Documentation
¶
Index ¶
Constants ¶
const ( // QueryParamToolsets narrows the toolsets visible via tools/list to a // comma-separated subset (e.g. ?toolsets=namespace,component,pe). Unknown // or disabled toolset names are silently ignored. When the param is // absent or empty, all registered toolsets are returned. QueryParamToolsets = "toolsets" // QueryParamFilterByAuthz controls whether MCP-layer authz filtering is // applied to tools/list and tools/call (e.g. ?filterByAuthz=false). // Defaults to true. The service layer enforces authz independently // regardless of this flag. QueryParamFilterByAuthz = "filterByAuthz" // QueryParamIncludeDeprecatedTools controls whether tools/list includes the // deprecated cluster-prefixed compatibility-alias tools (e.g. // ?includeDeprecatedTools=false). Defaults to true in v1.1: the aliases are // listed with a description-level deprecation banner and a structured _meta // marker so existing clients see a migration signal before they disappear. // Set this to false to preview the v1.2 surface, where the aliases are // hidden from tools/list but remain callable; in v1.3 they are removed. QueryParamIncludeDeprecatedTools = "includeDeprecatedTools" )
HTTP query parameter names recognized by the MCP HTTP handler. Both are optional and read once per session-creation request.
Variables ¶
This section is empty.
Functions ¶
func NewHTTPServer ¶
NewHTTPServer creates an MCP HTTP handler backed by a single shared server.
All configured toolsets are registered up front. Per-session narrowing happens via query parameters parsed from the initialize request:
- ?toolsets=ns1,ns2 — only show tools from those toolsets in tools/list
- ?filterByAuthz=false — disable MCP-layer authz filtering for the session
- ?includeDeprecatedTools=false — hide the deprecated cluster-prefixed alias tools (they are listed by default in v1.1 with a deprecation banner, hidden in v1.2, and removed in v1.3)
When pdp is non-nil the server installs a receiving middleware that filters tools/list results and guards tools/call invocations based on the authenticated user's permissions derived from their JWT token. When pdp is nil (authz disabled) all registered tools are visible and callable — the service layer still enforces authz independently. The toolset filter is always applied when the client requests it, regardless of pdp.
func NewSTDIO ¶
NewSTDIO creates an MCP server for STDIO transport (local CLI usage). Permission filtering is intentionally skipped for STDIO: there is no HTTP request, no JWT token, and no authenticated user identity available. The service layer still enforces authz for any operations that require it.
Types ¶
This section is empty.
Source Files
Directories