Documentation
¶
Overview ¶
Package enforcement contains the pure decision logic that decides whether a normalized tool call is permitted by an MDMConfiguration's EnforcementAllowlist.
The evaluator is deliberately I/O-free: it takes a NormalizedCall plus an allowlist and returns an allow/deny Decision. The decision endpoint and the device-side hook both build a NormalizedCall and feed it here.
Index ¶
Constants ¶
const ( KindMCP = "mcp" KindShell = "shell" KindRead = "read" KindWrite = "write" KindTask = "task" KindGeneric = "generic" )
Tool-call kinds produced by the device-side tool classifier. These mirror the classifications obot-sentry derives from a runtime tool name.
const ( AgentClaudeCode = "claude_code" AgentCodex = "codex" AgentVSCode = "vscode" AgentCursor = "cursor" )
Supported local agents.
Variables ¶
This section is empty.
Functions ¶
func CanonicalPackageName ¶
func CanonicalPackageName(source types.AllowlistServerPackageSource, name string) string
CanonicalPackageName reduces a package name to the single spelling its registry considers canonical, so that packageMatches — which compares names as exact strings — cannot be sidestepped by an alias form.
func NormalizedPort ¶
NormalizedPort returns the explicit port or the scheme's default port.
Types ¶
type Decision ¶
Decision is the result of evaluating a NormalizedCall against an allowlist.
func Evaluate ¶
func Evaluate(call NormalizedCall, allowlist types.EnforcementAllowlist) Decision
Evaluate decides whether call is permitted by allowlist. It is fail-closed: anything that does not positively match an allow rule is denied.
type NormalizedCall ¶
type NormalizedCall struct {
// Agent is the coding agent that issued the call (claude_code | codex | vscode | cursor).
Agent string
// Tool is the runtime tool name (for an MCP call this is the tool within the server).
Tool string
// Kind is the classified tool kind: mcp | shell | read | write | task | generic.
Kind string
// ServerName is the MCP server hint derived from the tool name (e.g. the
// "<server>" in mcp__<server>__<tool>). It may be empty when the agent does
// not expose a server hint. It is used to match the built-in agent MCP set.
ServerName string
// Server identifies the resolved target MCP server (for mcp calls).
Server ServerIdentity
// ObotHosted is true when the resolved server maps to an Obot-hosted or
// system MCP server.
ObotHosted bool
// Unresolved reports that the device could not establish what the call
// targets, and UnresolvedReason names the specific cause. Such a call is
// denied ahead of every allowlist toggle: nothing can be said to match a
// target that was never identified.
Unresolved bool
UnresolvedReason string
}
NormalizedCall is the parameter-free description of a single tool call that the evaluator decides on. It is produced by the device-side pre-tool hook (resolving the target server from the agent's MCP config) and by the decision endpoint before evaluation.
type PackageIdentity ¶
type PackageIdentity struct {
Source types.AllowlistServerPackageSource
Name string
Version string
}
PackageIdentity is the canonical package identity of a stdio MCP server that is launched via a package runner (npx / uvx).
type ServerIdentity ¶
type ServerIdentity struct {
URL string
Package *PackageIdentity
Command string
Hostname string
// Connector is the display name of a hosted agent-account connector, which
// has no local URL and no local command.
Connector string
}
ServerIdentity identifies a resolved MCP server. For an MCP call at most one of URL / Package / Command / Connector is populated; Hostname is derived from URL when present.
Source Files