From 21628a83aaa4ae6d11651a958b5cb3b9aae42b0c Mon Sep 17 00:00:00 2001 From: Lukasz Kaminski Date: Thu, 16 Jul 2026 12:10:59 +0200 Subject: [PATCH 1/3] MCP Tools declare required permissions --- .../src/main/java/org/graylog/mcp/server/Tool.java | 3 +++ .../java/org/graylog/mcp/tools/AggregateMessagesTool.java | 5 +++++ .../main/java/org/graylog/mcp/tools/CurrentTimeTool.java | 7 +++++++ .../main/java/org/graylog/mcp/tools/ListFieldsTool.java | 5 +++++ .../main/java/org/graylog/mcp/tools/ListIndexSetsTool.java | 6 ++++++ .../main/java/org/graylog/mcp/tools/ListIndicesTool.java | 5 +++++ .../main/java/org/graylog/mcp/tools/ListInputsTool.java | 6 ++++++ .../main/java/org/graylog/mcp/tools/ListResourceTool.java | 6 ++++++ .../main/java/org/graylog/mcp/tools/ListStreamsTool.java | 6 ++++++ .../main/java/org/graylog/mcp/tools/ReadResourceTool.java | 6 ++++++ .../java/org/graylog/mcp/tools/SearchMessagesTool.java | 5 +++++ .../org/graylog/mcp/tools/SystemInfoFormattedTool.java | 6 ++++++ .../main/java/org/graylog/mcp/tools/SystemInfoTool.java | 6 ++++++ 13 files changed, 72 insertions(+) diff --git a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java index 45516233d879..96539cb30675 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java @@ -26,6 +26,7 @@ import java.util.Map; import java.util.Optional; +import java.util.Set; /** * The base class for MCP tools. @@ -110,6 +111,8 @@ protected ObjectMapper getObjectMapper() { return objectMapper; } + public abstract Set requiredPermissions(); + @JsonProperty public String name() { return name; diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java index 324ca78e75a4..0435afc460a6 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java @@ -79,6 +79,11 @@ You can scope the search to streams (by passing their IDs) or stream categories, this.scriptingApiService = scriptingApiService; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public TabularResponse apply(PermissionHelper permissionHelper, AggregateMessagesTool.Parameters parameters) { try { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java index e650f9560b85..d6649c846fd5 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java @@ -27,6 +27,8 @@ import org.joda.time.DateTime; import org.joda.time.DateTimeZone; +import java.util.Set; + import static org.graylog2.shared.utilities.StringUtils.f; /** @@ -60,6 +62,11 @@ public CurrentTimeTool(final CustomizationConfig customizationConfig, ); } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public String apply(PermissionHelper permissionHelper, CurrentTimeTool.Parameters unused) { return Tools.getISO8601String(DateTime.now(DateTimeZone.UTC)); diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java index 8b81861c389b..e97b87cd66fc 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java @@ -66,6 +66,11 @@ Fields can have different meanings in different streams (and also per source), s this.mappedFieldTypesService = mappedFieldTypesService; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public Result apply(final PermissionHelper permissionHelper, final ListFieldsTool.Parameters parameters) { final Set messageStreamIds = permissionHelper.getSearchUser().streams().loadAllMessageStreams(); diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java index f1c58d74341b..f253226fada9 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java @@ -35,6 +35,7 @@ import java.io.PrintWriter; import java.io.StringWriter; import java.util.Comparator; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -69,6 +70,11 @@ retention settings (how long data is kept), index prefix patterns, and current s this.customizationConfig = customizationConfig; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public String apply(PermissionHelper permissionHelper, ListIndexSetsTool.Parameters unused) { // TODO: find a better way to do this. This is all from org.graylog2.rest.resources.system.indexer.IndexSetsResource diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java index ce3c763a6714..19e75f50e332 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java @@ -85,6 +85,11 @@ public ListIndicesTool(Indices indices, this.indexSetRegistry = indexSetRegistry; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public String apply(PermissionHelper permissionHelper, ListIndicesTool.Parameters unused) { final var all = AllIndices.create(closed(permissionHelper), reopened(permissionHelper), open(permissionHelper)); diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java