Files
zeekay 25c6f62cff feat(rust): hanzo-shell reads exec's command and says allow, ask or deny
A pure-Rust classifier for the `Classify` seam. brush-parser (MIT) gives the bash AST
and rustpython-parser (MIT) the Python one; every simple command, redirection,
substitution and nested script (bash -c, here-documents, a script the command wrote and
runs, python -c, ssh host '...') is read in the order the shell runs them, and the policy
over paths decides what each costs. rust/shell is its own crate with a wasm-bindgen build,
so kai-gateway can replace safety.ts with it.

exec: an ask is refused until the call carries approve: true (never lifts a deny); the
interpreter must be a shell the classifier reads; the env is read beside the command;
the git tool asks the same classifier and runs with core.fsmonitor=false; ui install no
longer hands the component name to sh -c.

On 408,231 Bash commands: safety.ts flags 20.69% (15.27% unparsed); this answers
allow 88.2 / ask 9.6 / deny 2.2 (roots set), cannot read 0.22%, p99 0.6 ms.
2026-10-14 16:32:13 -07:00

108 lines
2.9 KiB
TOML

[workspace]
members = ["trigram", "shell"]
[package]
name = "hanzo-mcp"
version = "1.1.29"
repository = "https://github.com/hanzoai/mcp"
homepage = "https://hanzo.ai"
keywords = ["mcp", "ai", "tools", "hanzo", "llm"]
categories = ["development-tools", "command-line-utilities"]
edition = "2021"
authors = ["Hanzo AI"]
description = "Native MCP server for Hanzo AI Cloud and local development tools"
license = "MIT"
exclude = ["target/", "tests/", "benches/"]
[dependencies]
# Core
tokio = { version = "1", features = ["full"] }
async-trait = "0.1"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
serde_yaml = "0.9"
toml = "0.8"
sha2 = "0.10"
blake3 = "1.5"
# MCP Protocol
jsonrpc-core = "18.0"
jsonrpc-derive = "18.0"
jsonrpc-http-server = "18.0"
# Logging
log = "0.4"
env_logger = "0.10"
# Utils
anyhow = "1.0"
thiserror = "1.0"
dirs = "5.0"
clap = { version = "4.4", features = ["derive"] }
reqwest = { version = "0.11", default-features = false, features = ["json", "rustls-tls"] }
walkdir = "2.4"
glob = "0.3"
regex = "1.10"
rayon = "1.8"
once_cell = "1.19"
base64 = "0.21"
shellexpand = "3.1"
chrono = { version = "0.4", features = ["serde"] }
tempfile = "3.10"
which = "6.0"
shell-escape = "0.1"
# The ZAP router every Hanzo process embeds (one per login, elected by lock),
# and this process's seat on it. crates.io has 1.1.2, which predates the
# unpaired door on 9998, so the tag is the pin.
zapd = "1.1.5"
# Search and AST
# The in-process text, symbol and document search over tgrep-core; light enough for
# Dev to link on its own, re-exported here as `hanzo_mcp::trigram`.
hanzo-trigram = { path = "trigram", version = "0.1.0" }
# The shell command classifier behind exec's allow / ask / deny: pure Rust, also built for wasm.
hanzo-shell = { path = "shell", version = "0.1.0" }
tree-sitter = "0.20"
tree-sitter-rust = "0.20"
tree-sitter-javascript = "0.20"
tree-sitter-typescript = "0.20"
tree-sitter-python = "0.20"
tree-sitter-go = "0.20"
tree-sitter-java = "0.20"
tree-sitter-cpp = "0.20"
tree-sitter-c = "0.20"
# Vector store (optional)
# lance = "0.10" # Temporarily disabled due to arrow version conflict
# arrow = "50.0" # Temporarily disabled due to build issues
# vectordb = { version = "0.1", optional = true }
[dev-dependencies]
[target.'cfg(unix)'.dependencies]
nix = { version = "0.29", features = ["signal", "process"] }
# Platform specific
[target.'cfg(target_os = "macos")'.dependencies]
cocoa = "0.25"
objc = "0.2"
[target.'cfg(target_os = "windows")'.dependencies]
winapi = { version = "0.3", features = ["winuser", "wingdi", "windef", "minwindef"] }
[target.'cfg(target_os = "linux")'.dependencies]
x11 = "2.21"
[features]
default = []
# all-tools = ["computer-control", "blockchain", "vector-store", "file-system", "web-search", "code-execution"]
[[bin]]
name = "hanzo-mcp"
path = "src/main.rs"
[lib]
name = "hanzo_mcp"
path = "src/lib.rs"
crate-type = ["lib", "cdylib", "staticlib"]