MCPKit.Policy behaviour (mcp_kit v0.2.4)

Copy Markdown View Source

Host-owned authorization boundary for MCP surfaces.

Policy is evaluated on every request. Router declarations define the superset of available capabilities, while policy determines which items are visible or invokable for the current session and request parameters.

Summary

Types

decision()

Callbacks

authorize(action, context)

Authorizes a request-time MCP action.

Types

decision()

@type decision() :: :allow | {:deny, :not_found | :forbidden}

Callbacks

authorize(action, context)

@callback authorize(action :: term(), context :: map()) :: decision()

Authorizes a request-time MCP action.

The action identifies the surface being accessed, such as a tool call, prompt completion, or resource read. The context map includes the current session, request parameters, normalized arguments, and host definition module.