index 0f7f67675a8f..2acc91ce2874 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java @@ -38,6 +38,7 @@ import java.util.HashMap; import java.util.Locale; import java.util.Map; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -74,6 +75,11 @@ public ListInputsTool(InputService inputService, this.customizationConfig = customizationConfig; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public String apply(PermissionHelper permissionHelper, ListInputsTool.Parameters unused) { StringWriter sw = new StringWriter(); diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java index 5128f4659587..8e90ef405fb2 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java @@ -31,6 +31,7 @@ import java.util.List; import java.util.Locale; import java.util.Map; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -57,6 +58,11 @@ public ListResourceTool(ObjectMapper objectMapper, this.resourceProviders = resourceProviders; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public ListResourceTool.Result apply(PermissionHelper permissionHelper, ListResourceTool.Parameters parameters) { GRNType grnType = switch (parameters.type.toLowerCase(Locale.US).replace(' ', '_')) { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java index 5c28b3d85b7d..39560eab9c20 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java @@ -29,6 +29,7 @@ import java.util.Map; import java.util.Objects; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -57,6 +58,11 @@ public ListStreamsTool(StreamService streamService, this.streamService = streamService; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public String apply(PermissionHelper permissionHelper, ListStreamsTool.Parameters unused) { try (var dtos = streamService.streamAllDTOs()) { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java index d2fc81e72884..df9676c5b437 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java @@ -30,6 +30,7 @@ import java.net.URI; import java.net.URISyntaxException; import java.util.Map; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -56,6 +57,11 @@ public ReadResourceTool(ObjectMapper objectMapper, this.resourceProviders = resourceProviders; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public String apply(PermissionHelper permissionHelper, ReadResourceTool.Parameters parameters) { try { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java index 9be5bce47db5..158fef64ac67 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java @@ -77,6 +77,11 @@ You can scope the search to streams (by passing their IDs) or stream categories, this.scriptingApiService = scriptingApiService; } + @Override + public Set requiredPermissions() { + return Set.of(); + } + @Override public TabularResponse apply(PermissionHelper permissionHelper, SearchMessagesTool.Parameters parameters) { try { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java index 54e8f1af058b..508fb9861757 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java @@ -32,6 +32,7 @@ import java.util.List; import java.util.Locale; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -63,6 +64,11 @@ public SystemInfoFormattedTool(ObjectMapper objectMapper, this.leaderElectionService = leaderElectionService; } + @Override + public Set requiredPermissions() { + return Set.of(RestPermissions.SYSTEM_READ); + } + @Override public String apply(PermissionHelper permissionHelper, SystemInfoFormattedTool.Parameters unused) { try { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java index bc2d983fd1a1..c85c17fa7a40 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java @@ -31,6 +31,7 @@ import org.graylog2.web.customization.CustomizationConfig; import java.util.Locale; +import java.util.Set; import static org.graylog2.shared.utilities.StringUtils.f; @@ -66,6 +67,11 @@ public SystemInfoTool(ServerStatus serverStatus, this.customizationConfig = customizationConfig; } + @Override + public Set requiredPermissions() { + return Set.of(RestPermissions.SYSTEM_READ); + } + @Override public SystemOverviewResponse apply(PermissionHelper permissionHelper, SystemInfoTool.Parameters unused) { try { From ec21f29562b74ccab18c96289a22c302378230f6 Mon Sep 17 00:00:00 2001 From: Lukasz Kaminski Date: Thu, 16 Jul 2026 14:56:46 +0200 Subject: [PATCH 2/3] Different permissions declared for minimal and full access --- .../src/main/java/org/graylog/mcp/server/Tool.java | 12 +++++++++++- .../org/graylog/mcp/tools/AggregateMessagesTool.java | 2 +- .../java/org/graylog/mcp/tools/CurrentTimeTool.java | 2 +- .../java/org/graylog/mcp/tools/ListFieldsTool.java | 2 +- .../org/graylog/mcp/tools/ListIndexSetsTool.java | 7 ++++++- .../java/org/graylog/mcp/tools/ListIndicesTool.java | 11 ++++++++--- .../java/org/graylog/mcp/tools/ListInputsTool.java | 7 ++++++- .../java/org/graylog/mcp/tools/ListResourceTool.java | 2 +- .../java/org/graylog/mcp/tools/ListStreamsTool.java | 7 ++++++- .../java/org/graylog/mcp/tools/ReadResourceTool.java | 2 +- .../org/graylog/mcp/tools/SearchMessagesTool.java | 2 +- .../graylog/mcp/tools/SystemInfoFormattedTool.java | 7 ++++++- .../java/org/graylog/mcp/tools/SystemInfoTool.java | 7 ++++++- 13 files changed, 55 insertions(+), 15 deletions(-) diff --git a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java index 96539cb30675..fe7ab038ac3b 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java @@ -111,7 +111,17 @@ protected ObjectMapper getObjectMapper() { return objectMapper; } - public abstract Set requiredPermissions(); + /** + * @return Minimal set of permissions to run the MCP Tool. Depending on additional permissions the results of the run can be different. + */ + public abstract Set minimalRequiredPermissions(); + + /** + * @return Full set of permissions needed to access all the data when invoking MCP Tool. Override for tools that filter results based on permissions or have entity-level permissions checks. + */ + public Set fullAccessPermissions() { + return minimalRequiredPermissions(); + } @JsonProperty public String name() { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java index 0435afc460a6..d72734005f50 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java @@ -80,7 +80,7 @@ You can scope the search to streams (by passing their IDs) or stream categories, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java index d6649c846fd5..a0a9aa17e3e6 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java @@ -63,7 +63,7 @@ public CurrentTimeTool(final CustomizationConfig customizationConfig, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java index e97b87cd66fc..98c1f2ae149d 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java @@ -67,7 +67,7 @@ Fields can have different meanings in different streams (and also per source), s } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java index f253226fada9..2761338e8ed2 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java @@ -71,10 +71,15 @@ retention settings (how long data is kept), index prefix patterns, and current s } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } + @Override + public Set fullAccessPermissions() { + return Set.of(RestPermissions.INDEXSETS_READ); + } + @Override public String apply(PermissionHelper permissionHelper, ListIndexSetsTool.Parameters unused) { // TODO: find a better way to do this. This is all from org.graylog2.rest.resources.system.indexer.IndexSetsResource diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java index 19e75f50e332..1e53383949cd 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java @@ -21,10 +21,10 @@ import jakarta.inject.Inject; import org.graylog.mcp.server.SchemaGeneratorProvider; import org.graylog.mcp.server.Tool; -import org.graylog2.indexer.indexset.IndexSet; -import org.graylog2.indexer.indexset.registry.IndexSetRegistry; import org.graylog2.indexer.NodeInfoCache; +import org.graylog2.indexer.indexset.IndexSet; import org.graylog2.indexer.indexset.index.IndexPattern; +import org.graylog2.indexer.indexset.registry.IndexSetRegistry; import org.graylog2.indexer.indices.Indices; import org.graylog2.indexer.indices.stats.IndexStatistics; import org.graylog2.indexer.indices.util.NumberBasedIndexNameComparator; @@ -86,10 +86,15 @@ public ListIndicesTool(Indices indices, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } + @Override + public Set fullAccessPermissions() { + return Set.of(RestPermissions.INDICES_READ); + } + @Override public String apply(PermissionHelper permissionHelper, ListIndicesTool.Parameters unused) { final var all = AllIndices.create(closed(permissionHelper), reopened(permissionHelper), open(permissionHelper)); diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java index 2acc91ce2874..141416429c06 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java @@ -76,10 +76,15 @@ public ListInputsTool(InputService