Croway opened a new pull request, #27812: URL: https://github.com/apache/camel/pull/27812
Fixes https://issues.apache.org/jira/browse/CAMEL-25641 `McpSecurityInterceptor` is bound by the `@McpSecured` interceptor binding, so a tool class without the annotation silently skips the audit log, argument sanitisation and secret redaction when `camel.mcp.security.enabled=true`. Six classes lacked it (21 tools, among them `camel_get_errors`, `camel_get_log`, `camel_write_file`, `camel_run` and `camel_control`): `AuthoringTools`, `AiTraceTools`, `AiPipelineScaffoldTools`, `DependencySecurityAuditTools`, `RouteCostEstimateTools`, `SecurityScanTools`. - `@McpSecured` on the six classes; the `AuthoringTools` javadoc now says what the annotation does for it. - `McpSecuredToolClassesTest` scans the compiled package for every class with a `@Tool` method and fails if one is missing the annotation, so the next tool class cannot skip it. Removing the annotation from one class makes it fail. Tests: `McpSecur*` in camel-jbang-mcp (17 tests). _Claude Code on behalf of Croway_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
