How to protect tools

[psociety]

I've have an auth middleware set and i want to return the user a list of tools depending on what tools can he use.
Can tools be a callback so it can be dynamically set? Or what's the proper way to do it?

[jskorlol]

It seems that there’s currently no way to configure the middleware.

I’ll look into adding support for this as part of implementing the authentication protocol.

Most likely, it will follow the function middleware() approach commonly used in Laravel controllers.

[kargnas]

Since the streamable HTTP and the SSE are not for web browsers, the normal auth module won't work.

My idea is that you add an argument in the function names auth_token and send the user auth token when your agent calls the MCP tool.

Then you can auth the user using the token inside execute().

To filter the tool list, you can create a middleware that set an array config of tool list with authentication.