mc8yp 2.0.0 → 2.1.0

package/README.md

@@ -154,39 +154,96 @@ async () => {
 
 ### Prompts
 
-| Prompt            | Description                                                                                                                               |
-| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `code-mode-guide` | Full reference for the `query` and `execute` tools, including available types, examples, and restriction info for the current connection. |
+| Prompt            | Description                                                                                                                                 |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `code-mode-guide` | Full reference for the `query` and `execute` tools, including available types, examples, and access-policy info for the current connection. |
 
-## API Restrictions
+## API Access Policy
 
-Restrictions are deny rules that block specific API operations. They can be applied per-connection to limit what an AI agent can access.
+mc8yp supports two per-connection rule types:
+
+- **Restrictions** — deny rules that block matching API operations
+- **Allow rules** — allow-list rules that permit matching API operations and block everything else when at least one allow rule is configured
+
+If both apply to the same operation, **restrictions take priority**.
+
+Example: allowing `/inventory/**` but restricting `/inventory/managedObjects` still blocks `/inventory/managedObjects`.
+
+Both rule types use the same syntax.
+
+### Restrictions
+
+Restrictions are deny rules that block specific API operations.
+
+### Allow Rules
+
+Allow rules are the inverse of restrictions. They define what is permitted. When one or more allow rules are configured, any operation that does not match at least one allow rule is blocked.
 
 ### Rule Format
 
+A restriction or allow rule can be written in either of these forms:
+
+```txt
+<path-pattern>
+<method>:<path-pattern>
 ```
-[METHOD:]<path-pattern>
-```
 
-- **Without a method prefix** — blocks all HTTP methods for matching paths
-- **With a method prefix** — blocks only that method (e.g. `GET:`, `DELETE:`, `POST:`)
-- **Path patterns** support `*` (single segment wildcard) and `**` (recursive wildcard)
-- Query strings and fragments are not allowed in patterns
+- **Without a method prefix** — matches all HTTP methods for matching paths
+- **With a method prefix** — matches only that method (for example `GET:`, `DELETE:`, `POST:`)
+- **The `:` separator is only present when a method prefix is provided**
+- **Supported methods** — `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT`, `TRACE`, or `*`
+- Method names are case-insensitive when parsed (`get:/inventory/**` becomes `GET:/inventory/**`)
+
+### Path Pattern Syntax
+
+Patterns are matched against the request **pathname**.
+
+- Query strings and fragments are **not allowed in rule patterns**
+- Incoming request query strings are ignored for matching, so `/inventory/**` also matches requests such as `/inventory?pageSize=5`
+- Patterns must start with `/`
+- Matching is path-segment aware: `/` separates segments
+
+Supported wildcards:
+
+- `*` — wildcard **inside a single path segment**. It matches any characters except `/`
+- `**` — recursive wildcard across **zero or more whole path segments**. `**` must be its own complete segment
 
-### Examples
+### Path Pattern Examples
 
-| Rule                             | Effect                                              |
-| -------------------------------- | --------------------------------------------------- |
-| `/inventory/**`                  | Block all methods on all inventory paths            |
-| `DELETE:/inventory/**`           | Block only DELETE on inventory paths                |
-| `/alarm/alarms`                  | Block all methods on the exact path `/alarm/alarms` |
-| `GET:/measurement/measurements`  | Block only GET on measurements                      |
-| `POST:/inventory/managedObjects` | Block creating new managed objects                  |
-| `/user/**`                       | Block all user management                           |
+| Pattern               | Matches                                                     | Does Not Match                             |
+| --------------------- | ----------------------------------------------------------- | ------------------------------------------ |
+| `/inventory`          | `/inventory`                                                | `/inventory/managedObjects`                |
+| `/inventory/**`       | `/inventory`, `/inventory/managedObjects`, `/inventory/x/y` | `/alarm/alarms`                            |
+| `/i*`                 | `/inventory`, `/identity`, `/i`                             | `/inventory/managedObjects`                |
+| `/i*/**`              | `/inventory`, `/inventory/managedObjects`, `/identity/x`    | `/alarm/alarms`                            |
+| `/inventory/m*`       | `/inventory/managedObjects`, `/inventory/measurements`      | `/inventory/events`, `/inventory/m/x`      |
+| `/inventory/*/child`  | `/inventory/device-1/child`, `/inventory/x/child`           | `/inventory/child`, `/inventory/a/b/child` |
+| `/inventory/**/child` | `/inventory/child`, `/inventory/a/b/child`                  | `/inventory/a/b/sibling`                   |
+
+### Common Rule Examples
+
+| Rule                             | Restriction Effect                                           | Allow-list Effect                                             |
+| -------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------- |
+| `/inventory/**`                  | Block all methods on `/inventory` and everything below it    | Permit all methods on `/inventory` and everything below it    |
+| `DELETE:/inventory/**`           | Block only DELETE on `/inventory` and everything below it    | Permit only DELETE on `/inventory` and everything below it    |
+| `/alarm/alarms`                  | Block all methods on the exact path `/alarm/alarms`          | Permit all methods on the exact path `/alarm/alarms`          |
+| `GET:/measurement/measurements`  | Block only GET on the exact path `/measurement/measurements` | Permit only GET on the exact path `/measurement/measurements` |
+| `POST:/inventory/managedObjects` | Block creating new managed objects                           | Permit creating new managed objects                           |
+| `/i*/**`                         | Block all routes whose first path segment starts with `i`    | Permit all routes whose first path segment starts with `i`    |
+| `/user/**`                       | Block all user management paths                              | Permit all user management paths                              |
+
+### Important Notes
+
+- `/inventory/**` already matches `/inventory` itself, so you do **not** need both `/inventory` and `/inventory/**`
+- `/i**` is **not valid** because `**` must be its own segment. Use `/i*/**` if you want to match a first segment starting with `i` and everything below it
+- `*:/inventory/**` is allowed and means the same thing as `/inventory/**`
+- Rule patterns may not contain empty segments (`//`), `.` or `..` segments, query strings, or fragments
 
 ### CLI Mode
 
-Pass restrictions as CLI arguments. Repeat `-r` / `--restriction` for multiple rules:
+Pass restrictions and allow rules as CLI arguments.
+
+Repeat `-r`, `--restrict`, or `--restriction` for deny rules:
 
 ```sh
 # Block all inventory access
@@ -197,25 +254,45 @@ mc8yp -r "DELETE:/inventory/**" -r "/alarm/**"
 
 # Block everything under user management
 mc8yp --restriction "/user/**"
+
+# Same thing using the long alias
+mc8yp --restrict "/user/**"
+```
+
+Repeat `-a`, `--allow`, or `--allowed` for allow rules:
+
+```sh
+# Only permit inventory access
+mc8yp -a "/inventory/**"
+
+# Permit GET inventory access and POST alarms
+mc8yp --allow "GET:/inventory/**" --allowed "POST:/alarm/**"
+
+# Allow inventory broadly, but still block one path with a restriction
+mc8yp -a "/inventory/**" -r "/inventory/managedObjects"
 ```
 
 ### Microservice Mode (HTTP)
 
-Pass restrictions as `restriction` query parameters on the MCP endpoint URL:
+Pass restrictions as `restriction`, `restrict`, or `r` query parameters on the MCP endpoint URL.
+Pass allow rules as `allowed`, `allow`, or `a` query parameters.
