cycode 3.25.1.dev6__tar.gz → 3.25.2.dev1__tar.gz

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.25.1.dev6
+Version: 3.25.2.dev1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.25.1.dev6'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.25.2.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/__init__.py

@@ -35,23 +35,22 @@ def get_ide(name: str) -> IDE:
     return ide
 
 
-def collect_all_session_contexts() -> tuple[dict[str, dict], dict]:
+def collect_all_session_contexts() -> tuple[list[dict], dict]:
     """Sweep every registered IDE's session context, regardless of which IDE triggered the hook.
 
-    Returns ``(config_files_by_ide, plugins)``: the global MCP config file of each IDE that has
-    one (keyed by IDE name), and the enabled plugins merged across IDEs (first registered IDE
-    wins on a duplicate plugin key - plugins are IDE-agnostic marketplace artifacts).
+    Returns ``(config_files, plugins)``: the global MCP config files of every IDE, and the
+    enabled plugins merged across IDEs (first registered IDE wins on a duplicate plugin key -
+    plugins are IDE-agnostic marketplace artifacts).
     """
-    config_files_by_ide: dict[str, dict] = {}
+    config_files: list[dict] = []
     plugins: dict = {}
     for ide in IDES.values():
-        global_config_file, enabled_plugins = ide.get_session_context()
-        if global_config_file:
-            config_files_by_ide[ide.name] = global_config_file
+        global_config_files, enabled_plugins = ide.get_session_context()
+        config_files.extend(global_config_files)
         for plugin_key, plugin in (enabled_plugins or {}).items():
             plugins.setdefault(plugin_key, plugin)
 
-    return config_files_by_ide, plugins
+    return config_files, plugins
 
 
 def collect_all_skills() -> list[dict]:

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/_plugin_utils.py

@@ -42,17 +42,17 @@ def load_plugin_json(path: Path) -> Optional[dict]:
         return None
 
 
-def build_global_config_file(path: Path, mcp_servers: Optional[dict]) -> Optional[dict]:
+def build_global_config_files(path: Path, mcp_servers: Optional[dict]) -> list[dict]:
     """Wrap a global (non-plugin) MCP config into the session-context file shape.
 
-    Returns ``{"path": <full path>, "content": <{"mcpServers": ...} JSON>}`` when
-    there are servers, else ``None``. ``content`` is normalized to the canonical
+    Returns ``[{"path": <full path>, "content": <{"mcpServers": ...} JSON>}]`` when
+    there are servers, else ``[]``. ``content`` is normalized to the canonical
     ``{"mcpServers": {...}}`` shape, dropping everything else in the source file.
     """
-    servers = mcp_servers or {}
+    servers = mcp_servers if isinstance(mcp_servers, dict) else {}
     if not servers:
-        return None
-    return {'path': str(path), 'content': json.dumps({'mcpServers': servers})}
+        return []
+    return [{'path': str(path), 'content': json.dumps({'mcpServers': servers})}]
 
 
 def walk_enabled_plugins(

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/base.py

@@ -176,19 +176,19 @@ class IDE(ABC):
         """
         return None
 
-    def get_session_context(self) -> tuple[Optional[dict], dict]:
-        """Return ``(global_config_file, enabled_plugins)`` for session-context reporting.
+    def get_session_context(self) -> tuple[list[dict], dict]:
+        """Return ``(global_config_files, enabled_plugins)`` for session-context reporting.
 
-        ``global_config_file`` is the IDE's global (non-plugin) MCP config as
-        ``{"path": <full path>, "content": <normalized {"mcpServers": ...} JSON>}``,
-        or ``None`` when there is no global MCP config. ``enabled_plugins`` maps each
-        enabled plugin key to its metadata (including its own ``mcp_config_file``
-        content and ``mcp_config_file_path``).
+        ``global_config_files`` are the IDE's global (non-plugin) MCP configs, each as
+        ``{"path": <full path>, "content": <normalized {"mcpServers": ...} JSON>}``;
+        empty when there is none. ``enabled_plugins`` maps each enabled plugin key to
+        its metadata (including its own ``mcp_config_file`` content and
+        ``mcp_config_file_path``).
 
