protect-mcp 0.7.3 → 0.7.5

package/dist/demo-server.d.mts

@@ -12,6 +12,9 @@
  *  - delete_file  (destructive, blocked by default policy)
  *  - web_search   (rate-limited)
  *  - deploy       (high-privilege)
+ *  - github_create_pr (source-control mutation)
+ *  - send_email   (external communication)
+ *  - pms_book_fill (mock portfolio-management booking)
  */
 /**
  * Smithery sandbox server — returns a McpServer instance

package/dist/demo-server.d.ts

@@ -12,6 +12,9 @@
  *  - delete_file  (destructive, blocked by default policy)
  *  - web_search   (rate-limited)
  *  - deploy       (high-privilege)
+ *  - github_create_pr (source-control mutation)
+ *  - send_email   (external communication)
+ *  - pms_book_fill (mock portfolio-management booking)
  */
 /**
  * Smithery sandbox server — returns a McpServer instance

package/dist/demo-server.js

@@ -35064,6 +35064,48 @@ var TOOLS = [
       },
       required: ["environment"]
     }
+  },
+  {
+    name: "github_create_pr",
+    description: "Create a GitHub pull request",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: { type: "string", description: "Repository name" },
+        branch: { type: "string", description: "Source branch" },
+        title: { type: "string", description: "Pull request title" }
+      },
+      required: ["repo", "branch", "title"]
+    }
+  },
+  {
+    name: "send_email",
+    description: "Send an email",
+    inputSchema: {
+      type: "object",
+      properties: {
+        to: { type: "string", description: "Recipient email address" },
+        subject: { type: "string", description: "Subject line" },
+        body: { type: "string", description: "Message body" }
+      },
+      required: ["to", "subject"]
+    }
+  },
+  {
+    name: "pms_book_fill",
+    description: "Book a fill into the mock portfolio management system",
+    inputSchema: {
+      type: "object",
+      properties: {
+        account: { type: "string", description: "Portfolio or fund account" },
+        symbol: { type: "string", description: "Instrument symbol" },
+        side: { type: "string", enum: ["BUY", "SELL"] },
+        quantity: { type: "number" },
+        price: { type: "number" },
+        strategy: { type: "string" }
+      },
+      required: ["account", "symbol", "side", "quantity", "price"]
+    }
   }
 ];
 function handleRequest(request) {
@@ -35073,7 +35115,7 @@ function handleRequest(request) {
       id: request.id,
       result: {
         protocolVersion: "2024-11-05",
-        serverInfo: { name: "protect-mcp-demo", version: "0.5.3" },
+        serverInfo: { name: "protect-mcp-demo", version: process.env.PROTECT_MCP_VERSION || "0.5.3" },
         capabilities: { tools: {} }
       }
     });
@@ -35111,6 +35153,15 @@ Contents: Hello from protect-mcp demo server!`;
       case "deploy":
         resultText = `[demo] Deployed to ${args.environment || "staging"}${args.reason ? ` (reason: ${args.reason})` : ""}`;
         break;
+      case "github_create_pr":
+        resultText = `[demo] Created PR in ${args.repo || "scopeblind/demo"} from ${args.branch || "agent/demo"}: ${args.title || "Agent change"}`;
+        break;
+      case "send_email":
+        resultText = `[demo] Drafted email to ${args.to || "pm@example.com"}: ${args.subject || "Agent update"}`;
+        break;
+      case "pms_book_fill":
+        resultText = `[demo] Booked ${args.side || "BUY"} ${args.quantity || 0} ${args.symbol || "AAPL"} @ ${args.price || 0} into ${args.account || "Demo Fund"} (${args.strategy || "Unassigned"})`;
+        break;
       default:
         resultText = `[demo] Unknown tool: ${toolName}`;
     }
@@ -35150,7 +35201,7 @@ function createSandboxServer() {
   const { z } = require_zod();
   const server = new McpServer({
     name: "protect-mcp",
-    version: "0.4.5",
+    version: process.env.PROTECT_MCP_VERSION || "0.4.5",
     description: "Security gateway for MCP servers. Per-tool policies, Ed25519-signed receipts, human approval gates, trust tiers."
   });
   server.tool(
@@ -35183,6 +35234,30 @@ function createSandboxServer() {
     { environment: z.enum(["staging", "production"]).describe("Target environment"), reason: z.string().optional().describe("Deployment reason") },
     async (args) => ({ content: [{ type: "text", text: `[demo] Deployed to ${args.environment}` }] })
   );
+  server.tool("github_create_pr", "Create a GitHub pull request", {
+    repo: z.string(),
+    branch: z.string(),
+    title: z.string()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] PR created in ${args.repo} from ${args.branch}: ${args.title}` }]
+  }));
+  server.tool("send_email", "Send an email", {
+    to: z.string(),
+    subject: z.string(),
+    body: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Email prepared for ${args.to}: ${args.subject}` }]
+  }));
+  server.tool("pms_book_fill", "Book a fill into a mock PMS", {
+    account: z.string(),
+    symbol: z.string(),
+    side: z.enum(["BUY", "SELL"]),
+    quantity: z.number(),
+    price: z.number(),
+    strategy: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Booked ${args.side} ${args.quantity} ${args.symbol} @ ${args.price} into ${args.account}` }]
+  }));
   return server;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/demo-server.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createSandboxServer
-} from "./chunk-J6L4XCTE.mjs";
+} from "./chunk-SETXVE2K.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {
   createSandboxServer

