synartesis 0.8.7 → 0.9.0

package/manifests/github.yaml

@@ -1,27 +1,34 @@
-# Policy for GitHub's MCP server.
+# Policy for GitHub's MCP server, github/github-mcp-server, written against
+# the tool reference in its README at v1.12.2.
 #
-# NOT verified against a live account. Everything here is derived from GitHub's
-# documented API shapes, which is exactly the position the filesystem policy was
-# in before it met a real server and turned out to be wrong in one place. Run
-# `synartesis check --manifest manifests/github.yaml` against your own token
-# before trusting it, and expect to correct at least one field.
+# NOT verified against a live account. Every name and argument below was read
+# from GitHub's own documentation, which is exactly the position the
+# filesystem policy was in before it met a real server and turned out to be
+# wrong in one place. Run `synartesis check` against your own token before
+# trusting it, and expect to correct at least one field.
 #
-# The npm package @modelcontextprotocol/server-github is deprecated. The
-# supported server is github/github-mcp-server. Synartesis speaks stdio only,
-# so use the local binary rather than GitHub's hosted remote server.
+# Why this was rewritten: 1.12 folded get_issue, update_issue, create_issue and
+# get_pull_request into issue_read, issue_write and pull_request_read, and
+# renamed update_pull_request's pull_number to pullNumber. The previous policy
+# still named the old tools, and a policy that calls tools a server does not
+# have used to stop the proxy starting -- so everyone who had wrapped GitHub
+# and let it update was left with no GitHub at all. The proxy now holds such a
+# rule instead of refusing to start, and this file names what 1.12 exposes.
 #
-# The honest limit of this adapter: GitHub has no ordinary-scope delete for most
-# things it creates. An issue can be closed but not un-created; a comment is
-# gone only if the author removes it; a published release stays published.
+# The honest limit of this adapter: GitHub has no ordinary-scope delete for
+# most things it creates. An issue can be closed but not un-created; a comment
+# is gone only if its author removes it; a published release stays published.
 # Anything that puts a permanent, publicly visible record into the world is
-# gated rather than dressed up as reversible.
+# held rather than dressed up as reversible -- and every write this file does
+# not name is held too, because an unlisted tool falls to the fail-closed
+# default.
 version: 1
 
 servers:
   github:
     command: github-mcp-server
     args: ["stdio"]
-    # Read from your shell; never written into this file.
+    # Read from where the server is started; never written into this file.
     env:
       GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_PERSONAL_ACCESS_TOKEN}"
     # Nothing here has met a real github; every shape below comes from
@@ -30,50 +37,39 @@ servers:
 
 tools:
   # --- reads -------------------------------------------------------------
+  # 1.12 names most of its reads by suffix -- issue_read, pull_request_read,
+  # actions_get, projects_list -- as well as by the older prefixes.
   - match: "github.get_*"
     class: readonly
   - match: "github.list_*"
     class: readonly
   - match: "github.search_*"
     class: readonly
+  - match: "github.*_read"
+    class: readonly
+  - match: "github.*_get"
+    class: readonly
+  - match: "github.*_list"
+    class: readonly
+
+  # The one tool the `*_read` suffix would misread: it *marks* notifications
+  # read, which is a write. The longer name wins over the pattern above.
+  - match: "github.mark_all_notifications_read"
+    class: irreversible
+    gate: always
 
   # --- issues ------------------------------------------------------------
 
-  # An issue cannot be deleted through the API, only closed. Closing is not
-  # the same as never having existed: people were notified.
-  - match: "github.create_issue"
+  # One tool that creates an issue or updates one, chosen by its `method`
+  # argument. An update could be undone from an issue_read taken first; a
+  # creation cannot be undone at all -- an issue can be closed but not
+  # un-created, and people were notified. A rule matches a tool by name alone,
+  # so it cannot tell the two apart, and treating the whole tool as undoable
+  # would promise an undo for every issue the agent opens. Held.
+  - match: "github.issue_write"
     class: irreversible
     gate: always
 
