oscerd opened a new pull request, #25046: URL: https://github.com/apache/camel/pull/25046
## Summary Adds a Security-First execution layer to the Camel JBang MCP Server via a CDI interceptor, covering: - **Access control**: role-based tool access (readonly / readwrite / admin) based on existing `@Tool.Annotations` hints - **Audit logging**: structured logging of all tool invocations (caller, args, outcome, duration) to `camel.mcp.audit` category - **Output sanitization**: redacts passwords, tokens, AWS access keys, and bearer tokens from `JsonObject` tool responses - **Configuration**: all settings exposed via standard Quarkus/MicroProfile Config properties ### New classes | Class | Purpose | |-------|---------| | `McpAccessLevel` | Enum defining three access levels with tool-allow logic | | `McpSecured` | CDI `@InterceptorBinding` annotation | | `McpSecurityInterceptor` | Enforces access policy, logs audit trail, redacts secrets | | `McpSecurityConfig` | Quarkus config properties (`@ConfigProperty`) | | `McpAuditLog` | Structured audit logging service | | `OutputSanitizer` | Pattern-based secret redaction for tool output | ### Configuration properties | Property | Default | Description | |----------|---------|-------------| | `camel.mcp.security.access-level` | `admin` | `readonly`, `readwrite`, or `admin` | | `camel.mcp.security.audit.enabled` | `false` | Log every tool invocation | | `camel.mcp.security.redact-secrets` | `true` | Redact credentials in output | All 19 tool classes annotated with `@McpSecured`. ## Test plan - [x] `McpAccessLevelTest` — parsing, tool-allow logic for all three levels - [x] `OutputSanitizerTest` — JSON key redaction, bearer tokens, AWS keys, generic patterns, null safety - [x] All 323 existing MCP server tests pass (no regressions) _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
