MCP tool policy tester

Test your proposed access rules

Session-only inputs. No upload, autosave, model calls or permission changes.

100 tool rules; 500 cases; 512 KiB, 20,000 nodes and 32 levels per input. Independent limits apply. Use non-sensitive labels only. No tokens, credentials, call arguments or raw outputs.

Policy decisions and test expectations

Allow describes this supplied policy only. It does not authenticate identity, approve a pending action or prove that a live server enforces the rule.

Use explicit policy rules, not inferred intent

The policy must set default_decision to deny and contain a tools array. Each tool rule needs its exact name, allowed roles, all required_scopes, allowed environments and boolean approval_required. Empty role or environment lists deny everyone; an empty required-scope list requires no scope labels. An empty tools list denies all calls.

{"default_decision":"deny","tools":[{"name":"lookup_record","roles":["operator"],"required_scopes":["records:read"],"environments":["test"],"approval_required":false}]}

[{"id":"read-01","tool":"lookup_record","role":"operator","scopes":["records:read"],"environment":"test","expected_decision":"allow"}]

Names and labels are case-sensitive; there are no wildcard permissions, role inheritance, inferred read/write rights or scope-prefix matching. Tool names use 1-128 ASCII letters, digits, dots, underscores or hyphens; other identifiers may also use colons. Each rule list accepts at most twenty unique labels. Optional group is non-empty text up to eighty characters, without control characters.

Each test needs a unique id, tool, role, supplied scopes, environment and expected_decision: allow, deny or approval_required. Unknown keys, duplicate keys/IDs/rules and unsupported shapes are rejected without a partial report. This is our documented policy-test format, not a native MCP catalog or OAuth credential.

Run the same tests in a private release job

The self-contained free Node 22+ CLI reads two bounded UTF-8 files, makes no network calls and writes the complete report to standard output. It needs no installation, account, model or API key.

node mcp-tool-policy-audit.mjs --policy policy.json --cases cases.json > report.json
node mcp-tool-policy-audit.mjs --policy policy.json --cases cases.json --fail-on-mismatch > report.json

Exit 0 means valid report generation, not that all tests match. With --fail-on-mismatch, exit 2 means at least one expected decision differs. Input/I/O errors exit 1. Expected denials and approval-required cases can pass their tests. The CLI does not act as a live authorization middleware.

Separate a tested decision from a granted capability

Denial takes precedence if a tool, role or environment is unlisted, or any required scope is missing. Only an otherwise eligible case reaches allow or approval-required. Approval-required remains pending; no consent flag, token or override is accepted.

The seven-case illustrative fixture contains six matching expectations and one deliberate mismatch. It includes allowed reads, missing scopes, role/environment boundaries and an unlisted tool. One listed export tool is untested. These are not client outcomes, and complete listed-tool coverage is not exhaustive coverage.

This tester does not validate tokens, issuer/audience/expiry, tenant or record access, arguments, resource URLs, budgets, prompt injection, consent authenticity or downstream effects. Test those in your authorized implementation. It does not assign a risk score from a tool's name or decide your business acceptance criteria.

Make tool access part of the working system

Nothing here opens an account, grants access, calls a server, sends a message or starts a paid engagement.