Andrea Cosentino created CAMEL-24218:
----------------------------------------
Summary: Camel JBang MCP Server - Add Security-First execution
layer
Key: CAMEL-24218
URL: https://issues.apache.org/jira/browse/CAMEL-24218
Project: Camel
Issue Type: Improvement
Components: camel-jbang
Reporter: Andrea Cosentino
The Camel JBang MCP Server currently exposes 63 tools without any permission
model, audit trail, or input sanitization framework. Tools like
camel_runtime_eval, camel_runtime_send, and camel_runtime_stop execute without
authorization checks. This is a concern for production deployments.
Scope:
- Tool-level authorization: role-based or scope-based access control (read-only
vs read-write vs admin)
- Audit trail: structured logging of who invoked what tool, with what
arguments, and the outcome
- Input sanitization framework: centralized validation layer before tool
execution
- Secret redaction in responses: filter credentials, connection strings, tokens
from tool outputs
- Configuration: security policy configurable via properties file or
environment variables
- MCP tool annotations: set readOnlyHint/destructiveHint on all tools
Location: dsl/camel-jbang/camel-jbang-mcp/
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
