protect-mcp 0.2.2 → 0.3.0

package/dist/index.mjs

@@ -1,5 +1,6 @@
 import {
   ProtectGateway,
+  buildDecisionContext,
   checkRateLimit,
   evaluateTier,
   getSignerInfo,
@@ -10,132 +11,11 @@ import {
   loadPolicy,
   meetsMinTier,
   parseRateLimit,
+  queryExternalPDP,
   resolveCredential,
   signDecision,
   validateCredentials
-} from "./chunk-ZCKNFULF.mjs";
-
-// src/external-pdp.ts
-async function queryExternalPDP(context, config) {
-  const timeout = config.timeout_ms || 500;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeout);
-  try {
-    const body = formatRequest(context, config.format || "generic");
-    const response = await fetch(config.endpoint, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-      signal: controller.signal
-    });
-    clearTimeout(timer);
-    if (!response.ok) {
-      return fallbackDecision(config, `PDP returned HTTP ${response.status}`);
-    }
-    const result = await response.json();
-    return parseResponse(result, config.format || "generic");
-  } catch (err) {
-    clearTimeout(timer);
-    if (err instanceof Error && err.name === "AbortError") {
-      return fallbackDecision(config, `PDP timeout after ${timeout}ms`);
-    }
-    return fallbackDecision(config, `PDP error: ${err instanceof Error ? err.message : "unknown"}`);
-  }
-}
-function formatRequest(context, format) {
-  switch (format) {
-    case "opa":
-      return {
-        input: {
-          actor: context.actor,
-          action: context.action,
-          target: context.target,
-          credential_ref: context.credential_ref,
-          mode: context.mode,
-          metadata: context.request_metadata
-        }
-      };
-    case "cerbos":
-      return {
-        principal: {
-          id: context.actor.id || "unknown",
-          roles: [context.actor.tier],
-          attr: {
-            manifest_hash: context.actor.manifest_hash
-          }
-        },
-        resource: {
-          kind: "tool",
-          id: context.action.tool,
-          attr: context.target
-        },
-        actions: [context.action.operation || "call"]
-      };
-    case "generic":
-    default:
-      return context;
-  }
-}
-function parseResponse(result, format) {
-  switch (format) {
-    case "opa":
-      if (typeof result.result === "boolean") {
-        return { allowed: result.result };
-      }
-      if (result.result && typeof result.result === "object") {
-        const r = result.result;
-        return {
-          allowed: Boolean(r.allow),
-          reason: r.reason,
-          metadata: r
-        };
-      }
-      return { allowed: false, reason: "unrecognized OPA response" };
-    case "cerbos":
-      if (Array.isArray(result.results) && result.results.length > 0) {
-        const actions = result.results[0].actions;
-        if (actions) {
-          const effect = Object.values(actions)[0];
-          return { allowed: effect === "EFFECT_ALLOW" };
-        }
-      }
-      return { allowed: false, reason: "unrecognized Cerbos response" };
-    case "generic":
-    default:
-      return {
-        allowed: Boolean(result.allowed),
-        reason: result.reason,
-        metadata: result.metadata
-      };
-  }
-}
-function fallbackDecision(config, reason) {
-  const fallback = config.fallback || "deny";
-  return {
-    allowed: fallback === "allow",
-    reason: `fallback_${fallback}: ${reason}`
-  };
-}
-function buildDecisionContext(toolName, tier, opts) {
-  return {
-    v: 1,
-    actor: {
-      id: opts.agentId,
-      tier,
-      manifest_hash: opts.manifestHash
-    },
-    action: {
-      tool: toolName,
-      operation: "call"
-    },
-    target: {
-      service: opts.slug || "default"
-    },
-    credential_ref: opts.credentialRef,
-    mode: opts.mode,
-    request_metadata: opts.requestMetadata || {}
-  };
-}
+} from "./chunk-3WCA7O4D.mjs";
 
 // src/bundle.ts
 function createAuditBundle(opts) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "protect-mcp",
-  "version": "0.2.2",
-  "description": "Security gateway for MCP servers. Shadow-mode logs by default, per-tool policies, optional local signing, and offline-verifiable receipts.",
+  "version": "0.3.0",
+  "description": "Security gateway for MCP servers. Shadow-mode logs by default, per-tool policies, trust-tier gating, credential isolation, BYOPE (OPA/Cerbos), signed receipts, offline verification.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "module": "dist/index.mjs",
@@ -16,7 +16,7 @@
     }
   },
   "scripts": {
-    "build": "tsup src/index.ts src/cli.ts --format cjs,esm --dts --clean",
+    "build": "tsup src/index.ts src/cli.ts src/demo-server.ts --format cjs,esm --dts --clean",
     "test": "vitest run",
     "prepublishOnly": "npm run build"
   },