stacklok / toolhive / 29580704301

69%

Build Type

push

github

Committed by web-flow

Commit Message

Harden vMCP authz gate: single parse source and reserved-name check (#5850)

Harden vMCP authz gate: single parse + name guard

Two hardening items split out of the #5841 review (the vMCP HTTP-403
authz gate). Refs #5845.

1. Single parse source for tools/call. The pre-dispatch gate authorized
   on the transport parser's decoded arguments while the Serve handler
   re-authorized and forwarded the backend call on the SDK's separate
   decode of the same bytes. For an argument-conditional Cedar policy the
   two decodes could diverge (json.Number vs float64, duplicate keys),
   letting the gate ALLOW while the call path DENIED — re-introducing the
   200/IsError the gate exists to remove. coreToolHandler now prefers the
   transport-parsed map via gateParsedArgs, so gate check, enforced check,
   and backend forward all derive from one decode. Fallback paths (batch,
   embedders bypassing the transport, method/tool mismatch) keep the SDK
   decode and make a single decision on a single map, so they cannot
   diverge. core.CallTool is untouched and stays standalone defense.

2. Fail-loud reserved-name check. A backend tool literally named
   execute_tool_script would be silently shadowed by the code-mode
   virtual tool and skip its Cedar policy. The codemode decorator now
   routes every inner tool-set read through innerTools, which returns
   ErrReservedToolName (naming the offending backend) so the collision
   aborts listing/lookup/script execution rather than shadowing silently.

Item 3 of #5845 (verb parity for elicitation/sampling/tasks) stays open:
it is blocked on a core admission decision for those verbs, which does
not exist yet.


Claude-Session: https://claude.ai/code/session_01UthZzKery5m7GBNcXYKALe

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Coverage Stats

23 of 23 new or added lines in 2 files covered. (100.0%)

59 existing lines in 8 files now uncovered.

74522 of 108835 relevant lines covered (68.47%)

64.1 hits per line