Spaces:
Running
Running
tommitt commited on
Upgrade Eunomia authorization docs (#1144)
Browse files
docs/integrations/eunomia-authorization.mdx
CHANGED
|
@@ -6,13 +6,36 @@ icon: shield-check
|
|
| 6 |
tag: NEW
|
| 7 |
---
|
| 8 |
|
| 9 |
-
Add **policy-based authorization** to your FastMCP servers with
|
| 10 |
|
| 11 |
-
Control which
|
| 12 |
|
| 13 |
-
##
|
| 14 |
|
| 15 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 16 |
|
| 17 |
```mermaid
|
| 18 |
sequenceDiagram
|
|
@@ -21,15 +44,17 @@ sequenceDiagram
|
|
| 21 |
participant MCPServer as FastMCP Server
|
| 22 |
participant EunomiaServer as Eunomia Server
|
| 23 |
|
| 24 |
-
MCPClient->>EunomiaMiddleware: MCP Request
|
| 25 |
-
Note over MCPClient, EunomiaMiddleware: Middleware intercepts request to server
|
| 26 |
EunomiaMiddleware->>EunomiaServer: Authorization Check
|
| 27 |
-
EunomiaServer->>EunomiaMiddleware: Authorization Decision
|
| 28 |
EunomiaMiddleware-->>MCPClient: MCP Unauthorized Error (if denied)
|
| 29 |
-
EunomiaMiddleware->>MCPServer: MCP Request (if allowed)
|
| 30 |
-
MCPServer-->>
|
|
|
|
| 31 |
```
|
| 32 |
|
|
|
|
|
|
|
| 33 |
<Note>
|
| 34 |
Eunomia is an AI-specific standalone authorization server that handles policy decisions. You must have an Eunomia server running alongside your FastMCP server for the middleware to function.
|
| 35 |
|
|
@@ -49,11 +74,11 @@ First, install the `eunomia-mcp` package:
|
|
| 49 |
pip install eunomia-mcp
|
| 50 |
```
|
| 51 |
|
| 52 |
-
Then create a FastMCP server and add the Eunomia middleware
|
| 53 |
|
| 54 |
```python server.py
|
| 55 |
from fastmcp import FastMCP
|
| 56 |
-
from eunomia_mcp import
|
| 57 |
|
| 58 |
mcp = FastMCP("Secure FastMCP Server 🔒")
|
| 59 |
|
|
@@ -62,12 +87,11 @@ def add(a: int, b: int) -> int:
|
|
| 62 |
"""Add two numbers"""
|
| 63 |
return a + b
|
| 64 |
|
| 65 |
-
middleware =
|
| 66 |
-
app = mcp.
|
| 67 |
|
| 68 |
if __name__ == "__main__":
|
| 69 |
-
|
| 70 |
-
uvicorn.run(app, host="0.0.0.0", port=8080)
|
| 71 |
```
|
| 72 |
|
| 73 |
### Configure Access Policies
|
|
@@ -97,12 +121,14 @@ Start your FastMCP server normally:
|
|
| 97 |
python server.py
|
| 98 |
```
|
| 99 |
|
| 100 |
-
The middleware will now intercept all MCP requests and check them against your policies. Requests include agent identification through headers like `X-Agent-ID`, `X-User-ID`, or `Authorization` and an automatic mapping of MCP methods to authorization resources and actions.
|
| 101 |
|
| 102 |
<Tip>
|
| 103 |
For detailed policy configuration, custom authentication, and advanced
|
| 104 |
deployment patterns, visit the [Eunomia MCP Middleware
|
| 105 |
-
repository][eunomia-github].
|
| 106 |
</Tip>
|
| 107 |
|
| 108 |
-
[eunomia-github]: https://github.com/whataboutyou-ai/eunomia
|
|
|
|
|
|
|
|
|
| 6 |
tag: NEW
|
| 7 |
---
|
| 8 |
|
| 9 |
+
Add **policy-based authorization** to your FastMCP servers with one-line code addition with the **[Eunomia][eunomia-github] authorization middleware**.
|
| 10 |
|
| 11 |
+
Control which tools, resources and prompts MCP clients can view and execute on your server. Define dynamic JSON-based policies and obtain a comprehensive audit log of all access attempts and violations.
|
| 12 |
|
| 13 |
+
## How it Works
|
| 14 |
|
| 15 |
+
Exploiting FastMCP's [Middleware][fastmcp-middleare], the Eunomia middleware intercepts all MCP requests to your server and, then, automatically maps MCP methods to authorization checks.
|
| 16 |
+
|
| 17 |
+
### Listing Operations
|
| 18 |
+
|
| 19 |
+
The middleware behaves as a filter for listing operations (`tools/list`, `resources/list`, `prompts/list`), hiding to the client components that are not authorized by the defined policies.
