Apparitor - FastMCPAuthorizationMiddleware: authorize tools/call before they run, via AuthZEN #4330
jhawlwut
started this conversation in
Show and tell
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I built a FastMCP middleware that handles authorization on tool calls. Before a tools/call (or resources/read, prompts/get) runs, it checks whether the user is actually allowed to do it against a policy engine. It talks AuthZEN so you can point it at whatever you already run... OpenFGA, Cedar, OPA.
It takes the subject from the validated OAuth sub, so you add it after your auth middleware. If anything fails it denies by default.
Repo: https://github.com/jhawlwut/apparitor (Apache-2.0, still early and hoping you'll help test it).
All reactions