-        Default: ``(None, {})`` (no plugin system, no discoverable MCP config).
+        Default: ``([], {})`` (no plugin system, no discoverable MCP config).
         Override to surface MCP/plugin inventory.
         """
-        return None, {}
+        return [], {}
 
     def get_skills(self) -> list[dict]:
         """Return the IDE's user-scope skills as ``[{"path", "content"}]``.
@@ -198,7 +198,7 @@ class IDE(ABC):
         read these files off endpoints can only ever return raw content.
 
         Kept separate from ``get_session_context`` rather than folded into its
-        ``global_config_file`` slot, which is normalized to an MCP server map.
+        ``global_config_files``, which are normalized to an MCP server map.
 
         Default: ``[]`` (the IDE has no skill system). Override to surface skills.
         """

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/claude_code.py

@@ -1,6 +1,7 @@
 """Claude Code IDE integration for AI guardrails."""
 
 import json
+import re
 from collections.abc import Iterator
 from copy import deepcopy
 from pathlib import Path
@@ -8,7 +9,7 @@ from typing import ClassVar, Optional
 
 from cycode.cli.apps.ai_guardrails.consts import CYCODE_SCAN_PROMPT_COMMAND, CYCODE_SESSION_START_COMMAND
 from cycode.cli.apps.ai_guardrails.ides._plugin_utils import (
-    build_global_config_file,
+    build_global_config_files,
     load_plugin_json,
     resolve_cached_plugin_dir,
     walk_enabled_plugins,
@@ -253,6 +254,41 @@ def resolve_plugins(settings: dict) -> dict:
     )
 
 
+def _sanitize_mcp_name(name: str) -> str:
+    """Mirrors how Claude Code sanitizes a server name inside a tool name."""
+    return re.sub(r'[^a-z0-9_-]', '_', name.lower())
+
+
+def _local_mcp_servers(config: Optional[dict], cwd: Optional[str]) -> Iterator[tuple[str, str]]:
+    """Yield ``(name as Claude Code namespaces it, config key)`` for each locally configured MCP server."""
+    sources = []
+    if config:
+        sources.append(get_mcp_servers(config))
+        if cwd:
+            sources.append(((config.get('projects') or {}).get(cwd) or {}).get('mcpServers'))
+    if cwd:
+        sources.append((load_plugin_json(Path(cwd) / '.mcp.json') or {}).get('mcpServers'))
+    for servers in sources:
+        if isinstance(servers, dict):
+            for name in servers:
+                yield name, name
+
+    settings = load_claude_settings()
+    for plugin_key, entry in (resolve_plugins(settings) if settings else {}).items():
+        plugin_name = plugin_key.split('@', 1)[0]
+        for server in entry.get('mcp_server_names') or []:
+            yield f'plugin_{plugin_name}_{server}', server
+
+
+def _resolve_mcp_server_name(server: str, config: Optional[dict], cwd: Optional[str]) -> str:
+    """Map the server segment of ``mcp__<server>__<tool>`` back to its config key; unknown names pass through."""
+    wanted = _sanitize_mcp_name(server)
+    for namespaced, name in _local_mcp_servers(config, cwd):
+        if _sanitize_mcp_name(namespaced) == wanted:
+            return name
+    return server
+
+
 # --- IDE integration ----------------------------------------------------------
 
 
@@ -339,6 +375,8 @@ class ClaudeCode(IDE):
 
         config = load_claude_config()
         ide_user_email = _email_from_config(config) if config else None
+        if mcp_server_name:
+            mcp_server_name = _resolve_mcp_server_name(mcp_server_name, config, raw_payload.get('cwd'))
 
         return AIHookPayload(
             event_name=canonical_event,
@@ -396,14 +434,14 @@ class ClaudeCode(IDE):
         config = load_claude_config()
         return _email_from_config(config) if config else None
 
