From 32669b2cc06ed832d8ac3bccea038510d0e49dda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20B=C3=B6hmer?= Date: Sat, 25 Jul 2026 21:35:27 +0200 Subject: [PATCH] Require authentication for accessing MCP tools --- config/packages/security.yaml | 3 +++ config/permissions.yaml | 5 +++++ translations/messages.en.xlf | 6 ++++++ 3 files changed, 14 insertions(+) diff --git a/config/packages/security.yaml b/config/packages/security.yaml index e7a44e0c..d9bf0400 100644 --- a/config/packages/security.yaml +++ b/config/packages/security.yaml @@ -73,3 +73,6 @@ security: - { path: "^/api", allow_if: 'is_granted("@api.access_api") and is_authenticated()' } # Restrict access to KICAD to users, which has API access permission - { path: "^/kicad-api", allow_if: 'is_granted("@api.access_api") and is_authenticated()' } + + # Restrict MCP access to users, which has the MCP access permission + - { path: "^/mcp", allow_if: 'is_granted("@api.use_mcp") and is_authenticated()' } diff --git a/config/permissions.yaml b/config/permissions.yaml index 39e91b57..704da880 100644 --- a/config/permissions.yaml +++ b/config/permissions.yaml @@ -381,7 +381,12 @@ perms: # Here comes a list with all Permission names (they have a perm_[name] co access_api: label: "perm.api.access_api" apiTokenRole: ROLE_API_READ_ONLY + use_mcp: + label: "perm.api.use_mcp" + alsoSet: [ 'access_api' ] + apiTokenRole: ROLE_API_READ_ONLY manage_tokens: label: "perm.api.manage_tokens" alsoSet: ['access_api'] apiTokenRole: ROLE_API_FULL + diff --git a/translations/messages.en.xlf b/translations/messages.en.xlf index 4d59c51a..0f0bae0e 100644 --- a/translations/messages.en.xlf +++ b/translations/messages.en.xlf @@ -13793,5 +13793,11 @@ Buerklin-API Authentication server: Warning: Changing values here can break the info retrieval mechanism! You should use the "update from info provider" functionality whenever possible. + + + perm.api.use_mcp + Use MCP tools (for AI agents) + +