 
 ```
-/mcp?restriction=/inventory/**&restriction=DELETE:/alarm/**
+/mcp?restriction=/inventory/**&restrict=DELETE:/alarm/**
+/mcp?r=/inventory/**&r=DELETE:/alarm/**
+/mcp?allow=/inventory/**&allowed=POST:/alarm/**
+/mcp?a=/inventory/**&r=/inventory/managedObjects
 ```
 
-### How Restrictions Work
+### How Access Policy Works
 
-1. **OpenAPI spec annotation**: The `query` tool annotates blocked operations in the spec with `x-mc8yp-restricted` and related `x-mc8yp-*` metadata fields. The operations remain visible so the agent understands what exists, but they are clearly marked as blocked.
+1. **Query visibility**: The `query` tool exposes the raw bundled OpenAPI snapshot for the current MCP connection. It does not annotate or filter operations based on restrictions or allow rules.
 
-2. **Sandbox request enforcement**: The `execute` tool checks restrictions inside the generated sandbox request helper, where the actual HTTP method and normalized path are both available. Matching requests are blocked before any `fetch` is attempted.
+2. **Sandbox request enforcement**: The `execute` tool checks restrictions and allow rules inside the generated sandbox request helper, where the actual HTTP method and normalized path are both available. Matching deny rules block first. If any allow rules are configured, requests must also match at least one allow rule.
 
 3. **Network boundary**: The secure-exec permission layer independently restricts network access to the configured tenant host. Other network operations are denied.
 
-When an `execute` request is blocked by MCP restrictions, the tool returns explanatory text stating that the operation was intentionally denied by MCP connection policy, no request was sent to Cumulocity, and retrying through the same connection will not help.
+When an `execute` request is blocked by MCP connection policy, the tool returns explanatory text stating whether the operation was denied by a restriction or blocked because it is outside the configured allow list, no request was sent to Cumulocity, and retrying through the same connection will not help.
 
 ## Build And Packaging
 
@@ -234,6 +311,10 @@ The versions built are driven by [`openapi-versions.json`](openapi-versions.json
 
 Use the dedicated packaging command after `pnpm build` to create Docker-based Cumulocity release zips:
 
+The packaging step writes a temporary generated Dockerfile under `.c8y/`, copies the selected versioned server bundle into `/app/server/`, and installs production dependencies inside the Linux image with pnpm before copying them into the runtime stage. This avoids cross-platform native optional dependency issues when release artifacts are built on macOS but deployed as `linux/amd64` microservices.
+
+The deployed HTTP transport uses POST-only streamable HTTP (`GET /mcp` intentionally returns `405`) because some reverse proxies and microservice ingress layers do not keep the optional long-lived SSE notification channel stable enough for reliable MCP tool calls.
+
 ```sh
 pnpm package:microservices
 ```
@@ -251,7 +332,7 @@ The GitHub release workflow uses that packaging command when building tagged rel
 
 ### Prerequisites
 
-- Node.js ≥22.0.0
+- Node.js ≥24.0.0
 - pnpm
 
 ### Setup

package/dist/cli.mjs

@@ -10,7 +10,6 @@ import { defineTool } from "tmcp/tool";
 import * as v from "valibot";
 import { encode } from "@toon-format/toon";
 import { NodeRuntime, createNodeDriver, createNodeRuntimeDriverFactory } from "secure-exec";
-import "ufo";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { useContext } from "unctx";
@@ -41,7 +40,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
 //#region package.json
 var name = "mc8yp";
-var version = "2.0.0";
+var version = "2.1.0";
 var description = "Cumulocity IoT MCP Server - Model Context Protocol integration for IoT device management";
 //#endregion
 //#region \0virtual:core-openapi
@@ -85234,7 +85233,9 @@ function createCodeModeGuidePrompt(server) {
 		description: "Guide for the two code-mode tools: query and execute, including available shapes and examples."
 	}, () => {
 		const restrictions = server.ctx.custom?.restrictions ?? [];
-		const restrictionSection = restrictions.length > 0 ? `\n## Current Connection Restrictions\nThe current MCP connection blocks matching operations using these deny rules:\n${restrictions.map((rule) => `- \`${rule.source}\``).join("\n")}\n\nRestricted operations stay visible in the spec and are annotated with \`x-mc8yp-restricted\` and related \`x-mc8yp-*\` fields.\n` : "";
+		const allowRules = server.ctx.custom?.allowRules ?? [];
+		const policyLines = [...restrictions.map((rule) => `- deny: \`${rule.source}\``), ...allowRules.map((rule) => `- allow: \`${rule.source}\``)];
+		const restrictionSection = policyLines.length > 0 ? `\n## Current Connection Access Policy\n${policyLines.join("\n")}\n\nThe \`query\` tool still shows the raw bundled OpenAPI spec. These rules are enforced when requests are executed, not by rewriting the spec.\n` : "";
 		return prompt.message(`# Cumulocity Code Mode
 
 You have exactly two MCP tools available.
@@ -85247,8 +85248,8 @@ Use \`query\` when you need to inspect the core OpenAPI spec.
 - Return the exact value you want back from that function
 - Sync and async functions are both supported
 - Strings are returned as-is; other results are returned as JSON text
-- Restricted operations stay visible and are annotated with \`x-mc8yp-restricted\` and related \`x-mc8yp-*\` fields
-- Treat operations marked with \`x-mc8yp-restricted\` as intentionally unavailable on this MCP connection; inspect them for context, but do not plan to execute them
+- The \`query\` tool shows the raw bundled OpenAPI spec for the selected snapshot
+- The current MCP connection may still block \`execute\` requests through deny rules and/or an allow list even when an operation exists in the spec
 
 ### Available Shape
 \`\`\`ts
@@ -85296,8 +85297,8 @@ Use \`execute\` when you want to call the real Cumulocity API.
