feat: enhance tool filtering with explicit allow/block modes and update configuration

Author: TBXark

README.md

@@ -65,6 +65,14 @@ The server is configured using a JSON file. Below is an example configuration:
       ],
       "env": {
         "GITHUB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>"
+      },
+      "options": {
+        "toolFilter": {
+          "mode": "block",
+          "list": [
+            "create_or_update_file"
+          ]
+        }
       }
     },
     "fetch": {
@@ -77,11 +85,7 @@ The server is configured using a JSON file. Below is an example configuration:
         "logEnabled": false,
         "authTokens": [
           "SpecificTokens"
-        ],
-        "toolFilter": {
-          "mode": "block", // Must be explicitly set to "allow" or "block"
-          "list": ["tool_name_to_block_or_allow"]
-        }
+        ]
       }
     },
     "amap": {
@@ -96,14 +100,14 @@ Common options for `mcpProxy` and `mcpServers`.
 
 - `panicIfInvalid`: If true, the server will panic if the client is invalid.
 - `logEnabled`: If true, the server will log the client's requests.
-- `authTokens`: A list of authentication tokens for the client. The `Authorization` header will be checked against this list. 
-- `toolFilter`: Optional tool filtering configuration.
-  - `mode`: Specifies the filtering mode. Must be explicitly set to "allow" or "block" if `list` is provided. If `list` is present but `mode` is missing or invalid, the filter will be ignored for this server.
+- `authTokens`: A list of authentication tokens for the client. The `Authorization` header will be checked against this list.
+- `toolFilter`: Optional tool filtering configuration. **This configuration is only effective in `mcpServers`.**
+  - `mode`: Specifies the filtering mode. Must be explicitly set to `allow` or `block` if `list` is provided. If `list` is present but `mode` is missing or invalid, the filter will be ignored for this server.
   - `list`: A list of tool names to filter (either allow or block based on the `mode`).
-
   > **Tip:** If you don't know the exact tool names, run the proxy once without any `toolFilter` configured. The console will log messages like `<server_name> Adding tool <tool_name>` for each successfully registered tool. You can use these logged names in your `toolFilter` list.
 
- > In the new configuration, the `authTokens` of `mcpProxy` is not a global authentication token, but rather the default authentication token for `mcpProxy`. When `authTokens` is set in `mcpServers`, the value of `authTokens` in `mcpServers` will be used instead of the value in `mcpProxy`. In other words, the `authTokens` of `mcpProxy` serves as a default value and is only applied when `authTokens` is not set in `mcpServers`.
+> In the new configuration, the `authTokens` of `mcpProxy` is not a global authentication token, but rather the default authentication token for `mcpProxy`. When `authTokens` is set in `mcpServers`, the value of `authTokens` in `mcpServers` will be used instead of the value in `mcpProxy`. In other words, the `authTokens` of `mcpProxy` serves as a default value and is only applied when `authTokens` is not set in `mcpServers`.
+
 > Other fields are the same.
 
 ### **`mcpProxy`**
@@ -134,7 +138,7 @@ For sse mcp servers, the `url` field is required. When the current `url` exists,
 For http streaming mcp servers, the `url` field is required. and `transportType` need to manually set to `streamable-http`.
 - `url`: The URL of the MCP client.
 - `headers`: The headers to send with the request to the MCP client.
-- `timeout`: The timeout for the request to the MCP client. 
+- `timeout`: The timeout for the request to the MCP client.
 
 
 ## Usage

client.go

@@ -134,28 +134,35 @@ PingLoop:
 
 func (c *Client) addToolsToServer(ctx context.Context, mcpServer *server.MCPServer) error {
 	toolsRequest := mcp.ListToolsRequest{}
-	filterSet := make(map[string]struct{})
-	var filterMode string // Store the validated filter mode
-	applyFilter := false  // Whether to apply filter rules
+	filterFunc := func(toolName string) bool {
+		return true
+	}
 
 	if c.options != nil && c.options.ToolFilter != nil && len(c.options.ToolFilter.List) > 0 {
-		// List is provided, now validate the mode explicitly
-		mode := strings.ToLower(c.options.ToolFilter.Mode)
-		if mode == "allow" || mode == "block" {
-			// Mode is valid, prepare to apply filter
-			applyFilter = true
-			filterMode = mode // Store the valid mode
-			for _, toolName := range c.options.ToolFilter.List {
-				filterSet[toolName] = struct{}{}
+		filterSet := make(map[string]struct{})
+		mode := ToolFilterMode(strings.ToLower(string(c.options.ToolFilter.Mode)))
+		for _, toolName := range c.options.ToolFilter.List {
+			filterSet[toolName] = struct{}{}
+		}
+		switch mode {
+		case ToolFilterModeAllow:
+			filterFunc = func(toolName string) bool {
+				_, inList := filterSet[toolName]
+				if !inList {
+					log.Printf("<%s> Ignoring tool %s as it is not in allow list", c.name, toolName)
+				}
+				return inList
 			}
-		} else {
-			// Mode is missing or invalid, ignore the filter configuration
-			if c.options.ToolFilter.Mode == "" {
-				log.Printf("<%s> WARNING: toolFilter list provided but mode is missing. Ignoring toolFilter configuration for this server. Mode must be 'allow' or 'block'.", c.name)
-			} else {
-				log.Printf("<%s> WARNING: Invalid toolFilter mode '%s' provided. Ignoring toolFilter configuration for this server. Mode must be 'allow' or 'block'.", c.name, c.options.ToolFilter.Mode)
+		case ToolFilterModeBlock:
+			filterFunc = func(toolName string) bool {
+				_, inList := filterSet[toolName]
+				if inList {
+					log.Printf("<%s> Ignoring tool %s as it is in block list", c.name, toolName)
+				}
+				return !inList
 			}
-			// applyFilter remains false
+		default:
+			log.Printf("<%s> Unknown tool filter mode: %s, skipping tool filter", c.name, mode)
 		}
 	}
 
