pomerium/pkg/policy
Denis Mishin f9e7308f12
mcp: add mcp_tool to ppl (#5662)
## Summary

Adds `mcp_tool` PPL criterion, that matches MCP tool names like 

```yaml
  - from: https://db.localhost.pomerium.io
    to: http://localhost:3000/mcp
    policy:
      allow:
        and:
          - email: 
              in: ["user@pomerium.com"]
          - mcp_tool:
              in: ["list_tables", "read_table", "search_records"]
    mcp: {}
```

## Related issues

Fix
https://linear.app/pomerium/issue/ENG-2393/mcp-authorize-each-incoming-request-to-an-mcp-route

## User Explanation

<!-- How would you explain this change to the user? If this
change doesn't create any user-facing changes, you can leave
this blank. If filled out, add the `docs` label -->

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review
2025-06-23 12:43:43 -04:00
..
criteria mcp: add mcp_tool to ppl (#5662) 2025-06-23 12:43:43 -04:00
generator chore(deps): bump the go group with 39 updates (#5559) 2025-04-04 16:26:51 -07:00
parser core/lint: upgrade golangci-lint, replace interface{} with any (#5099) 2024-05-02 14:33:52 -06:00
rules policy: support emails from directory user (#5504) 2025-02-27 13:39:28 -07:00
policy.go ppl: bubble up values, bug fixes (#2213) 2021-05-18 14:01:36 -06:00