Support backend-scoped Cedar authorization in VirtualMCPServer

Summary

When using a VirtualMCPServer (vMCP) with multiple discovered MCPServer backends, there is currently no first-class way to authorize access to all tools belonging to a specific backend.

Today, tools are exposed as individual Tool entities and inherit from the vMCP server entity itself:

Tool::<tool-name>
  -> parent MCP::<vmcp-name>

This makes the following policy work:

permit(principal, action, resource)
when {
    resource in MCP::"vmcp-main"
};

However, backend MCPServer resources are not represented as Cedar entities, so policies such as:

permit(principal, action, resource)
when {
    resource in MCP::"backend-a"
};

do not match any tools.

Current workaround

The current workaround is to use prefix matching on the resolved tool name:

permit(principal, action, resource)
when {
    resource.name like "backend-a_*"
};

This works, but it relies on string matching rather than a resource hierarchy.

Requested enhancement

Represent discovered backends as Cedar entities and make tools inherit from their originating backend.

For example:

Tool::"backend-a_get_user"
  -> parent MCP::"backend-a"

Tool::"backend-b_read_file"
  -> parent MCP::"backend-b"

This would allow policies such as:

permit(principal in THVGroup::"mcp.common", action, resource)
when {
    resource in MCP::"backend-a"
};

and

permit(principal in THVGroup::"mcp.dev", action, resource)
when {
    resource in MCP::"backend-b"
};

without enumerating individual tools or relying on naming conventions.

Use case

A common scenario is a single vMCP aggregating multiple backends where access should be granted per backend rather than per tool.

Example:

backend-a = Directory / Identity tools
backend-b = File access tools
backend-c = Infrastructure tools

Administrators may want to grant access to all tools from a backend while keeping a single vMCP endpoint and a clean Cedar authorization model.

Environment

• ToolHive v0.29.1
• VirtualMCPServer with dynamically discovered MCPServer backends
• Cedar authorization enabled