\t\t],\n\t\treadiness: \"stable\",\n\t\trisk: \"R2\",\n\t\tsourceUrls: [\n\t\t\t\"https://github.com/microsoft/markitdown\",\n\t\t\t\"https://github.com/microsoft/markitdown/tree/main/packages/markitdown-mcp\",\n\t\t],\n\t\ttransport: {\n\t\t\ttype: \"stdio\",\n\t\t\tcommand: \"markitdown-mcp\",\n\t\t\targs: [],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"convert_to_markdown\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tallowedUriSchemes: [\"file\", \"data\"],\n\t\t\tblockHttpByDefault: true,\n\t\t\tdenyYoutubeByDefault: true,\n\t\t\tdenyZipByDefault: true,\n\t\t\tevidenceLedger: true,\n\t\t\tfileRoot: \"workspaceRoot\",\n\t\t\tmaxInputBytes: 30_000_000,\n\t\t\tmaxOutputTokens: 50_000,\n\t\t\toutputGuard: true,\n\t\t\trequiresSandbox: true,\n\t\t},\n\t},\n\tfirecrawlWebUnderstand: {\n\t\tdefaultEnabled: false,\n\t\tid: \"firecrawl-web-understand\",\n\t\timplementation: \"upstream-mcp\",\n\t\tkey: \"firecrawlWebUnderstand\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\n\t\t\t\"Opt-in live web understanding preset; search and scrape are the only default-admissible tools.\",\n\t\t\t\"Prefer JSON extraction over full-page Markdown to protect the context budget.\",\n\t\t],\n\t\treadiness: \"stable\",\n\t\trisk: \"R2\",\n\t\tsourceUrls: [\"https://github.com/firecrawl/firecrawl-mcp-server\"],\n\t\ttransport: {\n\t\t\ttype: \"http\",\n\t\t\turl: \"https://mcp.firecrawl.dev/v2/mcp\",\n\t\t},\n\t\tauth: {\n\t\t\tkind: \"bearer\",\n\t\t\tsecretRef: \"secret-ref:firecrawl_api_key\",\n\t\t},\n\t\tsecrets: {\n\t\t\toptional: [\"FIRECRAWL_API_KEY\", \"FIRECRAWL_OAUTH_TOKEN\"],\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"firecrawl_scrape\", \"firecrawl_search\"],\n\t\t\tdisabledByDefault: [\"firecrawl_agent\", \"firecrawl_crawl\", \"firecrawl_interact\", \"firecrawl_monitor\"],\n\t\t\tgated: [\"firecrawl_extract\", \"firecrawl_map\", \"firecrawl_research\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tblockMetadataIp: true,\n\t\t\tblockPrivateNetwork: true,\n\t\t\tdistillBeforeMainContext: true,\n\t\t\tevidenceLedger: true,\n\t\t\tforkContext: true,\n\t\t\tmarkdownFullPageRequiresExplicitNeed: true,\n\t\t\tmaxOutputTokens: 40_000,\n\t\t\tmaxUrlsPerTask: 10,\n\t\t\toutputGuard: true,\n\t\t\tpreferJsonExtraction: true,\n\t\t\trequireOriginAllowlistForScrape: true,\n\t\t},\n\t},\n\tdeepwikiRepoUnderstandCandidate: {\n\t\tdefaultEnabled: false,\n\t\tid: \"deepwiki-repo-understand\",\n\t\timplementation: \"candidate-wrapper\",\n\t\tkey: \"deepwikiRepoUnderstandCandidate\",\n\t\tlicense: \"Unspecified\",\n\t\tnotes: [\n\t\t\t\"Candidate only until an official MCP endpoint, tool schema, auth model, and retention boundary are verified.\",\n\t\t\t\"Remote repository indexing is public-repo-only by default.\",\n\t\t],\n\t\treadiness: \"candidate\",\n\t\trisk: \"R2\",\n\t\tsourceUrls: [\"https://deepwiki.com/\"],\n\t\ttools: {\n\t\t\tallow: [],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tdescriptorHashPinned: true,\n\t\t\tevidenceLedger: true,\n\t\t\tnoSecrets: true,\n\t\t\toutputGuard: true,\n\t\t\tprivateRepoDeniedByDefault: true,\n\t\t\tpublicReposOnly: true,\n\t\t},\n\t},\n\tinsaneSearchCandidate: {\n\t\tdefaultEnabled: false,\n\t\tid: \"insane-search-public-reader\",\n\t\timplementation: \"candidate-wrapper\",\n\t\tkey: \"insaneSearchCandidate\",\n\t\tlicense: \"MIT\",\n\t\tnotes: [\n\t\t\t\"Candidate only: upstream is a Claude Code plugin, not a verified standalone MCP transport.