authorize MCP tool calls with Lelu

[lelu-auth]

MCP's biggest gap is authorization. Add an examples/mcp/ showing an MCP server that runs each tool call through Lelu before executing, returning allow/deny/human_review.
Pointers: examples/agentgateway/ (ext_authz pattern), engine mcpauth. Acceptance: runnable MCP example + README. Good for: 🔌 MCP builders.

[hummbl-dev]

For the MCP example, I would make the acceptance criteria prove both enforcement and replay safety.

A useful contract for each tools/call check:

server_id
tool_name
canonical_args_digest
actor / session
policy_version
decision: allow | deny | human_review
reason_code
approval_ref
expires_at
executed: true | false
terminal_outcome_ref

Then the example can show three paths clearly:

1. allowed read tool executes and records an allow decision;
2. denied write tool returns a typed non-execution result and never calls the underlying handler;
3. human_review pauses, resumes only if the approval matches the same tool name + args digest + session, and fails closed on timeout or changed args.

That would make the README more than an integration demo. It would give MCP builders a small conformance target for the boundary they actually need: every tool call goes through policy before execution, and an approval cannot be replayed onto a different call.

[lelu-auth]

This is excellent — adopting it. The replay-safety point is the part most integration demos get wrong, and it's exactly the boundary this example should prove. An approval must be a capability for one specific call, not a green light for whatever the agent does next.

Updating the acceptance criteria for this issue to your three paths:

1. ✅ allow — read tool executes, decision recorded with the full contract fields;
2. ⛔ deny — write tool returns a typed non-execution result; the underlying handler is provably never invoked;
3. 🙋 human_review — call pauses; resumes only if the approval matches the same tool_name + canonical_args_digest + actor/session; fails closed on expires_at timeout or changed args.

A few implementation pointers for whoever picks this up (interested? it's yours — happy to review):

• Where it lives: examples/mcp/ — an MCP proxy that wraps any downstream MCP server and gates every tools/call before forwarding. Important distinction from sdk/mcp (lelu-mcp): that package is advisory — it exposes lelu_agent_authorize as a tool the agent may choose to call. This example is enforcement — the agent gets no vote.
• Interception pattern: examples/agentgateway/ shows the ext-authz shape (decision point outside the execution path); the engine also has engine/internal/mcpauth/ for the MCP OAuth side.
• canonical_args_digest: suggest JCS (RFC 8785) canonicalization of the args object, then SHA-256. Key-order-insensitive, so semantically identical calls hash the same, and any semantic change breaks the digest — which is what makes the replay check honest.
• human_review resume: the engine's review queue returns a requestId — that maps to your approval_ref. The proxy should re-verify digest + session on resume rather than trusting the approval blob, so a stale or re-targeted approval fails closed.
• executed / terminal_outcome_ref: worth writing both to the audit log even on the deny path — "decision made but nothing ran" is an auditable fact, and it's what makes the three paths verifiable in the demo output rather than just claimed in the README.

Agreed on the framing too: the README should read as a small conformance target for MCP builders — "every tool call goes through policy before execution, and an approval cannot be replayed onto a different call" — with the three paths as runnable proof, quickstart-style (one script, three requests, three visibly different outcomes).

[Abenezer0923]

Hello @hummbl-dev, thanks for your interest in the project!

At this stage, the best way to support us is by giving the GitHub repository a ⭐. If you have any questions, feel free to ask me anytime.

When you're ready to start contributing, don't forget to fork the repository first.

Thank you for your support! 🚀

[hummbl-dev]

@Abenezer0923 starred!

[lelu-auth]

Hello @hummbl-dev, hope you're doing well! If you're stuck on anything or need any clarification, I'd be happy to help. Just let me know!