MCP Tools declare required permissions.

graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java

@@ -26,6 +26,7 @@
 
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 
 /**
  * The base class for MCP tools.
@@ -110,6 +111,8 @@ protected ObjectMapper getObjectMapper() {
         return objectMapper;
     }
 
+    public abstract Set<String> checkedPermissions();
+
     @JsonProperty
     public String name() {
         return name;

graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java

@@ -79,6 +79,11 @@ You can scope the search to streams (by passing their IDs) or stream categories,
         this.scriptingApiService = scriptingApiService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public TabularResponse apply(PermissionHelper permissionHelper, AggregateMessagesTool.Parameters parameters) {
         try {

graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java

@@ -27,6 +27,8 @@
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
 
+import java.util.Set;
+
 import static org.graylog2.shared.utilities.StringUtils.f;
 
 /**
@@ -60,6 +62,11 @@ public CurrentTimeTool(final CustomizationConfig customizationConfig,
         );
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, CurrentTimeTool.Parameters unused) {
         return Tools.getISO8601String(DateTime.now(DateTimeZone.UTC));

graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java

@@ -66,6 +66,11 @@ Fields can have different meanings in different streams (and also per source), s
         this.mappedFieldTypesService = mappedFieldTypesService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public Result apply(final PermissionHelper permissionHelper, final ListFieldsTool.Parameters parameters) {
         final Set<String> messageStreamIds = permissionHelper.getSearchUser().streams().loadAllMessageStreams();

graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java

@@ -35,6 +35,7 @@
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.util.Comparator;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -69,6 +70,11 @@ retention settings (how long data is kept), index prefix patterns, and current s
         this.customizationConfig = customizationConfig;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.INDEXSETS_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListIndexSetsTool.Parameters unused) {
         // TODO: find a better way to do this. This is all from org.graylog2.rest.resources.system.indexer.IndexSetsResource

graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java

@@ -21,10 +21,10 @@
 import jakarta.inject.Inject;
 import org.graylog.mcp.server.SchemaGeneratorProvider;
 import org.graylog.mcp.server.Tool;
-import org.graylog2.indexer.indexset.IndexSet;
-import org.graylog2.indexer.indexset.registry.IndexSetRegistry;
 import org.graylog2.indexer.NodeInfoCache;
+import org.graylog2.indexer.indexset.IndexSet;
 import org.graylog2.indexer.indexset.index.IndexPattern;
+import org.graylog2.indexer.indexset.registry.IndexSetRegistry;
 import org.graylog2.indexer.indices.Indices;
 import org.graylog2.indexer.indices.stats.IndexStatistics;
 import org.graylog2.indexer.indices.util.NumberBasedIndexNameComparator;
@@ -85,6 +85,11 @@ public ListIndicesTool(Indices indices,
         this.indexSetRegistry = indexSetRegistry;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.INDICES_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListIndicesTool.Parameters unused) {
         final var all = AllIndices.create(closed(permissionHelper), reopened(permissionHelper), open(permissionHelper));

graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java

@@ -38,6 +38,7 @@
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -74,6 +75,11 @@ public ListInputsTool(InputService inputService,
         this.customizationConfig = customizationConfig;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.INPUTS_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListInputsTool.Parameters unused) {
         StringWriter sw = new StringWriter();

graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java

@@ -31,6 +31,7 @@
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -57,6 +58,11 @@ public ListResourceTool(ObjectMapper objectMapper,
         this.resourceProviders = resourceProviders;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public ListResourceTool.Result apply(PermissionHelper permissionHelper, ListResourceTool.Parameters parameters) {
         GRNType grnType = switch (parameters.type.toLowerCase(Locale.US).replace(' ', '_')) {

graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java

@@ -29,6 +29,7 @@
 
 import java.util.Map;
 import java.util.Objects;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -57,6 +58,11 @@ public ListStreamsTool(StreamService streamService,
         this.streamService = streamService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.STREAMS_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListStreamsTool.Parameters unused) {
         try (var dtos = streamService.streamAllDTOs()) {

graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java

@@ -30,6 +30,7 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Map;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -56,6 +57,11 @@ public ReadResourceTool(ObjectMapper objectMapper,
         this.resourceProviders = resourceProviders;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ReadResourceTool.Parameters parameters) {
         try {

graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java

@@ -77,6 +77,11 @@ You can scope the search to streams (by passing their IDs) or stream categories,
         this.scriptingApiService = scriptingApiService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public TabularResponse apply(PermissionHelper permissionHelper, SearchMessagesTool.Parameters parameters) {
         try {

graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java

@@ -32,6 +32,7 @@
 
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -63,6 +64,11 @@ public SystemInfoFormattedTool(ObjectMapper objectMapper,
         this.leaderElectionService = leaderElectionService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.SYSTEM_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, SystemInfoFormattedTool.Parameters unused) {
         try {

graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java

@@ -31,6 +31,7 @@
 import org.graylog2.web.customization.CustomizationConfig;
 
 import java.util.Locale;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -66,6 +67,11 @@ public SystemInfoTool(ServerStatus serverStatus,
         this.customizationConfig = customizationConfig;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.SYSTEM_READ);
+    }
+
     @Override
     public SystemOverviewResponse apply(PermissionHelper permissionHelper, SystemInfoTool.Parameters unused) {
         try {