protect-mcp 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.7.3: tool input reaches `context.input`, and the hook path fails closed
+
+Two correctness fixes for policy authors who rely on the documented Cedar shape.
+
+The evaluator maps tool input to Cedar `context.input`, and the bundled policy
+examples are written against `context.input.*`, but the `evaluate` CLI path and
+the HTTP hook server only flattened tool input into top-level context fields. So
+a policy keyed on `context.input.path` silently saw nothing on those paths: a
+`forbid` that should have denied never fired, and the call was allowed. Both
+paths now pass the tool input through, so nested-shape policies match. The
+existing flattened fields are kept for back-compat. (Thanks to @koriyoshi2041,
+scopeblind-gateway#8, for the report and repro.)
+
+Separately, the hook server's Cedar evaluation fell through to **allow** on an
+unexpected evaluator throw, which contradicted the "denies on any error"
+guarantee from 0.7.0 (the CLI path already failed closed). The hook path now
+denies on an unexpected eval error while a policy is configured.
+
+Regression coverage added on all three paths; `npm ci` from a clean clone also
+works again (the lockfile was out of sync).
+
+## 0.7.2: run the gate in other agents (Codex, Cursor, Gemini, Hermes)
+
+The `evaluate` and `sign` verbs now accept `--format <host>`
+(claude | codex | gemini | cursor | hermes | grok). With it, the verb reads the
+host's hook payload from stdin (tool name and input) and emits the deny verdict
+in that host's hook contract, so the same fail-closed Cedar gate works as a
+PreToolUse/PostToolUse hook outside Claude Code.
+
+The load-bearing detail: **Hermes ignores hook exit codes** and reads the verdict
+from stdout, so `--format hermes` denies via `{"decision":"block"}` on stdout. A
+raw exit-2 (which every other host honors) would have silently failed open there.
+Cursor and Gemini receive their structured stdout deny verdict in addition to
+exit 2. Without `--format`, the verbs behave exactly as before (the
+`--tool`/`--input` flag mode is unchanged).
+
 ## 0.7.1: documentation and security policy
 
 No code change from 0.7.0. Rewrote the README to lead with the fail-closed and

package/README.md

@@ -68,7 +68,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.0 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
+            "command": "npx protect-mcp@0.7.3 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
           }
         ]
       }
@@ -79,7 +79,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.0 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
+            "command": "npx protect-mcp@0.7.3 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
           }
         ]
       }
@@ -93,6 +93,26 @@ session always runs the gate you tested:
 configured, and if no signer is available it records an honest unsigned line
 (`"signed": false`) rather than failing the tool.
 
+## Use it in other agents (Codex, Cursor, Gemini, Hermes)
+
+The same fail-closed gate runs as a tool hook in any agent that supports them. Add
+`--format <host>` so the verb reads that host's hook payload from stdin and denies
+in its contract:
+
+```bash
+# the PreToolUse / before-tool command for each host
+npx -y protect-mcp@latest evaluate --format codex  --cedar ./cedar   # OpenAI Codex
+npx -y protect-mcp@latest evaluate --format gemini --cedar ./cedar   # Gemini CLI BeforeTool
+npx -y protect-mcp@latest evaluate --format cursor --cedar ./cedar   # Cursor beforeShellExecution
+npx -y protect-mcp@latest evaluate --format hermes --cedar ./cedar   # Hermes pre_tool_call
+```
+
+Pair each with `sign --format <host>` on the post-tool event for receipts. The
+important case is **Hermes**, which ignores hook exit codes and reads the verdict
+from stdout, so `--format hermes` denies via `{"decision":"block"}` rather than
+exit 2 (a raw exit-2 would silently fail open there). Without `--format`, the
+verbs read `--tool`/`--input` flags exactly as in the Claude Code section above.
+
 ## Write a policy
 
 Cedar policies live in a directory you point at with `--cedar`. A `forbid` rule

package/dist/{chunk-X63ELMU4.mjs → chunk-G67NUBML.mjs}

@@ -258,7 +258,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -297,10 +300,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {

