Files
OmniRoute/src/app/api/mcp/tools/route.ts
Bob.Hou dea5345397 fix(mcp): honor the mcp:connect carve-out in transport route guards (#11139)
Validated on the combined batch board over tip 17897cc3: gates clean (changelog, file-size 159 frozen, complexity 2628<=2774, cognitive 1184<=1223, dead-code 409<=416, provider-consistency 267/350/0), typecheck:core clean, 83/83 PR suites + neighbors green (mcp-route-scope-carveout 15 tests with bug-injection proof, management-auth-hardening per-route call-shape pinning). The route layer now honors the #9159 mcp:connect carve-out exactly like the policy layer — audit/audit-stats deliberately stay manage-only, oma_ tokens still require admin. Thank you @HouMinXi!
2026-08-23 02:18:06 -03:00

26 lines
956 B
TypeScript

import { NextResponse } from "next/server";
import { MCP_TOOLS, MCP_TOOL_MAP } from "@omniroute/open-sse/mcp-server/schemas/tools";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
export async function GET(request: Request) {
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
try {
return NextResponse.json({
total: MCP_TOOLS.length,
mappedTotal: Object.keys(MCP_TOOL_MAP).length,
tools: MCP_TOOLS.map((tool) => ({
name: tool.name,
description: tool.description,
scopes: [...tool.scopes],
phase: tool.phase,
auditLevel: tool.auditLevel,
sourceEndpoints: [...tool.sourceEndpoints],
})),
});
} catch (error) {
const message = error instanceof Error ? error.message : "Failed to load MCP tools";
return NextResponse.json({ error: message }, { status: 500 });
}
}