Authorize MCP Skills extension requests

[JAORMX]

Summary

• Enable ToolHive's direct proxy to apply authorization policy to the accepted MCP SEP-2640 Skills extension, so newly introduced skill discovery does not become an ungoverned metadata-disclosure path.
• Map skills/get to Cedar Action::"get_skill" / Skill::<exact URI> and filter skills/list entries by that same permission.
• Reject ambiguous or malformed skill identifiers/results without forwarding unauthorized skill metadata; retain raw permitted extension fields and preserve independent resources/read authorization.
• Document policy semantics and add direct-middleware, JSON-RPC, SSE, Cedar, and HTTP-PDP regression coverage.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test) — attempted with TMPDIR="$PWD/.tmp" task test; the full race suite failed in unrelated existing tests: pkg/client.TestDetectProjectRoot, pkg/server/discovery.TestCheckHealth_UnixSocket_Success, and the 10-minute timeout in pkg/transport.TestBridge_ToolsListChanged_TriggersReSync.
• E2E tests (task test-e2e)
• Linting (TMPDIR="$PWD/.tmp" task lint-fix)
• Manual testing — reviewed the direct middleware paths for allowed/denied skills/get, skills/list response filtering, malformed/duplicate URI rejection, and SSE error substitution; automated regressions cover each path.

Changes

Area	Change
pkg/mcp, pkg/authz	Parse and authorize SEP-2640 Skill methods; filter skills lists safely.
Cedar / HTTP PDP authorizers	Add the skill feature and get_skill policy mapping.
Tests	Exercise JSON, SSE, duplicate-key, malformed-result, and policy paths.
docs/authz.md	Document policy and direct-proxy scope.

Does this introduce a user-facing change?

Yes. Operators can now write get_skill policies for direct-proxied MCP servers that negotiate SEP-2640. A skills/list response exposes only the skills the caller may get; reading its files still requires the existing resource-read permission.

Implementation plan

Approved implementation plan

1. Add a skill authorization feature and parse skills/get by its literal URI.
2. Map skills/get to an exact Cedar Skill entity and admission-check invalid/ambiguous identifiers before dispatch.
3. Forward skills/list but filter every entry through the same get_skill permission; fail closed on unsafe response shapes.
4. Preserve direct-proxy capability negotiation as transparent pass-through.
5. Add parser, middleware, policy, JSON-RPC, and SSE regression coverage; document the policy contract.

Deferred: vMCP aggregation/routing, content-integrity verification, consent records, host materialization, dynamic Skills, and resources/directory/read.

Special notes for reviewers

This deliberately implements only the direct-proxy authorization seam. ToolHive does not advertise, fabricate, or rewrite the Skills extension; client and backend capability negotiation remains end-to-end. The full unit suite currently has unrelated failures noted above.

[codecov]

Codecov Report

❌ Patch coverage is 83.96226% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.27%. Comparing base (fd1e7b5) to head (247beb4).

Files with missing lines	Patch %	Lines
pkg/authz/response_filter.go	82.97%	8 Missing ⚠️
pkg/authz/middleware.go	81.25%	6 Missing ⚠️
pkg/authz/authorizers/cedar/core.go	88.88%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6512      +/-   ##
==========================================
- Coverage   78.32%   78.27%   -0.05%     
==========================================
  Files         770      770              
  Lines       75456    75557     +101     
==========================================
+ Hits        59101    59143      +42     
- Misses      16350    16409      +59     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.