 - Return the value you want from that function; async functions are usually the right choice here
 - On success, the returned value is sent back in Toon format
 - If execution is blocked or fails, execute returns a plain text error message
-- The current MCP connection may reject restricted method/path combinations before network access
-- If a request is blocked by MCP connection policy, \`execute\` returns an explanatory text message. That is an intentional connection-level restriction, not a Cumulocity API failure, and retrying through the same connection will not help
+- The current MCP connection may reject restricted method/path combinations before network access, and it may also reject requests that are outside a configured allow list
+- If a request is blocked by MCP connection policy, \`execute\` returns an explanatory text message. That is an intentional connection-level access restriction, not a Cumulocity API failure, and retrying through the same connection will not help
 
 ### Available Shape
 \`\`\`ts
@@ -85363,60 +85364,34 @@ function createPrompts(server) {
 	return [createCodeModeGuidePrompt(server)];
 }
 //#endregion
-//#region src/utils/restriction-core.ts
-const HTTP_METHODS = [
-	"DELETE",
-	"GET",
-	"HEAD",
-	"OPTIONS",
-	"PATCH",
-	"POST",
-	"PUT",
-	"TRACE"
-];
-const HTTP_METHOD_SET$1 = new Set(HTTP_METHODS);
-function normalizeRestrictionMatchPath(value) {
-	let raw = value.trim();
-	if (!raw) return "/";
-	raw = raw.startsWith("/") ? raw : `/${raw}`;
-	raw = raw.replace(/\/{2,}/g, "/");
-	return raw.length > 1 && raw.endsWith("/") ? raw.slice(0, -1) : raw || "/";
-}
-function normalizeAndValidateRestrictionPath(rawPath) {
-	const segmentPattern = /^[A-Za-z0-9._~*-]+$/;
-	if (rawPath.includes("?") || rawPath.includes("#")) throw new Error(`Restriction pattern "${rawPath}" must not include query strings or fragments.`);
-	if (!rawPath.startsWith("/")) throw new Error("Restriction path pattern must start with \"/\".");
-	const pathPattern = normalizeRestrictionMatchPath(rawPath);
-	const segments = pathPattern === "/" ? [] : pathPattern.slice(1).split("/");
-	for (const segment of segments) {
-		if (segment === "." || segment === "..") throw new Error(`Restriction segment "${segment}" is not allowed.`);
-		if (segment === "**") continue;
-		if (segment.includes("**")) throw new Error(`Invalid restriction segment "${segment}". "**" must be its own path segment.`);
-		if (!segmentPattern.test(segment)) throw new Error(`Restriction segment "${segment}" contains unsupported characters.`);
+//#region src/codemode/semaphore.ts
+var AsyncSemaphore = class {
+	#maxConcurrency;
+	#activeCount = 0;
+	#waiters = [];
+	constructor(maxConcurrency) {
+		if (!Number.isInteger(maxConcurrency) || maxConcurrency <= 0) throw new Error("maxConcurrency must be a positive integer.");
+		this.#maxConcurrency = maxConcurrency;
 	}
-	return pathPattern;
-}
-function parseRestrictionRule(input) {
-	const source = input.trim();
-	if (!source) throw new Error("Restriction value must not be empty.");
-	const sep = source.indexOf(":");
-	if (sep > 0 && !source.startsWith("/")) {
-		const rawMethod = source.slice(0, sep).trim().toUpperCase();
-		const rawPath = source.slice(sep + 1).trim();
-		if (!rawPath) throw new Error("Restriction path pattern must not be empty.");
-		if (rawMethod && rawMethod !== "*" && !HTTP_METHOD_SET$1.has(rawMethod)) throw new Error(`Unsupported restriction method "${source.slice(0, sep)}".`);
-		return {
-			method: !rawMethod || rawMethod === "*" ? "*" : rawMethod,
-			pathPattern: normalizeAndValidateRestrictionPath(rawPath),
-			source
+	get activeCount() {
+		return this.#activeCount;
+	}
+	async acquire() {
+		if (this.#activeCount >= this.#maxConcurrency) await new Promise((resolve) => {
+			this.#waiters.push(resolve);
+		});
+		this.#activeCount += 1;
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			this.#activeCount -= 1;
+			this.#waiters.shift()?.();
 		};
 	}
-	return {
-		method: "*",
-		pathPattern: normalizeAndValidateRestrictionPath(source),
-		source
-	};
-}
+};
+//#endregion
+//#region src/utils/restriction-matcher.ts
 function escapeRestrictionRegex(value) {
 	let escaped = "";
 	for (const char of value) escaped += "\\^$.*+?()[]{}|".includes(char) ? `\\${char}` : char;
@@ -85429,13 +85404,13 @@ function compileRestrictionSegment(segment) {
 }
 function matchCompiledSegments(pattern, path, pi = 0, si = 0) {
 	while (pi < pattern.length) {
-		const seg = pattern[pi];
-		if (seg === "**") {
+		const segment = pattern[pi];
+		if (segment === "**") {
 			if (pi === pattern.length - 1) return true;
 			for (let i = si; i <= path.length; i++) if (matchCompiledSegments(pattern, path, pi + 1, i)) return true;
 			return false;
 		}
-		if (si >= path.length || !(seg instanceof RegExp) || !seg.test(path[si])) return false;
+		if (si >= path.length || !(segment instanceof RegExp) || !segment.test(path[si])) return false;
 		pi++;
 		si++;
 	}
@@ -85450,51 +85425,35 @@ function compileRestrictionRule(rule) {
 function matchesCompiledRule(rule, method, pathSegments) {
 	return (rule.method === "*" || rule.method === method) && matchCompiledSegments(rule.segments, pathSegments);
 }
-function compileRestrictionSources(restrictionSources) {
-	return restrictionSources.map(parseRestrictionRule).map(compileRestrictionRule);
-}
-function getBlockedCompiledRestrictions(compiledRestrictions, method, pathname) {
-	const normalizedMethod = String(method ?? "GET").trim().toUpperCase() || "GET";
-	const normalizedPath = normalizeRestrictionMatchPath(pathname);
-	const pathSegments = normalizedPath === "/" ? [] : normalizedPath.slice(1).split("/");
-	return compiledRestrictions.filter((rule) => matchesCompiledRule(rule, normalizedMethod, pathSegments));
-}
-//#endregion
-//#region src/utils/restrictions.ts
-const RESTRICTION_EXTENSION_KEY = "x-mc8yp-restrictions";
-const RESTRICTED_OPERATION_FLAG = "x-mc8yp-restricted";
-const RESTRICTED_OPERATION_MESSAGE = "x-mc8yp-restrictionMessage";
-const RESTRICTED_OPERATION_RULES = "x-mc8yp-restrictionRules";
-const RESTRICTED_OPERATION_TYPE = "x-mc8yp-restrictionType";
-const RESTRICTED_AGENT_NOTE = "x-mc8yp-agentNote";
-const HTTP_METHOD_SET = new Set(HTTP_METHODS);
-function normalizePath(value) {
-	let raw = value.trim();
-	if (!raw) return "/";
-	try {
-		if (/^[A-Za-z][A-Za-z\d+\-.]*:\/\//.test(raw)) raw = new URL(raw).pathname || "/";
-	} catch {}
-	raw = (raw.split("#", 1)[0] ?? raw).split("?", 1)[0] ?? raw;
-	raw = raw.startsWith("/") ? raw : `/${raw}`;
-	raw = raw.replace(/\/{2,}/g, "/");
-	return raw.length > 1 && raw.endsWith("/") ? raw.slice(0, -1) : raw || "/";
+function findMatchingRules(rules, method, pathname) {
+	const normalizedMethod = typeof method === "string" ? method.trim().toUpperCase() : "";
+	const pathSegments = pathname === "/" ? [] : pathname.slice(1).split("/");
+	return rules.filter((rule) => {
+		const compiledRule = compileRestrictionRule(rule);
+		if (!normalizedMethod) return compiledRule.method === "*" && matchCompiledSegments(compiledRule.segments, pathSegments);
+		return matchesCompiledRule(compiledRule, normalizedMethod, pathSegments);
+	});
 }
-function normalizeMethod(value) {
-	const upper = value?.trim().toUpperCase() || "GET";
-	if (HTTP_METHOD_SET.has(upper)) return upper;
-	throw new Error(`Unsupported HTTP method "${value}".`);
+function findBlockingRestrictions(rules, method, pathname) {
+	return findMatchingRules(rules, method, pathname);
 }
-function evaluateRestrictions(rules, method, path) {
-	const m = normalizeMethod(method);
-	const p = normalizePath(path);
-	const segs = p === "/" ? [] : p.slice(1).split("/");
+function evaluateAccessPolicy(restrictions, allowRules, method, pathname) {
+	const matchingRestrictions = findMatchingRules(restrictions, method, pathname);
+	if (matchingRestrictions.length > 0) return {
+		blocked: true,
+		blockedBy: "restriction",
+		matchingRestrictions
+	};
+	if (allowRules.length === 0) return { blocked: false };
+	if (findMatchingRules(allowRules, method, pathname).length > 0) return { blocked: false };
 	return {
-		method: m,
-		path: p,
-		matchingRules: rules.filter((rule) => matchesCompiledRule(compileRestrictionRule(rule), m, segs))
+		blocked: true,
+		blockedBy: "allow"
 	};
 }
-function createNetworkPermissionDecision(tenantUrl, request, rules = []) {
+//#endregion
+//#region src/codemode/network-permissions.ts
+function createNetworkPermissionDecision(tenantUrl, request, restrictions = [], allowRules = []) {
 	const tenantHostname = new URL(tenantUrl).hostname;
 	if (request.op !== "connect") return {
 		allow: false,
@@ -85504,96 +85463,33 @@ function createNetworkPermissionDecision(tenantUrl, request, rules = []) {
 		allow: false,
 		reason: `Network connect blocked: only ${tenantHostname} is allowed in execute mode.`
 	};
-	if (typeof request.method === "string") {
-		const requestPath = typeof request.url === "string" ? new URL(request.url).pathname : "/";
-		const restrictionMatch = evaluateRestrictions(rules, request.method, requestPath);
-		if (restrictionMatch.matchingRules.length > 0) return {
-			allow: false,
-			reason: `Network connect blocked by MCP restrictions: ${restrictionMatch.matchingRules.map((rule) => rule.source).join(", ")}`
-		};
-	}
-	return { allow: true };
-}
-//#endregion
-//#region src/codemode/openapi-restrictions.ts
-const OPENAPI_OPERATION_METHODS = [
-	"delete",
-	"get",
-	"head",
-	"options",
-	"patch",
-	"post",
-	"put",
-	"trace"
-];
-function annotateRestrictedOperation(operation, matchingRules) {
-	return {
-		...operation,
-		[RESTRICTED_OPERATION_FLAG]: true,
-		[RESTRICTED_OPERATION_TYPE]: "deny",
-		[RESTRICTED_OPERATION_RULES]: matchingRules.map((rule) => rule.source),
-		[RESTRICTED_OPERATION_MESSAGE]: "This operation is blocked by the current MCP connection restrictions.",
-		[RESTRICTED_AGENT_NOTE]: "The route exists, but it is intentionally restricted for this MCP connection."
