Reference

Four internal role interfaces in the server module (org.xwiki.contrib.llm.mcp.internal) centralize authorization and scoping decisions. Tools in the server module use them directly. External modules must use the platform's own authorization APIs.

MCPDocumentAccess

Single sanctioned way to resolve a reference and enforce authorization.

@Role
public interface MCPDocumentAccess {
    DocumentReference resolveAndAuthorize(String reference, Right right)
        throws MCPAccessDeniedException;
}

Applies in order: reach gate → ContextualAuthorizationManager.hasAccess → space filter. Throws MCPAccessDeniedException with an agent-facing refusal message.

MCPSpaceFilter

Applies the MCP space whitelist or blacklist.

@Role
public interface MCPSpaceFilter {
    boolean isAllowed(DocumentReference reference);
    List<String> filterQueries();
}

• isAllowed: per-document check against the configured filter mode and entries.
• filterQueries: Solr filter query clauses for scoping search results.
• Entries: a space covers the space and its whole subtree; a document matches exactly.
• Fails closed on read errors (deny / match-nothing -*:*).

MCPWikiReach

Decides how far an endpoint reaches beyond its own wiki.

@Role
public interface MCPWikiReach {
    boolean isReachEnabled();
    boolean canReachWiki(String wikiId);
    List<String> resolveSearchWikis(String wikiParam);
}

• isReachEnabled: whether this endpoint may cross wikis.
• canReachWiki: whether a specific target wiki is reachable.
• resolveSearchWikis: translates a wiki parameter (blank → current wiki, "all" → whole farm, id → single validated wiki).

Backed by the main-wiki-only reachEnabledWikis list. A reach-enabled endpoint reaches every wiki in the farm regardless of the target's own enable gate, tool toggles, or space filter.

MCPDocumentSearch

Builds a Solr search query scoped to wikis, space filter, and rights.

@Role
public interface MCPDocumentSearch {
    Query createQuery(String statement, List<String> additionalFilterQueries,
                      List<String> targetWikiIds);
}

Uses SecureQuery with checkCurrentUser(true), wiki-scope clauses, and the space filter — the single query path for query_documents.

MCPAccessDeniedException

public class MCPAccessDeniedException extends Exception {
    public MCPAccessDeniedException(String message) { ... }
}

Carries the agent-facing refusal message. Thrown by MCPDocumentAccess.resolveAndAuthorize() and caught by the tool to produce an isError result.