Support for Authorize attribute on tool class and functions #672
Description
In .NET APIs, often in combination with OAuth/Token authentication it is custom to mail claims to roles, and perform role based authentication in the solution. For example the below controller:
- Authorize with (optional) roles attribute on class level
- Authorize with (optional) roles attribute on function level
namespace OfficeConnect.Api
{
[ApiController]
[Route("api/[controller]")]
[Authorize(Roles = "Dossier.Read")]
public class DossierController : ControllerBase
{
private readonly ILogger<DossierController> _logger;
private readonly DossierHandler _dossierHandler;
public DossierController(ILogger<DossierController> logger, DossierHandler dossierHandler)
...
[HttpGet]
...
[HttpPost]
[Authorize(Roles = "Dossier.Write")]
....
}
}
It would be nice and ver .NET alike to have this also on the level of MCP tool type definition in a similar way so that roles are automatically validated, but, also for example the "list" adjusts it's content depending on the provided authentication token. In combination with OAuth this significantly reduces the implementation time for secure MCP severs and uses well known techniques for .NET developers.
namespace OfficeConnect.Api.Tools
{
[McpServerToolType]
[Authorize(Roles = "Dossier.Read")]
public class DossierTool
{
private readonly ILogger<DossierTool> _logger;
private readonly DossierHandler _dossierClient;
public DossierTool(ILogger<DossierTool> logger, DossierHandler dossierClient)
...
// We are returning the HashcodeInfo object directly, which gets serialized to json automatically. The LLM is able to understand this object well
[McpServerTool, Description("Get dossier summary by hash code")]
...
[McpServerTool, Description("Create new dossier")]
[Authorize(Roles = "Dossier.Write")]
...
}
}