package/dist/{ed25519-DZMMNNVE.mjs → ed25519-BSHMMVNX.mjs}

@@ -15,7 +15,7 @@ import {
   ristretto255,
   ristretto255_hasher,
   x25519
-} from "./chunk-LYKNULYU.mjs";
+} from "./chunk-LJQOALYR.mjs";
 import "./chunk-D733KAPG.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {

package/dist/hook-server.js

@@ -24,7 +24,7 @@ __export(hook_server_exports, {
 });
 module.exports = __toCommonJS(hook_server_exports);
 var import_node_http2 = require("http");
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_fs5 = require("fs");
 var import_node_path3 = require("path");
 
@@ -320,6 +320,7 @@ function signDecision(entry) {
     if (entry.timing) payload.timing = entry.timing;
     if (entry.swarm) payload.swarm = entry.swarm;
     if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
+    if (entry.action_readback) payload.action_readback = entry.action_readback;
     if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
     const result = artifactsModule.createSignedArtifact(
       artifactType,
@@ -613,6 +614,95 @@ function getScopeBlindBridge() {
   return singleton;
 }
 
+// src/action-readback.ts
+var import_node_crypto3 = require("crypto");
+var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
+var DESTINATION_KEYS = [
+  "path",
+  "file_path",
+  "filePath",
+  "url",
+  "uri",
+  "endpoint",
+  "host",
+  "hostname",
+  "repo",
+  "repository",
+  "branch",
+  "channel",
+  "to",
+  "recipient",
+  "symbol",
+  "account",
+  "bucket",
+  "database",
+  "table",
+  "service"
+];
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`).join(",")}}`;
+}
+function redact(value, path = [], redacted = [], disclosed = [], depth = 0) {
+  if (depth > 4) return "[truncated-depth]";
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") {
+    if (path.length > 0) disclosed.push(path.join("."));
+    if (typeof value === "string" && value.length > 240) return `${value.slice(0, 240)}...`;
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item, idx) => redact(item, [...path, String(idx)], redacted, disclosed, depth + 1));
+  }
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = [...path, key];
+    if (SECRET_KEY_RE.test(key)) {
+      redacted.push(childPath.join("."));
+      out[key] = "[redacted]";
+      continue;
+    }
+    out[key] = redact(child, childPath, redacted, disclosed, depth + 1);
+  }
+  return out;
+}
+function firstStringValue(input, keys) {
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+  }
+  return void 0;
+}
+function actionFor(tool, input) {
+  const explicit = firstStringValue(input, ["action", "operation", "method", "verb", "command"]);
+  if (explicit) return explicit.length > 90 ? `${explicit.slice(0, 90)}...` : explicit;
+  return tool;
+}
+function buildActionReadback(tool, input) {
+  const normalized = input && typeof input === "object" && !Array.isArray(input) ? input : { value: input };
+  const canonical = stableStringify(normalized);
+  const redactedFields = [];
+  const disclosedFields = [];
+  const payloadPreview = redact(normalized, [], redactedFields, disclosedFields);
+  const action = actionFor(tool, normalized);
+  const destination = firstStringValue(normalized, DESTINATION_KEYS);
+  const summary = destination ? `${tool} -> ${destination}` : `${tool} request`;
+  return {
+    tool,
+    action,
+    destination,
+    payload_preview: payloadPreview,
+    payload_hash: (0, import_node_crypto3.createHash)("sha256").update(canonical).digest("hex"),
+    payload_bytes: Buffer.byteLength(canonical, "utf-8"),
