+ lHjr>aRCt%0tRt^RIt^RIt^RIt^RIt^RIHtHt^RI H t ^RI H t ]P!R4tRDUUu.uF#wr]PV]P 4V3NK% upptRRltRR R //tR tREtR R /RltRRltRRltRt^@t^t]!4t]^kRRltRRltRR/R3RRRRRRR//R.3R R!/R3R"R#R$RRRR%/R&RR RR'R /R(R)//R$.3R*R+/R3R,R-R$RRRR./R&RR RR/R /R(R)/R0RRRR1/R2RRRR3/R4RRRR5//R$.3R6R7R$RRRR8/R&RR RR9R /R(R)//R$.33t R:R;lt!R<R=lt"R>R?lt#RR@RR@R RAR"RAR*RBR,RBR6RB/t$R#uuppi)FzMCP tool schema conversion and naming: JSON-schema normalisation for provider compatibility, mcp__server__tool naming, utility-tool schemas, include/exclude filters and description injection scanning.N)AnyList)strip_unicode_tags) mcp_fieldztools.mcp_toolc ^V^8dQhR\R\R\R\\,/#) server_name tool_name descriptionreturn)strlist)formats":/home/ubuntu/.hermes/hermes-agent/tools/mcp_tool_schema.py __annotate__r s/  s s  QUVYQZ cV'g.#\UUu.uF wr4VPV4'gKVNK" pppV'd(\PRWRP V4V4V#uuppi)zzScan a tool description for injection patterns; returns finding strings (empty = clean) and logs a warning when any match.uUMCP server '%s' tool '%s': suspicious description content — %s. Description: %.200sz; )_MCP_INJECTION_PATTERNSsearchloggerwarningjoin)rr r patternreasonfindingss&&& r_scan_mcp_descriptionr s`  .Ee.E?7XcId.EHen"tyy/BK Q O fs A.A.typeobject propertiesc Z\V\4'dVUu.uFp\V4NK up#\V\4'gV#/pVP 4Fjwr4VR9dI\V\4'd3VP 4UUu/uFwrVV\V4bK uppW#&KT\V4Y#R8XdRMT&Kl VP R4p\V\ 4'd0VPR4'dRV\R4R,VR&V#uupiuuppi)u_Promote legacy ``definitions`` to ``$defs`` (Moonshot rejects the draft-07 form) — ONLY where it is a JSON Schema meta-keyword, never as a property NAME inside ``properties``/``patternProperties``: a parameter legitimately named ``definitions`` rewritten to ``$defs`` would 400 the whole tool array (Anthropic/OpenAI forbid ``$`` in property names). definitions$defsz$refz#/definitions/z#/$defs/N)rpatternProperties) isinstancer _rewrite_local_refsdictitemsgetr startswithlen)nodeitem normalizedkeyvaluenameschemarefs& rr$r$/s  $6:;dd#D)d;; dD ! ! Jjjl  5 5*UD:Q:QUZU`U`UbcUb\Tt%8%@@UbcJOCVW\C]J"6wC @ # .. C#s/? @ @'#c2B.C.D*EE 6 < ds D"D' _object_rootFc \V\4'dVUu.uFp\V4NK up#\V\4'gV#/pVP 4FewrEV\ 9dI\V\4'd3VP 4UUu/uFwrgV\V4bK uppW4&KX\V4W4&Kg V'gRV9gRV9dVP R4'gRV9gRV9dRVR&VP R4R8Xd\VP R4\4'g/VR&VP R4pVP R4;'g/p \V\4'd3VU u.uF%p \V \4'gKW9gK#V NK' up M.VR&V#uupiuuppiuup i)uRecursively fill a missing object ``type``, ensure ``properties`` (so ``required`` can't dangle) and prune ``required`` to names present in ``properties`` (Gemini 400s otherwise). A dict carrying ``required`` but declaring no ``properties`` and no ``type`` is NOT an object declaration — it is a *constraint fragment*, the JSON Schema idiom for "at least one of these keys must be present" (``allOf``/``oneOf``/``anyOf``/``if`` branches). Synthesising ``properties: {}`` for it prunes every name out of ``required``, so sibling branches collapse into identical always-true schemas; the enclosing ``oneOf`` then has two matches and can never be satisfied, making the tool permanently un-dispatchable while the server-side tool itself is fine. Only the parameters-schema ROOT still gets the dangling-``required`` repair (``_object_root``), because that is the single node handed to providers as the function's argument object. rrrequiredr)r#r _repair_object_shaper%r&_SCHEMA_MAP_KEYSr'r ) r*r2r+repairedr-r.r/r0r4propsrs &$ rr5r5Js$7;'>UZT_T_TabTaLDT#7#??TabHM07HM#|x/6T>||F##)AZS[E['HV  << 8 +hll<8$??)