AI MCP Gateway and A2A
Relevant source files
The following files were used as context for generating this wiki page:
Casdoor acts as an open-source AI-first Identity and Access Management (IAM) and AI MCP (Model Context Protocol) gateway. It provides a standardized interface for AI models to interact with organizational data and applications through a secure, authenticated bridge. This system enables Application-to-Application (A2A) communication by allowing AI clients to discover and invoke specific tools (such as managing applications) while adhering to strict security policies and scopes.
Sources: README.md:1-3, mcp/base.go:21-25
MCP Architecture and Protocol
The MCP implementation in Casdoor follows a JSON-RPC 2.0 structure to handle requests and responses between AI clients and the Casdoor server. The gateway centralizes tool discovery and execution, ensuring that all interactions are logged and authorized.
Protocol Structure
The system uses standardized structures for MCP communication, including initialization, tool listing, and tool calling.
The diagram above illustrates the primary data structures used to encapsulate MCP JSON-RPC messages and tool definitions.
Sources: mcp/base.go:27-104
MCP Controller Logic
The McpController manages the lifecycle of an MCP session, routing requests to specific handlers based on the RPC method.
| Method | Description |
|---|---|
initialize | Sets up the protocol version and server capabilities (e.g., tool listing). |
tools/list | Returns a list of available tools filtered by the requester's authentication scope. |
tools/call | Executes a specific tool with provided arguments after validating permissions. |
ping | Simple health check to ensure the gateway is responsive. |
Sources: mcp/base.go:167-210
A2A Gateway and Security Filtering
Casdoor implements a sophisticated filtering mechanism to secure A2A interactions. Every MCP request passing through the gateway is subjected to an authorization filter that validates the subject (AI application/user) against the requested object and action.
Authorization Flow
The gateway intercepts requests at /api/mcp and extracts metadata for the Casbin enforcer.
The diagram shows how the ApiFilter intercepts MCP calls and utilizes extra metadata (like the specific tool method) to perform granular access control.
Sources: routers/authz_filter.go:230-316, mcp/base.go:167-175
Extra Metadata Extraction
For MCP requests, the filter extracts the "method" from the JSON body and maps it to detailPathUrl in the authorization context. This allows administrators to define permissions not just for the /api/mcp endpoint, but for specific MCP methods like tools/call.
Sources: routers/authz_filter.go:207-224
Tool Management and Scopes
The gateway exposes specific "Tools" that AI clients can invoke. Access to these tools is governed by scopes embedded in JWT claims or session data.
Available MCP Tools
Casdoor currently provides tools focused on application management, allowing AI to query, create, or modify applications within the IAM system.
| Tool Name | Description | Required Arguments |
|---|---|---|
get_applications | List applications for an owner | owner |
get_application | Get details of a specific app | id |
add_application | Create a new application | application (object) |
update_application | Modify an existing application | id, application |
delete_application | Remove an application | application (object) |
Sources: mcp/base.go:343-410
Scope-Based Access Control
The handleToolsList function filters the toolset based on the requester's granted scopes. If a token is present, it extracts scopes to determine which tools are visible and callable. Unauthenticated requests may see all tools for discovery purposes, but execution is blocked by the permission checker.
Sources: mcp/base.go:212-250, mcp/base.go:281-314
Summary
The Casdoor AI MCP Gateway provides a robust framework for Application-to-Application (A2A) integration by wrapping standard IAM operations in the Model Context Protocol. By leveraging JSON-RPC for communication and Casbin for granular authorization filtering, it ensures that AI models can safely access and manipulate organizational resources through a governed set of tools. Key functionalities include dynamic tool discovery, scope-based filtering, and integrated security logging for every AI-driven interaction.
Sources: README.md:1-5, mcp/base.go:167-185, routers/router.go:195