\",\n\t\t\t\"Any OMK integration must be a sandboxed first-party wrapper around public-content reads, with auto-install disabled.\",\n\t\t],\n\t\treadiness: \"candidate\",\n\t\trisk: \"R3\",\n\t\tsourceUrls: [\"https://github.com/fivetaku/insane-search\"],\n\t\ttools: {\n\t\t\tallow: [\"insane_search_public_read\"],\n\t\t\tdisabledByDefault: [\"insane_search_auto_install_dependencies\"],\n\t\t\tgated: [\"insane_search_browser_escalation\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tauthenticationBoundaryRequired: true,\n\t\t\tblockMetadataIp: true,\n\t\t\tblockPrivateNetwork: true,\n\t\t\tdisableAutoInstall: true,\n\t\t\tdistillBeforeMainContext: true,\n\t\t\tevidenceLedger: true,\n\t\t\tforkContext: true,\n\t\t\tmaxBrowserActions: 20,\n\t\t\tmaxOutputTokens: 30_000,\n\t\t\toutputGuard: true,\n\t\t\tpublicContentOnly: true,\n\t\t\trequiresOriginAllowlist: true,\n\t\t\trequiresSandbox: true,\n\t\t},\n\t},\n\tplaywrightSandboxed: {\n\t\tid: \"playwright-sandboxed\",\n\t\tkey: \"playwrightSandboxed\",\n\t\tlicense: \"Apache-2.0\",\n\t\tnotes: [\"Browser automation preset; enable only with sandbox and origin controls.\"],\n\t\trisk: \"R3\",\n\t\tsourceUrls: [\"https://github.com/microsoft/playwright-mcp\"],\n\t\ttransport: {\n\t\t\ttype: \"local-package\",\n\t\t\tpackage: \"@playwright/mcp\",\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\n\t\t\t\t\"browser_close\",\n\t\t\t\t\"browser_click\",\n\t\t\t\t\"browser_navigate\",\n\t\t\t\t\"browser_snapshot\",\n\t\t\t\t\"browser_type\",\n\t\t\t\t\"browser_wait_for\",\n\t\t\t],\n\t\t\tdeny: [\"browser_console_messages\", \"browser_file_upload\", \"browser_pdf_save\", \"browser_press_key\"],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tblockMetadataIp: true,\n\t\t\tblockPrivateNetwork: true,\n\t\t\tledger: true,\n\t\t\tmaxBrowserActions: 40,\n\t\t\trecordEvidence: true,\n\t\t\trequiresExplicitPostconditions: true,\n\t\t\trequiresOriginAllowlist: true,\n\t\t\trequiresSandbox: true,\n\t\t},\n\t},\n\tmicrosoftLearn: {\n\t\tid: \"microsoft-learn\",\n\t\tkey: \"microsoftLearn\",\n\t\tlicense: \"Unspecified\",\n\t\tnotes: [\"Microsoft official remote documentation endpoint from the Microsoft MCP catalog.\"],\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/microsoft/mcp\"],\n\t\ttransport: {\n\t\t\ttype: \"http\",\n\t\t\turl: \"https://learn.microsoft.com/api/mcp\",\n\t\t},\n\t\ttools: {\n\t\t\tallow: [\"*\"],\n\t\t\tdenyByDefault: true,\n\t\t\tdenyMutations: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tcacheable: true,\n\t\t\tmaxOutputTokens: 6000,\n\t\t\toutputGuard: true,\n\t\t\tpromptTaint: \"external-docs\",\n\t\t\treadOnly: true,\n\t\t},\n\t},\n\tofficialReferenceSafePack: {\n\t\tid: \"official-reference-safe-pack\",\n\t\tkey: \"officialReferenceSafePack\",\n\t\tlicense: \"Apache-2.0/MIT/CC-BY-4.0\",\n\t\tnotes: [\"Reference implementations only; wrap before production use.