-	};
-}
-function applyRestrictionsToOpenApiSpec(spec, rules) {
-	if (!spec.paths || rules.length === 0) return spec;
-	const compiledRules = rules.map(compileRestrictionRule);
-	let nextPaths;
-	for (const [path, pathItem] of Object.entries(spec.paths)) {
-		let nextPathItem;
-		const pathSegments = path === "/" ? [] : path.slice(1).split("/");
-		for (const method of OPENAPI_OPERATION_METHODS) {
-			const operation = pathItem[method];
-			if (!operation || typeof operation !== "object") continue;
-			const matchingRules = compiledRules.filter((rule) => matchesCompiledRule(rule, method.toUpperCase(), pathSegments));
-			if (matchingRules.length === 0) continue;
-			nextPathItem ??= { ...pathItem };
-			nextPathItem[method] = annotateRestrictedOperation(operation, matchingRules);
-		}
-		if (nextPathItem) {
-			nextPaths ??= { ...spec.paths };
-			nextPaths[path] = nextPathItem;
+	if (typeof request.url === "string") {
+		const pathname = new URL(request.url).pathname;
+		const requestMethod = typeof request.method === "string" ? request.method.trim() : void 0;
+		const normalizedMethod = requestMethod?.toUpperCase() ?? "";
+		if (normalizedMethod) {
+			const decision = evaluateAccessPolicy(restrictions, allowRules, normalizedMethod, pathname);
+			if (decision.blocked) {
+				if (decision.blockedBy === "restriction") return {
+					allow: false,
+					reason: `Network connect blocked by MCP restrictions: ${decision.matchingRestrictions.map((rule) => rule.source).join(", ")}`
+				};
+				return {
+					allow: false,
+					reason: `Network connect blocked by MCP allow list: no allow rule matched ${normalizedMethod} ${pathname}. Configured allow rules: ${allowRules.map((rule) => rule.source).join(", ")}`
+				};
+			}
+		} else {
+			const blockingRules = findBlockingRestrictions(restrictions, requestMethod, pathname);
+			if (blockingRules.length > 0) return {
+				allow: false,
+				reason: `Network connect blocked by MCP restrictions: ${blockingRules.map((rule) => rule.source).join(", ")}`
+			};
 		}
 	}
-	return {
-		...spec,
-		paths: nextPaths ?? spec.paths,
-		[RESTRICTION_EXTENSION_KEY]: {
-			mode: "deny",
-			rules: rules.map((rule) => rule.source),
-			message: "Operations marked with x-mc8yp-restricted are intentionally blocked for the current MCP connection."
-		}
-	};
+	return { allow: true };
 }
 //#endregion
-//#region src/codemode/semaphore.ts
-var AsyncSemaphore = class {
-	#maxConcurrency;
-	#activeCount = 0;
-	#waiters = [];
-	constructor(maxConcurrency) {
-		if (!Number.isInteger(maxConcurrency) || maxConcurrency <= 0) throw new Error("maxConcurrency must be a positive integer.");
-		this.#maxConcurrency = maxConcurrency;
-	}
-	get activeCount() {
-		return this.#activeCount;
-	}
-	async acquire() {
-		if (this.#activeCount >= this.#maxConcurrency) await new Promise((resolve) => {
-			this.#waiters.push(resolve);
-		});
-		this.#activeCount += 1;
-		let released = false;
-		return () => {
-			if (released) return;
-			released = true;
-			this.#activeCount -= 1;
-			this.#waiters.shift()?.();
-		};
-	}
-};
-//#endregion
 //#region node_modules/.pnpm/tslib@2.8.1/node_modules/tslib/tslib.es6.mjs
 function __awaiter(thisArg, _arguments, P, generator) {
 	function adopt(value) {
@@ -142365,24 +142261,277 @@ function createC8yAuthHeaders(auth) {
 	throw new Error("Invalid authentication credentials");
 }
 //#endregion
+//#region src/utils/restrictions.ts
+const HTTP_METHODS = [
+	"DELETE",
+	"GET",
+	"HEAD",
+	"OPTIONS",
+	"PATCH",
+	"POST",
+	"PUT",
+	"TRACE"
+];
+const HTTP_METHOD_SET = new Set(HTTP_METHODS);
+const SEGMENT_PATTERN = /^[A-Za-z0-9._~*-]+$/;
+function parseRestrictionRule(input) {
+	const inputs = typeof input === "string" ? [input] : input;
+	const parsedRules = [];
+	const failedRules = [];
+	for (const source of inputs) {
+		if (!source) {
+			failedRules.push({
+				rule: source,
+				reason: "Restriction value must not be empty."
+			});
+			continue;
+		}
+		const sep = source.indexOf(":");
+		if (sep > 0 && !source.startsWith("/")) {
+			const rawMethod = source.slice(0, sep).toUpperCase();
+			const rawPath = source.slice(sep + 1);
+			if (!rawPath) {
+				failedRules.push({
+					rule: source,
+					reason: "Restriction path pattern must not be empty."
+				});
+				continue;
+			}
+			if (rawMethod && rawMethod !== "*" && !HTTP_METHOD_SET.has(rawMethod)) {
+				failedRules.push({
+					rule: source,
+					reason: `Unsupported restriction method "${source.slice(0, sep)}".`
+				});
+				continue;
+			}
+			if (rawPath.includes("?") || rawPath.includes("#")) {
+				failedRules.push({
+					rule: source,
+					reason: `Restriction pattern "${rawPath}" must not include query strings or fragments.`
+				});
+				continue;
+			}
+			if (!rawPath.startsWith("/")) {
+				failedRules.push({
+					rule: source,
+					reason: "Restriction path pattern must start with \"/\"."
+				});
+				continue;
+			}
+			const rawPathSegments = rawPath === "/" ? [] : rawPath.slice(1).split("/");
+			if (rawPathSegments.some((segment) => segment.length === 0)) {
+				failedRules.push({
+					rule: source,
+					reason: "Restriction path pattern must not contain empty segments."
