feat(security): 接入 MCP server/tool 权限规则 by Cai-Tang-www · Pull Request #237 · 1024XEngineer/neo-code

Cai-Tang-www · 2026-04-12T04:37:53Z

目标

补齐 #178 中 MCP server/tool 权限规则接入这条链路，让 MCP 工具进入现有的权限策略与 session remember 闭环，同时保证规则优先级和可追溯性一致。

Closes #178

这次改动

1. 补齐 MCP 权限 identity

MCP tool 的权限 action 不再只落到 server 级 target
统一收敛为完整 identity：mcp.<server>.<tool>
同时保留 mcp.<server> 作为 server 级分类 identity，用于 server 级规则命中

2. 补齐 MCP 默认策略与规则模板

在推荐策略中新增 ask-all-mcp
新增 MCP server 级规则模板：命中 mcp.<server>
新增 MCP tool 级规则模板：命中 mcp.<server>.<tool>
固定 MCP 规则优先级为 deny > ask > allow
保证 server-level deny 可以覆盖同 server 下所有 tool，且不会被 tool-level allow 反转

3. 收紧 session remember 边界

MCP remember 改成 server 分类 + tool 精确 scope
避免一次 tool 授权放大到同 server 的其他 tool
保证 session remember 不能绕过硬 deny

4. 对齐权限事件展示语义

runtime 权限事件里的 MCP ToolCategory 统一展示为 mcp.<server>
保持 rule_id / reason / target 在错误对象与事件侧可追溯

测试

已补充并通过：

MCP 默认 ask 命中测试
server-level deny 覆盖 tool-level allow 测试
tool-level ask 精确命中测试
MCP remember 不跨 tool 放大测试
deny 规则的 rule_id / reason / target 追溯测试

本地已执行：

go test ./...

codecov · 2026-04-12T04:39:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Cai-Tang-www · 2026-04-12T04:52:33Z

/code -codex 帮我解决你说的review和出现的问题，然后帮我提高测试覆盖率到100

fennoai · 2026-04-12T04:52:44Z

已完成

修复了 review 指出的 MCP server 解析歧义问题（server id 含 . 时不再错误截断为第二段）。
统一 runtime/tools 的 MCP server 分类提取逻辑，复用 security.CanonicalMCPServerIdentity，避免多处实现分叉。
补充回归测试，覆盖：

带点号 server id 的 canonical 解析
不同 dotted server 间策略隔离（避免碰撞误命中）
runtime 权限事件分类对 dotted server 的展示
permission mapper 对 dotted server 的提取

已执行并通过：go test ./...

关键改动文件

internal/security/policy.go
internal/security/policy_test.go
internal/runtime/permission.go
internal/runtime/permission_test.go
internal/tools/permission_mapper.go
internal/tools/manager_test.go

提交与推送

Commit: cc8c6f4
已推送到 PR 分支：Cai-Tang-www/neo-code:feat/178-mcp-permission-rules

未完成项说明

按 git-push-fork skill 调用 fork PR 同步脚本时失败（当前环境 gh 未登录：gh auth login / GH_TOKEN 未注入给该脚本）。
代码修复与测试补齐已完成并推送，不影响本 PR 分支更新。

View job run

Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: Cai-Tang-www <106404101+Cai-Tang-www@users.noreply.github.com>

phantom5099 · 2026-04-12T06:18:38Z

/review -codex

fennoai

发现 1 个需要修复的问题：CanonicalMCPServerIdentity 当前按最后一个 . 切分，会在 tool 名包含 . 时把 server 错分，导致 server-level 规则命中错误。其余改动整体方向正确。

fennoai

发现 1 个值得修复的问题：CanonicalMCPServerIdentity 在输入已是 server 级 canonical identity 且 server 含 . 时会被错误截断，可能导致规则命中到错误 server。

fennoai

发现 1 处需要修正的问题：canonicalMCPServerIdentity 在处理已是 server identity 且 server 含 . 的输入时会被再次截断，可能导致 server 级匹配/展示错误。

fennoai

聚合审查后保留 1 个问题：CanonicalMCPServerIdentity 在处理已是 server 级 identity 且 server 含 . 的输入时会误截断，可能导致 server 级规则匹配或事件分类错误。

