AbstractRuntime 0.8.2__tar.gz → 0.8.3__tar.gz

{abstractruntime-0.8.2 → abstractruntime-0.8.3}/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Nothing yet.
+
+## [0.8.3] - 2026-10-01
+
+
+### Added
+
+- `integrations.abstractcore.mcp_facade`: opens a stdio or HTTP MCP client (a stdio server starts
+  with exactly the environment given), turns a server's tool into an `mcp::<server>::<tool>` spec
+  without its URL, and runs `tools/call` with the runtime's result mapping. The gateway calls
+  registered MCP servers through it.
+
+### Changed
+
+- An automation run started by an email from someone else (untrusted input) is never offered an MCP
+  tool: every `mcp::...` name leaves its tool lists and is never granted, even when named.
+
 ## [0.8.2] - 2026-10-01
 
 Pausing an automation also stops its retries. Requires AbstractCore 2.20.2 (unchanged).

{abstractruntime-0.8.2 → abstractruntime-0.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.8.2
+Version: 0.8.3
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime

{abstractruntime-0.8.2 → abstractruntime-0.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.8.2"
+version = "0.8.3"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.8.3/release-notes.md

@@ -0,0 +1,11 @@
+### Added
+
+- `integrations.abstractcore.mcp_facade`: opens a stdio or HTTP MCP client (a stdio server starts
+  with exactly the environment given), turns a server's tool into an `mcp::<server>::<tool>` spec
+  without its URL, and runs `tools/call` with the runtime's result mapping. The gateway calls
+  registered MCP servers through it.
+
+### Changed
+
+- An automation run started by an email from someone else (untrusted input) is never offered an MCP
+  tool: every `mcp::...` name leaves its tool lists and is never granted, even when named.

{abstractruntime-0.8.2 → abstractruntime-0.8.3}/src/abstractruntime/automations/controller.py

@@ -320,7 +320,17 @@ def _never_granted(name: str) -> bool:
     `send` network reach (`agora_post_message`, `agora_send_dm`, which have no core row)."""
     from ..integrations.abstractcore.tool_effects import sends_messages
 
-    return _grant_excludes(name) or sends_messages(name)
+    return _grant_excludes(name) or sends_messages(name) or _is_mcp_tool(name)
+
+
+# Tools of registered MCP servers (`mcp::<server>::<tool>`, AbstractCore's naming): external
+# programs whose effects no fact table here describes. A run that reads text written by other
+# people is never offered one and never granted one, named or not.
+_MCP_TOOL_PREFIX = "mcp::"
+
+
+def _is_mcp_tool(name: Any) -> bool:
+    return str(name or "").strip().startswith(_MCP_TOOL_PREFIX)
 
 
 # `_runtime.untrusted_input = True`: the run reads text written by other people (an inbound
@@ -368,12 +378,13 @@ def grant_tool_approval(
     beyond configured services, no code or command execution, no messaging, no
     writes outside the run's workspace, no delegation). Every other tool
     (`fetch_url`, `skim_url`, `web_search`, `execute_command`, `shell_exec`,
-    `execute_python`, `delegate_agent`, `channel_fs_write`, MCP tools...) is
+    `execute_python`, `delegate_agent`, `channel_fs_write`...) is
     granted only when the user NAMED it individually in the definition
     (`policy.untrusted_input_tools`, passed as `named_tools`), and only within
     the target's tool ceiling. Message-sending tools (`send_email`,
     `reply_email`, `agora_post_message`, `agora_send_dm`, ...) are never
-    granted, named or not. A withheld call asks a person. Schedule and manual
+    granted, named or not. MCP tools (`mcp::<server>::<tool>`) leave the run's tool lists
+    and are never granted. A withheld call asks a person. Schedule and manual
     automations keep the full grant (decision recorded in 0992).
 