@@ -169,37 +176,17 @@ func (c *Client) addToolsToServer(ctx context.Context, mcpServer *server.MCPServ
 		}
 		log.Printf("<%s> Successfully listed %d tools", c.name, len(tools.Tools))
 		for _, tool := range tools.Tools {
-			shouldAdd := true // Default to adding the tool
-
-			if applyFilter { // Only apply filter rules if applyFilter is true
-				_, inList := filterSet[tool.Name]
-				if filterMode == "allow" {
-					if !inList {
-						shouldAdd = false
-					}
-				} else { // filterMode == "block" (already validated)
-					if inList {
-						shouldAdd = false
-					}
-				}
-			}
-
-			if shouldAdd {
+			if filterFunc(tool.Name) {
 				log.Printf("<%s> Adding tool %s", c.name, tool.Name)
 				mcpServer.AddTool(tool, c.client.CallTool)
-			} else if applyFilter { // Log skip reason only if filtering was applied and caused the skip
-				if filterMode == "allow" {
-					log.Printf("<%s> Skipping tool %s (not in allowlist)", c.name, tool.Name)
-				} else { // filterMode == "block"
-					log.Printf("<%s> Skipping blocked tool %s", c.name, tool.Name)
-				}
 			}
 		}
 		if tools.NextCursor == "" {
 			break
 		}
 		toolsRequest.Params.Cursor = tools.NextCursor
 	}
+
 	return nil
 }
 

config.go

@@ -82,16 +82,23 @@ func parseMCPClientConfigV1(conf *MCPClientConfigV1) (any, error) {
 
 // ---- V2 ----
 
+type ToolFilterMode string
+
+const (
+	ToolFilterModeAllow ToolFilterMode = "allow"
+	ToolFilterModeBlock ToolFilterMode = "block"
+)
+
 type ToolFilterConfig struct {
-	Mode string   `json:"mode,omitempty"` // 过滤模式 ("allow" or "block")
-	List []string `json:"list,omitempty"` // 用于过滤的工具列表
+	Mode ToolFilterMode `json:"mode,omitempty"`
+	List []string       `json:"list,omitempty"`
 }
 
 type OptionsV2 struct {
 	PanicIfInvalid optional.Field[bool] `json:"panicIfInvalid,omitempty"`
 	LogEnabled     optional.Field[bool] `json:"logEnabled,omitempty"`
 	AuthTokens     []string             `json:"authTokens,omitempty"`
-	ToolFilter     *ToolFilterConfig    `json:"toolFilter,omitempty"` // 工具过滤配置
+	ToolFilter     *ToolFilterConfig    `json:"toolFilter,omitempty"`
 }
 
 type MCPProxyConfigV2 struct {

config.json

@@ -21,6 +21,14 @@
       ],
       "env": {
         "GITHUB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>"
+      },
+      "options": {
+        "toolFilter": {
+          "mode": "block",
+          "list": [
+            "create_or_update_file"
+          ]
+        }
       }
     },
     "fetch": {

go.mod

@@ -7,7 +7,7 @@ toolchain go1.23.7
 require (
 	github.com/TBXark/confstore v0.0.3
 	github.com/TBXark/optional-go v0.0.1
-	github.com/mark3labs/mcp-go v0.23.1
+	github.com/mark3labs/mcp-go v0.24.1
 	golang.org/x/sync v0.13.0
 )
 

go.sum

@@ -14,8 +14,8 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mark3labs/mcp-go v0.23.1 h1:RzTzZ5kJ+HxwnutKA4rll8N/pKV6Wh5dhCmiJUu5S9I=
-github.com/mark3labs/mcp-go v0.23.1/go.mod h1:rXqOudj/djTORU/ThxYx8fqEVj/5pvTuuebQ2RC7uk4=
+github.com/mark3labs/mcp-go v0.24.1 h1:YV+5X/+W4oBdERLWgiA1uR7AIvenlKJaa5V4hqufI7E=
+github.com/mark3labs/mcp-go v0.24.1/go.mod h1:rXqOudj/djTORU/ThxYx8fqEVj/5pvTuuebQ2RC7uk4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=