McpCaller Class

Assembly: CodeEffects.Rule.Mcp.dll
Namespace: CodeEffects.Rule.Mcp

Summary

Describes the verified caller of one MCP request: the accountable user, the AI agent acting for them, and the permissions they have.

Syntax

public sealed class McpCaller

Remarks

Your MapCaller delegate of CodeEffectsMcpOptions creates one for every request, from the identity that your application's authentication verified. Build it from the signed-in person's claims and from the client the token was issued to. Never build it from what an MCP client reports about itself: no tool takes a login, password or token, and the server trusts nothing but your delegate.

The class has a public parameterless constructor. Only UserId is required.

The permissions follow the model of the Rule Repository: AccessMode says how Actions is read. With the default, ActionPermissionMode.ViewOnly, the caller has no permission at all beyond viewing the four core objects: source objects, source versions, rules and rule versions. With ActionPermissionMode.AllowAllExcept the caller may do everything except what Actions lists, and a withheld permission withholds every permission that requires it. With ActionPermissionMode.AllowOnly the caller may do only what Actions lists, and the list must be complete: a permission granted without the ones it requires is a configuration error, and the request fails with a message that says what is missing. The tools a client is offered follow this set, and the server checks it again when a tool is called.

Some actions, such as making a version live, approving and deleting, are a person's only. A caller that has an AgentId is never granted them, whatever the set says.

Example

using System.Collections.Generic;
using CodeEffects.Rule.Common.Models;
using CodeEffects.Rule.Mcp;

// Dana, signed in to an AI client: she may do everything except delete rules
var caller = new McpCaller
{
	UserId = "u-1001",
	UserName = "Dana Whitaker",
	UserType = McpUserType.User,
	AgentId = "claude-connector",
	AgentName = "Claude",
	AccessMode = ActionPermissionMode.AllowAllExcept,
	Actions = new HashSet<ActionPermissionType> { ActionPermissionType.RuleDelete }
};