## Summary Implements the Go SDK for MCP interceptors — validation and mutation middleware for any MCP server. The framework treats interceptors as first-class MCP primitives: they are registered on an MCP server, discoverable via `interceptors/list`, and invocable via `interceptor/invoke` — the same JSON-RPC pattern as tools, prompts, and resources. A chain engine orchestrates execution across one or more interceptor servers, and an optional go-sdk middleware integration applies interceptors automatically on every matching request/response. ## Architecture **Three-layer design:** 1. **`interceptors`** — Protocol-agnostic core. Defines interceptor types (validators, mutators), metadata, invocation, wire types, and results. Zero MCP dependencies. 2. **`interceptors/mcpserver`** — MCP server integration. Wraps `mcp.Server` to register `interceptors/list` and `interceptor/invoke` as custom JSON-RPC methods and advertise interceptor capabilities during `initialize`. 3. **`interceptors/chain`** — Chain engine. Orchestrates execution across N interceptor servers with trust-boundary-aware ordering, priority-based mutation sequencing, parallel validation, audit-mode isolation, and fail-open/fail-closed semantics. 4. **`interceptors/integrations/gomiddleware`** — Optional go-sdk middleware. Installs on `mcp.Server` via `AddReceivingMiddleware()` to automatically run the interceptor chain on every matching request/response. **Key design decisions:** - **Trust-boundary ordering** — request phase: validate → mutate; response phase: mutate → validate. Validation always guards the boundary crossing. - **Wire-level invocation** — the chain calls `interceptor/invoke` over the MCP transport (even in-process via `LocalChain()`), so local and remote interceptor servers use the same interface. - **Audit-mode isolation** — audit-mode mutators compute transformations without applying them. Only audit mutators pay the serialization cost. - **Concurrency** — validators run in parallel; mutators run sequentially in priority order. ### Package Structure | Package | File | Responsibility | |---------|------|----------------| | `interceptors` | `interceptor.go` | Enums, Metadata, Interceptor interface, Validator/Mutator structs, handler types, Invocation | | `interceptors` | `wire.go` | Wire types: ListParams/Result, InvokeParams/Result, InterceptorInfo, event/method constants | | `interceptors` | `priority.go` | Priority with phase-aware resolution and JSON marshaling | | `interceptors` | `doc.go` | Package documentation with examples | | `interceptors/chain` | `chain.go` | Chain engine: discovery, filtering, sorting, execution orchestration | | `interceptors/chain` | `result.go` | ExecutionResult, AbortInfo | | `interceptors/chain` | `doc.go` | Sub-package documentation | | `interceptors/mcpserver` | `server.go` | MCP server wrapper, interceptor registry, capability advertisement, `LocalChain()` | | `interceptors/mcpserver` | `rpc.go` | `interceptors/list` and `interceptor/invoke` JSON-RPC handlers | | `interceptors/mcpserver` | `doc.go` | Sub-package documentation | | `integrations/gomiddleware` | `middleware.go` | go-sdk `Middleware` that runs the chain on every request/response | | `integrations/gomiddleware` | `errors.go` | Abort-to-JSONRPC error conversion | | `integrations/gomiddleware` | `doc.go` | Sub-package documentation | ### Documentation - `doc/DESIGN.md` — architecture, execution model, integration with go-sdk - `doc/CONFORMANCE.md` — SEP conformance status - `doc/PERFORMANCE.md` — per-request cost model ### Examples - `examples/validator` — blocks dangerous tool calls, demonstrates `WithContextProvider` - `examples/mutator` — tags tool responses with audit trail ## Vendor: go-sdk v1.4.0 with custom method support Vendors `go-sdk` with minimal extensions for custom JSON-RPC methods: - `Server.AddCustomMethod` — registers a handler that bypasses the typed pipeline - `ClientSession.CallCustom` — sends raw JSON-RPC calls for custom methods These changes are generic (not interceptor-specific) and enable any MCP extension to define its own JSON-RPC methods. ## TODO - More integration tests - Unit tests - Support wildcards for event interception (separate PR) --------- Signed-off-by: Kurt Degiorgio <kdegiorgio@bloomberg.net>
239 lines
6.9 KiB
Go
239 lines
6.9 KiB
Go
// Copyright 2025 The MCP Interceptors Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache-2.0
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package chain_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"log/slog"
|
|
"testing"
|
|
|
|
"github.com/modelcontextprotocol/go-sdk/mcp"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/modelcontextprotocol/ext-interceptors/go/sdk/interceptors"
|
|
"github.com/modelcontextprotocol/ext-interceptors/go/sdk/interceptors/chain"
|
|
)
|
|
|
|
// setupChainWithInterceptors creates an MCP server with the given
|
|
// interceptors registered via custom methods, connects a chain via
|
|
// in-memory transport, and returns the chain ready for testing.