+    disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
+    redacted_fields: [...new Set(redactedFields)].slice(0, 80),
+    summary
+  };
+}
+
 // src/hook-server.ts
 var DEFAULT_PORT = 9377;
 var LOG_FILE = ".protect-mcp-log.jsonl";
@@ -641,7 +731,7 @@ function computePayloadDigest(input) {
     return void 0;
   }
   return {
-    input_hash: (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex"),
+    input_hash: (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex"),
     input_size: size,
     truncated: true,
     preview: content.slice(0, 256)
@@ -654,7 +744,7 @@ function computeOutputDigest(output) {
     return void 0;
   }
   return {
-    output_hash: (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex"),
+    output_hash: (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex"),
     output_size: size
   };
 }
@@ -677,13 +767,14 @@ function detectSandboxState() {
 async function handlePreToolUse(input, state) {
   const hookStart = Date.now();
   const toolName = input.toolName || "unknown";
-  const requestId = input.toolUseId || (0, import_node_crypto3.randomUUID)().slice(0, 12);
+  const requestId = input.toolUseId || (0, import_node_crypto4.randomUUID)().slice(0, 12);
   state.inflightTools.set(requestId, {
     tool: toolName,
     startedAt: hookStart,
     requestId
   });
   const payloadDigest = computePayloadDigest(input.toolInput);
+  const actionReadback = buildActionReadback(toolName, input.toolInput || {});
   const swarm = {
     ...state.swarmContext,
     ...input.agentId && { agent_id: input.agentId },
@@ -723,6 +814,7 @@ async function handlePreToolUse(input, state) {
           swarm: swarm.team_name ? swarm : void 0,
           timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
           payload_digest: payloadDigest,
+          action_readback: actionReadback,
           deny_iteration: denyCount,
           sandbox_state: detectSandboxState(),
           plan_receipt_id: state.activePlanReceiptId || void 0
@@ -757,6 +849,7 @@ async function handlePreToolUse(input, state) {
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
         payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
@@ -781,6 +874,7 @@ async function handlePreToolUse(input, state) {
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
         payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
@@ -801,13 +895,15 @@ async function handlePreToolUse(input, state) {
         hook_event: "PreToolUse",
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
           permissionDecision: "ask",
-          permissionDecisionReason: `[ScopeBlind] "${toolName}" requires human approval. Policy: ${state.policyDigest}`
+          permissionDecisionReason: `[ScopeBlind] Approval required for exactly this action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Policy: ${state.policyDigest}`
         }
       };
     }
@@ -852,6 +948,7 @@ async function handlePreToolUse(input, state) {
     swarm: swarm.team_name ? swarm : void 0,
     timing: { hook_latency_ms: hookLatency, started_at: hookStart },
     payload_digest: payloadDigest,
+    action_readback: actionReadback,
     sandbox_state: detectSandboxState(),
     plan_receipt_id: state.activePlanReceiptId || void 0
   });
@@ -868,7 +965,7 @@ async function handlePreToolUse(input, state) {
 }
 async function handlePostToolUse(input, state) {
   const toolName = input.toolName || "unknown";
-  const requestId = input.toolUseId || (0, import_node_crypto3.randomUUID)().slice(0, 12);
