active_mcp 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00ecbb60485be256f7d033221a79ff3cae7d113bbd1876e5b6f191f2aeeff393
-  data.tar.gz: a7d32577afebf477e230adbac59116f8f3b92331aeac111a9c129bfac83b132b
+  metadata.gz: f94cddd4a196e9f5d1b0501457cb9d318fe1a32cfb997391f0b428f42b850813
+  data.tar.gz: de38f78d65269af6441c9f375ebca7ae2372acbee26c87ac04d68815a844da07
 SHA512:
-  metadata.gz: c94ad9b53bbfc8e9e6104f0e8ae76dbc9b1b54c1f153e55eab3c2be02c6f5f54ae40fec89c4b55a39505d1a8d9e42e1bb2d3c65868bd6c711b0fbad72e4d069d
-  data.tar.gz: 7ba6697d22894f9c5166623ae176319885d4fc050c462c8ccaf18322b119b53ec858d20de75fc91feacc87554037de2e7157cae7a4b32dd55d1a5da03ba17491
+  metadata.gz: 17f8847a39433c08b61838f416dfa6f3e0aecce6daf6ef8051dffdb5e71ac58f191c7654080570f18aae88b002219efd06a260d3afd26d7d1724a5758abf8746
+  data.tar.gz: afc770724f80df1f92929ab69c88577a6a0e974ad0647acf2dbdf677c7d6dc5b0a01f8792d53ef7eac818a72e11346769f13cd64f6651cc6375ba1bb544c8099

data/README.md

@@ -136,7 +136,43 @@ http://your-app.example.com/mcp
 
 Clients will discover the available tools and their input schemas automatically through the MCP protocol.
 
-## Authentication Flow
+## Authorization & Authentication
+
+ActiveMcp supports both authentication (verifying who a user is) and authorization (controlling what resources they can access).
+
+### Authorization for Tools
+
+You can control which tools are visible and accessible to different users by overriding the `authorized?` class method:
+
+```ruby
+class AdminOnlyTool < ActiveMcp::Tool
+  description "This tool is only accessible by admins"
+
+  property :command, :string, required: true, description: "Admin command to execute"
+
+  # Define authorization logic - only admin tokens can access this tool
+  def self.authorized?(auth_info)
+    return false unless auth_info
+    return false unless auth_info[:type] == :bearer
+    
+    # Check if the token belongs to an admin
+    auth_info[:token] == "admin-token" || User.find_by_token(auth_info[:token])&.admin?
+  end
+
+  def call(command:, auth_info: nil)
+    # Tool implementation
+  end
+end
+```
+
+When a user makes a request to the MCP server:
+1. Only tools that return `true` from their `authorized?` method will be included in the tools list
+2. Users can only call tools that they're authorized to use
+3. Unauthorized access attempts will return a 403 Forbidden response
+
+This makes it easy to create role-based access control for your MCP tools.
+
+### Authentication Flow
 
 ActiveMcp supports receiving authentication credentials from MCP clients and forwarding them to your Rails application. There are two ways to handle authentication:
 

data/app/controllers/active_mcp/base_controller.rb

@@ -37,7 +37,11 @@ module ActiveMcp
     end
 
     def render_tools_list
-      tools = Tool.registered_tools.map do |tool_class|
+      # 認可チェックを含めてツールリストをフィルタリング
+      tools = Tool.registered_tools.select do |tool_class|
+        # 認可チェック - ツールがauthorized?メソッドでtrueを返すもののみを選択
+        tool_class.authorized?(@auth_info)
+      end.map do |tool_class|
         {
           name: tool_class.tool_name,
           description: tool_class.desc,
@@ -65,6 +69,12 @@ module ActiveMcp
         render json: {error: "Tool not found: #{tool_name}"}, status: 404
         return
       end
+      
+      # 認可チェック
+      unless tool_class.authorized?(@auth_info)
+        render json: {error: "Unauthorized: Access to tool '#{tool_name}' denied"}, status: 403
+        return
+      end
 
       tool = tool_class.new
       validation_result = tool.validate_arguments(arguments)

data/lib/active_mcp/tool.rb

@@ -34,6 +34,10 @@ module ActiveMcp
       def inherited(subclass)
         registered_tools << subclass
       end
+
+      def authorized?(auth_info)
+        true
+      end
     end
 
     def initialize

data/lib/active_mcp/version.rb

@@ -1,3 +1,3 @@
 module ActiveMcp
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/lib/generators/active_mcp/tool/templates/tool.rb.erb

@@ -5,6 +5,23 @@ class <%= class_name %> < ActiveMcp::Tool
   property :param2, :string, required: false, description: "Second parameter description"
   # Add more parameters as needed
   
+  # Uncomment and modify this method to implement authorization control
+  # This controls who can see and use this tool
+  # def self.authorized?(auth_info)
+  #   # Example: require authentication
+  #   # return false unless auth_info
+  #   
+  #   # Example: require a specific authentication type
+  #   # return false unless auth_info[:type] == :bearer
+  #   
+  #   # Example: check for admin permissions
+  #   # admin_tokens = ["admin-token"]
+  #   # return admin_tokens.include?(auth_info[:token])
+  #   
+  #   # Default: allow all access
+  #   true
+  # end
+  
   def call(param1:, param2: nil, auth_info: nil, **args)
     # Authentication information can be accessed via _auth_info parameter
     # auth_info = { type: :bearer, token: "xxx", header: "Bearer xxx" }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_mcp
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Your Name