inputService, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } + @Override + public Set fullAccessPermissions() { + return Set.of(RestPermissions.INPUTS_READ); + } + @Override public String apply(PermissionHelper permissionHelper, ListInputsTool.Parameters unused) { StringWriter sw = new StringWriter(); diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java index 8e90ef405fb2..48b063e13fe7 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java @@ -59,7 +59,7 @@ public ListResourceTool(ObjectMapper objectMapper, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java index 39560eab9c20..cd5aa678fbff 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java @@ -59,10 +59,15 @@ public ListStreamsTool(StreamService streamService, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } + @Override + public Set fullAccessPermissions() { + return Set.of(RestPermissions.STREAMS_READ); + } + @Override public String apply(PermissionHelper permissionHelper, ListStreamsTool.Parameters unused) { try (var dtos = streamService.streamAllDTOs()) { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java index df9676c5b437..3f0432c9d120 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java @@ -58,7 +58,7 @@ public ReadResourceTool(ObjectMapper objectMapper, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java index 158fef64ac67..8d658e9887a3 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java @@ -78,7 +78,7 @@ You can scope the search to streams (by passing their IDs) or stream categories, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java index 508fb9861757..bafb77271af5 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java @@ -65,7 +65,12 @@ public SystemInfoFormattedTool(ObjectMapper objectMapper, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { + return Set.of(); + } + + @Override + public Set fullAccessPermissions() { return Set.of(RestPermissions.SYSTEM_READ); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java index c85c17fa7a40..ca3cf10640fc 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java @@ -68,7 +68,12 @@ public SystemInfoTool(ServerStatus serverStatus, } @Override - public Set requiredPermissions() { + public Set minimalRequiredPermissions() { + return Set.of(); + } + + @Override + public Set fullAccessPermissions() { return Set.of(RestPermissions.SYSTEM_READ); } From f34f334736b517e769af7a93a4996963660da8fc Mon Sep 17 00:00:00 2001 From: Lukasz Kaminski Date: Tue, 21 Jul 2026 09:51:47 +0200 Subject: [PATCH 3/3] MCP Tools have only one method to declare permissions, they do not separate 2 different families of perm. from now on --- .../src/main/java/org/graylog/mcp/server/Tool.java | 12 +----------- .../org/graylog/mcp/tools/AggregateMessagesTool.java | 2 +- .../java/org/graylog/mcp/tools/CurrentTimeTool.java | 2 +- .../java/org/graylog/mcp/tools/ListFieldsTool.java | 2 +- .../org/graylog/mcp/tools/ListIndexSetsTool.java | 7 +------ .../java/org/graylog/mcp/tools/ListIndicesTool.java | 7 +------ .../java/org/graylog/mcp/tools/ListInputsTool.java | 7 +------ .../java/org/graylog/mcp/tools/ListResourceTool.java | 2 +- .../java/org/graylog/mcp/tools/ListStreamsTool.java | 7 +------ .../java/org/graylog/mcp/tools/ReadResourceTool.java | 2 +- .../org/graylog/mcp/tools/SearchMessagesTool.java | 2 +- .../graylog/mcp/tools/SystemInfoFormattedTool.java | 7 +------ .../java/org/graylog/mcp/tools/SystemInfoTool.java | 7 +------ 13 files changed, 13 insertions(+), 53 deletions(-) diff --git a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java index fe7ab038ac3b..1c1de815b35c 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java @@ -111,17 +111,7 @@ protected ObjectMapper getObjectMapper() { return objectMapper; } - /** - * @return Minimal set of permissions to run the MCP Tool. Depending on additional permissions the results of the run can be different. - */ - public abstract Set minimalRequiredPermissions(); - - /** - * @return Full set of permissions needed to access all the data when invoking MCP Tool. Override for tools that filter results based on permissions or have entity-level permissions checks. - */ - public Set fullAccessPermissions() { - return minimalRequiredPermissions(); - } + public abstract Set checkedPermissions(); @JsonProperty public String name() { diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java index d72734005f50..e2dd51f57c76 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java @@ -80,7 +80,7 @@ You can scope the search to streams (by passing their IDs) or stream categories, } @Override - public Set minimalRequiredPermissions() { + public Set checkedPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java index a0a9aa17e3e6..3963f37983ce 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java @@ -63,7 +63,7 @@ public CurrentTimeTool(final CustomizationConfig customizationConfig, } @Override - public Set minimalRequiredPermissions() { + public Set checkedPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java index 98c1f2ae149d..ec16d72495c2 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java @@ -67,7 +67,7 @@ Fields can have different meanings in different streams (and also per source), s } @Override - public Set minimalRequiredPermissions() { + public Set checkedPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java index 2761338e8ed2..fc833311bb9b 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java @@ -71,12 +71,7 @@ retention settings (how long data is kept), index prefix patterns, and current s } @Override - public Set minimalRequiredPermissions() { - return Set.of(); - } - - @Override - public Set fullAccessPermissions() { + public Set checkedPermissions() { return Set.of(RestPermissions.INDEXSETS_READ); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java index 1e53383949cd..9f2ed1712717 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java @@ -86,12 +86,7 @@ public ListIndicesTool(Indices indices, } @Override - public Set minimalRequiredPermissions() { - return Set.of(); - } - - @Override - public Set fullAccessPermissions() { + public Set checkedPermissions() { return Set.of(RestPermissions.INDICES_READ); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java index 141416429c06..757770900a3d 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java @@ -76,12 +76,7 @@ public ListInputsTool(InputService inputService, } @Override - public Set minimalRequiredPermissions() { - return Set.of(); - } - - @Override - public Set fullAccessPermissions() { + public Set checkedPermissions() { return Set.of(RestPermissions.INPUTS_READ); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java index 48b063e13fe7..2002561792ab 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java @@ -59,7 +59,7 @@ public ListResourceTool(ObjectMapper objectMapper, } @Override - public Set minimalRequiredPermissions() { + public Set checkedPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java index cd5aa678fbff..0ac828d8875d 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java @@ -59,12 +59,7 @@ public ListStreamsTool(StreamService streamService, } @Override - public Set minimalRequiredPermissions() { - return Set.of(); - } - - @Override - public Set fullAccessPermissions() { + public Set checkedPermissions() { return Set.of(RestPermissions.STREAMS_READ); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java index 3f0432c9d120..9fc1735b8835 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java @@ -58,7 +58,7 @@ public ReadResourceTool(ObjectMapper objectMapper, } @Override - public Set minimalRequiredPermissions() { + public Set checkedPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java index 8d658e9887a3..5aeee343f3e8 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java @@ -78,7 +78,7 @@ You can scope the search to streams (by passing their IDs) or stream categories, } @Override - public Set minimalRequiredPermissions() { + public Set checkedPermissions() { return Set.of(); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java index bafb77271af5..6009b84788cc 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java @@ -65,12 +65,7 @@ public SystemInfoFormattedTool(ObjectMapper objectMapper, } @Override - public Set minimalRequiredPermissions() { - return Set.of(); - } - - @Override - public Set fullAccessPermissions() { + public Set checkedPermissions() { return Set.of(RestPermissions.SYSTEM_READ); } diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java index ca3cf10640fc..e59489e69586 100644 --- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java +++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java @@ -68,12 +68,7 @@ public SystemInfoTool(ServerStatus serverStatus, } @Override - public Set minimalRequiredPermissions() { - return Set.of(); - } - - @Override - public Set fullAccessPermissions() { + public Set checkedPermissions() { return Set.of(RestPermissions.SYSTEM_READ); }