feat(policy): add mcp l7 enforcement

Add MCP-aware JSON-RPC inspection using tower-mcp-types, including strict tool-name enforcement and method/tool policy matching.

Wire MCP options through proto, YAML, provider profiles, OPA/Rego policy evaluation, docs, and the MCP conformance harness.

Signed-off-by: ddurst <267424412+ddurst-nvidia@users.noreply.github.com>

Author: ddurst-nvidia

Cargo.lock

@@ -8,7 +8,7 @@ members = ["crates/*"]
 [workspace.package]
 version = "0.0.0"
 edition = "2024"
-rust-version = "1.88"
+rust-version = "1.90"
 license = "Apache-2.0"
 repository = "https://github.com/NVIDIA/OpenShell"
 
@@ -73,6 +73,7 @@ serde_json = "1"
 serde_yml = "0.0.12"
 toml = "0.8"
 apollo-parser = "0.8.5"
+tower-mcp-types = "0.12.0"
 
 # HTTP client
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }

Cargo.toml

@@ -51,10 +51,13 @@ identifies the calling binary, checks trust-on-first-use binary identity, reject
 unsafe internal destinations, and evaluates the active policy.
 For inspected HTTP traffic, the proxy can enforce REST method/path rules,
 WebSocket upgrade and text-message rules, GraphQL operation rules, and
-JSON-RPC method and params rules on sandbox-to-server request bodies. JSON-RPC
-request inspection buffers up to the endpoint `json_rpc.max_body_bytes` limit.
-Literal dotted keys in JSON-RPC params are rejected before policy evaluation so
-they cannot be confused with flattened nested selector paths.
+MCP or generic JSON-RPC method and params rules on sandbox-to-server request
+bodies. MCP and JSON-RPC inspection buffers up to the endpoint
+`mcp.max_body_bytes` or `json_rpc.max_body_bytes` limit. MCP `tools/call`
+tool names are checked against the spec-recommended syntax by default before
+policy evaluation, with a per-endpoint `mcp.strict_tool_names` compatibility
+opt-out. Literal dotted keys in JSON-RPC params are rejected before policy
+evaluation so they cannot be confused with flattened nested selector paths.
 JSON-RPC responses and server-to-client MCP messages on response or SSE streams
 are relayed but are not currently parsed for policy enforcement.