Documentation
¶
Overview ¶
Package emauth provides MCP Enterprise-Managed Authorization support for mcp-google: audit logging and scope-based tool gating driven by the identity verified from an ID-JAG-derived access token.
The identity (subject, RFC 8693 act delegation chain, scope) is placed in the request context by omniskill's ExternalBearerMiddleware; this package consumes it at the MCP method layer via a receiving middleware.
Index ¶
Constants ¶
const ( ScopeDocs = "docs:read" ScopeSheets = "sheets:read" ScopeSlides = "slides:read" )
Scopes understood by mcp-google. When the verified token carries a scope claim, tool calls require the matching skill scope; tokens without a scope claim are not gated (identity is still audit-logged).
Variables ¶
This section is empty.
Functions ¶
func HasScope ¶
HasScope reports whether the space-delimited scope string contains the required scope.
func Middleware ¶
func Middleware(logger *slog.Logger) mcp.Middleware
Middleware returns an MCP receiving middleware that audit-logs the verified identity on every tool call and denies calls whose token scope does not cover the tool. Non-tool methods pass through untouched.
func RequiredScope ¶
RequiredScope maps a tool name to the scope that authorizes it. Returns an empty string for tools with no scope mapping (allowed by default).
Types ¶
This section is empty.
Source Files