openmoat 0.6.0

Policy checks for AI coding agents: decides allow, defer, ask or deny for every tool call from Claude Code, Codex and Cursor, configures Claude Code's and Codex's own OS sandboxes from the same policy, and keeps a local audit log.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

//! `moat mcp …` grammar.

use std::path::PathBuf;

use clap::{Args, Subcommand};

#[derive(Debug, Subcommand)]
pub enum McpCommand {
    /// Show what changed in the agents' MCP server definitions, and in the tools of
    /// servers run through `moat mcp proxy`, and ask before accepting it. Until then,
    /// the changed server's tool calls are refused. Refused unless run from an
    /// interactive terminal, and over a drifted lock.
    Accept(McpAcceptArgs),
    /// Run one stdio MCP server through OpenMoat (started by the agent from its
    /// configuration, not by people): pin each tool's description and input schema,
    /// hide a tool whose definition changed until `moat mcp accept`, and record every
    /// tool call in the audit log.
    Proxy(McpProxyArgs),
    /// Point stdio MCP servers in the agents' user configuration at `moat mcp proxy`,
    /// backing the files up first. Refused unless run from an interactive terminal.
    Wrap(McpWrapArgs),
    /// Point wrapped MCP servers back at their own command. Refused unless run from an
    /// interactive terminal.
    Unwrap(McpUnwrapArgs),
}

#[derive(Debug, Args)]
pub struct McpAcceptArgs {
    /// Only this server's changes. Defaults to every change found.
    pub server: Option<String>,
}

#[derive(Debug, Args)]
pub struct McpProxyArgs {
    /// The server's name in the agent's configuration.
    #[arg(long)]
    pub server: String,

    /// Start the server under `moat run`: in a sandbox made from the policy, with
    /// network only through OpenMoat's proxy (macOS, Linux). Not inside `moat run`:
    /// sandboxes do not nest.
    #[arg(long)]
    pub sandbox: bool,

    /// With --sandbox: a file or directory the server may also write (`moat run --write`).
    #[arg(long = "write", value_name = "PATH", requires = "sandbox")]
    pub writes: Vec<PathBuf>,

    /// The server's command and arguments, after `--`.
    #[arg(required = true, last = true, value_name = "COMMAND")]
    pub command: Vec<std::ffi::OsString>,
}

#[derive(Debug, Args)]
pub struct McpWrapArgs {
    /// Servers to wrap, by name. Defaults to every stdio server found.
    pub servers: Vec<String>,

    /// Also start each server under `moat run` (`moat mcp proxy --sandbox`).
    #[arg(long)]
    pub sandbox: bool,

    /// Print what would change without writing anything.
    #[arg(long)]
    pub dry_run: bool,
}

#[derive(Debug, Args)]
pub struct McpUnwrapArgs {
    /// Servers to unwrap, by name. Defaults to every wrapped server.
    pub servers: Vec<String>,
}