+				});
+				continue;
+			}
+			const invalidRawPathSegment = rawPathSegments.find((segment) => {
+				if (segment === "**") return false;
+				return segment.includes("**") || segment === "." || segment === ".." || !SEGMENT_PATTERN.test(segment);
+			});
+			if (invalidRawPathSegment) {
+				failedRules.push({
+					rule: source,
+					reason: invalidRawPathSegment === "." || invalidRawPathSegment === ".." ? `Restriction segment "${invalidRawPathSegment}" is not allowed.` : invalidRawPathSegment.includes("**") ? `Invalid restriction segment "${invalidRawPathSegment}". "**" must be its own path segment.` : `Restriction segment "${invalidRawPathSegment}" contains unsupported characters.`
+				});
+				continue;
+			}
+			parsedRules.push({
+				type: "deny",
+				method: !rawMethod || rawMethod === "*" ? "*" : rawMethod,
+				pathPattern: rawPath,
+				source
+			});
+			continue;
+		}
+		if (source.includes("?") || source.includes("#")) {
+			failedRules.push({
+				rule: source,
+				reason: `Restriction pattern "${source}" must not include query strings or fragments.`
+			});
+			continue;
+		}
+		if (!source.startsWith("/")) {
+			failedRules.push({
+				rule: source,
+				reason: "Restriction path pattern must start with \"/\"."
+			});
+			continue;
+		}
+		const sourceSegments = source === "/" ? [] : source.slice(1).split("/");
+		if (sourceSegments.some((segment) => segment.length === 0)) {
+			failedRules.push({
+				rule: source,
+				reason: "Restriction path pattern must not contain empty segments."
+			});
+			continue;
+		}
+		const invalidSourceSegment = sourceSegments.find((segment) => {
+			if (segment === "**") return false;
+			return segment.includes("**") || segment === "." || segment === ".." || !SEGMENT_PATTERN.test(segment);
+		});
+		if (invalidSourceSegment) {
+			failedRules.push({
+				rule: source,
+				reason: invalidSourceSegment === "." || invalidSourceSegment === ".." ? `Restriction segment "${invalidSourceSegment}" is not allowed.` : invalidSourceSegment.includes("**") ? `Invalid restriction segment "${invalidSourceSegment}". "**" must be its own path segment.` : `Restriction segment "${invalidSourceSegment}" contains unsupported characters.`
+			});
+			continue;
+		}
+		parsedRules.push({
+			type: "deny",
+			method: "*",
+			pathPattern: source,
+			source
+		});
+	}
+	return {
+		parsedRules,
+		failedRules
+	};
+}
+function parseAllowRule(input) {
+	const inputs = typeof input === "string" ? [input] : input;
+	const parsedRules = [];
+	const failedRules = [];
+	for (const source of inputs) {
+		if (!source) {
+			failedRules.push({
+				rule: source,
+				reason: "Allow value must not be empty."
+			});
+			continue;
+		}
+		const sep = source.indexOf(":");
+		if (sep > 0 && !source.startsWith("/")) {
+			const rawMethod = source.slice(0, sep).toUpperCase();
+			const rawPath = source.slice(sep + 1);
+			if (!rawPath) {
+				failedRules.push({
+					rule: source,
+					reason: "Allow path pattern must not be empty."
+				});
+				continue;
+			}
+			if (rawMethod && rawMethod !== "*" && !HTTP_METHOD_SET.has(rawMethod)) {
+				failedRules.push({
+					rule: source,
+					reason: `Unsupported allow method "${source.slice(0, sep)}".`
+				});
+				continue;
+			}
+			if (rawPath.includes("?") || rawPath.includes("#")) {
+				failedRules.push({
+					rule: source,
+					reason: `Allow pattern "${rawPath}" must not include query strings or fragments.`
+				});
+				continue;
+			}
+			if (!rawPath.startsWith("/")) {
+				failedRules.push({
+					rule: source,
+					reason: "Allow path pattern must start with \"/\"."
+				});
+				continue;
+			}
+			const rawPathSegments = rawPath === "/" ? [] : rawPath.slice(1).split("/");
+			if (rawPathSegments.some((segment) => segment.length === 0)) {
+				failedRules.push({
+					rule: source,
+					reason: "Allow path pattern must not contain empty segments."
+				});
+				continue;
+			}
+			const invalidRawPathSegment = rawPathSegments.find((segment) => {
+				if (segment === "**") return false;
+				return segment.includes("**") || segment === "." || segment === ".." || !SEGMENT_PATTERN.test(segment);
+			});
+			if (invalidRawPathSegment) {
+				failedRules.push({
+					rule: source,
+					reason: invalidRawPathSegment === "." || invalidRawPathSegment === ".." ? `Allow segment "${invalidRawPathSegment}" is not allowed.` : invalidRawPathSegment.includes("**") ? `Invalid allow segment "${invalidRawPathSegment}". "**" must be its own path segment.` : `Allow segment "${invalidRawPathSegment}" contains unsupported characters.`
+				});
+				continue;
+			}
+			parsedRules.push({
+				type: "allow",
+				method: !rawMethod || rawMethod === "*" ? "*" : rawMethod,
+				pathPattern: rawPath,
+				source
+			});
+			continue;
+		}
+		if (source.includes("?") || source.includes("#")) {
+			failedRules.push({
+				rule: source,
+				reason: `Allow pattern "${source}" must not include query strings or fragments.`
+			});
+			continue;
+		}
+		if (!source.startsWith("/")) {
+			failedRules.push({
+				rule: source,
+				reason: "Allow path pattern must start with \"/\"."
+			});
+			continue;
+		}
+		const sourceSegments = source === "/" ? [] : source.slice(1).split("/");
+		if (sourceSegments.some((segment) => segment.length === 0)) {
+			failedRules.push({
+				rule: source,
+				reason: "Allow path pattern must not contain empty segments."
