policy

Documentation

Overview

Package policy is the curation layer (L4): it decides which operations are safe and appropriate to expose as MCP tools. This is api2mcp's core value — not converting an API, but exposing a deliberately small, safe slice of it.

The default posture is conservative: with ReadOnly enabled, only side-effect free operations survive, so an LLM cannot POST/PUT/DELETE against your API unless you explicitly opt in.

Index

• type Matcher
  • func Custom(fn func(ir.Operation) bool) Matcher
  • func Method(verb string) Matcher
  • func OperationID(id string) Matcher
  • func PathGlob(glob string) Matcher
  • func Tag(tag string) Matcher
• type Policy
  • func (p Policy) Apply(ops []ir.Operation) []ir.Operation

Types

type Matcher

type Matcher func(ir.Operation) bool

Matcher reports whether an operation matches some criterion.

func Custom

func Custom(fn func(ir.Operation) bool) Matcher

Custom wraps an arbitrary predicate as a Matcher.

func Method

func Method(verb string) Matcher

Method matches operations using the given HTTP verb (case-insensitive).

func OperationID

func OperationID(id string) Matcher

OperationID matches an operation by its exact id.

func PathGlob

func PathGlob(glob string) Matcher

PathGlob matches operations whose path matches a shell glob (e.g. "/admin/*"). As a convenience, a trailing "/*" matches recursively, so "/admin/*" matches both "/admin/users" and "/admin/users/{id}". An invalid pattern never matches.

func Tag

func Tag(tag string) Matcher

Tag matches operations carrying the given tag.

type Policy

type Policy struct {
	Includes []Matcher
	Excludes []Matcher
	ReadOnly bool
}

Policy is an ordered set of include/exclude matchers plus a read-only switch.

Filtering semantics, applied per operation:

1. if ReadOnly is set and the op is not read-only, drop it;
2. if any Include matchers exist, the op must match at least one, else drop;
3. if the op matches any Exclude matcher, drop it.

func (Policy) Apply

func (p Policy) Apply(ops []ir.Operation) []ir.Operation

Apply returns the subset of ops permitted by the policy, preserving order.