|
|
func setupChainWithInterceptors(t *testing.T, is ...interceptors.Interceptor) *chain.Chain {
|
|
t.Helper()
|
|
|
|
mcpServer := mcp.NewServer(&mcp.Implementation{
|
|
Name: "chain-test-server",
|
|
Version: "0.1.0",
|
|
}, nil)
|
|
|
|
// Register interceptors/list and interceptor/invoke handlers.
|
|
registerInterceptorMethods(mcpServer, is)
|
|
|
|
serverTransport, clientTransport := mcp.NewInMemoryTransports()
|
|
|
|
ss, err := mcpServer.Connect(context.Background(), serverTransport, nil)
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { ss.Close() })
|
|
|
|
client := mcp.NewClient(&mcp.Implementation{
|
|
Name: "chain-test-client",
|
|
Version: "0.1.0",
|
|
}, nil)
|
|
cs, err := client.Connect(context.Background(), clientTransport, nil)
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { cs.Close() })
|
|
|
|
ch := chain.NewChain(chain.WithChainLogger(slog.Default()))
|
|
err = ch.AddMCPServer(context.Background(), cs)
|
|
require.NoError(t, err)
|
|
|
|
return ch
|
|
}
|
|
|
|
// registerInterceptorMethods adds interceptors/list and interceptor/invoke
|
|
// custom methods to the server, backed by the given interceptor list.
|
|
func registerInterceptorMethods(server *mcp.Server, is []interceptors.Interceptor) {
|
|
server.AddCustomMethod(interceptors.MethodList,
|
|
func(_ context.Context, _ *mcp.ServerSession, raw json.RawMessage) (any, error) {
|
|
var params interceptors.ListParams
|
|
if len(raw) > 0 {
|
|
if err := json.Unmarshal(raw, ¶ms); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
infos := make([]interceptors.InterceptorInfo, 0, len(is))
|
|
for _, i := range is {
|
|
if params.Event != "" {
|
|
match := false
|
|
for _, e := range i.GetMetadata().Hook.Events {
|
|
if e == params.Event {
|
|
match = true
|
|
break
|
|
}
|
|
}
|
|
if !match {
|
|
continue
|
|
}
|
|
}
|
|
infos = append(infos, interceptors.InfoFromInterceptor(i))
|
|
}
|
|
return &interceptors.ListResult{Interceptors: infos}, nil
|
|
},
|
|
)
|
|
|
|
server.AddCustomMethod(interceptors.MethodInvoke,
|
|
func(ctx context.Context, _ *mcp.ServerSession, raw json.RawMessage) (any, error) {
|
|
var params interceptors.InvokeParams
|
|
if err := json.Unmarshal(raw, ¶ms); err != nil {
|
|
return nil, err
|
|
}
|
|
var target interceptors.Interceptor
|
|
for _, i := range is {
|
|
if i.GetMetadata().Name == params.Name {
|
|
target = i
|
|
break
|
|
}
|
|
}
|
|
if target == nil {
|
|
return nil, fmt.Errorf("interceptor %q not found", params.Name)
|
|
}
|
|
|
|
inv := &interceptors.Invocation{
|
|
Event: params.Event,
|
|
Phase: params.Phase,
|
|
Payload: params.Payload,
|
|
Config: params.Config,
|
|
Context: params.Context,
|
|
}
|
|
|
|
result := &interceptors.InvokeResult{
|
|
Interceptor: params.Name,
|
|
Type: target.GetType(),
|
|
Phase: params.Phase,
|
|
}
|
|
|
|
switch v := target.(type) {
|
|
case *interceptors.Validator:
|
|
vr, err := v.Handler(ctx, inv)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
result.Validation = vr
|
|
case *interceptors.Mutator:
|
|
mr, err := v.Handler(ctx, inv)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
result.Mutation = mr
|
|
result.Payload = mr.Payload
|
|
}
|
|
return result, nil
|
|
},
|
|
)
|
|
}
|
|
|
|
func TestChain_FailOpenRecordsExecutionResult(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
