Struct ScopePolicy 

pub struct ScopePolicy { /* private fields */ }

Policy mapping MCP operations to their required OAuth scopes.

Allows configuring per-tool, per-resource, and per-prompt scope requirements, with a default fallback.

Example

use tower_mcp::oauth::ScopePolicy;

let policy = ScopePolicy::new()
    .default_scope("mcp:read")
    .tool_scope("dangerous_tool", "mcp:admin")
    .resource_scope("secret://data", "mcp:secret");

Implementations

impl ScopePolicy

pub fn new() -> Self

Create an empty scope policy (no scopes required for anything).

pub fn scope_matcher(self, matcher: impl ScopeMatcher) -> Self

Use a custom matcher for exact or hierarchical scope semantics.

The matcher receives (granted, required) and should return true when the granted scope authorizes the required scope.

pub fn default_scope(self, scope: impl Into<String>) -> Self

Set a default scope required for all operations.

pub fn default_scopes(self, requirement: ScopeRequirement) -> Self

Set a default scope requirement for all operations.

pub fn tool_scope( self, tool_name: impl Into<String>, scope: impl Into<String>, ) -> Self

Set scope requirement for a specific tool.

The tool scope is checked in addition to the default scope.

pub fn tool_scopes( self, tool_name: impl Into<String>, requirement: ScopeRequirement, ) -> Self

Set scope requirement for a specific tool with a full requirement.

pub fn resource_scope( self, resource_uri: impl Into<String>, scope: impl Into<String>, ) -> Self

Set scope requirement for a specific resource.

pub fn prompt_scope( self, prompt_name: impl Into<String>, scope: impl Into<String>, ) -> Self

Set scope requirement for a specific prompt.

pub fn check_default(&self, claims: &TokenClaims) -> Result<(), OAuthError>

Check if the given claims satisfy the default scope requirement.

pub fn check_tool( &self, tool_name: &str, claims: &TokenClaims, ) -> Result<(), OAuthError>

Check if the given claims satisfy the scope requirement for a tool.

Checks both default scopes and tool-specific scopes.

pub fn check_resource( &self, resource_uri: &str, claims: &TokenClaims, ) -> Result<(), OAuthError>

Check if the given claims satisfy the scope requirement for a resource.

pub fn check_prompt( &self, prompt_name: &str, claims: &TokenClaims, ) -> Result<(), OAuthError>

Check if the given claims satisfy the scope requirement for a prompt.

Trait Implementations

impl Clone for ScopePolicy

fn clone(&self) -> ScopePolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScopePolicy

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ScopePolicy

fn default() -> Self

Returns the “default value” for a type.