package/dist/cli.js

@@ -5096,7 +5096,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -5135,10 +5138,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {
@@ -7622,17 +7644,65 @@ function loadPolicyArg(argv) {
   }
   return null;
 }
+async function readHookStdin() {
+  if (process.stdin.isTTY) return null;
+  try {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const raw = Buffer.concat(chunks).toString("utf-8").trim();
+    return raw ? JSON.parse(raw) : null;
+  } catch {
+    return null;
+  }
+}
+function mapHookPayload(j) {
+  const tool = j.tool_name ?? j.toolName;
+  const input = j.tool_input ?? j.toolInput;
+  if (input === void 0 && j.command !== void 0) {
+    return { tool: tool ?? "Bash", input: { command: j.command } };
+  }
+  return { tool, input };
+}
+function emitDecision(format, allowed, reason) {
+  if (format === "hermes") {
+    process.stdout.write(JSON.stringify(allowed ? {} : { decision: "block", reason }) + "\n");
+    process.exit(0);
+  }
+  if (allowed) {
+    process.stdout.write(JSON.stringify({ allowed: true, reason }) + "\n");
+    process.exit(0);
+  }
+  if (format === "cursor") {
+    process.stdout.write(JSON.stringify({ permission: "deny", userMessage: reason }) + "\n");
+  } else if (format === "gemini") {
+    process.stdout.write(JSON.stringify({ decision: "deny", reason }) + "\n");
+  }
+  process.stderr.write(`protect-mcp denied: ${reason}
+`);
+  process.exit(2);
+}
 async function handleEvaluate(argv) {
-  const tool = flagValue(argv, "--tool") || "";
-  const inputRaw = flagValue(argv, "--input") || "{}";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
+  let inputRaw = flagValue(argv, "--input") || "{}";
   const contextRaw = flagValue(argv, "--context");
   const failOnMissing = flagValue(argv, "--fail-on-missing-policy") !== "false";
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+      if (m.input !== void 0) inputRaw = JSON.stringify(m.input);
+    }
+  }
   const policySet = loadPolicyArg(argv);
   if (!policySet) {
     if (failOnMissing) {
+      if (format) emitDecision(format, false, "policy not found (fail-closed)");
       process.stderr.write("protect-mcp evaluate: policy not found; denying (fail-closed). Pass --fail-on-missing-policy false to allow.\n");
       process.exit(2);
     }
+    if (format) emitDecision(format, true, "no_policy_configured");
     process.stdout.write(JSON.stringify({ allowed: true, reason: "no_policy_configured" }) + "\n");
     process.exit(0);
   }
@@ -7652,14 +7722,23 @@ async function handleEvaluate(argv) {
   if (typeof input.command === "string" && context.command_pattern === void 0) {
     context.command_pattern = input.command;
   }
-  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context }, void 0, { failClosed: true });
+  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context, toolInput: input }, void 0, { failClosed: true });
+  if (format) emitDecision(format, decision.allowed, decision.reason || (decision.allowed ? "allowed" : "denied by policy"));
   process.stdout.write(JSON.stringify({ allowed: decision.allowed, reason: decision.reason, policy_digest: policySet.digest }) + "\n");
   process.exit(decision.allowed ? 0 : 2);
 }
 async function handleSign(argv) {
-  const tool = flagValue(argv, "--tool") || "";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
   const receiptsDir = flagValue(argv, "--receipts") || "./receipts/";
   const keyPath = flagValue(argv, "--key");
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+    }
+  }
   if (keyPath && (0, import_node_fs10.existsSync)(keyPath)) {
     try {
       await initSigning({ enabled: true, key_path: keyPath });
@@ -7685,6 +7764,10 @@ async function handleSign(argv) {
     (0, import_node_fs10.appendFileSync)((0, import_node_path6.join)(receiptsDir, "receipts.jsonl"), line + "\n");
   } catch {
   }
+  if (format === "hermes") {
+    process.stdout.write("{}\n");
+    process.exit(0);
+  }
   process.stdout.write(JSON.stringify({ signed: Boolean(signed.signed), artifact_type: signed.artifact_type, request_id: requestId }) + "\n");
   process.exit(0);
 }