t.Run("fail-open validator error is recorded", func(t *testing.T) {
|
|
t.Parallel()
|
|
failOpenValidator := &interceptors.Validator{
|
|
Metadata: interceptors.Metadata{
|
|
Name: "fo-validator",
|
|
Hook: interceptors.Hook{
|
|
Events: []string{"test/event"},
|
|
Phase: interceptors.PhaseRequest,
|
|
},
|
|
Mode: interceptors.ModeEnforce,
|
|
FailOpen: true,
|
|
},
|
|
Handler: func(_ context.Context, _ *interceptors.Invocation) (*interceptors.ValidationResult, error) {
|
|
return nil, fmt.Errorf("transient failure")
|
|
},
|
|
}
|
|
passingValidator := &interceptors.Validator{
|
|
Metadata: interceptors.Metadata{
|
|
Name: "passing-validator",
|
|
Hook: interceptors.Hook{
|
|
Events: []string{"test/event"},
|
|
Phase: interceptors.PhaseRequest,
|
|
},
|
|
Mode: interceptors.ModeEnforce,
|
|
},
|
|
Handler: func(_ context.Context, _ *interceptors.Invocation) (*interceptors.ValidationResult, error) {
|
|
return &interceptors.ValidationResult{Valid: true}, nil
|
|
},
|
|
}
|
|
|
|
ch := setupChainWithInterceptors(t, failOpenValidator, passingValidator)
|
|
|
|
payload, _ := json.Marshal(map[string]any{"value": "hello"})
|
|
cr, err := ch.Execute(context.Background(), &chain.ExecutionParams{
|
|
Event: "test/event",
|
|
Phase: interceptors.PhaseRequest,
|
|
Payload: payload,
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
// Chain should succeed — fail-open doesn't abort.
|
|
assert.Equal(t, chain.ChainSuccess, cr.Status)
|
|
assert.Empty(t, cr.AbortedAt)
|
|
|
|
// Both interceptors should have a result entry.
|
|
require.Len(t, cr.Results, 2)
|
|
})
|
|
|
|
t.Run("fail-open mutator error is recorded", func(t *testing.T) {
|
|
t.Parallel()
|
|
failOpenMutator := &interceptors.Mutator{
|
|
Metadata: interceptors.Metadata{
|
|
Name: "fo-mutator",
|
|
Hook: interceptors.Hook{
|
|
Events: []string{"test/event"},
|
|
Phase: interceptors.PhaseResponse,
|
|
},
|
|
Mode: interceptors.ModeEnforce,
|
|
FailOpen: true,
|
|
PriorityHint: interceptors.NewPriority(10),
|
|
},
|
|
Handler: func(_ context.Context, _ *interceptors.Invocation) (*interceptors.MutationResult, error) {
|
|
return nil, fmt.Errorf("transient failure")
|
|
},
|
|
}
|
|
passingMutator := &interceptors.Mutator{
|
|
Metadata: interceptors.Metadata{
|
|
Name: "passing-mutator",
|
|
Hook: interceptors.Hook{
|
|
Events: []string{"test/event"},
|
|
Phase: interceptors.PhaseResponse,
|
|
},
|
|
Mode: interceptors.ModeEnforce,
|
|
PriorityHint: interceptors.NewPriority(20),
|
|
},
|
|
Handler: func(_ context.Context, _ *interceptors.Invocation) (*interceptors.MutationResult, error) {
|
|
return &interceptors.MutationResult{Modified: false}, nil
|
|
},
|
|
}
|
|
|
|
ch := setupChainWithInterceptors(t, failOpenMutator, passingMutator)
|
|
|
|
payload, _ := json.Marshal(map[string]any{"value": "hello"})
|
|
cr, err := ch.Execute(context.Background(), &chain.ExecutionParams{
|
|
Event: "test/event",
|
|
Phase: interceptors.PhaseResponse,
|
|
Payload: payload,
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
// Chain should succeed — fail-open doesn't abort.
|
|
assert.Equal(t, chain.ChainSuccess, cr.Status)
|
|
assert.Empty(t, cr.AbortedAt)
|
|
|
|
// Both interceptors should have a result entry.
|
|
require.Len(t, cr.Results, 2)
|
|
})
|
|
}
|