-    def get_session_context(self) -> tuple[Optional[dict], dict]:
+    def get_session_context(self) -> tuple[list[dict], dict]:
         config = load_claude_config()
-        global_config_file = build_global_config_file(_CLAUDE_CONFIG_PATH, get_mcp_servers(config)) if config else None
+        global_config_files = build_global_config_files(_CLAUDE_CONFIG_PATH, get_mcp_servers(config)) if config else []
 
         settings = load_claude_settings()
         enriched_plugins = resolve_plugins(settings) if settings else {}
 
-        return global_config_file, enriched_plugins
+        return global_config_files, enriched_plugins
 
     def get_skills(self) -> list[dict]:
         return walk_skill_dirs(_claude_skills_dir())

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/codex.py

@@ -2,7 +2,9 @@
 
 import json
 import os
+import re
 import sys
+from collections.abc import Iterator
 from pathlib import Path
 from typing import ClassVar, Optional
 
@@ -15,7 +17,7 @@ else:  # pragma: no cover - py<3.11 fallback
 
 from cycode.cli.apps.ai_guardrails.consts import CYCODE_SCAN_PROMPT_COMMAND, CYCODE_SESSION_START_COMMAND
 from cycode.cli.apps.ai_guardrails.ides._plugin_utils import (
-    build_global_config_file,
+    build_global_config_files,
     load_plugin_json,
     resolve_cached_plugin_dir,
     walk_enabled_plugins,
@@ -158,6 +160,42 @@ def _resolve_codex_plugins(config: dict) -> dict:
     )
 
 
+def _sanitize_mcp_name(name: str) -> str:
+    """Mirrors how Codex sanitizes a server name into a tool namespace."""
+    return re.sub(r'[^A-Za-z0-9_]', '_', name) or '_'
+
+
+def _local_mcp_server_names() -> Iterator[str]:
+    """Yield the config key of each locally configured Codex MCP server, plugin servers included."""
+    config = _load_codex_config()
+    if not config:
+        return
+    servers = config.get('mcp_servers')
+    if isinstance(servers, dict):
+        yield from servers
+    for entry in _resolve_codex_plugins(config).values():
+        yield from entry.get('mcp_server_names') or []
+
+
+def _split_mcp_tool_name(tool_name: str) -> tuple[Optional[str], Optional[str]]:
+    """Split ``mcp__<namespace>__<tool>`` into ``(server config key, tool)``; unknown namespaces split on ``__``."""
+    rest = tool_name[len('mcp__') :]
+    names = list(_local_mcp_server_names())
+    # Codex appends `_<12 hex>` to a namespace on collision or length overflow.
+    for suffix in ('__', r'_+[0-9a-f]{12}__'):
+        best: Optional[tuple[int, str]] = None
+        for name in names:
+            namespace = _sanitize_mcp_name(name).rstrip('_')
+            match = namespace and re.match(re.escape(namespace) + suffix, rest)
+            if match and (best is None or match.end() > best[0]):
+                best = (match.end(), name)
+        if best:
+            return best[1], rest[best[0] :]
+
+    parts = tool_name.split('__')
+    return (parts[1] if len(parts) >= 2 else None), (parts[2] if len(parts) >= 3 else None)
+
+
 def _enable_codex_hooks_feature(scope: str, repo_path: Optional[Path] = None) -> tuple[bool, str]:
     """Set ``[features] hooks = true`` in Codex's ``config.toml``.
 