+			});
+			continue;
+		}
+		const invalidSourceSegment = sourceSegments.find((segment) => {
+			if (segment === "**") return false;
+			return segment.includes("**") || segment === "." || segment === ".." || !SEGMENT_PATTERN.test(segment);
+		});
+		if (invalidSourceSegment) {
+			failedRules.push({
+				rule: source,
+				reason: invalidSourceSegment === "." || invalidSourceSegment === ".." ? `Allow segment "${invalidSourceSegment}" is not allowed.` : invalidSourceSegment.includes("**") ? `Invalid allow segment "${invalidSourceSegment}". "**" must be its own path segment.` : `Allow segment "${invalidSourceSegment}" contains unsupported characters.`
+			});
+			continue;
+		}
+		parsedRules.push({
+			type: "allow",
+			method: "*",
+			pathPattern: source,
+			source
+		});
+	}
+	return {
+		parsedRules,
+		failedRules
+	};
+}
+//#endregion
 //#region src/codemode/execute.ts
 const NO_DEFAULT_EXPORT_MESSAGE = "Execution completed without returning a value.";
 const QUERY_ENTRY_PATH = "/codemode-query.mjs";
 const EXECUTE_ENTRY_PATH = "/codemode-execute.mjs";
 const runtimeSemaphore = new AsyncSemaphore(3);
 const BLOCKED_REQUEST_PREFIX = "Request blocked by MCP connection policy.";
-function serializeExecuteConfig(tenantUrl, headers, restrictions) {
+function serializeExecuteConfig(tenantUrl, headers, restrictions, allowRules) {
 	const normalizedTenantUrl = new URL(tenantUrl).toString();
-	const restrictionSources = restrictions.map((rule) => {
-		const parsedRule = parseRestrictionRule(rule.source);
-		if (parsedRule.method !== rule.method || parsedRule.pathPattern !== rule.pathPattern) throw new TypeError(`Restriction source "${rule.source}" does not match its parsed shape.`);
-		return parsedRule.source;
-	});
+	const serializedRestrictions = restrictions.map(({ type, method, pathPattern, source }) => ({
+		type,
+		method,
+		pathPattern,
+		source
+	}));
+	const serializedAllowRules = allowRules.map(({ type, method, pathPattern, source }) => ({
+		type,
+		method,
+		pathPattern,
+		source
+	}));
 	return JSON.stringify({
 		tenantUrl: normalizedTenantUrl,
-		tenantOrigin: new URL(normalizedTenantUrl).origin,
 		authHeaders: headers,
-		restrictionSources
+		restrictions: serializedRestrictions,
+		allowRules: serializedAllowRules
 	});
 }
 function createQueryRuntime() {
@@ -142399,11 +142548,11 @@ function createQueryRuntime() {
 		cpuTimeLimitMs: 5e4
 	});
 }
-function createExecuteRuntime(tenantUrl, restrictions) {
+function createExecuteRuntime(tenantUrl, restrictions, allowRules) {
 	return new NodeRuntime({
 		systemDriver: createNodeDriver({
 			useDefaultNetwork: true,
-			permissions: { network: (request) => createNetworkPermissionDecision(tenantUrl, request, restrictions) }
+			permissions: { network: (request) => createNetworkPermissionDecision(tenantUrl, request, restrictions, allowRules) }
 		}),
 		runtimeDriverFactory: createNodeRuntimeDriverFactory(),
 		memoryLimit: 128,
@@ -142415,11 +142564,11 @@ function normalizeCode(functionCode) {
 	normalized = normalized.replace(/^```(?:js|javascript|ts|typescript)?\s*/i, "").replace(/\s*```$/, "").trim();
 	return normalized;
 }
-function buildQueryScript(sourceCode, restrictions) {
-	const restrictedSpec = applyRestrictionsToOpenApiSpec(getCoreOpenApiSpec(), restrictions);
+function buildQueryScript(sourceCode, _restrictions, _allowRules) {
+	const spec = getCoreOpenApiSpec();
 	const functionExpression = normalizeCode(sourceCode);
 	return [
-		`const spec = ${JSON.stringify(restrictedSpec)};`,
+		`const spec = ${JSON.stringify(spec)};`,
 		`const __mc8ypQuery = (${functionExpression});`,
 		"",
 		"if (typeof __mc8ypQuery !== \"function\") {",
@@ -142429,26 +142578,25 @@ function buildQueryScript(sourceCode, restrictions) {
 		"export default await __mc8ypQuery();"
 	].join("\n\n");
 }
-function buildExecutePrelude(tenantUrl, headers, restrictions = []) {
+function buildExecutePrelude(tenantUrl, headers, restrictions = [], allowRules = []) {
 	return [
 		"const cumulocity = Object.freeze((() => {",
-		`  const config = JSON.parse(${JSON.stringify(serializeExecuteConfig(tenantUrl, headers, restrictions))});`,
+		`  const config = JSON.parse(${JSON.stringify(serializeExecuteConfig(tenantUrl, headers, restrictions, allowRules))});`,
 		"  if (!config || typeof config !== \"object\") {",
 		"    throw new TypeError(\"Invalid execute configuration.\");",
 		"  }",
-		"  const { tenantUrl, tenantOrigin, authHeaders, restrictionSources } = config;",
-		"  if (typeof tenantUrl !== \"string\" || typeof tenantOrigin !== \"string\") {",
-		"    throw new TypeError(\"Execute configuration must contain string tenant values.\");",
+		"  const { tenantUrl, authHeaders, restrictions, allowRules } = config;",
+		"  if (typeof tenantUrl !== \"string\") {",
+		"    throw new TypeError(\"Execute configuration must contain a string tenant URL.\");",
 		"  }",
-		"  if (!Array.isArray(restrictionSources) || restrictionSources.some((source) => typeof source !== \"string\")) {",
-		"    throw new TypeError(\"Execute configuration must contain string restriction sources.\");",
+		"  if (!Array.isArray(restrictions) || restrictions.some((rule) => !rule || typeof rule !== \"object\" || typeof rule.type !== \"string\" || typeof rule.method !== \"string\" || typeof rule.pathPattern !== \"string\" || typeof rule.source !== \"string\")) {",
+		"    throw new TypeError(\"Execute configuration must contain valid restriction rules.\");",
+		"  }",
+		"  if (!Array.isArray(allowRules) || allowRules.some((rule) => !rule || typeof rule !== \"object\" || typeof rule.type !== \"string\" || typeof rule.method !== \"string\" || typeof rule.pathPattern !== \"string\" || typeof rule.source !== \"string\")) {",
+		"    throw new TypeError(\"Execute configuration must contain valid allow rules.\");",
 		"  }",
 		"  const resolveUrl = (descriptor) => {",
-		"    const resolved = new URL(descriptor, tenantUrl.endsWith(\"/\") ? tenantUrl : tenantUrl + \"/\");",
-		"    if (resolved.origin !== tenantOrigin) {",
-		"      throw new Error(\"Cumulocity requests must target the configured tenant origin.\");",
-		"    }",
-		"    return resolved;",
+		"    return new URL(descriptor, tenantUrl.endsWith(\"/\") ? tenantUrl : tenantUrl + \"/\");",
 		"  };",
 		"  const normalizeRequest = (options) => {",
 		"    if (!options || typeof options !== \"object\") {",
@@ -142457,34 +142605,85 @@ function buildExecutePrelude(tenantUrl, headers, restrictions = []) {
 		"    const { path, ...rest } = options;",
 		"    return { path, init: rest };",
 		"  };",
-		`  const HTTP_METHOD_SET = new Set(${JSON.stringify(HTTP_METHODS)});`,
-		`  const normalizeRestrictionMatchPath = ${normalizeRestrictionMatchPath.toString()};`,
-		`  const normalizeAndValidateRestrictionPath = ${normalizeAndValidateRestrictionPath.toString()};`,
-		`  const parseRestrictionRule = ${parseRestrictionRule.toString()};`,
+		`  const HTTP_METHODS = ${JSON.stringify(HTTP_METHODS)};`,
+		"  const HTTP_METHOD_SET = new Set(HTTP_METHODS);",
 		`  const escapeRestrictionRegex = ${escapeRestrictionRegex.toString()};`,
 		`  const compileRestrictionSegment = ${compileRestrictionSegment.toString()};`,
 		`  const matchCompiledSegments = ${matchCompiledSegments.toString()};`,
 		`  const compileRestrictionRule = ${compileRestrictionRule.toString()};`,
 		`  const matchesCompiledRule = ${matchesCompiledRule.toString()};`,
-		`  const compileRestrictionSources = ${compileRestrictionSources.toString()};`,
-		`  const getBlockedCompiledRestrictions = ${getBlockedCompiledRestrictions.toString()};`,
-		"  const compiledRestrictions = compileRestrictionSources(restrictionSources);",
-		"  const formatBlockedRequestMessage = (method, path, matchingRules) => [",
-		"    \"Request blocked by MCP connection policy.\",",
-		"    \"\",",
-		"    \"This operation is intentionally denied by the current MCP connection configuration.\",",
-		"    \"It did not fail at the Cumulocity API and it was not executed against the tenant.\",",
-		"    \"Retrying or trying the same operation again through this connection will not succeed.\",",
-		"    \"\",",
-		"    \"Report this to the user as a connection-level access restriction.\",",
-		"    \"If the operation is needed, the MCP restrictions for this connection must be updated by whoever manages that configuration.\",",
-		"    \"\",",
-		"    \"Blocked operation:\",",