package/dist/cli.mjs

@@ -1297,17 +1297,65 @@ function loadPolicyArg(argv) {
   }
   return null;
 }
+async function readHookStdin() {
+  if (process.stdin.isTTY) return null;
+  try {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const raw = Buffer.concat(chunks).toString("utf-8").trim();
+    return raw ? JSON.parse(raw) : null;
+  } catch {
+    return null;
+  }
+}
+function mapHookPayload(j) {
+  const tool = j.tool_name ?? j.toolName;
+  const input = j.tool_input ?? j.toolInput;
+  if (input === void 0 && j.command !== void 0) {
+    return { tool: tool ?? "Bash", input: { command: j.command } };
+  }
+  return { tool, input };
+}
+function emitDecision(format, allowed, reason) {
+  if (format === "hermes") {
+    process.stdout.write(JSON.stringify(allowed ? {} : { decision: "block", reason }) + "\n");
+    process.exit(0);
+  }
+  if (allowed) {
+    process.stdout.write(JSON.stringify({ allowed: true, reason }) + "\n");
+    process.exit(0);
+  }
+  if (format === "cursor") {
+    process.stdout.write(JSON.stringify({ permission: "deny", userMessage: reason }) + "\n");
+  } else if (format === "gemini") {
+    process.stdout.write(JSON.stringify({ decision: "deny", reason }) + "\n");
+  }
+  process.stderr.write(`protect-mcp denied: ${reason}
+`);
+  process.exit(2);
+}
 async function handleEvaluate(argv) {
-  const tool = flagValue(argv, "--tool") || "";
-  const inputRaw = flagValue(argv, "--input") || "{}";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
+  let inputRaw = flagValue(argv, "--input") || "{}";
   const contextRaw = flagValue(argv, "--context");
   const failOnMissing = flagValue(argv, "--fail-on-missing-policy") !== "false";
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+      if (m.input !== void 0) inputRaw = JSON.stringify(m.input);
+    }
+  }
   const policySet = loadPolicyArg(argv);
   if (!policySet) {
     if (failOnMissing) {
+      if (format) emitDecision(format, false, "policy not found (fail-closed)");
       process.stderr.write("protect-mcp evaluate: policy not found; denying (fail-closed). Pass --fail-on-missing-policy false to allow.\n");
       process.exit(2);
     }
+    if (format) emitDecision(format, true, "no_policy_configured");
     process.stdout.write(JSON.stringify({ allowed: true, reason: "no_policy_configured" }) + "\n");
     process.exit(0);
   }
@@ -1327,14 +1375,23 @@ async function handleEvaluate(argv) {
   if (typeof input.command === "string" && context.command_pattern === void 0) {
     context.command_pattern = input.command;
   }
-  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context }, void 0, { failClosed: true });
+  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context, toolInput: input }, void 0, { failClosed: true });
+  if (format) emitDecision(format, decision.allowed, decision.reason || (decision.allowed ? "allowed" : "denied by policy"));
   process.stdout.write(JSON.stringify({ allowed: decision.allowed, reason: decision.reason, policy_digest: policySet.digest }) + "\n");
   process.exit(decision.allowed ? 0 : 2);
 }
 async function handleSign(argv) {
-  const tool = flagValue(argv, "--tool") || "";
+  const format = flagValue(argv, "--format");
+  let tool = flagValue(argv, "--tool") || "";
   const receiptsDir = flagValue(argv, "--receipts") || "./receipts/";
   const keyPath = flagValue(argv, "--key");
+  if (format) {
+    const j = await readHookStdin();
+    if (j) {
+      const m = mapHookPayload(j);
+      if (m.tool) tool = m.tool;
+    }
+  }
   if (keyPath && existsSyncCli(keyPath)) {
     try {
       await initSigning({ enabled: true, key_path: keyPath });
@@ -1360,6 +1417,10 @@ async function handleSign(argv) {
     appendFileSyncCli(joinCli(receiptsDir, "receipts.jsonl"), line + "\n");
   } catch {
   }
+  if (format === "hermes") {
+    process.stdout.write("{}\n");
+    process.exit(0);
+  }
   process.stdout.write(JSON.stringify({ signed: Boolean(signed.signed), artifact_type: signed.artifact_type, request_id: requestId }) + "\n");
   process.exit(0);
 }

package/dist/hook-server.js

@@ -701,7 +701,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -740,10 +743,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {

package/dist/hook-server.mjs

@@ -1,6 +1,6 @@
 import {
   startHookServer
-} from "./chunk-X63ELMU4.mjs";
+} from "./chunk-G67NUBML.mjs";
 import "./chunk-546U3A7R.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {

package/dist/index.js

@@ -39960,7 +39960,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -39999,10 +40002,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {

package/dist/index.mjs

@@ -33,7 +33,7 @@ import {
   forwardReceipt,
   getScopeBlindBridge,
   startHookServer
-} from "./chunk-X63ELMU4.mjs";
+} from "./chunk-G67NUBML.mjs";
 import {
   checkRateLimit,
   evaluateCedar,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + signed receipts for AI agent tool calls. Blocks what breaks the rules before it runs, denies on any policy error, and proves the gate is live with a startup self-test.",
   "main": "dist/index.js",