Tharga.Platform.Mcp 2.1.0

Tharga Platform Mcp

Platform bridge for Tharga.Mcp. Connects MCP tool and resource invocations to Tharga.Platform's authentication, scope enforcement, and audit logging.

What it does

• Populates IMcpContext from the authenticated HttpContext.User (works with both OIDC and API Key authentication)
• Enforces provider scope class: McpScope.System requires Roles.Developer, McpScope.Team requires team membership
• Emits audit log entries for every MCP tool invocation — success and failure
• Registers built-in mcp:* scopes in Platform's scope registry
• Requires authentication on the MCP endpoint — anonymous requests are rejected

Quick start

builder.Services.AddThargaMcp(mcp =>
{
    mcp.AddPlatform();        // bridge to Platform auth/scopes/audit
    // ... other provider packages (e.g. mcp.AddMongoDB())
});

app.UseThargaMcp();

User and team resources

Always-on resource providers that surface the authenticated caller's own data. Both providers self-gate on the principal's claims, so anonymous and system-only callers see no resources.

User scope (McpScope.User)

Listed when the principal carries a NameIdentifier (or equivalent) claim. Read fails with UnauthorizedAccessException if IUserService.GetCurrentUserAsync returns null.

Team scope (McpScope.Team)

Listed only when the principal carries a TeamKey claim. Read fails with UnauthorizedAccessException if no team is selected. Cross-tenant team listing (reading other teams) is intentionally not supported here — that's a future system-scope provider once ITeamService.GetAllTeamsAsync is added.

System-scope diagnostic resources (opt-in)

Expose read-only diagnostic data under platform://system/* for callers with the Developer role. Non-developers see no resources and get UnauthorizedAccessException on read.

builder.Services.AddThargaMcp(mcp =>
{
    mcp.AddPlatform(o =>
    {
        o.ExposeSystemResources = true;
    });
});

Available resources (listed only when the matching dependency is registered):

Per-team API-key listings now ship under platform://team/apikeys (see "Team scope" above). Cross-tenant team listings remain deferred — they require a new ITeamService.GetAllTeamsAsync method.

Related packages