vantage-peers-mcp 2.4.1 → 2.4.2

package/dist/src/auth.js

@@ -119,8 +119,20 @@ export function checkNamespaceRead(ctx, namespace) {
         return null;
     if (isMasterScope(ctx))
         return null;
-    if (!namespace)
-        return null; // no namespace filter — list-across, which master-only in practice
+    if (!namespace) {
+        // Day 88 P0 fix: a list-across (namespace undefined) call from a
+        // non-master scope cannot be served safely — the underlying query
+        // returns rows across every tenant. Reject with an explicit message
+        // telling the caller to pass a namespace they own. Previously this
+        // returned null and leaked the whole memories/profiles/etc. table
+        // to any DCR-issued client.
+        const allowed = ctx.namespaceReadPrefixes.length > 0
+            ? ctx.namespaceReadPrefixes.join(", ")
+            : "(none — your client has no read scope)";
+        return ("Forbidden: this tool requires an explicit namespace argument when " +
+            `called with a non-master scope (current: ${ctx.scopeProfile}). ` +
+            `Pass namespace= one of: ${allowed}.`);
+    }
     if (checkNamespacePrefix(ctx.namespaceReadPrefixes, namespace))
         return null;
     return `Forbidden: namespace='${namespace}' is not readable by scope_profile=${ctx.scopeProfile}.`;