-		"    \"Method: \" + method,",
-		"    \"Path: \" + path,",
-		"    \"Matching restrictions:\",",
-		"    ...matchingRules.map((rule) => \"- \" + rule),",
-		"  ].join(\"\\n\");",
+		"  const compiledRestrictions = restrictions.map(compileRestrictionRule);",
+		"  const compiledAllowRules = allowRules.map(compileRestrictionRule);",
+		"  const findMatchingRules = (compiledRules, method, pathname) => {",
+		"    const normalizedMethod = typeof method === \"string\" ? method.trim().toUpperCase() : \"\";",
+		"    const pathSegments = pathname === \"/\" ? [] : pathname.slice(1).split(\"/\");",
+		"    return compiledRules.filter((rule) => {",
+		"      if (!normalizedMethod) {",
+		"        return rule.method === \"*\" && matchCompiledSegments(rule.segments, pathSegments);",
+		"      }",
+		"      return matchesCompiledRule(rule, normalizedMethod, pathSegments);",
+		"    });",
+		"  };",
+		"  const evaluateAccessPolicy = (method, pathname) => {",
+		"    const matchingRestrictions = findMatchingRules(compiledRestrictions, method, pathname);",
+		"    if (matchingRestrictions.length > 0) {",
+		"      return { blocked: true, blockedBy: \"restriction\", matchingRestrictions };",
+		"    }",
+		"    if (compiledAllowRules.length === 0) {",
+		"      return { blocked: false };",
+		"    }",
+		"    const matchingAllowRules = findMatchingRules(compiledAllowRules, method, pathname);",
+		"    if (matchingAllowRules.length > 0) {",
+		"      return { blocked: false };",
+		"    }",
+		"    return { blocked: true, blockedBy: \"allow\" };",
+		"  };",
+		"  const validateRequestMethod = (method) => {",
+		"    if (typeof method !== \"string\" || method.trim().length === 0) {",
+		"      throw new TypeError(\"request method must be a non-empty string\");",
+		"    }",
+		"    const normalizedMethod = method.trim().toUpperCase();",
+		"    if (!HTTP_METHOD_SET.has(normalizedMethod)) {",
+		"      throw new TypeError(\"request method must be one of: \" + HTTP_METHODS.join(\", \"));",
+		"    }",
+		"    return normalizedMethod;",
+		"  };",
+		"  const formatBlockedRequestMessage = (method, path, accessDecision) => {",
+		"    if (accessDecision.blockedBy === \"allow\") {",
+		"      return [",
+		"        \"Request blocked by MCP connection policy.\",",
+		"        \"\",",
+		"        \"This operation is intentionally blocked because it is not included in the current MCP connection allow list.\",",
+		"        \"It did not fail at the Cumulocity API and it was not executed against the tenant.\",",
+		"        \"Retrying or trying the same operation again through this connection will not succeed.\",",
+		"        \"\",",
+		"        \"Report this to the user as a connection-level access restriction.\",",
+		"        \"If the operation is needed, the MCP allow list for this connection must be updated by whoever manages that configuration.\",",
+		"        \"\",",
+		"        \"Blocked operation:\",",
+		"        \"Method: \" + method,",
+		"        \"Path: \" + path,",
+		"        \"Configured allow rules:\",",
+		"        ...(allowRules.length > 0 ? allowRules.map((rule) => \"- \" + rule.source) : [\"- (none)\"]),",
+		"      ].join(\"\\n\");",
+		"    }",
+		"    return [",
+		"      \"Request blocked by MCP connection policy.\",",
+		"      \"\",",
+		"      \"This operation is intentionally denied by the current MCP connection configuration.\",",
+		"      \"It did not fail at the Cumulocity API and it was not executed against the tenant.\",",
+		"      \"Retrying or trying the same operation again through this connection will not succeed.\",",
+		"      \"\",",
+		"      \"Report this to the user as a connection-level access restriction.\",",
+		"      \"If the operation is needed, the MCP restrictions for this connection must be updated by whoever manages that configuration.\",",
+		"      \"\",",
+		"      \"Blocked operation:\",",
+		"      \"Method: \" + method,",
+		"      \"Path: \" + path,",
+		"      \"Matching restrictions:\",",
+		"      ...accessDecision.matchingRestrictions.map((rule) => \"- \" + rule.source),",
+		"    ].join(\"\\n\");",
+		"  };",
 		"  const normalizeBody = (headers, body) => {",
 		"    if (body == null || typeof body === \"string\") {",
 		"      return body;",
@@ -142514,11 +142713,11 @@ function buildExecutePrelude(tenantUrl, headers, restrictions = []) {
 		"      if (typeof path !== \"string\" || path.length === 0) {",
 		"        throw new TypeError(\"request path must be a non-empty string\");",
 		"      }",
+		"      const method = validateRequestMethod(init.method);",
 		"      const resolvedUrl = resolveUrl(path);",
-		"      const blockedRules = getBlockedCompiledRestrictions(compiledRestrictions, init.method, resolvedUrl.pathname);",
-		"      if (blockedRules.length > 0) {",
-		"        const method = typeof init.method === \"string\" && init.method.trim() ? init.method.trim().toUpperCase() : \"GET\";",
-		"        throw new Error(formatBlockedRequestMessage(method, resolvedUrl.pathname, blockedRules.map((rule) => rule.source)));",
+		"      const accessDecision = evaluateAccessPolicy(method, resolvedUrl.pathname);",
+		"      if (accessDecision.blocked) {",
+		"        throw new Error(formatBlockedRequestMessage(method, resolvedUrl.pathname, accessDecision));",
 		"      }",
 		"      const headers = new Headers(init.headers ?? {});",
 		"      for (const [key, value] of Object.entries(authHeaders)) {",
@@ -142528,6 +142727,7 @@ function buildExecutePrelude(tenantUrl, headers, restrictions = []) {
 		"      const requestHeaders = Object.fromEntries(headers.entries());",
 		"      const response = await fetch(resolvedUrl.toString(), {",
 		"        ...init,",
+		"        method,",
 		"        headers: requestHeaders,",
 		"        body,",
 		"      });",
@@ -142542,10 +142742,10 @@ function buildExecutePrelude(tenantUrl, headers, restrictions = []) {
 		"})());"
 	].join("\n\n");
 }
-function buildExecuteScript(sourceCode, tenantUrl, headers, restrictions = []) {
+function buildExecuteScript(sourceCode, tenantUrl, headers, restrictions = [], allowRules = []) {
 	const functionExpression = normalizeCode(sourceCode);
 	return [
-		buildExecutePrelude(tenantUrl, headers, restrictions),
+		buildExecutePrelude(tenantUrl, headers, restrictions, allowRules),
 		`const __mc8ypExecute = (${functionExpression});`,
 		"",
 		"const __mc8ypErrorMessage = (error) => error instanceof Error ? error.message : String(error);",
@@ -142579,9 +142779,9 @@ function extractDefaultExport(exportsObject) {
 	if (typeof exportsObject !== "undefined") return exportsObject;
 	throw new Error(NO_DEFAULT_EXPORT_MESSAGE);
 }
-async function runExecuteScript(code, tenantUrl, restrictions) {
+async function runExecuteScript(code, tenantUrl, restrictions, allowRules) {
 	const release = await runtimeSemaphore.acquire();
-	const runtime = createExecuteRuntime(tenantUrl, restrictions);
+	const runtime = createExecuteRuntime(tenantUrl, restrictions, allowRules);
 	try {
 		const result = await runtime.run(code, EXECUTE_ENTRY_PATH);
 		if (result.code !== 0) {
@@ -142611,14 +142811,14 @@ async function runModule(code, entryPath, runtime) {
 		release();
 	}
 }
-async function query(functionCode, restrictions = []) {
-	const result = await runQueryScript(buildQueryScript(functionCode, restrictions));
+async function query(functionCode, restrictions = [], allowRules = []) {
+	const result = await runQueryScript(buildQueryScript(functionCode, restrictions, allowRules));
 	return typeof result === "string" ? result : JSON.stringify(result);
 }
-async function execute(functionCode, input, restrictions = []) {
+async function execute(functionCode, input, restrictions = [], allowRules = []) {
 	const auth = await resolveC8yAuth(input);
 	const authHeaders = createC8yAuthHeaders(auth);
-	const result = await runExecuteScript(buildExecuteScript(functionCode, auth.tenantUrl, authHeaders, restrictions), auth.tenantUrl, restrictions);
+	const result = await runExecuteScript(buildExecuteScript(functionCode, auth.tenantUrl, authHeaders, restrictions, allowRules), auth.tenantUrl, restrictions, allowRules);
 	if (result.status === "success") return encode(result.result);
 	return result.error.message;
 }
@@ -142688,8 +142888,8 @@ Recommended shapes:
 
 If your function returns a string, it is returned as-is. Otherwise the result is returned as JSON text.
