Package org.openidentityplatform.openig.ai.filter

Class MCPServerFeaturesFilter

java.lang.Object

org.openidentityplatform.openig.ai.filter.MCPServerFeaturesFilter

All Implemented Interfaces:

org.forgerock.http.Filter

public class MCPServerFeaturesFilter
extends Object
implements org.forgerock.http.Filter

MCPServerFeaturesFilter
This filter enforces allow/deny policies for MCP (Management & Control Protocol) features exchanged as JSON-RPC payloads with an MCP server. It inspects both incoming requests and outgoing responses and removes or rejects features according to the configured rules.

Policy enforcement logic:

• Deny lists take precedence over allow lists
• Empty allow list means all features are allowed (unless denied)
• Non-empty allow list means only listed features are allowed
• Denied features are always blocked, regardless of allow list

 {
     "type": "MCPFeaturesFilter",
     "config": {
         "allow": {
             "tools": ["get_weather", "tool2"],
             "prompts": ["code_review", "prompt2"]
         },
         "deny": {
             "resources": ["file:///project/src/main.rs"],
             "resources/templates": ["file:///{path}"]
         }
     }
 }
 
 

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	MCPServerFeaturesFilter.Heaplet
static class	MCPServerFeaturesFilter.MCPFeature

Constructor Summary

Constructors

Constructor	Description
MCPServerFeaturesFilter()

Method Summary

Modifier and Type	Method	Description
org.forgerock.util.promise.Promise<org.forgerock.http.protocol.Response,org.forgerock.util.promise.NeverThrowsException>	filter(org.forgerock.services.context.Context context, org.forgerock.http.protocol.Request request, org.forgerock.http.Handler next)
List<org.forgerock.json.JsonValue>	filterResponseFeature(MCPServerFeaturesFilter.MCPFeature mcpFeature, List<org.forgerock.json.JsonValue> featuresList, List<String> allowed, List<String> denied)	Filter a list of feature objects.
Map<MCPServerFeaturesFilter.MCPFeature,List<String>>	getAllowFeatures()
Map<MCPServerFeaturesFilter.MCPFeature,List<String>>	getDenyFeatures()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MCPServerFeaturesFilter

public MCPServerFeaturesFilter()

Method Detail

getAllowFeatures

public Map<MCPServerFeaturesFilter.MCPFeature,List<String>> getAllowFeatures()

getDenyFeatures

public Map<MCPServerFeaturesFilter.MCPFeature,List<String>> getDenyFeatures()

filter

public org.forgerock.util.promise.Promise<org.forgerock.http.protocol.Response,org.forgerock.util.promise.NeverThrowsException> filter(org.forgerock.services.context.Context context,
                                                                                                                                             org.forgerock.http.protocol.Request request,
                                                                                                                                             org.forgerock.http.Handler next)

Specified by:

filter in interface org.forgerock.http.Filter

filterResponseFeature

public List<org.forgerock.json.JsonValue> filterResponseFeature(MCPServerFeaturesFilter.MCPFeature mcpFeature,
                                                                List<org.forgerock.json.JsonValue> featuresList,
                                                                List<String> allowed,
                                                                List<String> denied)

Filter a list of feature objects.

Parameters:

featuresList - the original feature JSON objects

allowed - allowed names (empty == no allow constraint)

denied - denied names (empty == no deny constraint)

Returns:

filtered list (new list instance)