package/dist/src/tools.js

@@ -508,6 +508,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get memory",
     }, async ({ memoryId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_memory");
+            if (_scopeDenied)
+                return _scopeDenied;
             const memory = await convex.query("memories:getMemory", {
                 memoryId,
             });
@@ -725,6 +728,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get orchestrator profile",
     }, async ({ orchestratorId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_profile");
+            if (_scopeDenied)
+                return _scopeDenied;
             const profile = await convex.query("profiles:getProfile", {
                 orchestratorId,
             });
@@ -944,6 +950,13 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Check messages",
     }, async ({ recipient, recipientInstanceId, tenantId, since }) => {
         try {
+            // Non-master: force recipient to caller's own userId. Anything else
+            // would let the client read another tenant's inbox.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                if (recipient !== oauthCtx.userId) {
+                    return mcpError(`Forbidden: check_messages can only read messages for your own identity ('${oauthCtx.userId}'), not '${recipient}'.`);
+                }
+            }
             const messages = await convex.query("messages:checkNewMessages", {
                 recipient,
                 recipientInstanceId,
@@ -1105,6 +1118,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List peers",
     }, async () => {
         try {
+            const _scopeDenied = guardMasterOnly("list_peers");
+            if (_scopeDenied)
+                return _scopeDenied;
             const profiles = await convex.query("profiles:listProfiles", {});
             const peers = profiles.map((p) => ({
                 id: p.orchestratorId,
@@ -1152,6 +1168,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List messages",
     }, async ({ sessionDay, from, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_messages");
+            if (_scopeDenied)
+                return _scopeDenied;
             const messages = await convex.query("messages:listMessages", {
                 sessionDay,
                 from,
@@ -1190,6 +1209,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List broadcast status",
     }, async ({ messageId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_broadcast_status");
+            if (_scopeDenied)
+                return _scopeDenied;
             const status = await convex.query("messages:listBroadcastStatus", {
                 messageId,
             });
@@ -1314,6 +1336,16 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List tasks",
     }, async ({ assignedTo, assignedToInstance, status, project, limit, fields, createdBy, updatedSince, }) => {
         try {
+            // Non-master: must scope to own identity. If neither assignedTo
+            // nor createdBy matches the caller's userId, reject — otherwise
+            // the query would span the whole tenant table.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                const myId = oauthCtx.userId;
+                const scopedToSelf = assignedTo === myId || createdBy === myId;
+                if (!scopedToSelf) {
+                    return mcpError(`Forbidden: list_tasks requires assignedTo='${myId}' or createdBy='${myId}' for non-master scope (current: ${oauthCtx.scopeProfile}).`);
+                }
+            }
             const tasks = await convex.query("tasks:list", {
                 assignedTo,
                 assignedToInstance,
@@ -1695,6 +1727,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List tasks by mission",
     }, async ({ missionId, status, limit, fields, createdBy, updatedSince }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_tasks_by_mission");
+            if (_scopeDenied)
+                return _scopeDenied;
             const tasks = await convex.query("tasks:listByMission", {
                 missionId: missionId,
                 status,
@@ -1802,6 +1837,13 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List missions",
     }, async ({ project, pilot, status, limit, fields, updatedSince }) => {
         try {
+            // Non-master: must pilot=<own-userId>. Otherwise the query spans
+            // every tenant's missions.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                if (pilot !== oauthCtx.userId) {
+                    return mcpError(`Forbidden: list_missions requires pilot='${oauthCtx.userId}' for non-master scope (current: ${oauthCtx.scopeProfile}).`);
+                }
+            }
             const missions = await convex.query("missions:list", {
                 project,
                 pilot,
@@ -1843,6 +1885,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get mission",
     }, async ({ missionId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_mission");
+            if (_scopeDenied)
+                return _scopeDenied;
             const mission = await convex.query("missions:get", {
                 missionId: missionId,
             });
@@ -2002,6 +2047,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get diary entry",
     }, async ({ date, orchestrator }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_diary");
+            if (_scopeDenied)
+                return _scopeDenied;
             const entry = await convex.query("diary:get", {
                 date,
                 orchestrator,
@@ -2050,6 +2098,12 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List diary entries",
     }, async ({ orchestrator, limit }) => {
         try {
+            // Non-master: must scope to own orchestrator id.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                if (orchestrator !== oauthCtx.userId) {
+                    return mcpError(`Forbidden: list_diaries requires orchestrator='${oauthCtx.userId}' for non-master scope (current: ${oauthCtx.scopeProfile}).`);
+                }
+            }
             const entries = await convex.query("diary:list", {
                 orchestrator,
                 limit: limit ?? 20,
@@ -2203,6 +2257,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List briefing notes",
     }, async ({ topic, limit, fields, updatedSince }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_briefing_notes");
+            if (_scopeDenied)
+                return _scopeDenied;
             const notes = await convex.query("briefingNotes:list", {
                 topic,
                 limit,
@@ -2316,6 +2373,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List components",
     }, async ({ type, team, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_components");
+            if (_scopeDenied)
+                return _scopeDenied;
             const components = await convex.query("components:list", {
                 type,
                 team,
@@ -2345,6 +2405,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get component",
     }, async ({ name, type }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_component");
+            if (_scopeDenied)
+                return _scopeDenied;
             const component = await convex.query("components:get", {
                 name,
                 type,
@@ -2442,6 +2505,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Search components",
     }, async ({ query, type, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("search_components");
+            if (_scopeDenied)
+                return _scopeDenied;
             const results = await convex.query("components:search", {
                 query,
                 type,
@@ -2532,6 +2598,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List recurring tasks",
     }, async ({ assignedTo, active, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_recurring_tasks");
+            if (_scopeDenied)
+                return _scopeDenied;
             const tasks = await convex.query("recurringTasks:list", {
                 assignedTo,
                 active,
@@ -2875,6 +2944,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List mandates",
     }, async ({ requestedBy, fulfilledBy, status, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_mandates");
+            if (_scopeDenied)
+                return _scopeDenied;
             const mandates = await convex.query("mandates:list", {
                 requestedBy,
                 fulfilledBy,
@@ -3041,6 +3113,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get BU",
     }, async ({ buId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_bu");
+            if (_scopeDenied)
+                return _scopeDenied;
             const bu = await convex.query("businessUnits:get", {
                 buId: buId,
             });
@@ -3080,6 +3155,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List BUs",
     }, async ({ orchestratorId, status, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_bus");
+            if (_scopeDenied)
+                return _scopeDenied;
             const bus = await convex.query("businessUnits:list", {
                 orchestratorId,
                 status,
@@ -3176,6 +3254,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List repo mappings",
     }, async () => {
         try {
+            const _scopeDenied = guardMasterOnly("list_repo_mappings");
+            if (_scopeDenied)
+                return _scopeDenied;
             const mappings = await convex.query("githubRepoMapping:list", {});
             return {
                 content: [
@@ -3247,6 +3328,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List issues",
     }, async ({ project, status, assignedTo, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_issues");
+            if (_scopeDenied)
+                return _scopeDenied;
             let results;
             if (assignedTo) {
                 results = await convex.query("issues:listByOrchestrator", {
@@ -3300,6 +3384,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get issue",
     }, async ({ repo, issueNumber }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_issue");
+            if (_scopeDenied)
+                return _scopeDenied;
             const issue = await convex.query("issues:getByRepoNumber", {
                 repo,
                 issueNumber,
@@ -3434,6 +3521,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Issue statistics",
     }, async ({ project }) => {
         try {
+            const _scopeDenied = guardMasterOnly("issue_stats");
+            if (_scopeDenied)
+                return _scopeDenied;
             const stats = await convex.query("issues:getStats", {
                 project,
             });
@@ -3590,6 +3680,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Search fix patterns",
     }, async ({ query, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("search_fix_patterns");
+            if (_scopeDenied)
+                return _scopeDenied;
             const results = await convex.action("search:searchFixPatterns", {
                 query,
                 limit,
@@ -3621,6 +3714,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List fix patterns",
     }, async ({ project, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_fix_patterns");
+            if (_scopeDenied)
+                return _scopeDenied;
             if (project) {
                 const results = await convex.query("fixPatterns:listByProject", {
                     sourceProject: project,
@@ -3682,6 +3778,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get mission template",
     }, async ({ name }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_mission_template");
+            if (_scopeDenied)
+                return _scopeDenied;
             const template = await convex.query("missionTemplates:getByName", { name });
             return {
                 content: [
@@ -3908,6 +4007,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List errors",
     }, async ({ deployment, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_errors");
+            if (_scopeDenied)
+                return _scopeDenied;
             const errors = await convex.query("errorMonitor:listErrors", {
                 deployment,
                 limit: limit ?? 50,
@@ -3935,6 +4037,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get error",
     }, async ({ errorId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_error");
+            if (_scopeDenied)
+                return _scopeDenied;
             const error = await convex.query("errorMonitor:getError", {
                 errorId: errorId,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vantage-peers-mcp",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "MCP server for VantagePeers — shared memory, messaging, and task coordination for AI agent teams",
   "type": "module",
   "main": "./dist/server.js",