feat: add tool-level quarantine with rug pull detection#328
Merged
Conversation
Add tool-level quarantine storage layer: - ToolApprovalRecord model with status (pending/approved/changed), hash tracking, and description diff fields - BBolt CRUD operations: Save, Get, List (by server), Delete, DeleteAll - Storage Manager wrapper methods with proper locking - Comprehensive tests covering roundtrips, filtering, status transitions
- Config.QuarantineEnabled (*bool): defaults to true when nil (secure by default), explicit false disables tool-level quarantine globally - ServerConfig.SkipQuarantine (bool): per-server opt-out from tool-level quarantine while still tracking hashes - Helper methods: IsQuarantineEnabled() and IsQuarantineSkipped() - Tests for default values, explicit overrides, and JSON serialization
Core tool quarantine engine: - calculateToolApprovalHash: stable SHA-256 hash of tool name, description, and schema for rug-pull detection - checkToolApprovals: checks discovered tools against stored approval records, creates pending records for new tools, detects changes - ApproveTools/ApproveAllTools: approve pending/changed tools - Integration into applyDifferentialToolUpdate: blocked tools are filtered from indexing and removed from index if previously indexed - Respects quarantine_enabled (global) and skip_quarantine (per-server) config flags -- hashes are always tracked even when not enforcing - Activity events emitted for tool discovery, changes, and approvals - Existing tool invalidation tests updated to disable quarantine
In handleCallToolVariant, after server-level quarantine check: - Look up ToolApprovalRecord for the requested tool - If status is "pending": block with structured JSON explaining it is a new unapproved tool, include description and approval instructions - If status is "changed": block with previous/current descriptions showing what changed, include approval instructions - Respects quarantine_enabled and skip_quarantine config flags - Emits activity policy decision events for blocked calls
- New ActivityTypeToolQuarantineChange activity type for tool-level quarantine state changes (discovered, changed, approved) - handleToolQuarantineChange handler in ActivityService persists tool quarantine events with full metadata (descriptions, hashes) - Added to ValidActivityTypes for filter support
Add ServerController interface methods for tool-level quarantine:
- ListToolApprovals, ApproveTools, ApproveAllTools, GetToolApproval
Add REST API routes under /api/v1/servers/{id}/:
- POST /tools/approve - approve specific tools or all tools
- GET /tools/{tool}/diff - view description/schema changes
- GET /tools/export - export tool descriptions (JSON or text)
Add Runtime delegation methods and mock controller stubs.
Add 11 handler tests covering all endpoints and error paths.
Add 'mcpproxy upstream inspect <server>' to view tool approval status with table/JSON/YAML output and --tool flag for detailed diff view. Add 'mcpproxy upstream approve <server> [tools...]' to approve pending or changed tools, with approve-all when no tool names given. Add cliclient methods: GetToolApprovals, GetToolDiff, ApproveTools. Add Server delegation methods for ServerController interface.
Add ToolApproval type and API methods (getToolApprovals, getToolDiff, approveTools) to frontend services. Add quarantine panel in ServerDetail Tools tab showing pending/changed tools with approve individual/all buttons and inline diff view for changed tool descriptions.
Add inspect_tools, approve_tool, and approve_all_tools operations to the quarantine_security MCP tool, enabling AI agents to inspect tool approval status and approve individual or all pending/changed tools via the MCP protocol.
SkipQuarantine is a runtime-only config field (Spec 032) that does not need BBolt persistence. Add it to the SaveServerSync field coverage test's exclusion list alongside Shared.
Add tool-level quarantine to Security Model, CLI commands, Built-in Tools, HTTP API endpoints, and Key Implementation Details sections.
Prevents orphaned ToolApprovalRecords from accumulating in the tool_approvals BBolt bucket when an upstream server is deleted. Follows the same pattern as ClearOAuthState cleanup.
Deploying mcpproxy-docs with
|
| Latest commit: |
f00c04a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://eae4b6de.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://032-tool-quarantine.mcpproxy-docs.pages.dev |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 22897566983 --repo smart-mcp-proxy/mcpproxy-go
|
- Convert if/else chain to switch statement in handleInspectToolApprovals to fix staticcheck QF1003 lint error - Disable tool-level quarantine in E2E test environment since existing tests don't test this feature (quarantine-specific tests have their own setup). Without this, new tools from mock servers were blocked as "pending" approval, causing 4 E2E test failures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ToolApprovalRecordmodel with state machine: pending -> approved -> changed -> approvedmcpproxy upstream inspect <server>andmcpproxy upstream approve <server>quarantine_securitywithinspect_tools,approve_tool,approve_all_toolsoperationsquarantine_enabled(global, default true) andskip_quarantine(per-server)Test plan
-race