@@ -247,12 +285,8 @@ class Codex(IDE):
         mcp_server_name = None
         mcp_tool_name = None
         mcp_arguments = None
-        if tool_name.startswith('mcp__'):
-            parts = tool_name.split('__')
-            if len(parts) >= 2:
-                mcp_server_name = parts[1]
-            if len(parts) >= 3:
-                mcp_tool_name = parts[2]
+        if canonical_event == AiHookEventType.MCP_EXECUTION:
+            mcp_server_name, mcp_tool_name = _split_mcp_tool_name(tool_name)
             mcp_arguments = tool_input
 
         return AIHookPayload(
@@ -302,17 +336,17 @@ class Codex(IDE):
     def get_user_email(self) -> Optional[str]:
         return _email_from_auth()
 
-    def get_session_context(self) -> tuple[Optional[dict], dict]:
+    def get_session_context(self) -> tuple[list[dict], dict]:
         config = _load_codex_config()
         if not config:
-            return None, {}
+            return [], {}
         # Codex stores MCP servers under `[mcp_servers.<name>]`; the global config
         # file becomes its own session-context file. Plugins (via
         # `[plugins."<plugin>@<marketplace>"]`) carry their own config files.
         config_path = _codex_config_toml_path('user')
-        global_config_file = build_global_config_file(config_path, config.get('mcp_servers'))
+        global_config_files = build_global_config_files(config_path, config.get('mcp_servers'))
         enriched_plugins = _resolve_codex_plugins(config)
-        return global_config_file, enriched_plugins
+        return global_config_files, enriched_plugins
 
     def get_skills(self) -> list[dict]:
         return walk_skill_dirs(_codex_skills_dir())

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/copilot.py

@@ -33,7 +33,7 @@ from urllib.request import url2pathname
 
 from cycode.cli.apps.ai_guardrails.consts import CYCODE_SCAN_PROMPT_COMMAND, CYCODE_SESSION_START_COMMAND
 from cycode.cli.apps.ai_guardrails.ides._plugin_utils import (
-    build_global_config_file,
+    build_global_config_files,
     load_plugin_json,
     walk_enabled_plugins,
 )
@@ -283,6 +283,15 @@ def _collect_installed_plugins() -> dict:
 # --- MCP tool-name splitting ------------------------------------------------------
 
 
+def _global_mcp_server_maps() -> list[tuple[Path, object]]:
+    """``(path, servers)`` of each runtime's global MCP config: VS Code's ``servers``, the agent's ``mcpServers``."""
+    agent_config_path = _copilot_home() / _AGENT_MCP_CONFIG_FILENAME
+    return [
+        (_vscode_mcp_config_path(), (_load_vscode_mcp_config() or {}).get('servers')),
+        (agent_config_path, (_load_jsonc(agent_config_path) or {}).get('mcpServers')),
+    ]
+
+
 def _known_mcp_server_names() -> list[str]:
     """Config-declared MCP server names, across both runtimes' config files.
 
@@ -293,15 +302,7 @@ def _known_mcp_server_names() -> list[str]:
     Best-effort inventory: servers contributed by extensions, ``chat.mcp.discovery``
     imports, dev containers, or non-default profiles are not discoverable from disk.
     """
-    config = _load_vscode_mcp_config()
-    servers = (config or {}).get('servers')
-    names = list(servers.keys()) if isinstance(servers, dict) else []
-
-    agent_config = _load_jsonc(_copilot_home() / _AGENT_MCP_CONFIG_FILENAME) or {}
-    agent_servers = agent_config.get('mcpServers')
-    if isinstance(agent_servers, dict):
-        names.extend(agent_servers.keys())
-
+    names = [name for _, servers in _global_mcp_server_maps() if isinstance(servers, dict) for name in servers]
     for plugin in _collect_installed_plugins().values():
         names.extend(plugin.get('mcp_server_names') or [])
     return names
@@ -485,14 +486,11 @@ class Copilot(IDE):
             source=raw_payload.get('source'),
         )
 
