MCP delegation boundary: serveMcp accepts an inbound chain (stage 3)#6
Merged
Conversation
Lets a gateway sit in front of an MCP-served TOAD agent and have the agent honor the delegation chain — the cross-process half of the confused-deputy defense. - Toad-Delegation wire codec: encodeDelegationHeader / parseDelegationHeader (ids percent-encoded; identities-only — structured form carries scopes/claims). - serveMcp reads a chain from a tools/call's `_meta["toad/delegation"]` (the structured DelegationContext object or the header string), extends it by the served agent, and runs the agent with it — so the agent's own tool calls authorize against the full chain. Absent _meta ⇒ unchanged behavior. - New exports: encodeDelegationHeader, parseDelegationHeader, DELEGATION_HEADER. 8 new tests (82 runtime total): header round-trip + percent-encoding + tolerance, and the boundary accepting structured/string chains and extending by the agent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stage 3 of the delegation/authz design: the cross-process half of the confused-deputy defense. A gateway (Kagenti's MCP gateway, an Istio policy, an Envoy filter) can sit in front of an MCP-served TOAD agent, set the delegation chain, and the served agent honors it — so the agent's own tool calls authorize against the full chain, not just whatever the agent started with.
Builds on stages 1–2 (PR #5: chain propagation + deny-capable
authorizeToolCall).How
delegation.ts—encodeDelegationHeader/parseDelegationHeaderfor theToad-Delegationform:subject=<id>; chain=<id>,<id>,…, ids percent-encoded so any character is safe. Identities-only; the structured object form carries scopes/claims for full fidelity.serveMcpaccepts inbound — atools/callmay carry a chain in its MCP_metaundertoad/delegation, as either the structuredDelegationContextobject or the header string.serveMcpreads it, extends it by the served agent (this hop), and runs the agent with that chain._meta⇒ identical behavior to before. Fully opt-in.Verified
_metais absent.New exports
encodeDelegationHeader,parseDelegationHeader,DELEGATION_HEADER.Still future (stage 4, in the doc)
Outbound emission (a TOAD agent acting as an MCP client), optional JWS signing, and a declarative
.agentallow:block compiled bytoac.🤖 Generated with Claude Code