|
| 20 |
+
|
| 21 |
+
```mermaid
|
| 22 |
+
sequenceDiagram
|
| 23 |
+
participant MCPClient as MCP Client
|
| 24 |
+
participant EunomiaMiddleware as Eunomia Middleware
|
| 25 |
+
participant MCPServer as FastMCP Server
|
| 26 |
+
participant EunomiaServer as Eunomia Server
|
| 27 |
+
|
| 28 |
+
MCPClient->>EunomiaMiddleware: MCP Listing Request (e.g., tools/list)
|
| 29 |
+
EunomiaMiddleware->>MCPServer: MCP Listing Request
|
| 30 |
+
MCPServer-->>EunomiaMiddleware: MCP Listing Response
|
| 31 |
+
EunomiaMiddleware->>EunomiaServer: Authorization Checks
|
| 32 |
+
EunomiaServer->>EunomiaMiddleware: Authorization Decisions
|
| 33 |
+
EunomiaMiddleware-->>MCPClient: Filtered MCP Listing Response
|
| 34 |
+
```
|
| 35 |
+
|
| 36 |
+
### Execution Operations
|
| 37 |
+
|
| 38 |
+
The middleware behaves as a firewall for execution operations (`tools/call`, `resources/read`, `prompts/get`), blocking operations that are not authorized by the defined policies.
|
| 39 |
|
| 40 |
```mermaid
|
| 41 |
sequenceDiagram
|
|
|
|
| 44 |
participant MCPServer as FastMCP Server
|
| 45 |
participant EunomiaServer as Eunomia Server
|
| 46 |
|
| 47 |
+
MCPClient->>EunomiaMiddleware: MCP Execution Request (e.g., tools/call)
|
|
|
|
| 48 |
EunomiaMiddleware->>EunomiaServer: Authorization Check
|
| 49 |
+
EunomiaServer->>EunomiaMiddleware: Authorization Decision
|
| 50 |
EunomiaMiddleware-->>MCPClient: MCP Unauthorized Error (if denied)
|
| 51 |
+
EunomiaMiddleware->>MCPServer: MCP Execution Request (if allowed)
|
| 52 |
+
MCPServer-->>EunomiaMiddleware: MCP Execution Response (if allowed)
|
| 53 |
+
EunomiaMiddleware-->>MCPClient: MCP Execution Response (if allowed)
|
| 54 |
```
|
| 55 |
|
| 56 |
+
## Add Authorization to Your Server
|
| 57 |
+
|
| 58 |
<Note>
|
| 59 |
Eunomia is an AI-specific standalone authorization server that handles policy decisions. You must have an Eunomia server running alongside your FastMCP server for the middleware to function.
|
| 60 |
|
|
|
|
| 74 |
pip install eunomia-mcp
|
| 75 |
```
|
| 76 |
|
| 77 |
+
Then create a FastMCP server and add the Eunomia middleware in one line:
|
| 78 |
|
| 79 |
```python server.py
|
| 80 |
from fastmcp import FastMCP
|
| 81 |
+
from eunomia_mcp import EunomiaMcpMiddleware
|
| 82 |
|
| 83 |
mcp = FastMCP("Secure FastMCP Server 🔒")
|
| 84 |
|
|
|
|
| 87 |
"""Add two numbers"""
|
| 88 |
return a + b
|
| 89 |
|
| 90 |
+
middleware = EunomiaMcpMiddleware()
|
| 91 |
+
app = mcp.add_middleware(middleware)
|
| 92 |
|
| 93 |
if __name__ == "__main__":
|
| 94 |
+
mcp.run()
|
|
|
|
| 95 |
```
|
| 96 |
|
| 97 |
### Configure Access Policies
|
|
|
|
| 121 |
python server.py
|
| 122 |
```
|
| 123 |
|
| 124 |
+
The middleware will now intercept all MCP requests and check them against your policies. Requests include agent identification through headers like `X-Agent-ID`, `X-User-ID`, `User-Agent`, or `Authorization` and an automatic mapping of MCP methods to authorization resources and actions.
|
| 125 |
|
| 126 |
<Tip>
|
| 127 |
For detailed policy configuration, custom authentication, and advanced
|
| 128 |
deployment patterns, visit the [Eunomia MCP Middleware
|
| 129 |
+
repository][eunomia-mcp-github].
|
| 130 |
</Tip>
|
| 131 |
|
| 132 |
+
[eunomia-github]: https://github.com/whataboutyou-ai/eunomia
|
| 133 |
+
[eunomia-mcp-github]: https://github.com/whataboutyou-ai/eunomia/tree/main/pkgs/extensions/mcp
|
| 134 |
+
[fastmcp-middleare]: /servers/middleware
|