Authorize MCP Skills extension requests

[JAORMX]

Summary

• Enable ToolHive's direct proxy to apply authorization policy to the accepted MCP SEP-2640 Skills extension, so newly introduced skill discovery does not become an ungoverned metadata-disclosure path.
• Map skills/get to Cedar Action::"get_skill" / Skill::<exact URI> and filter skills/list entries by that same permission.
• Reject ambiguous or malformed skill identifiers/results without forwarding unauthorized skill metadata; retain raw permitted extension fields and preserve independent resources/read authorization.
• Document policy semantics and add direct-middleware, JSON-RPC, SSE, Cedar, and HTTP-PDP regression coverage.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test) — attempted with TMPDIR="$PWD/.tmp" task test; the full race suite failed in unrelated existing tests: pkg/client.TestDetectProjectRoot, pkg/server/discovery.TestCheckHealth_UnixSocket_Success, and the 10-minute timeout in pkg/transport.TestBridge_ToolsListChanged_TriggersReSync.
• E2E tests (task test-e2e)
• Linting (TMPDIR="$PWD/.tmp" task lint-fix)
• Manual testing — reviewed the direct middleware paths for allowed/denied skills/get, skills/list response filtering, malformed/duplicate URI rejection, and SSE error substitution; automated regressions cover each path.

Changes

Area	Change
pkg/mcp, pkg/authz	Parse and authorize SEP-2640 Skill methods; filter skills lists safely.
Cedar / HTTP PDP authorizers	Add the skill feature and get_skill policy mapping.
Tests	Exercise JSON, SSE, duplicate-key, malformed-result, and policy paths.
docs/authz.md	Document policy and direct-proxy scope.

Does this introduce a user-facing change?

Yes. Operators can now write get_skill policies for direct-proxied MCP servers that negotiate SEP-2640. A skills/list response exposes only the skills the caller may get; reading its files still requires the existing resource-read permission.

Implementation plan

Approved implementation plan

1. Add a skill authorization feature and parse skills/get by its literal URI.
2. Map skills/get to an exact Cedar Skill entity and admission-check invalid/ambiguous identifiers before dispatch.
3. Forward skills/list but filter every entry through the same get_skill permission; fail closed on unsafe response shapes.
4. Preserve direct-proxy capability negotiation as transparent pass-through.
5. Add parser, middleware, policy, JSON-RPC, and SSE regression coverage; document the policy contract.

Deferred: vMCP aggregation/routing, content-integrity verification, consent records, host materialization, dynamic Skills, and resources/directory/read.

Special notes for reviewers

This deliberately implements only the direct-proxy authorization seam. ToolHive does not advertise, fabricate, or rewrite the Skills extension; client and backend capability negotiation remains end-to-end. The full unit suite currently has unrelated failures noted above.

[codecov]

Codecov Report

❌ Patch coverage is 83.87097% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.90%. Comparing base (b934b7c) to head (f3280e9).

Files with missing lines	Patch %	Lines
pkg/authz/middleware.go	81.25%	6 Missing ⚠️
pkg/authz/response_filter.go	82.35%	6 Missing ⚠️
pkg/authz/authorizers/cedar/core.go	88.88%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6512      +/-   ##
==========================================
- Coverage   78.92%   78.90%   -0.03%     
==========================================
  Files         781      781              
  Lines       77881    77969      +88     
==========================================
+ Hits        61467    61518      +51     
- Misses      16409    16446      +37     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

Reviewed with parallel MCP protocol, security, Go quality, and docs sync passes — all clean. One optional nit: authorizeGet in pkg/authz/authorizers/cedar/core.go has a dead case MCPFeatureTool, MCPFeatureResource: fallthrough above default that returns the same error either way; not blocking.

Fail-closed behavior for missing/duplicate/malformed skill URIs verified end-to-end, and the skills/get/skills/list shapes match the SEP-2640 reference spec.

[jhrozek]

Re-checked after the update — the one nit from my earlier review (dead fallthrough case in authorizeGet) is still present but non-blocking. Fail-closed behavior and skills/get, skills/list shapes look good.