oscerd opened a new pull request, #25020: URL: https://github.com/apache/camel/pull/25020
## Summary Adds an opt-in security execution layer for the Camel JBang MCP Server that provides: - **Tool-level authorization**: Three access levels (read-only / read-write / admin) derived from existing MCP tool annotations (`readOnlyHint`/`destructiveHint`) — no separate ACL needed - **Audit trail**: Structured JSON logging of tool invocations (who, what, when, outcome) via dedicated logger category `org.apache.camel.mcp.security.audit` - **Input sanitization**: Centralized validation (argument length limits, control character stripping) before tool execution - **Secret redaction**: Regex-based filtering of credentials, tokens, API keys, AWS keys, and connection strings from tool responses - **Configuration**: All features controlled via Quarkus `@ConfigProperty` with `camel.mcp.security.*` prefix ### Architecture Uses Quarkus MCP Server 1.13.1 guardrail/filter APIs as global CDI beans (no per-tool annotation changes): | Component | API | Purpose | |-----------|-----|---------| | `McpAccessFilter` | `ToolFilter` | Hides unauthorized tools from `tools/list` | | `McpAccessGuardrail` | `ToolInputGuardrail` | Enforces authorization + input sanitization | | `McpOutputGuardrail` | `ToolOutputGuardrail` | Redacts secrets from responses | | `McpSecurityConfig` | CDI Bean | Configuration holder | | `McpAuditLogger` | CDI Bean | Structured audit log formatter | | `McpSecretRedactor` | CDI Bean | Regex-based redaction engine | All features are **disabled by default** (`camel.mcp.security.enabled=false`) to preserve backward compatibility. ### Access Level Model | Level | Permits | Tool count | |-------|---------|-----------| | `read-only` | `readOnlyHint=true` only | 57 | | `read-write` | above + `destructiveHint=false` | 62 | | `admin` (default) | all tools | 65 | ## Test plan - [x] `McpSecurityConfigTest` — AccessLevel.permits() logic (9 combinations), defaults, custom patterns - [x] `McpAccessFilterTest` — Tool visibility at each access level - [x] `McpSecretRedactorTest` — All redaction patterns, false positives, null/empty input - [x] `McpAuditLoggerTest` — JSON escaping, logger instantiation - [x] `McpAccessGuardrailTest` — Input sanitization (control chars, null, empty) - [x] All 334 existing tests pass (no regressions) _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
