MCP KDL: add upstream MCP proxy grants for guarded passthroughs #228

Merged

coilyco-ops merged 1 commit from issue-214 into main

2026-07-14 09:17:38 +00:00

coilyco-ops commented

2026-07-14 09:16:06 +00:00

Member

What changed: added proxy descriptors, inline KDL parsing, guard-rule validation, tests, and dedicated proxy docs.
Why: ward-mcp needs a guarded passthrough surface with deny-by-absence and preserved upstream schemas.
Checks: pre-commit run --all-files passed. go test ./http/opcore ./http/guardfile passed. Full make test hit unrelated environment-sensitive failures outside the touched package.

closes #214
ward.workflow: pull-request-and-merge

This adds an inline MCP proxy grant shape to opcore so ward-mcp can expose a small allowlisted subset of upstream Playwright tools without growing a semantic Grubhub layer. The parser now carries the exact upstream tool mapping plus request and response guard clauses, and the docs and feature inventory call out the new frozen grammar. - What changed: added proxy descriptors, inline KDL parsing, guard-rule validation, tests, and dedicated proxy docs. - Why: ward-mcp needs a guarded passthrough surface with deny-by-absence and preserved upstream schemas. - Checks: `pre-commit run --all-files` passed. `go test ./http/opcore ./http/guardfile` passed. Full `make test` hit unrelated environment-sensitive failures outside the touched package. closes #214 ward.workflow: pull-request-and-merge

coilyco-ops added 1 commit

2026-07-14 09:16:06 +00:00