+  const requestId = input.toolUseId || (0, import_node_crypto4.randomUUID)().slice(0, 12);
   const now = Date.now();
   const inflight = state.inflightTools.get(requestId);
   const timing = {
@@ -880,7 +977,7 @@ async function handlePostToolUse(input, state) {
     state.inflightTools.delete(requestId);
   }
   const outputDigest = computeOutputDigest(input.toolResult);
-  const receiptId = (0, import_node_crypto3.randomUUID)().slice(0, 8);
+  const receiptId = (0, import_node_crypto4.randomUUID)().slice(0, 8);
   const policyName = state.cedarPolicies ? `cedar:${state.policyDigest}` : state.policyDigest;
   const additionalContext = `[ScopeBlind] Tool call receipted. Policy: ${policyName}. Decision: allow. Receipt: #${receiptId}.` + (timing.tool_duration_ms !== void 0 ? ` Duration: ${timing.tool_duration_ms}ms.` : "") + (timing.hook_latency_ms !== void 0 ? ` Overhead: ${timing.hook_latency_ms}ms.` : "");
   emitDecisionLog(state, {
@@ -912,7 +1009,7 @@ function handleSubagentStart(input, state) {
     tool: `subagent:${agentId}`,
     decision: "allow",
     reason_code: "subagent_started",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SubagentStart",
     swarm: {
       ...state.swarmContext,
@@ -933,7 +1030,7 @@ function handleSubagentStop(input, state) {
     tool: `subagent:${agentId}`,
     decision: "allow",
     reason_code: "subagent_stopped",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SubagentStop",
     swarm: {
       ...state.swarmContext,
@@ -948,7 +1045,7 @@ function handleTaskCreated(input, state) {
     tool: `task:${input.taskId || "unknown"}`,
     decision: "allow",
     reason_code: "task_created",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "TaskCreated",
     swarm: {
       ...state.swarmContext,
@@ -962,7 +1059,7 @@ function handleTaskCompleted(input, state) {
     tool: `task:${input.taskId || "unknown"}`,
     decision: "allow",
     reason_code: "task_completed",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "TaskCompleted",
     swarm: state.swarmContext
   });
@@ -973,7 +1070,7 @@ function handleSessionStart(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "session_started",
-    request_id: input.sessionId || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: input.sessionId || (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SessionStart",
     swarm: state.swarmContext,
     sandbox_state: detectSandboxState()
@@ -996,7 +1093,7 @@ function handleSessionEnd(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "session_ended",
-    request_id: input.sessionId || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: input.sessionId || (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SessionEnd",
     swarm: state.swarmContext
   });
@@ -1007,7 +1104,7 @@ function handleTeammateIdle(input, state) {
     tool: `teammate:${input.agentId || "unknown"}`,
     decision: "allow",
     reason_code: "teammate_idle",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "TeammateIdle",
     swarm: {
       ...state.swarmContext,
@@ -1035,7 +1132,7 @@ function handleConfigChange(input, state) {
       tool: "config",
       decision: "deny",
       reason_code: "config_tamper_detected",
-      request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+      request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
       hook_event: "ConfigChange",
       swarm: state.swarmContext
     });
@@ -1044,7 +1141,7 @@ function handleConfigChange(input, state) {
       tool: "config",
       decision: "allow",
       reason_code: "config_changed",