\"],\n\t\trisk: \"R1\",\n\t\tsourceUrls: [\"https://github.com/modelcontextprotocol/servers\"],\n\t\tservers: [\"time\", \"memory\", \"sequential-thinking\", \"git-readonly\"],\n\t\ttools: {\n\t\t\tallow: [],\n\t\t\tdenyByDefault: true,\n\t\t},\n\t\tpolicy: {\n\t\t\tblockPrivateNetwork: true,\n\t\t\tdescriptorHashPinned: true,\n\t\t\tfilesystemRoot: \"workspaceRoot\",\n\t\t\tmutationsRequirePostconditions: true,\n\t\t},\n\t},\n} as const satisfies Record<PublicMcpPresetKey, PublicMcpPreset>;\n\nexport const OMK_PUBLIC_CONTEXT_MCP_BUNDLE = {\n\tstableDefaults: [\"repomix-code-compact\", \"docling-understand\", \"markitdown-lite\", \"omk-llmlingua-compress\"],\n\toptInResearchWeb: [\"firecrawl-web-understand\"],\n\tcandidatesNeedVerification: [\"deepwiki-repo-understand\", \"insane-search-public-reader\"],\n\tinternalRouters: [\"mcp-tool-rag-router\"],\n} as const;\n\nexport function listPublicMcpPresets(): PublicMcpPreset[] {\n\treturn Object.values(PUBLIC_MCP_PRESETS).map((preset) => clonePublicMcpPreset(preset));\n}\n\nexport function canonicalMcpPolicyHash(value: PublicMcpHashable): string {\n\treturn createHash(\"sha256\").update(canonicalStringify(value)).digest(\"hex\");\n}\n\nexport function canonicalPublicMcpServerIdentity(preset: PublicMcpPreset): string {\n\treturn canonicalMcpPolicyHash({\n\t\tid: preset.id,\n\t\tservers: preset.servers ?? null,\n\t\ttransport: preset.transport ?? null,\n\t});\n}\n\nexport function admitPublicMcpServer(\n\tpreset: PublicMcpPreset,\n\tobserved: PublicMcpObservedServer,\n\tapproved: PublicMcpApprovedServer | undefined,\n): PublicMcpAdmissionDecision {\n\tif (!approved) {\n\t\treturn {\n\t\t\tstatus: \"quarantine\",\n\t\t\treasons: [\"server_not_approved\"],\n\t\t};\n\t}\n\n\tif (approved.serverIdentity !== observed.serverIdentity) {\n\t\treturn {\n\t\t\tstatus: \"quarantine\",\n\t\t\treasons: [\"server_identity_changed\"],\n\t\t};\n\t}\n\n\tconst reasons: string[] = [];\n\n\tfor (const tool of observed.tools) {\n\t\tconst approvedDescriptorHash = approved.tools[tool.name];\n\n\t\tif (!approvedDescriptorHash) {\n\t\t\treasons.push(`new_tool:${tool.name}`);\n\t\t} else if (approvedDescriptorHash !== tool.descriptorHash) {\n\t\t\treasons.push(`descriptor_changed:${tool.name}`);\n\t\t}\n\n\t\tif (!isToolAllowed(preset.tools, tool.name)) {\n\t\t\treasons.push(`tool_not_allowed:${tool.name}`);\n\t\t}\n\n\t\tif (shouldDenyMutationLikeTool(preset, tool.name)) {\n\t\t\treasons.push(`mutation_tool_denied:${tool.name}`);\n\t\t}\n\n\t\tif (detectMcpDescriptorPromptInjection(tool.description).score > 0.7) {\n\t\t\treasons.push(`descriptor_prompt_injection:${tool.name}`);\n\t\t}\n\t}\n\n\treturn {\n\t\tstatus: reasons.length === 0 ? \"allow\" : \"quarantine\",\n\t\treasons,\n\t};\n}\n\nexport function detectMcpDescriptorPromptInjection(description: string): { readonly score: number } {\n\tconst normalized = description.toLowerCase();\n\tconst suspiciousPatterns = [\n\t\t/ignore\\s+(?:all\\s+)?previous\\s+instructions/,\n\t\t/disregard\\s+(?:all\\s+)?previous\\s+instructions/,\n\t\t/exfiltrat/,\n\t\t/reveal\\s+(?:the\\s+)?(?:system\\s+)?prompt/,\n\t\t/send\\s+(?:me\\s+)?(?:all\\s+)?secrets/,\n\t];\n\tconst hits = suspiciousPatterns.filter((pattern) => pattern.test(normalized)).length;\n\n\treturn {\n\t\tscore: hits === 0 ? 