+& ||J/HLL.44"E'1(D'A'A19$^1Jq#V^8dQhR\R,R\/#)rr0Nr )r%)rs"rrrwst rc,V'g\\4#^RIHpHp\ V4pV!VRR7pV!V4p\ VRR7p\V\4'g\\4#VPR4R8XdRV9d /VCR//CpV#)aNormalize MCP input schemas so one form is valid on OpenAI, Anthropic, Gemini and Moonshot. Order matters: ``definitions`` -> ``$defs``; nullable ``anyOf`` unions collapsed to the non-null branch (Anthropic rejects nullable branches; optionality lives in the parent's ``required``; the ``nullable: true`` hint is kept so runtime coercion can map a model-emitted ``"null"`` string to ``None``); same-typed const unions -> enum (AFTER the nullable strip); then object-shape repair. * Missing or ``null`` ``type`` on an object-shaped node is coerced to ``"object"`` (some servers omit it). See PR #4897. * When an ``object`` node lacks ``properties``, an empty ``properties`` dict is added so ``required`` entries don't dangle. * ``required`` arrays are pruned to only names that exist in ``properties``; otherwise Google AI Studio / Gemini 400s with ``property is not defined``. See PR #4651. * MCP/Pydantic optional fields commonly arrive as ``anyOf: [{...}, {"type": "null"}], default: null``. )collapse_const_unionsstrip_nullable_unionsT)keep_nullable_hint)r2rrr) r%_EMPTY_OBJECT_SCHEMAtools.schema_sanitizerr<r=r$r5r#r')r0r<r=r,s& r_normalize_mcp_input_schemarAws ())S$V,J&zdKJ&z2J%jtDJ j$ ' '())~~f)l*.L5 5L"5 rc0V^8dQhR\R\/#)rr.r r )rs"rrrs;;s;s;rcX\P!RR\T;'gR44#)zReplace every char outside ``[A-Za-z0-9_]`` with ``_`` (hyphens included, the historical behavior) so generated names pass provider validation.z [^A-Za-z0-9_]_)resubr )r.s&rsanitize_mcp_name_componentrIs# 66"CU[[b)9 ::rmcp__c<V^8dQhR\R\R\/#)rrr r rC)rs"rrrs& H H H H Hrc\ \V4 R\V4 2p\V4\8:dV#R\P !VP R44P4R\,pV\9d;\PV4\PRV\V4\4VR\\V4, V,#)zRegistry/wire name: ``mcp____``, clamped to 64 chars with a stable hash suffix when the natural name is longer.__rEzutf-8NzoMCP tool name %r (%d chars) exceeds the %d-char provider limit; shortened to a deterministic hash-suffixed name) MCP_TOOL_NAME_PREFIXrIr)_MCP_TOOL_NAME_MAX_LENGTHhashlibsha256encode hexdigest_MCP_TOOL_NAME_HASH_LENGTH_clamped_names_warnedaddrr)rr full_namesuffixs&& rmcp_prefixed_tool_namerYs(()D[)Q(RRTUpqzU{T|}I 9~22 7>>)"2"27";<FFHIdJde eF--!!),:;Dc)nVo q =/#f+= > GGrc0V^8dQhR\R\/#rrr )r r%)rs"rrrsStrc R\WP4R\VP;'gRVP RV 24R\ \ VRR44/#)z|Convert an MCP ``Tool`` (``.input_schema``, or ``.inputSchema`` before mcp 2.0) to a ``registry.register(schema=...)