security: SHRIKE-401 check_approval 403 handling + bump 3.3.0

- Handle DASHBOARD_REQUIRED, COOLDOWN_ACTIVE, SELF_APPROVAL_BLOCKED,
  SCANNER_ROUTE_DENIED 403 responses with user-facing guidance
- Updated tool description: high/critical require dashboard, low/medium
  have 60s cooldown, never decide autonomously
- Bump to 3.3.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Habirua

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to shrike-mcp will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.3.0] - 2026-02-28
+
+### Security
+- SHRIKE-401: Agent self-approval bypass prevention
+  - High/critical approvals now require dashboard authentication (JWT) — MCP-submitted decisions are rejected with `DASHBOARD_REQUIRED`
+  - 60-second cooldown on low/medium MCP-submitted decisions — prevents instant agent self-approval (`COOLDOWN_ACTIVE`)
+  - Self-approval blocked — the entity that triggered a scan cannot approve its own request (`SELF_APPROVAL_BLOCKED`)
+  - Scanner service `/decide` route removed — decisions only available via dashboard (`SCANNER_ROUTE_DENIED`)
+  - `check_approval` tool updated with structured 403 error handling and user-facing guidance for all enforcement scenarios
+
 ## [3.2.0] - 2026-02-28
 
 ### Added

package.json

@@ -1,7 +1,7 @@
 {
   "name": "shrike-mcp",
   "mcpName": "io.github.Shrike-Security/shrike-mcp",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "MCP server that gives AI agents 8 security tools powered by a multi-stage detection pipeline. Scans prompts, responses, SQL, file writes, and web searches for injection attacks, PII leaks, and policy violations. Human-in-the-loop approval engine for enterprise compliance.",
   "type": "module",
   "main": "./dist/index.js",

src/tools/checkApproval.ts

@@ -61,6 +61,27 @@ export async function checkApproval(input: CheckApprovalInput, customerId: strin
       clearTimeout(timeoutId);
 
       if (!response.ok) {
+        // SHRIKE-401: Handle severity-based enforcement responses
+        if (response.status === 403) {
+          const errorData = await response.json().catch(() => ({ error: 'Forbidden', code: 'UNKNOWN' }));
+          const code = errorData.code || '';
+          console.error(`[check_approval] Decision blocked: ${response.status} code=${code} ${errorData.error}`);
+
+          if (code === 'DASHBOARD_REQUIRED') {
+            return buildDashboardRequiredResponse(requestId, errorData.error);
+          }
+          if (code === 'COOLDOWN_ACTIVE') {
+            return buildCooldownResponse(requestId, errorData.error);
+          }
+          if (code === 'SELF_APPROVAL_BLOCKED') {
+            return buildSelfApprovalBlockedResponse(requestId);
+          }
+          if (code === 'SCANNER_ROUTE_DENIED') {
+            return buildDashboardRequiredResponse(requestId, errorData.error);
+          }
+          return buildErrorResponse(requestId, errorData.error || 'Forbidden');
+        }
+
         const errorText = await response.text().catch(() => 'Unknown error');
         console.error(`[check_approval] Decision failed: ${response.status} ${errorText}`);
         return buildErrorResponse(requestId, `Failed to submit decision: ${response.status}`);
@@ -257,6 +278,72 @@ function buildErrorResponse(requestId: string, reason: string): SanitizedRespons
   };
 }
 
