import { TealTiger } from 'tealtiger';
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

// Initialize TealTiger
const teal = new TealTiger({
  policies: {
    tools: {
      'filesystem/read': { allowed: true },
      'filesystem/write': { allowed: false },
      'filesystem/delete': { allowed: false }
    }
  }
});

// Create MCP server
const server = new Server({
  name: 'governed-filesystem',
  version: '1.0.0'
});

// Register tools with governance
server.setRequestHandler('tools/call', async (request) => {
  // Evaluate policy before executing tool
  const decision = await teal.evaluate({
    action: 'tool.execute',
    tool: request.params.name,
    arguments: request.params.arguments
  });
  
  if (decision.action === 'DENY') {
    return {
      error: {
        code: -32000,
        message: `Tool blocked: ${decision.reason_codes.join(', ')}`
      }
    };
  }
  
  // Execute the tool
  return await executeMCPTool(request.params.name, request.params.arguments);
});

// Start server
const transport = new StdioServerTransport();
await server.connect(transport);

import { TealTiger, PolicyMode } from 'tealtiger';
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
import { promises as fs } from 'fs';

// Initialize TealTiger with filesystem policies
const teal = new TealTiger({
  policies: {
    tools: {
      'filesystem/read': {
        allowed: true,
        conditions: {
          // Only allow reading from safe directories
          allowedPaths: ['/data', '/public'],
          denyPaths: ['/etc', '/root', '/.ssh']
        }
      },
      'filesystem/write': {
        allowed: true,
        conditions: {
          // Require approval for writes
          requireApproval: true,
          allowedPaths: ['/data/uploads']
        }
      },
      'filesystem/delete': {
        allowed: false  // Never allow deletes
      }
    }
  },
  audit: {
    enabled: true,
    outputs: ['console', 'file']
  },
  mode: {
    defaultMode: PolicyMode.ENFORCE
  }
});

// Create MCP server
const server = new Server({
  name: 'governed-filesystem',
  version: '1.0.0'
}, {
  capabilities: {
    tools: {}
  }
});

// Register read tool
server.setRequestHandler('tools/list', async () => {
  return {
    tools: [
      {
        name: 'filesystem/read',
        description: 'Read a file',
        inputSchema: {
          type: 'object',
          properties: {
            path: { type: 'string' }
          }
        }
      },
      {
        name: 'filesystem/write',
        description: 'Write a file',
        inputSchema: {
          type: 'object',
          properties: {
            path: { type: 'string' },
            content: { type: 'string' }
          }
        }
      }
    ]
  };
});

// Handle tool calls with governance
server.setRequestHandler('tools/call', async (request) => {
  const { name, arguments: args } = request.params;
  
  // Evaluate policy
  const decision = await teal.evaluate({
    action: 'tool.execute',
    tool: name,
    arguments: args,
    context: {
      environment: 'production'
    }
  });
  
  // Handle decision
  if (decision.action === 'DENY') {
    return {
      content: [{
        type: 'text',
        text: `Tool blocked: ${decision.reason_codes.join(', ')}`
      }],
      isError: true
    };
  }
  
  if (decision.action === 'REQUIRE_APPROVAL') {
    return {
      content: [{
        type: 'text',
        text: `Tool requires approval. Reference: ${decision.correlation_id}`
      }],
      isError: true
    };
  }
  
  // Execute tool
  try {
    let result;
    
    if (name === 'filesystem/read') {
      const content = await fs.readFile(args.path, 'utf-8');
      result = { content };
    } else if (name === 'filesystem/write') {
      await fs.writeFile(args.path, args.content);
      result = { success: true };
    }
    
    // Log execution
    await teal.logToolExecution({
      tool: name,
      arguments: args,
      result,
      correlationId: decision.correlation_id
    });
    
    return {
      content: [{
        type: 'text',
        text: JSON.stringify(result)
      }]
    };
    
  } catch (error) {
    return {
      content: [{
        type: 'text',
        text: `Error: ${error.message}`
      }],
      isError: true
    };
  }
});

// Start server
const transport = new StdioServerTransport();
await server.connect(transport);