-      request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+      request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
       hook_event: "ConfigChange"
     });
   }
@@ -1066,7 +1163,7 @@ function handleStop(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "agent_stopped",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "Stop",
     swarm: state.swarmContext
   });
@@ -1074,8 +1171,8 @@ function handleStop(input, state) {
 }
 function emitDecisionLog(state, entry) {
   const mode = state.enforce ? "enforce" : "shadow";
-  const otelTraceId = (0, import_node_crypto3.randomBytes)(16).toString("hex");
-  const otelSpanId = (0, import_node_crypto3.randomBytes)(8).toString("hex");
+  const otelTraceId = (0, import_node_crypto4.randomBytes)(16).toString("hex");
+  const otelSpanId = (0, import_node_crypto4.randomBytes)(8).toString("hex");
   const log = {
     v: 2,
     tool: entry.tool || "unknown",
@@ -1083,7 +1180,7 @@ function emitDecisionLog(state, entry) {
     reason_code: entry.reason_code || "default_allow",
     policy_digest: state.policyDigest,
     policy_engine: state.cedarPolicies ? "cedar" : "built-in",
-    request_id: entry.request_id || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: entry.request_id || (0, import_node_crypto4.randomUUID)().slice(0, 12),
     timestamp: Date.now(),
     mode,
     otel_trace_id: otelTraceId,
@@ -1264,7 +1361,7 @@ async function startHookServer(options = {}) {
       res.end(JSON.stringify({
         status: "ok",
         server: "protect-mcp-hooks",
-        version: "0.5.0",
+        version: process.env.PROTECT_MCP_VERSION || "unknown",
         uptime_ms: Date.now() - state.startTime,
         mode: enforce ? "enforce" : "shadow",
         policy_digest: policyDigest,
@@ -1351,9 +1448,10 @@ async function startHookServer(options = {}) {
     const pad = (s, n = 46) => s.padEnd(n);
     w(`
 `);
-    w(`  protect-mcp v0.5.4
+    w(process.env.PROTECT_MCP_VERSION ? `  protect-mcp v${process.env.PROTECT_MCP_VERSION}
+` : `  protect-mcp
 `);
-    w(`  ScopeBlind \u2014 https://scopeblind.com
+    w(`  ScopeBlind \xB7 https://scopeblind.com
 `);
     w(`
 `);
@@ -1381,7 +1479,13 @@ async function startHookServer(options = {}) {
 `);
     w(`
 `);
-    w(`  deny is authoritative \u2014 cannot be overridden.
+    w(`  deny is authoritative: it cannot be overridden.
+`);
+    w(`
+`);
+    w(`  See your record   npx protect-mcp record
+`);
+    w(`                    a searchable view of every decision, all on this machine
 `);
     w(`
 `);

package/dist/hook-server.mjs

@@ -1,7 +1,7 @@
 import {
   startHookServer
-} from "./chunk-G67NUBML.mjs";
-import "./chunk-546U3A7R.mjs";
+} from "./chunk-6E2DHBAR.mjs";
+import "./chunk-WIPWNWMJ.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {
   startHookServer

package/dist/{http-transport-R5AO7X6D.mjs → http-transport-JBORN27G.mjs}

@@ -1,7 +1,7 @@
 import {
   ProtectGateway
-} from "./chunk-OHUTUFTC.mjs";
-import "./chunk-546U3A7R.mjs";
+} from "./chunk-VTPZ4G5I.mjs";
+import "./chunk-WIPWNWMJ.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 
 // src/http-transport.ts
@@ -34,7 +34,7 @@ async function startHttpTransport(options) {
       res.end(JSON.stringify({
         status: "ok",
         server: "protect-mcp",
-        version: "0.4.0",
+        version: process.env.PROTECT_MCP_VERSION || "unknown",
         transport: "streamable-http",
         mode: config.policy ? config.enforce ? "enforce" : "shadow" : "shadow",
         wrapping: serverCommand.join(" ")