fix(mcp): intersect per-call scope params with env-pinned tenant scoping (#108) - #143
Merged
Merged
Conversation
…ing (#108) Client-supplied read_scopes replaced ENGRAM_READ_SCOPES and scope replaced ENGRAM_SCOPE, so a stdio child pinned to one Hermes profile could read and write any tenant with one tool argument. resolveCallScoping now treats the env read scopes as the ceiling when they are set: read_scopes is intersected (empty intersection throws) and scope must be one of them. With the env unset (shared HTTP daemon) the params remain the tenant identity, unchanged. Tests flipped where they asserted the old escape; docs and changelog say which deployment pins the tenant where. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FJcVdAMkcEH6U3ZMKrEwv
…ets in CHANGELOG Conflict was only CHANGELOG.md (Unreleased/Fixed: #87 and #109 on main, #108 here). All three kept. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015xo3z3uv6caDhR8zjrv5QF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #108.
Summary
resolveCallScopinglet request params replace the env:read_scopesreplacedENGRAM_READ_SCOPESandscopereplacedENGRAM_SCOPE, so a stdio child pinned to one Hermes profile could read and write any tenant with one tool argument.Now, when the env restricts (
getTenantScoping(env).readScopesdefined):read_scopesis intersected with the env read scopes; empty intersection throws.scopemust be one of the env read scopes (write only where you may read); otherwise throws.With the env unset (shared HTTP daemon, params are the tenant identity) behaviour is unchanged.
One guard in the shared resolver covers all nine scoped call sites in
server.ts.provider.py's docstring ("no tool argument can write outside this profile's scope") is now true. #109 (forgetscope: "global"bypass) and #87 (bridge drops env) are untouched siblings.Changes
src/interfaces/mcp/scoping.ts— intersect / membership checks with actionable error messages.tests/core/tenant-scoping.test.ts— 4 new cases; existing override case now stays insideENGRAM_READ_SCOPES.tests/interfaces/mcp/per-request-scoping.test.ts— env-pinned test asserts both escapes returnisError(it previously asserted the escape).docs/integrate-your-agent.md,CHANGELOG.md.Test plan
npm run test:run— 132 files / 1692 tests pass, 13 skippednpm run lintclean🤖 Generated with Claude Code
https://claude.ai/code/session_014FJcVdAMkcEH6U3ZMKrEwv