mcp_authorization v0.7.1

12. Serve different tool surfaces from one app (domains)

One Rails app, but you want a recruiting tool surface and an operations tool surface at different URLs, each exposing its own set of tools.

Problem. One Rails app, but you want a recruiting tool surface and an operations tool surface at different URLs, each exposing its own set of tools.

Solution. Tag tools with one or more domains; route by the :domain path segment.

class FetchLatestApplicantTool < McpAuthorization::Tool
  tool_name "fetch_latest_applicant"
  tags "recruiting"                    # only on /mcp/recruiting
  dynamic_contract Workflows::FetchLatestApplicant
end

class ReconcileLedgerTool < McpAuthorization::Tool
  tool_name "reconcile_ledger"
  tags "operations", "finance"          # on both /mcp/operations and /mcp/finance
  dynamic_contract Ops::ReconcileLedger
end

Result.

POST /mcp/recruiting   -> tools tagged "recruiting"
POST /mcp/operations   -> tools tagged "operations"
POST /mcp              -> tools tagged with config.default_domain

Point different MCP clients at different URLs. Untagged tools default to ["default"]. Domain filtering composes with everything above โ€” a tool must match the domain and pass its gates.

Collected from COOKBOOK.md in the repository. Edit it there, not here.