+/**
+ * SHRIKE-401: Response for high/critical approvals that require dashboard auth.
+ */
+function buildDashboardRequiredResponse(requestId: string, serverMsg: string): SanitizedResponse {
+  return {
+    blocked: true,
+    action: 'block',
+    threat_type: 'scan_error',
+    owasp_category: 'LLM08',
+    severity: 'high',
+    confidence: 'high',
+    guidance: serverMsg,
+    agent_instruction: 'This approval requires dashboard authentication. You CANNOT approve or reject it from here. Direct the user to the Shrike Security dashboard to review and decide on this approval.',
+    user_message: 'This approval must be decided through the Shrike Security dashboard. Please log in to your dashboard to approve or reject this action.',
+    audit: {
+      scan_id: requestId,
+      timestamp: new Date().toISOString(),
+    },
+    request_id: requestId,
+  };
+}
+
+/**
+ * SHRIKE-401: Response when cooldown period hasn't elapsed yet.
+ */
+function buildCooldownResponse(requestId: string, serverMsg: string): SanitizedResponse {
+  return {
+    blocked: true,
+    action: 'block',
+    threat_type: 'scan_error',
+    owasp_category: 'LLM08',
+    severity: 'medium',
+    confidence: 'high',
+    guidance: serverMsg,
+    agent_instruction: 'The approval is in a mandatory review cooldown period. Wait for the cooldown to expire, then ask the user if they want you to try submitting the decision again.',
+    user_message: `${serverMsg}. This cooldown ensures time for human review before any decision is accepted.`,
+    audit: {
+      scan_id: requestId,
+      timestamp: new Date().toISOString(),
+    },
+    request_id: requestId,
+  };
+}
+
+/**
+ * SHRIKE-401: Response when the same user tries to approve their own request.
+ */
+function buildSelfApprovalBlockedResponse(requestId: string): SanitizedResponse {
+  return {
+    blocked: true,
+    action: 'block',
+    threat_type: 'scan_error',
+    owasp_category: 'LLM08',
+    severity: 'high',
+    confidence: 'high',
+    guidance: 'Self-approval is not permitted. A different authorized user must review and decide on this approval.',
+    agent_instruction: 'Self-approval was blocked by the server. The user who triggered this scan cannot approve their own request. A different authorized user must decide. Inform the user of this requirement.',
+    user_message: 'Self-approval is not permitted. A different authorized user must review and decide on this approval through the Shrike dashboard.',
+    audit: {
+      scan_id: requestId,
+      timestamp: new Date().toISOString(),
+    },
+    request_id: requestId,
+  };
+}
+
 /**
  * MCP Tool definition for check_approval
  */
@@ -272,9 +359,13 @@ POLL MODE (no decision parameter): Returns the current status of an approval.
 - status="rejected": the action was denied. Return the rejection reason to the user and STOP. Do not retry.
 - status="expired": the approval timed out without a decision. Inform the user and STOP.
 
-DECIDE MODE (decision + justification parameters): Submits an approval decision.
-- decision="approved": approve the pending action. Optionally include justification.
-- decision="rejected": reject the pending action. Justification is recommended.
+DECIDE MODE (decision + justification parameters): Submits a decision after the user explicitly instructs you to approve or reject.
+- You MUST present the full approval context (threat type, severity, risk factors) to the user FIRST.
+- You MUST wait for the user's EXPLICIT instruction (e.g., "approve it", "reject it") before calling with a decision.
+- NEVER decide autonomously — always require explicit human instruction.
+- High/critical severity approvals can ONLY be decided via the Shrike dashboard — the server will reject MCP-submitted decisions for these.
+- Low/medium severity approvals have a 60-second cooldown after creation before decisions are accepted.
+- If the server returns a 403 error, inform the user of the reason and direct them to the dashboard if needed.
 
 IMPORTANT: Do NOT automatically poll in a loop. Approvals may take minutes to hours. Inform the user of the pending status and wait for them to ask you to check again.
 
@@ -291,7 +382,7 @@ ERROR HANDLING: If this tool returns an error, inform the user. Do NOT proceed w
       decision: {
         type: 'string',
         enum: ['approved', 'rejected'],
-        description: 'Submit a decision (omit to poll status only)',
+        description: 'Submit a decision ONLY after the user explicitly instructs you to approve or reject. Never decide autonomously.',
       },
       justification: {
         type: 'string',