Nobulex MCP Compliance Server

Instructions

Implementation Reference

• src/rules.ts:28-76 (handler)

  The core logic for checking an action against a set of rules.

  export function checkAction(
    action: string,
    _params: Record<string, unknown>,
    rules: Rule[]
  ): CheckResult {
    // Rules are evaluated in order; first match wins
    for (const rule of rules) {
      const matches =
        rule.action === "*" || rule.action === action || action.startsWith(rule.action + ".");
  
      if (!matches) continue;
  
      if (rule.type === "forbid") {
        return {
          allowed: false,
          action,
          matchedRule: rule,
          reason: rule.reason ?? `Action "${action}" is forbidden.`,
        };
      }
  
      if (rule.type === "permit") {
        return {
          allowed: true,
          action,
          matchedRule: rule,
          reason: rule.reason ?? `Action "${action}" is permitted.`,
        };
      }
  
      // "require" — treated as permit (the requirement is informational for the agent)
      if (rule.type === "require") {
        return {
          allowed: true,
          action,
          matchedRule: rule,
          reason: rule.reason ?? `Action "${action}" is permitted (requirement noted).`,
        };
      }
    }
  
    // Default: no matching rule → allowed (open policy)
    return {
      allowed: true,
      action,
      matchedRule: null,
      reason: `No rule matched action "${action}"; allowed by default.`,
    };
  }

• src/index.ts:52-78 (registration)

  Registration of the 'check_action' tool in the MCP server.

  server.tool(
    "check_action",
    "Check whether an action is allowed or blocked by the current covenant rules.",
    {
      action: z.string().describe("The action name to check, e.g. 'delete_user'"),
      params: z
        .record(z.string(), z.unknown())
        .optional()
        .default({})
        .describe("Optional parameters for the action"),
    },
    async ({ action, params }) => {
      const result = checkAction(action, params, rules);
      auditLog.append(action, params, {
        allowed: result.allowed,
        reason: result.reason,
      });
      return {
        content: [
          {
            type: "text" as const,
            text: JSON.stringify(result, null, 2),
          },
        ],
      };
    }
  );