Vengtoo authorization plugin for IBM ContextForge

A native ContextForge MCP Gateway plugin that authorizes every MCP tool call against Vengtoo. It hooks tool_pre_invoke, forwards the call to Vengtoo's decision endpoint, and blocks the invocation when policy denies it.

The plugin calls the same ext_authz endpoint any gateway uses: it's a thin Policy Enforcement Point, and our policy engine is untouched.

Verified

The plugin has been loaded and invoked through ContextForge's real cpex.framework.PluginManager (gateway 1.0.6 / cpex 0.1.2): real registration, real tool_pre_invoke dispatch, real block-on-violation.

Install

1. Copy the vengtoo_authz plugin package into your ContextForge plugins/ tree.
2. Add the plugin entry under plugins: in your plugins/config.yaml. Use mode: enforce to block (permissive only logs) and a low priority so authorization runs first.
3. Export your key in the gateway environment (never in the config):

   export VENGTOO_API_KEY=vgt_live_...

4. Restart the gateway. Denied tool calls return a VENGTOO_DENY violation.

Configuration

Key	Default	Meaning
endpoint	https://pdp.vengtoo.com/mcp/v1/ext-authz	Vengtoo decision endpoint
api_key_env	VENGTOO_API_KEY	Env var holding the API key
subject	(gateway user)	Agent identity asserted to the PDP. Omit to use the request's authenticated user.
subject_type	ai_agent	Subject type
timeout	5.0	PDP request timeout (seconds)
fail_open	false	If the PDP is unreachable: deny (false) or allow (true)

By default the plugin fails closed: if Vengtoo can't be reached, the tool call is denied. The deny lands on the destructive SQL, not the tool name: argument-level policy lives in Vengtoo.

Security: Vengtoo does not independently verify the subject

The PEP/gateway MUST set subject (or omit it to use the request's independently authenticated user, not an unverified client-supplied claim) from its OWN authenticated session. Never pass through an unverified client-supplied header or claim as the subject. Doing so allows subject impersonation within your tenant.

Notes

• Framework import. ContextForge moved plugin classes from mcpgateway.plugins.framework to the standalone cpex.framework package (the "CPEX" split, gateway > 1.0.0). The plugin imports from cpex.framework and falls back to the old path for gateways ≤ 1.0.0.
• This is the native (in-process) plugin: the frictionless on-ramp. A decoupled external/hosted variant (matching IBM's own LLMGuard pattern) is tracked separately.
• Install caveat: pin mcp<2. Gateway 1.0.6 / cpex 0.1.2 declare mcp with no upper bound, but mcp 2.0.0 renamed McpError → MCPError, so a fresh install crashes on import. Install mcp<2 mcp-types<2 until the gateway caps it upstream.