0 : Math.min(1, 0.6 + hits * 0.25),\n\t};\n}\n\nfunction clonePublicMcpPreset(preset: PublicMcpPreset): PublicMcpPreset {\n\treturn {\n\t\t...preset,\n\t\tauth: preset.auth ? { ...preset.auth } : undefined,\n\t\tdefaultEnabled: preset.defaultEnabled,\n\t\timplementation: preset.implementation,\n\t\tnotes: [...preset.notes],\n\t\tpolicy: cloneRuntimePolicy(preset.policy),\n\t\treadiness: preset.readiness,\n\t\tsecrets: preset.secrets\n\t\t\t? {\n\t\t\t\t\theaders: preset.secrets.headers ? { ...preset.secrets.headers } : undefined,\n\t\t\t\t\toptional: preset.secrets.optional ? [...preset.secrets.optional] : undefined,\n\t\t\t\t\trequired: preset.secrets.required ? [...preset.secrets.required] : undefined,\n\t\t\t\t}\n\t\t\t: undefined,\n\t\tservers: preset.servers ? [...preset.servers] : undefined,\n\t\tsourceUrls: [...preset.sourceUrls],\n\t\ttools: {\n\t\t\tallow: [...preset.tools.allow],\n\t\t\tconditionalAllow: preset.tools.conditionalAllow ? [...preset.tools.conditionalAllow] : undefined,\n\t\t\tdeny: preset.tools.deny ? [...preset.tools.deny] : undefined,\n\t\t\tdenyByDefault: preset.tools.denyByDefault,\n\t\t\tdenyMutations: preset.tools.denyMutations,\n\t\t\tdisabledByDefault: preset.tools.disabledByDefault ? [...preset.tools.disabledByDefault] : undefined,\n\t\t\tgated: preset.tools.gated ? [...preset.tools.gated] : undefined,\n\t\t\trequirePostconditions: preset.tools.requirePostconditions\n\t\t\t\t? [...preset.tools.requirePostconditions]\n\t\t\t\t: undefined,\n\t\t},\n\t\ttransport: preset.transport ? cloneTransport(preset.transport) : undefined,\n\t};\n}\n\nfunction cloneTransport(transport: PublicMcpTransport): PublicMcpTransport {\n\tif (transport.type === \"stdio\") {\n\t\treturn {\n\t\t\t...transport,\n\t\t\targs: [...transport.args],\n\t\t};\n\t}\n\n\tif (transport.type === \"local-package\") {\n\t\treturn {\n\t\t\t...transport,\n\t\t\targs: transport.args ? [...transport.args] : undefined,\n\t\t};\n\t}\n\n\tif (transport.type === \"embedded-python-or-sidecar\") {\n\t\treturn { ...transport };\n\t}\n\n\treturn { ...transport };\n}\n\nfunction cloneRuntimePolicy(policy: PublicMcpRuntimePolicy): PublicMcpRuntimePolicy {\n\treturn {\n\t\t...policy,\n\t\tallowedUriSchemes: policy.allowedUriSchemes ? [...policy.allowedUriSchemes] : undefined,\n\t\trejectIfCoverageBelow: policy.rejectIfCoverageBelow ? { ...policy.rejectIfCoverageBelow } : undefined,\n\t};\n}\n\nfunction isToolAllowed(policy: PublicMcpToolPolicy, toolName: string): boolean {\n\tif (policy.deny?.includes(toolName)) {\n\t\treturn false;\n\t}\n\n\tif (policy.allow.includes(\"*\")) {\n\t\treturn true;\n\t}\n\n\treturn policy.allow.includes(toolName);\n}\n\nfunction shouldDenyMutationLikeTool(preset: PublicMcpPreset, toolName: string): boolean {\n\tif (!preset.tools.allow.includes(\"*\")) {\n\t\treturn false;\n\t}\n\n\tif (!preset.tools.denyMutations && !preset.policy.readOnly && !preset.policy.mutationsRequirePostconditions) {\n\t\treturn false;\n\t}\n\n\treturn isMutationLikeToolName(toolName);\n}\n\nfunction isMutationLikeToolName(toolName: string): boolean {\n\treturn /(?:^|[_-])(add|approve|archive|cancel|close|create|delete|dismiss|merge|post|push|remove|send|submit|update|upload|write)(?:$|[_-])/.test(\n\t\ttoolName.toLowerCase(),\n\t);\n}\n\nfunction canonicalStringify(value: PublicMcpHashable): string {\n\tif (value === null || typeof value === \"boolean\" || typeof value === \"number\" || typeof value === \"string\") {\n\t\treturn JSON.stringify(value);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map((item) => canonicalStringify(item)).join(\",\")}]`;\n\t}\n\n\tconst record = value as { readonly [key: string]: PublicMcpHashable };\n\tconst keys = Object.keys(record).sort();\n\treturn `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalStringify(record[key])}`).join(\",\")}}`;\n}\n"]}