Croway commented on code in PR #27812:
URL: https://github.com/apache/camel/pull/27812#discussion_r4269316282
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/AuthoringTools.java:
##########
@@ -37,13 +37,15 @@
/**
* The neutral Camel authoring tools shared with {@code camel tui --mcp}
(CAMEL-24695): thin MCP wrappers over the
* {@link ToolRegistry}, so an AI agent gets the same tools, names and answers
through either server. The logic lives in
- * camel-jbang-core ({@code AuthoringTools} there); these methods only carry
the MCP annotations the security
- * interceptor and access filter work on, and pass the arguments through.
+ * camel-jbang-core ({@code AuthoringTools} there); these methods only carry
the MCP annotations the access filter works
+ * on and pass the arguments through. The class is {@link McpSecured}, so
every call goes through the security
+ * interceptor (audit, argument sanitisation, secret redaction of the answer).
* <p>
* Writing a file is validated first and refused when the content is invalid,
but nobody is asked before the write: the
* MCP client (Claude Code, Cursor, and the others ask before a non read-only
tool runs) is where the human sits. The
* {@code read-only} access level hides the tools that write, run and control.
*/
+@McpSecured
Review Comment:
Fixed in cdfec1232a02, rejecting rather than exempting as you preferred: an
argument over `camel.mcp.security.max-argument-length` fails with a
`ToolCallException` naming the argument and the limit, for every secured tool,
so `camel_write_file`, `camel_edit_file` and `camel_validate_source` never get
cut content. Tests with security on cover a rejected write leaving the file
intact and an accepted write preserving every byte.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
