Package burp.mcp.util

Class PermissionManager

java.lang.Object
burp.mcp.util.PermissionManager
public class PermissionManager extends Object
Middleware permission manager for MCP tool access control. Four operating modes: READ_ONLY — only tools that don't modify state (query, list, parse, decode) READ_WRITE — all tools allowed (default) PROMPT — read tools allowed, write tools require operator approval CUSTOM — per-tool policy: ALLOW, PROMPT or DENY Sensitivity gate: when blockSensitive is true, tools tagged as sensitive are denied regardless of mode (a hard deny that never prompts).

  • Constructor Details

    • PermissionManager

      public PermissionManager()

  • Method Details

    • getLevel

      public PermissionManager.Level getLevel()

    • setLevel

      public void setLevel(PermissionManager.Level level)

    • isBlockSensitive

      public boolean isBlockSensitive()

    • setBlockSensitive

      public void setBlockSensitive(boolean block)

    • setToolPolicy

      public void setToolPolicy(String toolName, PermissionManager.Policy policy)
      Set the explicit policy for a tool in CUSTOM mode.

    • getToolPolicy

      public PermissionManager.Policy getToolPolicy(String toolName)
      Explicit policy for a tool in CUSTOM mode; unset defaults to ALLOW.

    • setToolPolicies

      public void setToolPolicies(Map<String,PermissionManager.Policy> policies)
      Replace the full per-tool policy map (for bulk import / Apply).

    • getToolPolicies

      public Map<String,PermissionManager.Policy> getToolPolicies()
      Snapshot of the explicitly configured per-tool policies.

    • enableTool

      public void enableTool(String toolName)
      Enable a tool in CUSTOM mode (policy ALLOW).

    • disableTool

      public void disableTool(String toolName)
      Disable a tool in CUSTOM mode (policy DENY).

    • isToolEnabled

      public boolean isToolEnabled(String toolName)
      Check if a tool is not explicitly denied in CUSTOM mode.

    • setEnabledTools

      public void setEnabledTools(Set<String> tools)
      Set the full set of allowed tools (others keep their default ALLOW).

    • setDisabledTools

      public void setDisabledTools(Set<String> tools)
      Set the full set of denied tools.

    • getEnabledTools

      public Set<String> getEnabledTools()

    • getDisabledTools

      public Set<String> getDisabledTools()

    • getPromptTools

      public Set<String> getPromptTools()

    • evaluate

      public PermissionManager.Access evaluate(String toolName)
      Evaluate the policy for a tool call. The returned PermissionManager.Access is never null: it is ALLOW, PROMPT or DENY.

    • isReadTool

      public static boolean isReadTool(String toolName)

    • isSensitive

      public static boolean isSensitive(String toolName)

    • getReadTools

      public static Set<String> getReadTools()

    • getSensitiveTools

      public static Set<String> getSensitiveTools()