 
-The current MCP connection may mark blocked operations with \`x-mc8yp-restricted\` and related \`x-mc8yp-*\` fields. These operations are intentionally unavailable even though they still exist in the OpenAPI spec.
-Treat those annotations as a hard connection-level restriction: use them to understand what exists, but do not plan to call those operations with \`execute\`.
+The spec exposed by \`query\` is the raw bundled OpenAPI snapshot. It is not rewritten for the current MCP connection policy.
+The current MCP connection may still block \`execute\` calls through restrictions and/or an allow list, so do not assume every operation visible in the spec is executable on this connection.
 
 Examples:
 () => {
@@ -142713,7 +142913,7 @@ Examples:
 		schema: v.object({ code: createCodeSchema("A JavaScript function expression. The top-level binding `spec` is available automatically. Return the final result from that function. Async functions are supported.") })
 	}, async (input) => {
 		try {
-			return tool.text(await query(input.code, server.ctx.custom?.restrictions ?? []));
+			return tool.text(await query(input.code, server.ctx.custom?.restrictions ?? [], server.ctx.custom?.allowRules ?? []));
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			return tool.error(message);
@@ -142754,7 +142954,8 @@ Tool output behavior:
 - On success, the actual function result is returned in Toon format.
 - On blocked or failed execution, the tool returns a plain text message.
 
-The current MCP connection may deny certain method/path combinations. Restricted routes remain visible in the spec, and \`cumulocity.request(...)\` will reject blocked calls before sending them.
+The current MCP connection may deny certain method/path combinations and may also use an allow list.
+The \`query\` tool does not annotate or filter the OpenAPI spec for that policy, and \`cumulocity.request(...)\` will reject blocked calls before sending them.
 When that happens, the tool returns a plain text connection-policy message. That is not a Cumulocity API failure and retrying the same operation through the same connection will not help.
 
 ${getExecuteEnvironmentNote()}
@@ -142788,7 +142989,7 @@ async () => {
 		schema: addTenantURLToSchema(v.object({ code: createCodeSchema("An async JavaScript function expression. The top-level binding `cumulocity` is available automatically. Return the final result from that function. `await` is supported.") }))
 	}, async (input) => {
 		try {
-			return tool.text(await execute(input.code, input, server.ctx.custom?.restrictions ?? []));
+			return tool.text(await execute(input.code, input, server.ctx.custom?.restrictions ?? [], server.ctx.custom?.allowRules ?? []));
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			return tool.error(message);
@@ -142826,7 +143027,7 @@ function createC8YMcpServer() {
 		capabilities: {
 			tools: { listChanged: true },
 			prompts: { listChanged: true },
-			resources: { listChanged: false }
+			resources: { listChanged: true }
 		}
 	}).withContext();
 	server.tools(createTools(server));
@@ -142921,7 +143122,12 @@ runMain(defineCommand({
 		restriction: {
 			type: "string",
 			description: "Restriction rule to deny API access (e.g. \"GET:/inventory/**\"). Can be repeated.",
-			alias: "r"
+			alias: ["r", "restrict"]
+		},
+		allowed: {
+			type: "string",
+			description: "Allow rule to permit API access (e.g. \"GET:/inventory/**\"). Can be repeated. When present, non-matching operations are blocked unless another allow rule matches them.",
+			alias: ["a", "allow"]
 		},
 		spec: {
 			type: "string",
@@ -142942,12 +143148,20 @@ runMain(defineCommand({
 		if (!selected) throw new Error(`Invalid --spec value "${requested}". Available: ${specs.map((s) => s.version).join(", ")}`);
 		setCoreOpenApiVersion(selected.version);
 		consola.info(`Using core OpenAPI snapshot: ${getCoreOpenApiLabel()}`);
-		const raw = args.restriction;
-		const restrictions = (Array.isArray(raw) ? raw : raw ? [raw] : []).filter(Boolean).map(parseRestrictionRule);
+		const rawRestrictions = args.restriction;
+		const { parsedRules: restrictions, failedRules: failedRestrictions } = parseRestrictionRule((Array.isArray(rawRestrictions) ? rawRestrictions : rawRestrictions ? [rawRestrictions] : []).filter((value) => typeof value === "string" && value.length > 0));
+		if (failedRestrictions.length > 0) throw new Error(["One or more restriction flags could not be parsed:", ...failedRestrictions.map((rule) => `- ${rule.rule}: ${rule.reason}`)].join("\n"));
+		const rawAllowed = args.allowed;
+		const { parsedRules: allowRules, failedRules: failedAllowRules } = parseAllowRule((Array.isArray(rawAllowed) ? rawAllowed : rawAllowed ? [rawAllowed] : []).filter((value) => typeof value === "string" && value.length > 0));
+		if (failedAllowRules.length > 0) throw new Error(["One or more allow flags could not be parsed:", ...failedAllowRules.map((rule) => `- ${rule.rule}: ${rule.reason}`)].join("\n"));
 		if (restrictions.length > 0) consola.info(`Applying ${restrictions.length} restriction rule(s):`, restrictions.map((r) => r.source));
+		if (allowRules.length > 0) consola.info(`Applying ${allowRules.length} allow rule(s):`, allowRules.map((rule) => rule.source));
 		const transport = new StdioTransport(createC8YMcpServer());
 		consola.info("Starting MCP server over stdio transport...");
-		transport.listen({ restrictions });
+		transport.listen({
+			restrictions,
+			allowRules
+		});
 	}
 }));
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mc8yp",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "type": "module",
   "description": "Cumulocity IoT MCP Server - Model Context Protocol integration for IoT device management",
   "keywords": [
@@ -49,6 +49,7 @@
   "devDependencies": {
     "@schplitt/eslint-config": "^1.4.0",
     "@types/node": "^24.12.2",
+    "changelogithub": "^14.0.0",
     "eslint": "^9.39.4",
     "tsdown": "^0.21.9",
     "typescript": "^5.9.3",