Documentation
¶
Overview ¶
Package mcp exposes a roost's privileged tools as a role-scoped MCP server.
Index ¶
- func OriginAllowed(r *http.Request) bool
- type CallEnvFunc
- type CallObserver
- type NativeCallObserver
- type NativeTool
- type Policy
- type Principal
- type PrincipalFunc
- type RolePolicy
- type RolesFunc
- type Server
- func (s *Server) HasNativeTools() bool
- func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)
- func (s *Server) SetCallEnv(callEnv CallEnvFunc)
- func (s *Server) SetCallObserver(observer CallObserver)
- func (s *Server) SetNativeCallObserver(observer NativeCallObserver)
- func (s *Server) SetNativeTools(tools []NativeTool, principalOf PrincipalFunc)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func OriginAllowed ¶
Native MCP clients omit Origin. Browser-originated requests must be same-host to prevent DNS rebinding; reverse proxies preserve the external Host header.
Types ¶
type CallEnvFunc ¶
CallEnvFunc supplies trusted per-request identity variables to the privileged tool process.
type CallObserver ¶
CallObserver receives allowed and denied tool-call attempts for centralized auditing.
type NativeCallObserver ¶ added in v0.144.0
NativeCallObserver receives the exact typed call envelope for audit logging.
type NativeTool ¶ added in v0.144.0
type NativeTool struct {
Name string
Title string
Description string
InputSchema map[string]any
Annotations map[string]any
Call func(context.Context, Principal, json.RawMessage) (map[string]any, bool, error)
}
NativeTool is a typed in-process MCP operation. Native tools are available to authenticated roost users independently of role-scoped executable tools.
type Principal ¶ added in v0.144.0
Principal is the authenticated identity supplied to built-in control tools. UserID owns created resources. ClientID identifies the acting MCP client.
type PrincipalFunc ¶ added in v0.144.0
PrincipalFunc resolves the authenticated caller from a request.
type RolePolicy ¶
type RolePolicy = config.MCPRoleConfig
RolePolicy aliases one role in the wing.yaml MCP configuration.
type RolesFunc ¶
RolesFunc resolves all caller roles from the request. Disabled roles contribute no access; tools allowed by any enabled role are included in the caller's maximum subset.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is an MCP-over-HTTP (Streamable HTTP) endpoint over a shared ToolRunner, gated by a per-role Policy.
func (*Server) HasNativeTools ¶ added in v0.144.0
func (*Server) ServeHTTP ¶
func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP handles a single JSON-RPC request per POST (stateless Streamable HTTP).
func (*Server) SetCallEnv ¶
func (s *Server) SetCallEnv(callEnv CallEnvFunc)
func (*Server) SetCallObserver ¶
func (s *Server) SetCallObserver(observer CallObserver)
func (*Server) SetNativeCallObserver ¶ added in v0.144.0
func (s *Server) SetNativeCallObserver(observer NativeCallObserver)
func (*Server) SetNativeTools ¶ added in v0.144.0
func (s *Server) SetNativeTools(tools []NativeTool, principalOf PrincipalFunc)