check_action
Verify if an action complies with covenant rules by checking permissions against defined parameters to determine allowance or blockage.
Instructions
Check whether an action is allowed or blocked by the current covenant rules.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | The action name to check, e.g. 'delete_user' | |
| params | No | Optional parameters for the action |
Implementation Reference
- src/rules.ts:28-76 (handler)The core logic for checking an action against a set of rules.
export function checkAction( action: string, _params: Record<string, unknown>, rules: Rule[] ): CheckResult { // Rules are evaluated in order; first match wins for (const rule of rules) { const matches = rule.action === "*" || rule.action === action || action.startsWith(rule.action + "."); if (!matches) continue; if (rule.type === "forbid") { return { allowed: false, action, matchedRule: rule, reason: rule.reason ?? `Action "${action}" is forbidden.`, }; } if (rule.type === "permit") { return { allowed: true, action, matchedRule: rule, reason: rule.reason ?? `Action "${action}" is permitted.`, }; } // "require" — treated as permit (the requirement is informational for the agent) if (rule.type === "require") { return { allowed: true, action, matchedRule: rule, reason: rule.reason ?? `Action "${action}" is permitted (requirement noted).`, }; } } // Default: no matching rule → allowed (open policy) return { allowed: true, action, matchedRule: null, reason: `No rule matched action "${action}"; allowed by default.`, }; } - src/index.ts:52-78 (registration)Registration of the 'check_action' tool in the MCP server.
server.tool( "check_action", "Check whether an action is allowed or blocked by the current covenant rules.", { action: z.string().describe("The action name to check, e.g. 'delete_user'"), params: z .record(z.string(), z.unknown()) .optional() .default({}) .describe("Optional parameters for the action"), }, async ({ action, params }) => { const result = checkAction(action, params, rules); auditLog.append(action, params, { allowed: result.allowed, reason: result.reason, }); return { content: [ { type: "text" as const, text: JSON.stringify(result, null, 2), }, ], }; } );