-    def get_session_context(self) -> tuple[Optional[dict], dict]:
-        # VS Code's mcp.json uses `servers` as its top-level key; normalized to the
-        # canonical mcpServers shape by build_global_config_file.
-        config = _load_vscode_mcp_config()
-        global_config_file = (
-            build_global_config_file(_vscode_mcp_config_path(), config.get('servers')) if config else None
-        )
-        return global_config_file, _collect_installed_plugins()
+    def get_session_context(self) -> tuple[list[dict], dict]:
+        global_config_files = [
+            file for path, servers in _global_mcp_server_maps() for file in build_global_config_files(path, servers)
+        ]
+        return global_config_files, _collect_installed_plugins()
 
     def get_skills(self) -> list[dict]:
         return walk_skill_dirs(_copilot_skills_dir())

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/ides/cursor.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import ClassVar, Optional
 
 from cycode.cli.apps.ai_guardrails.consts import CYCODE_SCAN_PROMPT_COMMAND, CYCODE_SESSION_START_COMMAND
-from cycode.cli.apps.ai_guardrails.ides._plugin_utils import build_global_config_file
+from cycode.cli.apps.ai_guardrails.ides._plugin_utils import build_global_config_files
 from cycode.cli.apps.ai_guardrails.ides._skill_utils import walk_skill_dirs
 from cycode.cli.apps.ai_guardrails.ides.base import IDE, DecisionAction, HookDecision
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
@@ -64,6 +64,44 @@ def _load_cursor_mcp_config(config_path: Optional[Path] = None) -> Optional[dict
         return None
 
 
+def _cursor_mcp_config_paths(workspace_roots: object) -> list[Path]:
+    roots = workspace_roots if isinstance(workspace_roots, list) else []
+    paths = [Path(root) / _REPO_SUBDIR / _MCP_CONFIG_FILENAME for root in roots if isinstance(root, str) and root]
+    paths.append(_cursor_mcp_config_path())
+    return paths
+
+
+def _server_command_line(server: dict) -> Optional[str]:
+    command = server.get('command')
+    if not isinstance(command, str) or not command:
+        return None
+    args = server.get('args')
+    return ' '.join([command, *(str(arg) for arg in args)]) if isinstance(args, list) else command
+
+
+def _resolve_mcp_server_name(raw_payload: dict) -> Optional[str]:
+    """Cursor sends the server's url or command, but the platform knows it by its mcp.json entry name."""
+    url = raw_payload.get('url')
+    command = raw_payload.get('command')
+    if not url and not command:
+        return None
+
+    lowered_command = command.lower() if command else None
+    for config_path in _cursor_mcp_config_paths(raw_payload.get('workspace_roots')):
+        servers = (_load_cursor_mcp_config(config_path) or {}).get('mcpServers')
+        if not isinstance(servers, dict):
+            continue
+        for name, server in servers.items():
+            if not isinstance(server, dict):
+                continue
+            if url and server.get('url') == url:
+                return name
+            if command and (command == _server_command_line(server) or lowered_command == name.lower()):
+                return name
+
+    return command
+
+
 class Cursor(IDE):
     name: ClassVar[str] = 'cursor'
     display_name: ClassVar[str] = 'Cursor'
@@ -95,7 +133,9 @@ class Cursor(IDE):
             ide_version=raw_payload.get('cursor_version'),
             prompt=raw_payload.get('prompt', ''),
             file_path=raw_payload.get('file_path') or raw_payload.get('path'),
-            mcp_server_name=raw_payload.get('command'),
+            mcp_server_name=(
+                _resolve_mcp_server_name(raw_payload) if canonical_event == AiHookEventType.MCP_EXECUTION else None
+            ),
             mcp_tool_name=raw_payload.get('tool_name') or raw_payload.get('tool'),
             mcp_arguments=(raw_payload.get('arguments') or raw_payload.get('tool_input') or raw_payload.get('input')),
         )
@@ -124,13 +164,11 @@ class Cursor(IDE):
             ide_version=raw_payload.get('cursor_version'),
         )
 
