oct.mcp.policy Namespace Reference

Classes
class	ToolSpec
class	PolicyDecision
class	McpPolicy

Functions
None	_dbg (*args, **kwargs)

Variables
	McpProfile = Literal["default", "strict", "airgapped"]

Detailed Description

Purpose
-------
Policy Engine (Layer 3) for the ``oct-mcp`` six-layer pipeline.
Maintains the tool manifest and decides whether a given tool call is
permitted under the active MCP profile.

Responsibilities
----------------
- Define :data:`TOOL_MANIFEST` mapping tool names to :class:`ToolSpec`.
- Define :class:`McpPolicy` which enforces profile-based rules.
- Return structured :class:`PolicyDecision` objects (never raises for
  policy rejections — callers check the decision).

Diagnostics
-----------
Domain: MCP
Levels:
    L1 — errors: unknown tool, manifest inconsistency
    L2 — lifecycle: policy decision
    L4 — deep trace: profile enforcement details

Contracts
---------
- This module does not import ``click``, the MCP SDK, or any other
  ``oct.mcp.*`` module except ``config.py``.
- :meth:`McpPolicy.check` never raises for normal policy decisions.
  Only ``ValueError`` is raised for programming errors (e.g. an unknown
  profile string passed at construction time).
- In ``airgapped`` profile, ALL tool calls are denied regardless of
  the tool manifest.
- In ``strict`` profile, only tools with ``auto_approve=True`` and
  ``destructive=False`` may execute, and repo-level config is ignored.

Function Documentation

_dbg()

None oct.mcp.policy._dbg ( * args, ** kwargs )

protected

Definition at line 48 of file policy.py.

Here is the caller graph for this function:

Variable Documentation

McpProfile

oct.mcp.policy.McpProfile = Literal["default", "strict", "airgapped"]

Definition at line 60 of file policy.py.