Skip to content

[MCP] Tool registry + class-level introspection + RBAC-aware tools/list filtering #615

Closed
#781
Closed
[MCP] Tool registry + class-level introspection + RBAC-aware tools/list filtering#615
#781
Labels
area:componentsComponents / applications subsystemarea:mcpModel Context Protocol (MCP) server: protocol, profiles, stdio CLIenhancementNew feature or requestfeature:mcp-v1Rollout of native MCP server v1 (HarperFast/harper#465). Removed when v1 closes.
Milestone
v5.1

Description

@kylebernhardy
kylebernhardy
opened on May 19, 2026

Scope. Build the tool registry, JSON Schema input plumbing, and the RBAC-aware tools/list filter. No real tools yet — this PR ships the framework; the operations and application profiles plug into it in #617 and #618.

Design reference. Sections "Tool-list filtering" and "Safety & Observability → Error mapping" in #465.

Acceptance criteria

  • Tool registry abstraction (addTool, removeTool, listTools(user)) with per-session caching of the filtered list.
  • Class-level verb introspection reuses the pattern at resources/openApi.ts:149-153 (prototype.method !== Resource.prototype.method).
  • User-level RBAC walk reuses the pattern at dataLayer/schemaDescribe.ts:29-49 (direct walk of user.role.permission[db].tables[table]). Does not use Resource.allowRead/Create/Update/Delete — those are instance methods bound to a record id (resources/Resource.ts:413-427).
  • tools/list paginates via opaque cursor / nextCursor; page size capped by mcp.<profile>.maxTools.
  • tools/call dispatches to a registered tool's handler; unknown tool → JSON-RPC -32601; invalid args → -32602; tool-execution error returns result.isError = true (NOT a JSON-RPC error).
  • Tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) flow through.
  • Unit tests cover: filter for super_user, structure_user, read-only role, anonymous; pagination; isError mapping; unknown-tool error.

Out of scope. No operations API integration (#617), no Resources registry integration (#618), no listChanged (#619), no rate limiting (#620).

Stacks on. #614 (transport + lifecycle).

Branch & PR conventions

Smoke test

# Register a stub tool in test, then:
curl -sS -X POST http://localhost:9925/mcp ... \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
# Expected: { result: { tools: [<stub>], nextCursor?: ... } }, RBAC-filtered to caller's role.

Tracking. Part of #465. Sub-issue #3 of 11.

Activity

  1. kylebernhardy
    added this to the milestone on May 19, 2026
  2. kylebernhardy
    added
    enhancementNew feature or request
    area:componentsComponents / applications subsystem
    area:mcpModel Context Protocol (MCP) server: protocol, profiles, stdio CLI
    feature:mcp-v1Rollout of native MCP server v1 (HarperFast/harper#465). Removed when v1 closes.
    on May 19, 2026
  3. kylebernhardy
    added a parent issue on May 19, 2026

  4. kriszyp commented on May 20, 2026

    @kriszyp
    kriszyp
    on May 20, 2026
    Member

    User-Level RBAC

    I am a skeptical that we can really introspect this. Most Harper applications have highly restricted RBAC access to tables, and then programmatically grant permission to public users. And for Resource (not tables), there is no such thing as RBAC at all. So I don't know that we can really determine tools based on RBAC, the permissions will probably still need to be applied at execution time.

  5. kylebernhardy commented on May 20, 2026

    @kylebernhardy
    kylebernhardy
    on May 20, 2026
    MemberAuthor

    User-Level RBAC

    I am a skeptical that we can really introspect this. Most Harper applications have highly restricted RBAC access to tables, and then programmatically grant permission to public users. And for Resource (not tables), there is no such thing as RBAC at all. So I don't know that we can really determine tools based on RBAC, the permissions will probably still need to be applied at execution time.

    OK a bit of fire, and see what happens. Makes sense with our programmatic implementation of allow*. Is there any harm in trying to introspect or should this be skipped for Resource class endpoints?

  6. kriszyp commented on May 24, 2026

    @kriszyp
    kriszyp
    on May 24, 2026
    Member

    Is there any harm in trying to introspect

    There is no harm in trying introspect the presence of static methods, that's the right thing to do.
    There is harm in trying to introspect RBAC permissions, they will often report no permissions even though permissions may be programmatically granted.

  7. kylebernhardy
    added 2 commits that reference this issue on May 26, 2026

    doc(mcp): clarify visibleTo is not a tools/call security boundary (#615)

    557c274

    test(mcp): integration test uses resources/list as unknown-method probe

    5ad8154
  8. kylebernhardy
    closed this as completedin #781on May 28, 2026
  9. kylebernhardy
    added 4 commits that reference this issue on May 28, 2026

    feat(mcp): resources capability — list, read, templates/list (#616)

    837ef82

    test(mcp): use definitely-unknown method as the -32601 probe

    61ad994

    feat(mcp): resources capability — list, read, templates/list (#616)

    14ece20

    test(mcp): use definitely-unknown method as the -32601 probe

    e691255
  10. kylebernhardy
    modified the milestones: , v5.1 on Jun 1, 2026
  11. kriszyp
    added a commit that references this issue on Jun 2, 2026

    feat(models): toolMode 'auto' agent loop on scope.models.generate (#612…

    83c151d
  12. pbrumblay
    added 2 commits that reference this issue on Jun 26, 2026

    feat(mcp): Streamable HTTP transport (HarperFast#614)

    8a5cf9d

    feat(mcp): tool registry + RBAC-aware tools/list (HarperFast#615)

    d3058f6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:componentsComponents / applications subsystemarea:mcpModel Context Protocol (MCP) server: protocol, profiles, stdio CLIenhancementNew feature or requestfeature:mcp-v1Rollout of native MCP server v1 (HarperFast/harper#465). Removed when v1 closes.

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions