[
https://issues.apache.org/jira/browse/CAMEL-24218?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino reassigned CAMEL-24218:
----------------------------------------
Assignee: Andrea Cosentino
> Camel JBang MCP Server - Add Security-First execution layer
> -----------------------------------------------------------
>
> Key: CAMEL-24218
> URL: https://issues.apache.org/jira/browse/CAMEL-24218
> Project: Camel
> Issue Type: Improvement
> Components: camel-jbang
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> The Camel JBang MCP Server currently exposes 63 tools without any permission
> model, audit trail, or input sanitization framework. Tools like
> camel_runtime_eval, camel_runtime_send, and camel_runtime_stop execute
> without authorization checks. This is a concern for production deployments.
> Scope:
> - Tool-level authorization: role-based or scope-based access control
> (read-only vs read-write vs admin)
> - Audit trail: structured logging of who invoked what tool, with what
> arguments, and the outcome
> - Input sanitization framework: centralized validation layer before tool
> execution
> - Secret redaction in responses: filter credentials, connection strings,
> tokens from tool outputs
> - Configuration: security policy configurable via properties file or
> environment variables
> - MCP tool annotations: set readOnlyHint/destructiveHint on all tools
> Location: dsl/camel-jbang/camel-jbang-mcp/
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
