feat: MCP gateway — govern tools/call (step 9) - #7
Merged
Conversation
A JSON-RPC reverse proxy at POST /mcp in front of an upstream MCP server. It forwards every MCP method transparently and intercepts tools/call: - per-tool allowlist (exact name or glob) — disallowed tools never reach upstream (JSON-RPC error -32001); - read-only vs side-effecting classification (config read-only set); only side-effecting tools are gated; - side-effecting tools route through the deterministic approval gate (blocks until a human resolves, bounded by RISKKERNEL_MCP_APPROVAL_TIMEOUT) — denied or timed-out calls never reach upstream; - every governed call recorded to the tool_calls audit table; - attribution by X-RiskKernel-Run-Id (same as the proxy). This is the approval gate's natural live producer (step 7). Enabled only when RISKKERNEL_MCP_UPSTREAM is set; allowlist/read-only via RISKKERNEL_MCP_*. Tests vs a fake upstream: passthrough of non-tool methods, allowlist block, read-only forward, approve->forward, deny->error (upstream untouched in both reject paths). Verified live end-to-end.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Implements the MCP gateway (§8 step 9): a JSON-RPC reverse proxy at
POST /mcpin front of an upstream MCP server. Point your MCP client at the gateway and governance is invisible to allowed, approved calls.It forwards every MCP method transparently and intercepts
tools/call:-32001).RISKKERNEL_MCP_APPROVAL_TIMEOUT); denied/timed-out calls never reach upstream.tool_calls.X-RiskKernel-Run-Id.This is the approval gate's natural live producer (step 7), reusing the gate, manager, and storage. Enabled only when
RISKKERNEL_MCP_UPSTREAMis set.Verification
go test -race ./...green;vet+gofmtclean.tools/callforwards and returns the upstream result.Notes
/mcpis JSON-RPC (not REST), so it's documented in CHANGELOG/.env.example rather than the/v1OpenAPI surface.