     Untrusted input under `approval="ask"` (framework backlog 0992 re-gate): the
@@ -397,6 +408,15 @@ def grant_tool_approval(
         if not untrusted_input:
             return
         replaced_target_policy = True
+    mcp_withheld: list = []
+    if untrusted_input:
+        # Untrusted input: every MCP tool leaves the run's tool lists (the agent's `tools` input and
+        # the `_runtime.allowed_tools` ceiling), so the model is never offered one.
+        for holder, key in ((input_data, "tools"), (runtime_ns, "allowed_tools")):
+            raw = holder.get(key)
+            if isinstance(raw, list) and any(_is_mcp_tool(t) for t in raw):
+                mcp_withheld += [str(t).strip() for t in raw if _is_mcp_tool(t)]
+                holder[key] = [t for t in raw if not _is_mcp_tool(t)]
     allowed = runtime_ns.get("allowed_tools")
     names = allowed if isinstance(allowed, list) else list(TOOL_EFFECT_CLASSES)
     candidates = sorted({n.strip() for n in names if isinstance(n, str) and n.strip()})
@@ -413,6 +433,7 @@ def grant_tool_approval(
     else:
         withheld = [n for n in candidates if _grant_excludes(n)]
     tools = [n for n in candidates if n not in withheld]
+    withheld = withheld + sorted(set(mcp_withheld) - set(withheld))
     policy: Dict[str, Any] = {"auto_approve_tools": tools, "withheld_tools": withheld, "source": AUTOMATION_GRANT_SOURCE}
     if untrusted_input:
         policy.update(

abstractruntime-0.8.3/src/abstractruntime/integrations/abstractcore/mcp_facade.py

@@ -0,0 +1,120 @@
+"""AbstractCore's MCP clients, reached through AbstractRuntime (the gateway's import boundary).
+
+The gateway may not import `abstractcore` directly (tests/test_gateway_import_boundary.py). Everything
+it needs to test a registered MCP server and to call that server's tools from a run lives here:
+
+- `open_mcp_client`: a connected-on-demand client for one server (stdio or Streamable HTTP). A stdio
+  server starts with exactly the environment given (`inherit_env=False`), so no gateway secret leaks
+  into a third-party process.
+- `mcp_tool_spec`: one server tool as the spec agents see, named `mcp::<server>::<tool>`.
+- `call_mcp_tool`: one `tools/call`, mapped to the runtime's tool result convention
+  `(success, output, error)` (the same mapping `McpToolExecutor` uses).
+- the client error classes, for callers that turn failures into sentences.
+
+Requires the AbstractCore MCP clients with `initialize()` and `inherit_env` (abstractcore round 3).
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Mapping, Optional, Sequence, Tuple
+
+from abstractcore.mcp import (  # noqa: F401 - re-exported names
+    MCP_TOOL_PREFIX,
+    McpClient,
+    McpServerInfo,
+    McpStdioClient,
+    mcp_tool_to_abstractcore_tool_spec,
+    namespaced_tool_name,
+    parse_namespaced_tool_name,
+)
+from abstractcore.mcp.client import McpError, McpHttpError, McpProtocolError, McpRpcError  # noqa: F401
+
+
+def is_mcp_tool_name(name: Any) -> bool:
+    """True for a namespaced MCP tool name (`mcp::<server>::<tool>`)."""
+    return parse_namespaced_tool_name(str(name or "")) is not None
+
+
+def open_mcp_client(
+    *,
+    transport: str,
+    command: str = "",
+    args: Sequence[str] = (),
+    cwd: Optional[str] = None,
+    env: Optional[Mapping[str, str]] = None,
+    url: str = "",
+    headers: Optional[Mapping[str, str]] = None,
+    timeout_s: Optional[float] = 30.0,
+    client_name: str = "abstractgateway",
+) -> Any:
+    """A client for one MCP server. stdio starts the process now (raises FileNotFoundError and
+    friends when it cannot start); http connects on the first request. Call `initialize()` first."""
+    if transport == "stdio":
+        if not str(command or "").strip():
+            raise ValueError("a stdio MCP server needs a command")
+        return McpStdioClient(
+            command=[str(command)] + [str(a) for a in args],
+            cwd=cwd or None,
+            env=dict(env or {}),
+            inherit_env=False,
+            timeout_s=timeout_s,
+            client_name=client_name,
+        )
+    if transport == "http":
+        if not str(url or "").strip():
+            raise ValueError("an http MCP server needs a URL")
+        return McpClient(url=str(url), headers=dict(headers or {}), timeout_s=timeout_s, client_name=client_name)
+    raise ValueError(f"unknown MCP transport {transport!r} (stdio or http)")
+
+
+def close_mcp_client(client: Any) -> None:
+    """Close the client; a stdio server still running afterwards is killed."""
+    try:
+        client.close()
+    except Exception:  # noqa: BLE001
+        pass
+    proc = getattr(client, "_proc", None)
+    if proc is not None and proc.poll() is None:
+        try:
+            proc.kill()
+            proc.wait(timeout=2)
+        except Exception:  # noqa: BLE001
+            pass
+
+
+def mcp_tool_spec(*, server_id: str, tool: Dict[str, Any], transport: str) -> Dict[str, Any]:
+    """The agent-facing spec of one MCP tool ({name: mcp::<server>::<tool>, description, parameters,
+    tags, origin}). `tool` is a tools/list entry ({name, description, inputSchema}). The origin carries
+    the server id and transport only — never a URL, header or command."""
+    server = McpServerInfo(server_id=server_id, url=f"{transport}://{server_id}", transport=transport)
+    spec = mcp_tool_to_abstractcore_tool_spec(tool, server=server)
+    origin = dict(spec.get("origin") or {})
+    origin.pop("url", None)
+    spec["origin"] = origin
+    return spec
+
+
+def call_mcp_tool(client: Any, *, tool_name: str, arguments: Optional[Dict[str, Any]] = None) -> Tuple[bool, Any, Optional[str]]:
+    """One tools/call → (success, output, error). Raises the client's errors (the caller words them)."""
+    from .tool_executor import _mcp_result_to_error, _mcp_result_to_output
+
+    result = client.call_tool(name=tool_name, arguments=dict(arguments or {}))
+    err = _mcp_result_to_error(result)
+    if err is not None:
+        return False, None, err
+    return True, _mcp_result_to_output(result), None
+
+
+__all__ = [
+    "MCP_TOOL_PREFIX",
+    "McpError",
+    "McpHttpError",
+    "McpProtocolError",
+    "McpRpcError",
+    "call_mcp_tool",
+    "close_mcp_client",
+    "is_mcp_tool_name",
+    "mcp_tool_spec",
+    "namespaced_tool_name",
+    "open_mcp_client",
+    "parse_namespaced_tool_name",
+]

