policy

package
v0.2.20 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 5, 2026 License: MPL-2.0 Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ToolDigestChangedReason = "tool digest changed"
	ToolPolicyDeniesReason  = "server/tool policy denies this tool"
	PolicyAllowedReason     = "policy allowed"
)

Variables

View Source 
var ErrInvalid = errors.New("invalid MCP policy")

Functions

func ApprovalRuleRank 

func ApprovalRuleRank(value MCPApprovalRule) int

func CloneToolPolicies 

func CloneToolPolicies(
	input map[string]MCPToolPolicyOverride,
) map[string]MCPToolPolicyOverride

CloneToolPolicies performs a deep clone of override pointer fields. A shallow map clone is unsafe because ApprovalRule and ExecutionMode are mutable pointers.

func EffectiveToolConstraints 

func EffectiveToolConstraints(
	value MCPPolicy,
	toolName string,
	discoveredApproval MCPApprovalRule,
	discoveredExecution MCPExecutionMode,
) (MCPApprovalRule, MCPExecutionMode)

func EffectiveToolPolicy 

func EffectiveToolPolicy(
	value MCPPolicy,
	toolName string,
) (
	MCPApprovalRule,
	MCPExecutionMode,
	MCPToolPolicyOverride,
	bool,
)

func ExecutionModeRank 

func ExecutionModeRank(value MCPExecutionMode) int

func InferToolRisk 

func InferToolRisk(
	hints ToolRiskHints,
	trustLevel MCPTrustLevel,
) string

func ValidateDigest 

func ValidateDigest(value string) error

func ValidateMCPApprovalRule 

func ValidateMCPApprovalRule(value MCPApprovalRule) error

func ValidateMCPExecutionMode 

func ValidateMCPExecutionMode(value MCPExecutionMode) error

func ValidateMCPPolicy 

func ValidateMCPPolicy(value MCPPolicy) error

func ValidateMCPServerPolicy 

func ValidateMCPServerPolicy(value MCPServerPolicy) error

func ValidateMCPToolPolicyOverride 

func ValidateMCPToolPolicyOverride(
	name string,
	value MCPToolPolicyOverride,
) error

Types

type Composition 

type Composition struct {
	Body      MCPPolicy
	Conflicts map[string]string
}

func ComposeMCPPolicy 

func ComposeMCPPolicy(
	baseline MCPPolicy,
	policies ...MCPPolicy,
) (Composition, error)

type Effective 

type Effective struct {
	Body      MCPPolicy         `json:"body"`
	Conflicts map[string]string `json:"conflicts,omitempty"`
	Digest    cryptoutil.Digest `json:"digest"`
}

Effective is the deterministic result of composing MCP policies. It is a domain value, not a Store value. Store persists policy documents, while Runtime consumes the resolved policy projection through Aggregate.

func Compose 

func Compose(
	baseline MCPPolicy,
	policies ...MCPPolicy,
) (Effective, error)

func (Effective) Validate 

func (e Effective) Validate() error

type MCPApprovalRule 

type MCPApprovalRule string
const (
	MCPApprovalRuleAsk   MCPApprovalRule = "ask"
	MCPApprovalRuleAllow MCPApprovalRule = "allow"
	MCPApprovalRuleDeny  MCPApprovalRule = "deny"
)

func NormalizedApprovalRule 

func NormalizedApprovalRule(value MCPApprovalRule) MCPApprovalRule

type MCPAppsPolicy 

type MCPAppsPolicy struct {
	Enabled                          bool `json:"enabled"`
	AllowAppInitiatedToolCalls       bool `json:"allowAppInitiatedToolCalls"`
	RequireApprovalForOpenLink       bool `json:"requireApprovalForOpenLink"`
	RequireApprovalForContextUpdates bool `json:"requireApprovalForContextUpdates"`
}

func DefaultMCPAppsPolicy 

func DefaultMCPAppsPolicy() MCPAppsPolicy

type MCPExecutionMode 

type MCPExecutionMode string
const (
	MCPExecutionModeManual MCPExecutionMode = "manual"
	MCPExecutionModeAuto   MCPExecutionMode = "auto"
)

func NormalizedExecutionMode 

func NormalizedExecutionMode(value MCPExecutionMode) MCPExecutionMode

type MCPPolicy 

type MCPPolicy struct {
	TrustLevel    MCPTrustLevel                    `json:"trustLevel"`
	DefaultPolicy MCPServerPolicy                  `json:"defaultPolicy"`
	ToolPolicies  map[string]MCPToolPolicyOverride `json:"toolPolicies,omitempty"`
	AppsPolicy    MCPAppsPolicy                    `json:"appsPolicy"`
}

func Baseline 

func Baseline() MCPPolicy

func CloneMCPPolicy 

func CloneMCPPolicy(input MCPPolicy) MCPPolicy

func NormalizeMCPPolicy 

func NormalizeMCPPolicy(input MCPPolicy) MCPPolicy

func TightenToolPolicy 

func TightenToolPolicy(
	value MCPPolicy,
	toolName string,
	currentApproval MCPApprovalRule,
	currentExecution MCPExecutionMode,
	mappedApproval MCPApprovalRule,
	mappedExecution MCPExecutionMode,
) (MCPPolicy, error)

type MCPServerPolicy 

type MCPServerPolicy struct {
	DefaultApprovalRule  MCPApprovalRule  `json:"defaultApprovalRule"`
	DefaultExecutionMode MCPExecutionMode `json:"defaultExecutionMode"`

	RequireApprovalForUnknownRisk bool `json:"requireApprovalForUnknownRisk"`
	RequireApprovalForWrite       bool `json:"requireApprovalForWrite"`
	RequireApprovalForDestructive bool `json:"requireApprovalForDestructive"`
}

func DefaultMCPServerPolicy 

func DefaultMCPServerPolicy() MCPServerPolicy

type MCPToolPolicyOverride 

type MCPToolPolicyOverride struct {
	ToolName string `json:"toolName"`

	ApprovalRule  *MCPApprovalRule  `json:"approvalRule,omitempty"`
	ExecutionMode *MCPExecutionMode `json:"executionMode,omitempty"`

	AllowStaleDigest bool   `json:"allowStaleDigest,omitempty"`
	ExpectedDigest   string `json:"expectedDigest,omitempty"`
}

type MCPTrustLevel 

type MCPTrustLevel string
const (
	MCPTrustLevelUntrusted MCPTrustLevel = "untrusted"
	MCPTrustLevelTrusted   MCPTrustLevel = "trusted"
)

type ToolDecision 

type ToolDecision string
const (
	ToolDecisionAllowed          ToolDecision = "allowed"
	ToolDecisionDenied           ToolDecision = "denied"
	ToolDecisionApprovalRequired ToolDecision = "approvalRequired"
)

type ToolEvaluation 

type ToolEvaluation struct {
	Decision ToolDecision
	Reason   string
}

func EvaluateTool 

func EvaluateTool(
	value MCPPolicy,
	input ToolEvaluationInput,
) ToolEvaluation

type ToolEvaluationInput 

type ToolEvaluationInput struct {
	Enabled             bool
	TaskSupportRequired bool

	ToolDigest          string
	RequestedToolDigest string
	ExpectedDigest      string
	AllowStaleDigest    bool

	Risk          string
	ApprovalRule  MCPApprovalRule
	ExecutionMode MCPExecutionMode
	Source        string
}

type ToolRiskHints 

type ToolRiskHints struct {
	DestructiveHint *bool
	OpenWorldHint   *bool
	ReadOnlyHint    bool
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.