stacklok / toolhive / 24725780665

push

github

Set MCP parent on resource entities for server-scoped policies (#4965)

When serverName is configured on the Cedar authorizer, resource entities
(Tool, Prompt, Resource) need an MCP parent so that server-scoped Cedar
policies like `resource in MCP::"github"` evaluate correctly. Without
this parent, those policies silently match nothing and deny all requests.

Add serverName parameter to CreateEntitiesForRequest and build an
MCP::"<serverName>" parent UID when non-empty. Thread a.serverName
through all four authorize* methods in core.go.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

19 of 19 new or added lines in 2 files covered. (100.0%)

58435 of 87904 relevant lines covered (66.48%)

63.24 hits per line