-    def get_session_context(self) -> tuple[Optional[dict], dict]:
+    def get_session_context(self) -> tuple[list[dict], dict]:
         config = _load_cursor_mcp_config()
         if not config:
-            return None, {}
-        config_path = _cursor_mcp_config_path()
-        global_config_file = build_global_config_file(config_path, config.get('mcpServers'))
-        return global_config_file, {}
+            return [], {}
+        return build_global_config_files(_cursor_mcp_config_path(), config.get('mcpServers')), {}
 
     def get_skills(self) -> list[dict]:
         return walk_skill_dirs(_cursor_skills_dir())

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/scan/guardrail_config.py

@@ -3,7 +3,7 @@
 session-start fetches the tenant's resolved guardrail config from the platform and writes it
 here; scans only read. Per-agent modes and sensitive-path globs are platform-owned - local
 policy files never carry them. An absent or corrupt cache means built-in defaults (Report
-everywhere + the default globs), always synchronous.
+everywhere + the default globs, with the unauthorized MCP server guardrail Off), always synchronous.
 """
 
 import json
@@ -23,7 +23,7 @@ logger = get_logger('AI Guardrails')
 
 GUARDRAILS_CONFIG_FILE_NAME = 'ai-guardrails-config.json'
 
-_DEFAULT_TTL_SECONDS = 900
+DEFAULT_TTL_SECONDS = 900
 
 # Guardrail keys are the CLI's block-reason vocabulary. Anything else in the payload (a future
 # guardrail this CLI doesn't implement) is ignored - unknown config must never fail closed.
@@ -34,14 +34,24 @@ _KNOWN_GUARDRAIL_KEYS = frozenset(
         BlockReason.SECRETS_IN_FILE,
         BlockReason.SENSITIVE_PATH,
         BlockReason.SECRETS_IN_MCP_ARGS,
+        BlockReason.UNAUTHORIZED_MCP_SERVER,
     )
 )
 
+# Off by default (not Report), so they never start enforcing on a tenant that hasn't configured them.
+_DEFAULT_OFF_GUARDRAIL_KEYS = frozenset((BlockReason.UNAUTHORIZED_MCP_SERVER.value,))
+
 
 def get_config_cache_path() -> Path:
     return Path.home() / CYCODE_CONFIGURATION_DIRECTORY / GUARDRAILS_CONFIG_FILE_NAME
 
 
+def default_mode_for(guardrail_key: str) -> str:
+    if guardrail_key in _DEFAULT_OFF_GUARDRAIL_KEYS:
+        return GuardrailCellMode.OFF.value
+    return GuardrailCellMode.REPORT.value
+
+
 def _default_sensitive_globs() -> list:
     return list(DEFAULT_SENSITIVE_PATH_GLOBS)
 
@@ -60,10 +70,20 @@ class GuardrailConfig:
             if guardrail.get('key') in _KNOWN_GUARDRAIL_KEYS
         }
 
+    @property
+    def ttl_seconds(self) -> float:
+        return self.payload.get('ttl_seconds') or DEFAULT_TTL_SECONDS
+
+    def _agents(self, guardrail_key: str) -> dict:
+        return (self._guardrails.get(guardrail_key) or {}).get('agents') or {}
+
     def mode_for(self, guardrail_key: str, ide_name: Optional[str]) -> str:
         """The platform keys the cells by our --ide names, so the lookup is direct."""
-        agents = (self._guardrails.get(guardrail_key) or {}).get('agents') or {}
-        return str(agents.get((ide_name or '').lower(), GuardrailCellMode.REPORT.value)).lower()
+        agents = self._agents(guardrail_key)
+        return str(agents.get((ide_name or '').lower(), default_mode_for(guardrail_key))).lower()
+
+    def is_off_for_every_agent(self, guardrail_key: str) -> bool:
+        return all(str(mode).lower() == GuardrailCellMode.OFF for mode in self._agents(guardrail_key).values())
 