abstractruntime-0.8.3/tests/test_mcp_runs_untrusted_and_facade.py

@@ -0,0 +1,119 @@
+"""MCP tools in runs (round 3, lane mcp-runs): untrusted input never offers nor grants an MCP tool,
+and the facade the gateway calls MCP servers through (stdio, exact env, mcp::<server>::<tool>)."""
+from __future__ import annotations
+
+import sys
+import textwrap
+
+import pytest
+
+from abstractruntime.automations.controller import grant_tool_approval
+from abstractruntime.core.models import RunState, RunStatus
+from abstractruntime.integrations.abstractcore import mcp_facade
+from abstractruntime.integrations.abstractcore.effect_handlers import _execute_with_run_policy
+from abstractruntime.integrations.abstractcore.tool_executor import (
+    ApprovalToolExecutor,
+    MappingToolExecutor,
+    ToolApprovalPolicy,
+)
+
+MCP = "mcp::fake::echo"
+EXECUTED: list = []
+
+
+def _executor() -> ApprovalToolExecutor:
+    def _echo(**kw):
+        EXECUTED.append(MCP)
+        return kw
+
+    def _read(**kw):
+        EXECUTED.append("read_file")
+        return "x"
+
+    return ApprovalToolExecutor(delegate=MappingToolExecutor({MCP: _echo, "read_file": _read}), policy=ToolApprovalPolicy())
+
+
+def _run(runtime_ns) -> RunState:
+    return RunState(run_id="r", workflow_id="w", status=RunStatus.RUNNING, current_node="n", vars={"_runtime": runtime_ns})
+
+
+@pytest.fixture(autouse=True)
+def _clear():
+    EXECUTED.clear()
+
+
+@pytest.mark.parametrize("approval", ["auto", "ask"])
+def test_untrusted_occurrence_removes_every_mcp_tool_from_its_tool_lists(approval):
+    data = {"tools": ["read_file", MCP, "mcp::other::x"], "_runtime": {"allowed_tools": ["read_file", MCP]}}
+    grant_tool_approval(data, untrusted_input=True, named_tools=[MCP], approval=approval)
+    assert data["tools"] == ["read_file"]
+    assert data["_runtime"]["allowed_tools"] == ["read_file"]
+    pol = data["_runtime"]["tool_policy"]
+    assert MCP in pol["withheld_tools"] and "mcp::other::x" in pol["withheld_tools"]
+    assert MCP not in pol["auto_approve_tools"]
+
+
+def test_trusted_occurrence_keeps_mcp_tools():
+    """Control: a schedule/manual automation keeps them (and allow-all grants them)."""
+    data = {"tools": ["read_file", MCP], "_runtime": {"allowed_tools": ["read_file", MCP]}}
+    grant_tool_approval(data, untrusted_input=False, approval="auto")
+    assert data["tools"] == ["read_file", MCP]
+    assert MCP in data["_runtime"]["tool_policy"]["auto_approve_tools"]
+
+
+def test_untrusted_run_never_auto_runs_an_mcp_tool_even_named():
+    pol = {"auto_approve_tools": [MCP, "read_file"], "untrusted_input": True, "approval": "auto",
+           "untrusted_input_tools": [MCP, "read_file"]}
+    out = _execute_with_run_policy(_executor(), [{"name": MCP, "arguments": {}, "call_id": "1"}], _run({"tool_policy": pol}))
+    assert out["mode"] == "approval_required" and EXECUTED == []
+    # Control: the named non-MCP tool runs.
+    out = _execute_with_run_policy(_executor(), [{"name": "read_file", "arguments": {}, "call_id": "1"}], _run({"tool_policy": pol}))
+    assert out["mode"] == "executed" and EXECUTED == ["read_file"]
+
+
