policy

package
v0.2.21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 9, 2026 License: MPL-2.0 Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ToolDigestChangedReason = "tool digest changed"
	ToolPolicyDeniesReason  = "server/tool policy denies this tool"
	PolicyAllowedReason     = "policy allowed"
)

Variables

View Source 
var ErrInvalid = errors.New("invalid MCP policy")

Functions

func ApprovalRuleRank 

func ApprovalRuleRank(value MCPApprovalRule) int

func EffectiveToolConstraints 

func EffectiveToolConstraints(
	value MCPPolicy,
	toolName string,
	discoveredApproval MCPApprovalRule,
	discoveredExecution MCPExecutionMode,
) (MCPApprovalRule, MCPExecutionMode)

func EffectiveToolPolicy 

func EffectiveToolPolicy(
	value MCPPolicy,
	toolName string,
) (
	MCPApprovalRule,
	MCPExecutionMode,
	MCPToolPolicyOverride,
	bool,
)

func ExecutionModeRank 

func ExecutionModeRank(value MCPExecutionMode) int

func InferToolRisk 

func InferToolRisk(
	hints ToolRiskHints,
	trustLevel MCPTrustLevel,
) string

Types

type Composition 

type Composition struct {
	Body      MCPPolicy
	Conflicts map[string]string
}

func ComposeMCPPolicy 

func ComposeMCPPolicy(
	baseline MCPPolicy,
	policies ...MCPPolicy,
) (Composition, error)

func ComposePolicies added in v0.2.21 

func ComposePolicies(
	baseline MCPPolicy,
	policies ...MCPPolicy,
) (Composition, error)

ComposePolicies exists only as the composition boundary for callers that require the conflict set without calculating an Effective digest.

type Effective 

type Effective struct {
	Body      MCPPolicy         `json:"body"`
	Conflicts map[string]string `json:"conflicts,omitempty"`
	Digest    cryptoutil.Digest `json:"digest"`
}

func Compose 

func Compose(
	baseline MCPPolicy,
	policies ...MCPPolicy,
) (Effective, error)

func (Effective) Validate 

func (value Effective) Validate() error

type MCPApprovalRule 

type MCPApprovalRule string
const (
	MCPApprovalRuleAsk   MCPApprovalRule = "ask"
	MCPApprovalRuleAllow MCPApprovalRule = "allow"
	MCPApprovalRuleDeny  MCPApprovalRule = "deny"
)

func NormalizedApprovalRule 

func NormalizedApprovalRule(value MCPApprovalRule) MCPApprovalRule

func (MCPApprovalRule) Validate added in v0.2.21 

func (value MCPApprovalRule) Validate() error

type MCPAppsPolicy 

type MCPAppsPolicy struct {
	Enabled                          bool `json:"enabled"`
	AllowAppInitiatedToolCalls       bool `json:"allowAppInitiatedToolCalls"`
	RequireApprovalForOpenLink       bool `json:"requireApprovalForOpenLink"`
	RequireApprovalForContextUpdates bool `json:"requireApprovalForContextUpdates"`
}

func DefaultMCPAppsPolicy 

func DefaultMCPAppsPolicy() MCPAppsPolicy

type MCPExecutionMode 

type MCPExecutionMode string
const (
	MCPExecutionModeManual MCPExecutionMode = "manual"
	MCPExecutionModeAuto   MCPExecutionMode = "auto"
)

func NormalizedExecutionMode 

func NormalizedExecutionMode(value MCPExecutionMode) MCPExecutionMode

func (MCPExecutionMode) Validate added in v0.2.21 

func (value MCPExecutionMode) Validate() error

type MCPPolicy 

type MCPPolicy struct {
	TrustLevel    MCPTrustLevel                    `json:"trustLevel"`
	DefaultPolicy MCPServerPolicy                  `json:"defaultPolicy"`
	ToolPolicies  map[string]MCPToolPolicyOverride `json:"toolPolicies,omitempty"`
	AppsPolicy    MCPAppsPolicy                    `json:"appsPolicy"`
}

func Baseline 

func Baseline() MCPPolicy

func Clone added in v0.2.21 

func Clone(input MCPPolicy) MCPPolicy

func Normalize added in v0.2.21 

func Normalize(input MCPPolicy) MCPPolicy

func TightenToolPolicy 

func TightenToolPolicy(
	value MCPPolicy,
	toolName string,
	currentApproval MCPApprovalRule,
	currentExecution MCPExecutionMode,
	mappedApproval MCPApprovalRule,
	mappedExecution MCPExecutionMode,
) (MCPPolicy, error)

func (MCPPolicy) Validate added in v0.2.21 

func (value MCPPolicy) Validate() error

type MCPServerPolicy 

type MCPServerPolicy struct {
	DefaultApprovalRule  MCPApprovalRule  `json:"defaultApprovalRule"`
	DefaultExecutionMode MCPExecutionMode `json:"defaultExecutionMode"`

	RequireApprovalForUnknownRisk bool `json:"requireApprovalForUnknownRisk"`
	RequireApprovalForWrite       bool `json:"requireApprovalForWrite"`
	RequireApprovalForDestructive bool `json:"requireApprovalForDestructive"`
}

func DefaultMCPServerPolicy 

func DefaultMCPServerPolicy() MCPServerPolicy

func (MCPServerPolicy) Validate added in v0.2.21 

func (value MCPServerPolicy) Validate() error

type MCPToolPolicyOverride 

type MCPToolPolicyOverride struct {
	ToolName string `json:"toolName"`

	ApprovalRule  *MCPApprovalRule  `json:"approvalRule,omitempty"`
	ExecutionMode *MCPExecutionMode `json:"executionMode,omitempty"`

	AllowStaleDigest bool   `json:"allowStaleDigest,omitempty"`
	ExpectedDigest   string `json:"expectedDigest,omitempty"`
}

func (MCPToolPolicyOverride) Validate added in v0.2.21 

func (value MCPToolPolicyOverride) Validate() error

type MCPTrustLevel 

type MCPTrustLevel string
const (
	MCPTrustLevelUntrusted MCPTrustLevel = "untrusted"
	MCPTrustLevelTrusted   MCPTrustLevel = "trusted"
)

func (MCPTrustLevel) Validate added in v0.2.21 

func (value MCPTrustLevel) Validate() error

type ToolDecision 

type ToolDecision string
const (
	ToolDecisionAllowed          ToolDecision = "allowed"
	ToolDecisionDenied           ToolDecision = "denied"
	ToolDecisionApprovalRequired ToolDecision = "approvalRequired"
)

type ToolEvaluation 

type ToolEvaluation struct {
	Decision ToolDecision
	Reason   string
}

func EvaluateTool 

func EvaluateTool(
	value MCPPolicy,
	input ToolEvaluationInput,
) ToolEvaluation

type ToolEvaluationInput 

type ToolEvaluationInput struct {
	Enabled             bool
	TaskSupportRequired bool

	ToolDigest          string
	RequestedToolDigest string
	ExpectedDigest      string
	AllowStaleDigest    bool

	Risk          string
	ApprovalRule  MCPApprovalRule
	ExecutionMode MCPExecutionMode
	Source        string
}

type ToolRiskHints 

type ToolRiskHints struct {
	DestructiveHint *bool
	OpenWorldHint   *bool
	ReadOnlyHint    bool
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.