Skip to main content

​
Security and trust boundaries

Public documentation preview — incomplete. The SDK and optional AI SDK peers remain private and unpublished. This guide is not a security certification or substitute for application-owned access controls.
mcprouter is an in-process Node.js SDK, not a hosted security perimeter. The application owns identity, network destinations, secrets, model budgets, and any approval workflow. Start with a synthetic, model-free example; read Router outcomes before introducing side effects.

​
Grant permission to an exact call

Every executable path goes through the same governed call: validate arguments, resolve a current binding, apply policy.authorize, and dispatch only when allowed. execute and AI SDK ToolSet calls supply an expected snapshot. For a direct router.call, expectedSnapshot is optional; pass the schemaHash and bindingGeneration from the current bound descriptor if you require stale-replacement detection. Define policy.eligibility for discoverability and policy.revision for rule changes. Without a policy, a supported call is denied. Filtering, model preferences, read-only annotations and scores are not grants. Populate RequestContext only from authenticated, trusted host state. Check the exact server, original tool name, target resource and arguments against current tenant permissions; do not accept a model-selected customer ID as proof of access. Advance the revision when permissions change. An approval-required outcome does not execute; the host must complete its own explicit approval and revalidation workflow. See shared policy configuration.

​
Bound network and model exposure

  • Treat MCP tool descriptions, schemas and response text as untrusted. Do not construct server URLs, executable commands or model destinations from tool or model output. Use trusted HTTPS endpoints for remote Streamable HTTP, or explicitly provision trusted stdio executables.
  • Named model adapters are host-configured objects, not a built-in {url, key} provider loader. modelAccess restricts model-backed router operations; it does not constrain direct AI SDK generateText calls. Approve their egress, prompt/schema exposure, logging and spending independently. See bindings and AI SDK integration.
  • A bound descriptor’s schema hash and generation protect against stale replacement when passed as the expected snapshot; they are not an automatic check for direct calls that omit it. Filtering raw MCP tool definitions does not register them or make them executable. Refresh/reselect when bindings change, and never substitute a different descriptor after model selection.
  • A timed-out or cancelled call may still have unknown post-dispatch effects. sideEffectState: 'unknown' is not a rollback, and a denied or approval-pending operation is not permission to retry. See outcomes.
The optional AI SDK ToolSet returns full execution results to trusted host code, while its default model-facing output includes only status/code/tool ID. Do not log or send raw result payloads to a model by accident. The docs site itself supplies no sandbox or policy for your host’s own inference requests.