Documentation
¶
Index ¶
Constants ¶
const ( // QueryParamToolsets narrows the toolsets visible via tools/list to a // comma-separated subset (e.g. ?toolsets=namespace,component,pe). Unknown // or disabled toolset names are silently ignored. When the param is // absent or empty, all registered toolsets are returned. QueryParamToolsets = "toolsets" // QueryParamFilterByAuthz controls whether MCP-layer authz filtering is // applied to tools/list and tools/call (e.g. ?filterByAuthz=false). // Defaults to true. The service layer enforces authz independently // regardless of this flag. QueryParamFilterByAuthz = "filterByAuthz" // QueryParamIncludeDeprecatedTools controls whether tools/list includes the // deprecated cluster-prefixed compatibility-alias tools (e.g. // ?includeDeprecatedTools=true). Defaults to false as of v1.2: the aliases // are hidden from tools/list but remain callable and still return a runtime // deprecation warning. Clients that have not yet migrated can set this to // true to keep listing the aliases — each carrying a description-level // deprecation banner and a structured _meta marker — until they are removed // in v1.3. QueryParamIncludeDeprecatedTools = "includeDeprecatedTools" )
HTTP query parameter names recognized by the MCP HTTP handler. Both are optional and read once per session-creation request.
Variables ¶
This section is empty.
Functions ¶
func NewHTTPServer ¶
NewHTTPServer creates an MCP HTTP handler backed by a single shared server.
All configured toolsets are registered up front. Per-session narrowing happens via query parameters parsed from the initialize request:
- ?toolsets=ns1,ns2 — only show tools from those toolsets in tools/list
- ?filterByAuthz=false — disable MCP-layer authz filtering for the session
- ?includeDeprecatedTools=true — list the deprecated cluster-prefixed alias tools (hidden by default as of v1.2; they remain callable and are removed in v1.3)
When pdp is non-nil the server installs a receiving middleware that filters tools/list results and guards tools/call invocations based on the authenticated user's permissions derived from their JWT token. When pdp is nil (authz disabled) all registered tools are visible and callable — the service layer still enforces authz independently. The toolset filter is always applied when the client requests it, regardless of pdp.
func NewSTDIO ¶
NewSTDIO creates an MCP server for STDIO transport (local CLI usage). Permission filtering is intentionally skipped for STDIO: there is no HTTP request, no JWT token, and no authenticated user identity available. The service layer still enforces authz for any operations that require it.
Types ¶
This section is empty.
Source Files
Directories