Cai-Tang-www · 2026-04-12T10:29:44Z

/simplify -claude

fennoai · 2026-04-12T10:29:55Z

Changes Made

Unresolved review comment fix (internal/security/policy.go):

Added dot-validation in canonicalMCPToolIdentity — tool names containing . now return empty string, preventing ambiguous server/tool boundary parsing that could cause permission bypass (the scenario raised in review: server=github, tool=enterprise.create_issue → identity mcp.github.enterprise.create_issue would previously extract server as mcp.github.enterprise instead of mcp.github)
Added naming-contract comment to canonicalMCPServerIdentity documenting that mcp.-prefixed inputs are treated as full tool identities, and pure server identities should be passed without the mcp. prefix

Code simplifications (per /simplify):

Extracted normalizeTrimmedStringList[T ~string] generic to deduplicate normalizeActionTypes / normalizeTargetTypes
Simplified mcpServerIdentity to read only action.Payload.Target (the Resource/ToolName fallbacks were never exercised in practice)
Removed redundant trimmed == "mcp." guard in canonicalMCPServerIdentity (covered by inner body == "" check)
Inlined normalizeMCPToolIdentity (was a one-liner); simplified mcpServerTarget to skip redundant ToLower+TrimSpace

All tests pass (go test ./...). Commit: d4b4829

Permission Required to Push

Hi @Cai-Tang-www! Changes are committed locally but I need permission to push to your fork.

View Details & Solution

Target: Cai-Tang-www/neo-code (fork)

Push blocked: xgopilot GitHub App is not installed on the fork repository.

Solution: Install GitHub App

Install xgopilot
Select repository: Cai-Tang-www/neo-code
Click "Install"
Return here and comment /simplify again

View job run

Cai-Tang-www · 2026-04-12T10:50:42Z

/code -claude simplify and resolve review like 1.Added naming-contract comment to canonicalMCPServerIdentity documenting that mcp.-prefixed inputs are treated as full tool identities, 和 pure server identities should be passed without the mcp. prefix 2.Added dot-validation in canonicalMCPToolIdentity — tool names containing . 现在 return empty string, preventing ambiguous server/tool boundary parsing that could cause permission bypass (the scenario raised in review: server=github, tool=enterprise.create_issue → identity mcp.github.enterprise.create_issue would previously extract server as mcp.github.enterprise instead of mcp.github)

fennoai · 2026-04-12T10:50:49Z

Changes Implemented

Two changes applied to internal/security/policy.go:

1. Naming-contract comment on canonicalMCPServerIdentity

Documents the calling convention so future readers know:

mcp.-prefixed inputs → treated as full tool identities; server portion is extracted
plain server names (no mcp. prefix) → directly completed to mcp.<server>
callers passing a pure server name must not include the mcp. prefix

2. Dot-validation in canonicalMCPToolIdentity

Tool names containing . now return "" immediately. This closes the permission-bypass vector raised in review:

server=github, tool=enterprise.create_issue
→ would produce identity mcp.github.enterprise.create_issue
→ canonicalMCPServerIdentity would extract server as mcp.github.enterprise (wrong)
instead of mcp.github (correct), bypassing server-level deny rules

All existing tests pass (go test ./internal/security/... ./internal/tools/...).

Changes pushed: Cai-Tang-www/neo-code#9

View job run

… identity functions - Added naming-contract comment to canonicalMCPServerIdentity documenting that mcp.-prefixed inputs are treated as full tool identities (server extracted from them), and pure server identities should be passed without the mcp. prefix - Added dot-validation in canonicalMCPToolIdentity: tool names containing "." now return empty string, preventing ambiguous server/tool boundary parsing that could cause permission bypass (e.g. server=github, tool=enterprise.create_issue would produce mcp.github.enterprise.create_issue, causing server to be incorrectly extracted as mcp.github.enterprise instead of mcp.github) Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: Cai-Tang-www <106404101+Cai-Tang-www@users.noreply.github.com>

fix(security): add naming contract comment and dot-validation for MCP identity functions