+def test_static_policy_asks_for_an_mcp_tool_and_allow_all_runs_it():
+    out = _execute_with_run_policy(_executor(), [{"name": MCP, "arguments": {}, "call_id": "1"}], _run({}))
+    assert out["mode"] == "approval_required" and EXECUTED == []
+    out = _execute_with_run_policy(_executor(), [{"name": MCP, "arguments": {}, "call_id": "1"}],
+                                   _run({"tool_policy": {"auto_approve_max_risk_rank": 4}}))
+    assert out["mode"] == "executed" and EXECUTED == [MCP]
+
+
+FAKE = textwrap.dedent(
+    """
+    import json, os, sys
+    for line in sys.stdin:
+        req = json.loads(line)
+        rid, m = req.get("id"), req.get("method")
+        if rid is None:
+            continue
+        if m == "initialize":
+            res = {"protocolVersion": "2025-06-18", "capabilities": {"tools": {}}, "serverInfo": {"name": "fake", "version": "1"}}
+        elif m == "tools/call":
+            a = req["params"]["arguments"]
+            res = {"content": [{"type": "text", "text": json.dumps({"echo": a.get("text"), "secret_env": os.environ.get("GW_SECRET")})}]}
+        else:
+            res = {"tools": [{"name": "echo", "description": "Echo text.", "inputSchema": {"type": "object", "properties": {"text": {"type": "string"}}, "required": ["text"]}}]}
+        sys.stdout.write(json.dumps({"jsonrpc": "2.0", "id": rid, "result": res}) + "\\n"); sys.stdout.flush()
+    """
+)
+
+
+def test_facade_calls_a_stdio_server_with_exactly_the_given_env(tmp_path, monkeypatch):
+    script = tmp_path / "fake.py"
+    script.write_text(FAKE)
+    monkeypatch.setenv("GW_SECRET", "must-not-leak")
+    client = mcp_facade.open_mcp_client(transport="stdio", command=sys.executable, args=[str(script)], cwd=str(tmp_path),
+                                        env={"PATH": "/usr/bin:/bin"}, timeout_s=10)
+    try:
+        client.initialize()
+        tools = client.list_tools()
+        ok, output, err = mcp_facade.call_mcp_tool(client, tool_name="echo", arguments={"text": "hi"})
+    finally:
+        mcp_facade.close_mcp_client(client)
+    assert (ok, err) == (True, None)
+    assert output == {"echo": "hi", "secret_env": None}
+    spec = mcp_facade.mcp_tool_spec(server_id="fake", tool=tools[0], transport="stdio")
+    assert spec["name"] == MCP and "text" in spec["parameters"]
+    assert "url" not in spec["origin"] and spec["origin"]["server_id"] == "fake"
+    assert mcp_facade.is_mcp_tool_name(MCP) and not mcp_facade.is_mcp_tool_name("read_file")

abstractruntime-0.8.2/release-notes.md

@@ -1,11 +0,0 @@
-Pausing an automation also stops its retries. Requires AbstractCore 2.20.2 (unchanged).
-
-### Changed
-- `automation.pause` also stops retries: an occurrence waiting in retry backoff is cancelled
-  (quietly, like `stop_current`), and a scheduled attempt that fails while the automation is paused
-  completes `failed` without a retry. An attempt already running still finishes, and a manual run
-  (`run_now`, allowed while paused) keeps its retries.
-
-### Notes
-- A retry that is waiting in backoff when you pause an automation is cancelled instead of starting
-  after its backoff. Resume the automation, or use `run_now`, to run it again.