davsclaus commented on code in PR #27812:
URL: https://github.com/apache/camel/pull/27812#discussion_r4269068422
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/AuthoringTools.java:
##########
@@ -37,13 +37,15 @@
/**
* The neutral Camel authoring tools shared with {@code camel tui --mcp}
(CAMEL-24695): thin MCP wrappers over the
* {@link ToolRegistry}, so an AI agent gets the same tools, names and answers
through either server. The logic lives in
- * camel-jbang-core ({@code AuthoringTools} there); these methods only carry
the MCP annotations the security
- * interceptor and access filter work on, and pass the arguments through.
+ * camel-jbang-core ({@code AuthoringTools} there); these methods only carry
the MCP annotations the access filter works
+ * on and pass the arguments through. The class is {@link McpSecured}, so
every call goes through the security
+ * interceptor (audit, argument sanitisation, secret redaction of the answer).
* <p>
* Writing a file is validated first and refused when the content is invalid,
but nobody is asked before the write: the
* MCP client (Claude Code, Cursor, and the others ask before a non read-only
tool runs) is where the human sits. The
* {@code read-only} access level hides the tools that write, run and control.
*/
+@McpSecured
Review Comment:
With this annotation, `McpSecurityInterceptor.sanitizeParameters` now
applies to `camel_write_file(content)`, `camel_edit_file(find, replace)` and
`camel_validate_source(content)`, and it cuts any String over
`max-argument-length` (10000 by default) without saying so. For a tool that
writes to disk, that silently loses data. A `ToolCallException` naming the
argument and the limit would be safer than truncation, for these tools and for
the existing ones.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
