entropic::PermissionManager Class Reference

Permission manager for MCP tool access control. More...

#include <entropic/mcp/permission_manager.h>

Public Member Functions
	PermissionManager (std::vector< std::string > allow_patterns={}, std::vector< std::string > deny_patterns={})
	Construct with initial allow/deny lists.
bool	is_denied (const std::string &tool_name, const std::string &pattern) const
	Check if a tool call is explicitly denied.
bool	is_allowed (const std::string &tool_name, const std::string &pattern) const
	Check if a tool call is explicitly allowed (skip prompting).
void	add_permission (const std::string &pattern, bool allow)
	Add a permission pattern at runtime.

Detailed Description

Permission manager for MCP tool access control.

Default-deny model. Deny list takes precedence over allow list. Only returns false for is_denied() if a deny pattern explicitly matches. Unknown tools are not denied — the engine handles prompting for tools not in either list.

Version

1.8.5

Definition at line 34 of file permission_manager.h.

Constructor & Destructor Documentation

PermissionManager()

entropic::PermissionManager::PermissionManager	(	std::vector< std::string >	allow_patterns = {},
		std::vector< std::string >	deny_patterns = {}
	)

Construct with initial allow/deny lists.

Parameters

allow_patterns	Allow list patterns.
deny_patterns	Deny list patterns.

Version

1.8.5

Parameters

allow_patterns	Allow list patterns.
deny_patterns	Deny list patterns. @dg_internal

Version

1.8.5

Definition at line 24 of file permission_manager.cpp.

Member Function Documentation

add_permission()

void entropic::PermissionManager::add_permission	(	const std::string &	pattern,
		bool	allow
	)

Add a permission pattern at runtime.

Parameters

pattern	Permission pattern string.
allow	true for allow list, false for deny list.

Version

1.8.5

Backs the operator's "always allow / always deny" decision; the new pattern takes effect on the next call. Re-adding an identical pattern is a no-op so repeated approvals do not grow the list.

Parameters

pattern	Permission pattern string, at whatever granularity the owning server's get_permission_pattern chose.
allow	true to insert into the allow list, false for the deny list. @req REQ-MCP-009

Version

1.8.5

Definition at line 94 of file permission_manager.cpp.

is_allowed()

bool entropic::PermissionManager::is_allowed	(	const std::string &	tool_name,
		const std::string &	pattern
	)		const

Check if a tool call is explicitly allowed (skip prompting).

Check if a tool call is explicitly allowed.

Parameters

tool_name	Fully-qualified tool name.
pattern	Tool pattern with args.

Returns

true if explicitly in allow list.

Version

1.8.5

Parameters

tool_name	Fully-qualified tool name (<server>.<tool>).
pattern	The <tool>:<args-summary> pattern for this call.

Returns

true when any allow pattern matches (the match is logged); false otherwise. Callers must still honour is_denied(), which wins over any allow match. @req REQ-MCP-009

Version

2.0.0

Definition at line 67 of file permission_manager.cpp.

is_denied()

bool entropic::PermissionManager::is_denied	(	const std::string &	tool_name,
		const std::string &	pattern
	)		const

Check if a tool call is explicitly denied.

Parameters

tool_name	Fully-qualified tool name (e.g., "filesystem.read_file").
pattern	Tool pattern with args (e.g., "filesystem.read_file:/path").

Returns

true if denied.

Version

1.8.5

Consulted before the allow list, so deny takes precedence whenever both lists match the same call.

Parameters

tool_name	Fully-qualified tool name (<server>.<tool>).
pattern	The <tool>:<args-summary> pattern for this call.

Returns

true when any deny pattern matches (the match is logged); false when the deny list is empty or nothing matches. A false here is NOT an approval — the engine's callback still prompts. @req REQ-MCP-009

Version

2.0.0

Definition at line 44 of file permission_manager.cpp.

---

The documentation for this class was generated from the following files:

• entropic/mcp/permission_manager.h
• mcp/permission_manager.cpp