Class: Karst::Mcp::VerifyAccessTool

Inherits:
MCP::Tool
  • Object
show all
Defined in:
lib/karst/mcp/verify_access_tool.rb

Overview

The one MCP tool Karst exposes: a thin transport adapter over Karst::CLI::Verification#evidence, itself a thin adapter over Access::Search. This class owns no verification behavior of its own -- it only shapes one MCP request into a Verification call and returns exactly the evidence document bin/rails karst:verify --json would print, so an agent calling this tool sees the same bounded runtime evidence a developer sees at the terminal, never a separate MCP result model.

Every safety boundary an agent might reach for -- which principal to run as, which population to try, whether to skip rollback, how many requests to issue -- is owned by the host application's Karst configuration and Access::Search itself; nothing about that is settable here. The only inputs are the request an agent is allowed to make: which path, and which HTTP method (GET only, currently).

Class Method Summary collapse

Class Method Details

.call(path:, method: "GET", server_context: nil) ⇒ Object

server_context is part of MCP::Tool's call signature (the server passes it by keyword whenever a tool's #call accepts it) but this tool needs no per-request context beyond its own arguments. rubocop:disable Lint/UnusedMethodArgument



60
61
62
63
 
# File 'lib/karst/mcp/verify_access_tool.rb', line 60

def call(path:, method: "GET", server_context: nil)
  document = ::Karst::CLI::Verification.new(path: path, http_method: method).evidence
  MCP::Tool::Response.new([{ type: "text", text: JSON.generate(document) }], error: document.key?(:error))
end