Repository navigation
feat(policy): an MCP access preset, or a validator message that says what to write when access presets are rejected on protocol: mcp #4293
Description
Activity
OpenShell already supports MCP access control through explicit method and tool rules. The v0.1.2 documentation includes the initialization methods and a tool allowlist.
There is also
mcp.allow_all_known_mcp_methods: true, but without explicit allow rules it permits tool execution too.For that behavior, remove
accessand use these fields on the MCP endpoint, retaining its host and port:protocol: mcp enforcement: enforce rules: - allow: method: initialize - allow: method: notifications/initialized - allow: method: tools/list
This allows initialization and tool discovery without allowing
tools/call. To permit selected tools, addmethod: tools/callrules withtoolorparams.namematchers.The v0.1.2 validator already points to
rules/deny_rulesand the allow-all option. Could you share the exact error and command you saw? That would help identify whether another validation path loses this guidance.For MCP and generic JSON-RPC, access presets like
access: read-onlyare currently unsupported. Both reading and writing can happen through the same RPC method, so policies use explicit method rules and, for MCP, tool-name rules.
Version. OpenShell 0.1.2. Observed 2026-09-29.
Observed. On an endpoint declared
protocol: mcp,access: read-onlyfails policy validation. The form that works is an explicittools/callparams.nameallowlist plus the handshake methods. The validator message says the preset is rejected but not what to write instead.Why it matters.
read-onlyis the first thing anyone writes for an MCP endpoint, and the natural reading of "rejected" is "MCP does not support access control", not "write the explicit list". We only found the working form by readingl7_validate.rs.Ask. Either of:
tools/listonly (the MCP equivalent of read-only), oraccesspresets do not apply toprotocol: mcp; declaretools/callparams.nameentries plusinitialize,notifications/initialized,tools/list".