     def _modes_for_event(self, event_name: str, ide_name: Optional[str]) -> list:
         return [
@@ -87,8 +107,7 @@ class GuardrailConfig:
         return globs if isinstance(globs, list) and globs else _default_sensitive_globs()
 
     def is_expired(self) -> bool:
-        ttl = self.payload.get('ttl_seconds') or _DEFAULT_TTL_SECONDS
-        return time.time() - self.fetched_at > ttl
+        return time.time() - self.fetched_at > self.ttl_seconds
 
     def needs_refresh(self, tenant_id: Optional[str]) -> bool:
         """Expired, or fetched for another tenant (the user switched tenants since)."""
@@ -99,14 +118,14 @@ def apply_platform_config(policy: dict, config: Optional[GuardrailConfig], ide_n
     """Overlay the platform-owned enforcement config onto the local knobs-only policy.
 
     The platform is the only mode source: no cache (cold start) means the built-in defaults -
-    Report everywhere with the default globs - which equal an unconfigured tenant's platform
-    config, so behaviour is uniform either way. Each matrix cell lands on its own per-feature
-    action, so the two FileRead guardrails (content scan vs. sensitive path) keep independent modes.
+    Report everywhere (unauthorized MCP server Off) with the default globs - which equal an unconfigured
+    tenant's platform config, so behaviour is uniform either way. Each matrix cell lands on its own
+    per-feature action, so guardrails sharing an event (e.g. the two FileRead ones) keep independent modes.
     An all-Off event never reaches here at all: scan_command skips it.
     """
 
     def cell(guardrail_key: str) -> str:
-        return config.mode_for(guardrail_key, ide_name) if config is not None else GuardrailCellMode.REPORT.value
+        return config.mode_for(guardrail_key, ide_name) if config is not None else default_mode_for(guardrail_key)
 
     def action(guardrail_key: str) -> str:
         return PolicyMode.BLOCK.value if cell(guardrail_key) == GuardrailCellMode.BLOCK else PolicyMode.WARN.value
@@ -123,7 +142,11 @@ def apply_platform_config(policy: dict, config: Optional[GuardrailConfig], ide_n
     )
     file_read['path_action'] = action(BlockReason.SENSITIVE_PATH)
 
-    policy.setdefault('mcp', {})['action'] = action(BlockReason.SECRETS_IN_MCP_ARGS)
+    mcp = policy.setdefault('mcp', {})
+    mcp['scan_args'] = cell(BlockReason.SECRETS_IN_MCP_ARGS) != GuardrailCellMode.OFF
+    mcp['action'] = action(BlockReason.SECRETS_IN_MCP_ARGS)
+    mcp['check_server'] = cell(BlockReason.UNAUTHORIZED_MCP_SERVER) != GuardrailCellMode.OFF
+    mcp['server_action'] = action(BlockReason.UNAUTHORIZED_MCP_SERVER)
 
 
 def save_guardrail_config(payload: dict, tenant_id: Optional[str]) -> None:

{cycode-3.25.1.dev6 → cycode-3.25.2.dev1}/cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -21,6 +21,7 @@ if TYPE_CHECKING:
 
 from cycode.cli.apps.ai_guardrails.consts import GuardrailsMode, PolicyMode
 from cycode.cli.apps.ai_guardrails.ides.base import HookDecision
+from cycode.cli.apps.ai_guardrails.scan.mcp_server_status import is_enforced, load_mcp_server_statuses
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
 from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value
 from cycode.cli.apps.ai_guardrails.scan.types import (
@@ -217,6 +218,16 @@ class _ArgScanFeature:
     deny_agent_message: str
     ask_message: Callable[[str], str]
     ask_agent_message: str
+    scan_enabled: bool = True
+
+
+class _PreScanFinding(NamedTuple):
+    """A finding on the call itself (e.g. an unauthorized MCP server), made before the text scan."""
+
+    block_reason: BlockReason
+    mode: GuardrailsMode
+    deny_message: str
+    deny_agent_message: str
 
