[Improvement]: Only advertise authorized tools based on mcp_authz policy
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 71
- Forks
- 111
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 110
Description
Please select the area the issue is related to
Gateway
Please select the aspect the issue is related to
Aspect/AI (AI/LLM integration, MCP, AI readiness)
Suggested Improvement
When an mcp client does its tool discovery, based on the scopes in its access token only return the set of tools it has access to. Default for tools unmapped to a scope should be to return them.
Request (JSON-RPC 2.0):
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list",
"params": {
"cursor": "optional-opaque-pagination-cursor"
}
}
Reasoning is an agent will always attempt a tool it sees returned until it fails which wastes tokens.
Related Issues
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Gateway entry point handling the MCP JSON-RPC tools/list request and read the mcp_authz policy behavior, then review related issue #2751. Done means discovery returns only tools authorized by the access-token scopes while still returning tools that are not mapped to a scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- ai, api, authorization
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100