-  # get_issue returns labels and assignees as objects while update_issue takes
-  # bare names, so the inverse projects the one field it needs out of each.
-  # `[]` reads the same key from every element and does nothing else; it is
-  # still a path, not a transform.
-  - match: "github.update_issue"
-    class: reversible
-    snapshot:
-      tool: "github.get_issue"
-      args:
-        owner: "$.owner"
-        repo: "$.repo"
-        issue_number: "$.issue_number"
-      # What GitHub says when the thing is not there. Anything else the
-      # pre-read reports -- a permissions change, a rate limit -- is a failed
-      # snapshot rather than absence, and the write is refused instead of being
-      # offered for approval as a creation.
-      absent_when: ["Not Found", "404"]
-    inverse:
-      tool: "github.update_issue"
-      args:
-        owner: "$.owner"
-        repo: "$.repo"
-        issue_number: "$.issue_number"
-        title: "$snapshot.title"
-        body: "$snapshot.body"
-        state: "$snapshot.state"
-        labels: "$snapshot.labels[].name"
-        assignees: "$snapshot.assignees[].login"
-
   - match: "github.add_issue_comment"
     class: irreversible
     gate: always
@@ -83,14 +79,17 @@ tools:
     class: irreversible
     gate: always
 
+  # pullNumber, not pull_number, in 1.12 -- the previous policy's inverse would
+  # have lost the one argument that says which pull request to put back.
   - match: "github.update_pull_request"
     class: reversible
     snapshot:
-      tool: "github.get_pull_request"
+      tool: "github.pull_request_read"
       args:
+        method: "get"
         owner: "$.owner"
         repo: "$.repo"
-        pull_number: "$.pull_number"
+        pullNumber: "$.pullNumber"
       # What GitHub says when the thing is not there. Anything else the
       # pre-read reports -- a permissions change, a rate limit -- is a failed
       # snapshot rather than absence, and the write is refused instead of being
@@ -101,7 +100,7 @@ tools:
       args:
         owner: "$.owner"
         repo: "$.repo"
-        pull_number: "$.pull_number"
+        pullNumber: "$.pullNumber"
         title: "$snapshot.title"
         body: "$snapshot.body"
         state: "$snapshot.state"
@@ -109,38 +108,14 @@ tools:
   - match: "github.merge_pull_request"
     class: irreversible
     gate: always
-  - match: "github.create_pull_request_review"
-    class: irreversible
-    gate: always
-  - match: "github.create_and_submit_pull_request_review"
-    class: irreversible
-    gate: always
-  - match: "github.submit_pending_pull_request_review"
+
+  # Creates, submits or deletes a review, by `method`. A submitted review is
+  # public and cannot be withdrawn; held whole for the same reason issue_write
+  # is.
+  - match: "github.pull_request_review_write"
     class: irreversible
     gate: always
 
-  # A pending review is a draft only its author can see, so deleting one puts
-  # nothing into the world. Recreating it restores the draft but not the
-  # comments that were inside it, which is a compensation rather than a
-  # reversal, and undo will report it as unverified.
-  - match: "github.delete_pending_pull_request_review"
-    class: compensable
-    inverse:
-      tool: "github.create_pending_pull_request_review"
-      args:
-        owner: "$.owner"
-        repo: "$.repo"
-        pull_number: "$.pull_number"
-
-  - match: "github.create_pending_pull_request_review"
-    class: compensable
-    inverse:
-      tool: "github.delete_pending_pull_request_review"
-      args:
-        owner: "$.owner"
-        repo: "$.repo"
-        pull_number: "$.pull_number"
-
   # --- file contents -----------------------------------------------------
 
   # The sha must be the blob being replaced at the moment of the revert, which
@@ -172,6 +147,13 @@ tools:
         sha: "$result.content.sha"
         message: "Revert agent change to $.path"
 
+  # A commit removing the file. The contents are gone from the branch head and
+  # would have to be read first to be put back, which this server's read does
+  # not return in a form an inverse can use unchanged. Held.
+  - match: "github.delete_file"
+    class: irreversible
+    gate: always
+
   # A multi-file push is one commit touching many paths. This format captures
   # one pre-read per action, not one per path, so there is nothing honest to
   # restore from.
@@ -188,13 +170,13 @@ tools:
   - match: "github.create_repository"
     class: irreversible
     gate: always
-  - match: "github.create_release"
+  - match: "github.delete_repository"
     class: irreversible
     gate: always
 