`` dict.r/r z MCP tool z from parameters input_schema inputSchema)rYr/rr rAr)rmcp_tools&&r_convert_mcp_schemaras_ &{MMB)(*>*>*p*pIhmm_\bcnboBpq1)HnVc2de rlist_resourcesz3List available resources from MCP server '{server}' read_resourcez1Read a resource by URI from MCP server '{server}'uristringr zURI of the resource to read list_promptsz1List available prompts from MCP server '{server}' get_promptz/Get a prompt by name from MCP server '{server}'r/zName of the prompt to retrieve argumentsz(Optional arguments to pass to the promptadditionalPropertiesTlist_event_typeszbList the event types MCP server '{server}' can notify about, and your active subscriptions to themsubscribe_eventzSubscribe to an event from MCP server '{server}': each occurrence starts a new agent run with your instructions and delivers its result to the chosen targetz%Event type name from list_event_typesz7Subscription arguments matching the event's inputSchema instructionsz>What to do each time the event arrives (up to 2000 characters)deliverz@Where each run's result goes: log, telegram, discord, slack, ...deliver_chat_idz(Optional chat id on the deliver platformunsubscribe_eventzMCP config %s must be a string or list of strings; ignoring %r)r|r#r r tuplerr)r.r{r+s&& r_normalize_name_filterrsk }u %w%$s+,,&+,edD e,, NNSUZb 5L-s BcRV^8dQhR\R\\,R\/#)rr patternsr )r r|bool)rs"rrr s*hh3h#c(hthrcaV'gR#SV9dR#\;QJdV3RlV4F 'gK R# R#!V3RlV44#)zTrue if ``tool_name`` matches any entry: exact names literally, entries with ``*``/``?``/``[`` as case-sensitive globs (same semantics as ``approvals.deny``). Exact membership is checked first so big lists stay O(1).FTc3<"TF3pRV9gRV9g RV9gK\P!SV4xK5 R#5i)*?[N)fnmatch fnmatchcase).0pr s& r &matches_name_filter..s<g(QcQhRUYZRZ^aef^f0w""9a00(s>>)any)r rsf&rmatches_name_filterr s? H 3g(g33g3g3g(g ggr resourcespromptseventscVV^8dQh/^\9d\\,;R&#)rrU)__conditional_annotations__r|r )rs"rrrs$##P('s3x'Q#r) )z)ignore\s+(all\s+)?previous\s+instructionsz8prompt override attempt ('ignore previous instructions'))zyou\s+are\s+now\s+az.identity override attempt ('you are now a...'))z1your\s+new\s+(task|role|instructions?)\s+(is|are)ztask override attempt)z system\s*:\s*zsystem prompt injection attempt)z <\s*(system|human|assistant)\s*>zrole tag injection attempt)z'do\s+not\s+(tell|inform|mention|reveal)zconcealment instruction)z(curl|wget|fetch)\s+https?://znetwork command in description)zbase64\.(b64decode|decodebytes)zbase64 decode reference)zexec\s*\(|eval\s*\(zcode execution reference)z&import\s+(subprocess|os|shutil|socket)zdangerous import reference)rr"r!r dependentSchemas)&r__doc__loggingrPrrGtypingrrtools.ansi_striprtools.mcp_tool_commonr getLoggerrcompile IGNORECASErrr?r$r6r5rArIrNrOrTr|rUrYrartryrr_UTILITY_CAPABILITY_ATTRSr)rrrs00@rrs# /+   + , S T SZZ'0 S T ,;0c)u)Z8;"%%' HLbRVWI fh /L MNQVPWYH"dSD &(M3ST  X F 2 #T +  $(U &(M3Z[  X U 2 #T + &(')ik VX"$fh VX}>hi  X &(M3DE  X O 2 #T + ?'T  h*k?KI|Y"3X?RT\^a Ts)E