mcp_authorization v0.7.1

4. Hide one input field from some users

advance_step should let managers jump an applicant to any stage via a stage_id param โ€” but operators shouldn't even see that the parameter exists.

Problem. advance_step should let managers jump an applicant to any stage via a stage_id param โ€” but operators shouldn't even see that the parameter exists.

Solution. Tag the param with @requires(:flag) in the #: annotation. The whole tool stays visible; only the field disappears.

#: (
#:   applicant_id: String,
#:   workflow_id: String,
#:   ?stage_id: String?    @requires(:backward_routing)
#: ) -> Hash[Symbol, untyped]
def call(applicant_id:, workflow_id:, stage_id: nil)
  # ...
end

Result.

RoleInput fields the LLM sees
operator (no backward_routing)applicant_id, workflow_id
manager (has backward_routing)applicant_id, workflow_id, stage_id

This is enforced, not cosmetic. If an operator's client sends stage_id in the raw JSON-RPC anyway, the gem strips it before #call runs โ€” the handler sees stage_id: nil. You don't have to re-check can? inside the method.

?stage_id (leading ?) = optional param. String? (trailing ?) = nilable type. Together: optional and may be nil.

Collected from COOKBOOK.md in the repository. Edit it there, not here.