Package edu.internet2.middleware.grouper.ws.mcp

Class GrouperMcpInstitutionalTools

java.lang.Object
edu.internet2.middleware.grouper.ws.mcp.GrouperMcpInstitutionalTools
public class GrouperMcpInstitutionalTools extends Object
MCP tool for discovering and executing institution-specific GSH templates that have been flagged as MCP-enabled. Supports two actions:
  • schema - list MCP-enabled templates the user can see, with their metadata, input definitions (including mcpScopeType for scope-validated inputs), whether they execute on groups/folders, and whether they are readonly or readwrite
  • execute - execute an MCP-enabled template, enforcing:
    • MCP readonly vs readwrite access (templates with mcpReadonly=true can be run by readonly MCP users; others require readwrite)
    • GSH template security (wheel, specifiedGroup, privilegeOnObject, everyone)
    • Input scope validation (inputs configured with mcpScopeType are validated against the user's approved readwrite folders/groups/subjects scopes)

Configuration in the GSH template wizard:

  • mcpEnabled - boolean, default false. Enables MCP for this template.
  • mcpReadonly - boolean, default false. If true, readonly MCP users can execute this template. Only shown when mcpEnabled is true.
  • input.N.mcpScopeType - dropdown (folders, groups, subjects). Restricts this input to approved readwrite scopes. Only shown when mcpEnabled is true and mcpReadonly is false.

  • Constructor Details

    • GrouperMcpInstitutionalTools

      public GrouperMcpInstitutionalTools()

  • Method Details

    • toolDefinition

      public static com.fasterxml.jackson.databind.node.ObjectNode toolDefinition(GrouperMcpAuthUser authUser, boolean hasReadwriteAccess)
      return the MCP tool definition for institutional_tools
      Parameters:
      authUser - the authenticated user (used to determine which tools are visible)
      hasReadwriteAccess - true if the user has MCP readwrite access
      Returns:
      the tool definition as a Jackson ObjectNode, or null if no institutional tools are available for this user (so the tool should not be advertised)

    • execute

      public static com.fasterxml.jackson.databind.node.ObjectNode execute(com.fasterxml.jackson.databind.JsonNode arguments, GrouperMcpAuthUser authUser, boolean hasReadwriteAccess)
      execute the institutional_tools tool
      Parameters:
      arguments - the tool arguments from the MCP request
      authUser - the authenticated user
      hasReadwriteAccess - true if the user has MCP readwrite access
      Returns:
      the MCP tool result