Cai-Tang-www · 2026-04-12T11:13:12Z

/code 提高test patch

fennoai · 2026-04-12T11:13:23Z

已完成 提高test patch 的改动，并已推送到当前 PR 分支 feat/178-mcp-permission-rules（commit: bc4a5bb）。

本次完成

在 internal/security/policy_test.go 新增 MCP 相关分支测试，补齐以下路径：
- mcpPolicyPriority 的 deny/ask/allow/default
- mcpServerIdentity 的 target/resource/toolName 回退链路与非 MCP 分支
- canonicalMCPServerIdentity 的边界输入（mcp..*、mcp.*.、大小写/空白归一化等）
- canonicalMCPToolIdentity 的合法与非法输入（含 dotted tool 拒绝）
- deriveToolCategory 的 MCP 分类与 fallback mcp
在 internal/security/policy.go 清理 2 处不可达分支（与前置校验重复），避免无意义未覆盖代码行。

验证结果

已执行并通过：go test ./...

说明

额外尝试按 git-push-fork 脚本创建/更新 fork 内 PR 时返回 No commits between ...，因为改动已直接同步到当前 PR 源分支，不影响本 PR 更新。

View job run

Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: Cai-Tang-www <106404101+Cai-Tang-www@users.noreply.github.com>

Cai-Tang-www added 2 commits April 12, 2026 12:36

feat(security): 补齐 MCP 权限 identity 与规则模板

0b9dc7a

test(security): 补齐 MCP 权限命中与 remember 边界测试

1e44363

This comment was marked as outdated.

Sign in to view

fix(security): resolve MCP server identity parsing collisions

cc8c6f4

Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: Cai-Tang-www <106404101+Cai-Tang-www@users.noreply.github.com>

fennoai Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread internal/security/policy.go

fennoai Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread internal/security/policy.go

fennoai Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread internal/security/policy.go

fennoai Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread internal/security/policy.go

xgopilot and others added 2 commits April 12, 2026 10:52

Merge pull request #9 from Cai-Tang-www/fork-pr-237-1775989789

81a1b37

fix(security): add naming contract comment and dot-validation for MCP identity functions

test(security): improve MCP policy patch coverage

bc4a5bb

Generated with [codeagent](https://github.com/qbox/codeagent) Co-authored-by: Cai-Tang-www <106404101+Cai-Tang-www@users.noreply.github.com>

phantom5099 merged commit e45a981 into 1024XEngineer:main Apr 12, 2026
2 checks passed

fennoai Bot mentioned this pull request Apr 15, 2026

风险点计算 #313

Closed

Cai-Tang-www deleted the feat/178-mcp-permission-rules branch April 19, 2026 17:01

Uh oh!

Conversation

Cai-Tang-www commented Apr 12, 2026

目标

这次改动

1. 补齐 MCP 权限 identity

2. 补齐 MCP 默认策略与规则模板

3. 收紧 session remember 边界

4. 对齐权限事件展示语义

测试

Uh oh!

codecov Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

Uh oh!

Cai-Tang-www commented Apr 12, 2026

Uh oh!

fennoai Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

已完成

关键改动文件

提交与推送

未完成项说明

Uh oh!

phantom5099 commented Apr 12, 2026

Uh oh!

fennoai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fennoai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fennoai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fennoai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Cai-Tang-www commented Apr 12, 2026

Uh oh!

fennoai Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes Made

Permission Required to Push

Solution: Install GitHub App

Uh oh!

Cai-Tang-www commented Apr 12, 2026

Uh oh!

fennoai Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes Implemented

Uh oh!

Cai-Tang-www commented Apr 12, 2026

Uh oh!

fennoai Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

本次完成

验证结果

说明

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Apr 12, 2026 •

edited

Loading

fennoai Bot commented Apr 12, 2026 •

edited

Loading

fennoai Bot commented Apr 12, 2026 •

edited

Loading

fennoai Bot commented Apr 12, 2026 •

edited

Loading

fennoai Bot commented Apr 12, 2026 •

edited

Loading