-# This policy is written for the server version named at the top. A later
-# version can keep a tool's name and change what it takes, which would leave
-# the policy above describing something else -- and undo would still produce an
-# answer. `synartesis pin` prints a `pins:` block for the server you actually
-# have; with it pasted in, a tool whose shape has moved stops the proxy at
-# startup instead of being quietly trusted.
+# Written for github-mcp-server v1.12.2. A later version can keep a tool's name
+# and change what it takes, which would leave the policy above describing
+# something else -- and undo would still produce an answer. `synartesis pin`
+# prints a `pins:` block for the server you actually have; with it pasted in, a
+# tool whose shape has moved stops the proxy at startup instead of being
+# quietly trusted.

package/manifests/playwright.yaml

@@ -0,0 +1,106 @@
+# Policy for @playwright/mcp.
+#
+# Written against 1.64.0 from the server's own tools/list, read-only hints and
+# all.
+#
+# Nothing a browser does can be undone. There is no inverse for a click, a
+# submitted form or a page left behind. Holding every one of them made this
+# server unusable behind Synartesis, since an agent driving a page clicks
+# dozens of times a minute. So this policy records instead of holding: each
+# interaction is classed as a call that cannot be undone, so every screen says
+# so, and is written to the journal with its arguments. `show` gives you the
+# whole session afterwards. It does not ask before each one.
+#
+# Three tools are still held, because each reaches past the page. Running code
+# the agent wrote has the full reach of the browser context, and it is how a
+# page's contents become an arbitrary action. A file upload sends something
+# from your disk to whoever runs the page, and so does a drop, which carries
+# files too. A tool this file does not mention is held until a rule says
+# otherwise, the same as everywhere else, so a new tool in a later version is
+# not let through by accident.
+#
+# Recorded is not reversible. If a page is somewhere an agent's click could do
+# real harm -- your bank, a production admin panel -- this policy does not
+# protect you from that click. It tells you it happened.
+version: 1
+
+servers:
+  playwright:
+    command: npx
+    args: ["-y", "@playwright/mcp@latest"]
+    provenance: live
+
+tools:
+  # --- reads: the tools the server itself marks read-only ------------------
+  - match: "playwright.browser_snapshot"
+    class: readonly
+  - match: "playwright.browser_take_screenshot"
+    class: readonly
+  - match: "playwright.browser_console_messages"
+    class: readonly
+  - match: "playwright.browser_network_requests"
+    class: readonly
+  - match: "playwright.browser_network_request"
+    class: readonly
+  - match: "playwright.browser_find"
+    class: readonly
+  - match: "playwright.browser_wait_for"
+    class: readonly
+
+  # --- held: each reaches past the page -------------------------------------
+  - match: "playwright.browser_run_code_unsafe"
+    class: irreversible
+    gate: always
+  - match: "playwright.browser_evaluate"
+    class: irreversible
+    gate: always
+  - match: "playwright.browser_file_upload"
+    class: irreversible
+    gate: always
+  - match: "playwright.browser_drop"
+    class: irreversible
+    gate: always
+
+  # --- recorded, not held: what driving a page is ---------------------------
+  - match: "playwright.browser_navigate"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_navigate_back"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_click"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_type"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_fill_form"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_press_key"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_select_option"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_hover"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_drag"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_handle_dialog"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_tabs"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_resize"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_emulate_media"
+    class: irreversible
+    gate: never
+  - match: "playwright.browser_close"
+    class: irreversible
+    gate: never

package/manifests/tavily.yaml

@@ -0,0 +1,27 @@
+# Policy for tavily-mcp.
+#
+# Written against 0.2.22 from the server's own tools/list.
+#
+# Search, extract, crawl, map and research all read the web and change
+# nothing. The server does not mark them read-only.
+#
+# A tool a later version adds is held until a rule says what it does.
+version: 1
+
+servers:
+  tavily:
+    command: npx
+    args: ["-y", "tavily-mcp"]
+    provenance: live
+
+tools:
+  - match: "tavily.tavily_search"
+    class: readonly
+  - match: "tavily.tavily_extract"
+    class: readonly
+  - match: "tavily.tavily_crawl"
+    class: readonly
+  - match: "tavily.tavily_map"
+    class: readonly
+  - match: "tavily.tavily_research"
+    class: readonly

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,