MCP authorization
Attach to:
The MCP authorization Authorization (AuthZ) The process of determining what actions an authenticated user or service is allowed to perform. Agentgateway supports HTTP authorization, MCP authorization, and external authorization services. policy works similarly to HTTP authorization, but runs in the context of an MCP request.
Note
Instead of running against an HTTP request, MCP authorization policies run against specific MCP method invocations such as list_tools and call_tools.
If a tool or other resource is not allowed, the gateway automatically filters it from the list response.
mcpAuthorization:
rules:
# Allow anyone to call 'echo'
- 'mcp.tool.name == "echo"'
# Only the test-user can call 'add'
- 'jwt.sub == "test-user" && mcp.tool.name == "add"'
# Any authenticated user with the claim `nested.key == value` can access 'printEnv'
- 'mcp.tool.name == "printEnv" && jwt.nested.key == "value"'CEL variables
The following MCP-specific CEL variables are available in authorization rules:
| Variable | Type | Availability | Description |
|---|---|---|---|
mcp.tool.name | string | Request-time | The name of the tool being called. |
mcp.tool.target | string | Request-time | The target backend handling the tool call. |
mcp.tool.arguments | map | Request-time | The JSON arguments passed to the tool call. |
mcp.tool.result | any | Post-request | The tool call result payload (access logs only). |
mcp.tool.error | any | Post-request | The tool call error payload (access logs only). |
mcp.prompt.name | string | Request-time | The name of the prompt being accessed. |
mcp.resource.name | string | Request-time | The name of the resource being accessed. |
mcp.methodName | string | Post-request | The MCP JSON-RPC method name, such as tools/call. |
mcp.sessionId | string | Post-request | The MCP session ID. |
Request-time variables are available during authorization and can be used in mcpAuthorization rules. Post-request variables are available in access log CEL expressions.
Authorize based on tool arguments
You can use tool arguments in authorization rules to enforce fine-grained access control. For example, restrict which URLs a fetch tool can access:
mcpAuthorization:
rules:
- 'mcp.tool.name == "fetch" && mcp.tool.arguments.url.startsWith("https://internal.")'Refer to the CEL reference for additional variables.
