feat(security): Introduce Conseca framework (#13193)

packages/core/src/policy/policies/conseca.toml

@@ -0,0 +1,6 @@
+[[safety_checker]]
+toolName = "*"
+priority = 100
+[safety_checker.checker]
+type = "in-process"
+name = "conseca"

packages/core/src/policy/policy-engine.ts

@@ -113,7 +113,10 @@ function ruleMatches(
 
   // Check tool name if specified
   if (rule.toolName) {
-    if (isWildcardPattern(rule.toolName)) {
+    // Support wildcard patterns: "serverName__*" matches "serverName__anyTool"
+    if (rule.toolName === '*') {
+      // Match all tools
+    } else if (isWildcardPattern(rule.toolName)) {
       if (
         !toolCall.name ||
         !matchesWildcard(rule.toolName, toolCall.name, serverName)

packages/core/src/policy/types.ts

@@ -78,6 +78,7 @@ export interface ExternalCheckerConfig {
 
 export enum InProcessCheckerType {
   ALLOWED_PATH = 'allowed-path',
+  CONSECA = 'conseca',
 }
 
 /**