agent-graph-mcp 0.2.5

MCP server for graph-orchestrated LLM workflows — 25 typed tools, daemon/proxy architecture, checkpoint/resume, HITL approvals, HMAC receipts
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

use std::collections::BTreeSet;

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
pub enum Capability {
    GraphRead,
    GraphCreate,
    GraphRun,
    GraphCancel,
    WitnessCapture,
    WitnessRead,
    CheckpointRequest,
    CheckpointRead,
    ApprovalDecide,
    GraphDelete,
    DatabaseMigration,
    ConfigInstall,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Principal {
    ModelClient,
    StdioProxy,
    Daemon,
    LocalOperator,
}

#[derive(Debug, Clone)]
pub struct CapabilityPolicy {
    principal: Principal,
    capabilities: BTreeSet<Capability>,
}

impl CapabilityPolicy {
    pub fn model() -> Self {
        Self {
            principal: Principal::ModelClient,
            capabilities: [
                Capability::GraphRead,
                Capability::GraphCreate,
                Capability::GraphRun,
                Capability::GraphCancel,
                Capability::WitnessCapture,
                Capability::WitnessRead,
                Capability::CheckpointRequest,
                Capability::CheckpointRead,
            ]
            .into_iter()
            .collect(),
        }
    }
    pub fn allows(&self, capability: Capability) -> bool {
        self.capabilities.contains(&capability)
    }
    pub fn principal(&self) -> Principal {
        self.principal
    }
    pub fn require(&self, capability: Capability) -> Result<(), &'static str> {
        if self.allows(capability) {
            Ok(())
        } else {
            Err("FORBIDDEN")
        }
    }
}