 
 def _handle_arg_scan(
@@ -225,8 +236,12 @@ def _handle_arg_scan(
     policy: dict,
     feature: _ArgScanFeature,
     scan_text: str,
+    pre_scan_finding: Optional[_PreScanFinding] = None,
 ) -> HookDecision:
-    """Shared scan + decision flow for MCP_EXECUTION and COMMAND_EXEC events."""
+    """Shared scan + decision flow for MCP_EXECUTION and COMMAND_EXEC events.
+
+    A Report-mode pre-scan finding still scans, and a secret found then takes over the response.
+    """
     ai_client = ctx.obj['ai_security_client']
 
     max_bytes = get_policy_value(policy, 'secrets', 'max_bytes', default=200000)
@@ -239,6 +254,18 @@ def _handle_arg_scan(
     error_message = None
 
     try:
+        if pre_scan_finding is not None:
+            block_reason = pre_scan_finding.block_reason
+            if pre_scan_finding.mode == GuardrailsMode.BLOCK:
+                outcome = AIHookOutcome.BLOCKED
+                return HookDecision.deny(
+                    feature.event_type, pre_scan_finding.deny_message, pre_scan_finding.deny_agent_message
+                )
+            outcome = AIHookOutcome.WARNED
+
+        if not feature.scan_enabled:
+            return HookDecision.allow(feature.event_type)
+
         scan_outcome = _scan_text_for_secrets(
             ctx,
             clipped,
@@ -282,8 +309,43 @@ def _handle_arg_scan(
         )
 
 
+def _check_mcp_server_authorization(payload: AIHookPayload, policy: dict) -> Optional[_PreScanFinding]:
+    """Fails open: no server name or no cached statuses lets the call through."""
+    mcp_config = get_policy_value(policy, 'mcp', default={})
+    if not get_policy_value(mcp_config, 'check_server', default=False):
+        return None
+
+    server_name = payload.mcp_server_name
+    if not server_name:
+        logger.debug('No MCP server name in the payload; skipping the server authorization check')
+        return None
+
+    statuses = load_mcp_server_statuses()
+    if statuses is None:
+        logger.debug('No cached MCP server statuses; skipping the server authorization check')
+        return None
+
+    status = statuses.status_of(server_name)
+    if not is_enforced(status):
+        return None
+
+    logger.debug('MCP server is not authorized, %s', {'mcp_server_name': server_name, 'status': status})
+    return _PreScanFinding(
+        block_reason=BlockReason.UNAUTHORIZED_MCP_SERVER,
+        mode=get_effective_mode(mcp_config, action_key='server_action'),
+        deny_message=(
+            f"Cycode blocked MCP server '{server_name}': it is not authorized in your organization. "
+            'Contact your admin to authorize it.'
+        ),
+        deny_agent_message=(
+            f"The MCP server '{server_name}' is not authorized in this organization. "
+            'Do not retry its tools or reach it another way.'
+        ),
+    )
+
+
 def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, policy: dict) -> HookDecision:
-    """Scan MCP tool arguments for secrets before execution."""
+    """Check the MCP server is authorized, then scan the tool arguments for secrets."""
     tool = payload.mcp_tool_name or 'unknown'
     args = payload.mcp_arguments or {}
     args_text = args if isinstance(args, str) else json.dumps(args)
@@ -297,8 +359,10 @@ def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, poli
             deny_agent_message='Do not pass secrets to tools. Use secret references (name/id) instead.',
             ask_message=lambda v: f'Allow MCP tool call "{tool}"? {v}',
             ask_agent_message='Possible secrets detected in tool arguments; proceed with caution.',
+            scan_enabled=get_policy_value(policy, 'mcp', 'scan_args', default=True),
         ),
         scan_text=args_text,
+        pre_scan_finding=_check_mcp_server_authorization(payload, policy),
     )