feat(policy): Support MCP Server Wildcards in Policy Engine

[jerop]

Fixes #19653

• Add support for *, __, and *__tool wildcard patterns in policy rules.
• Refine matchesWildcard logic to handle broad categories and specific tool names across servers.
• Update TOML loader to map mcpName to internal composite wildcard patterns.
• Add unit and integration tests for new wildcard matching scenarios.

[gemini-code-assist]

Summary of Changes

Hello @jerop, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the flexibility of the policy engine by introducing advanced wildcard support for Model Context Protocol (MCP) tools. Users can now define more granular or broad policy rules using patterns like *, *__*, and *__toolName, allowing for easier management of tool access across various servers. This change improves the expressiveness of policy configurations and streamlines the process of applying rules to multiple tools or servers without needing to list each one individually.

Highlights

• Expanded Wildcard Support: The policy engine now supports a broader range of wildcard patterns for Model Context Protocol (MCP) tools, including * (any tool), *__* (any tool from any MCP server), and *__toolName (a specific tool across all MCP servers).
• Refined Wildcard Matching Logic: The core matchesWildcard function has been refactored to robustly handle global and composite wildcard patterns, ensuring correct matching based on tool name and server context, and preventing spoofing.
• TOML Loader Integration: The TOML policy loader has been updated to correctly interpret mcpName = "*" rules, transforming them into the appropriate internal composite wildcard patterns for the policy engine.
• Comprehensive Testing: New unit and integration tests have been added to validate the functionality of all new wildcard patterns and ensure their correct behavior within the policy engine.
• Documentation Updates: The policy engine reference documentation has been updated to clearly explain the new wildcard syntax and provide examples for their usage.

Changelog

• docs/reference/policy-engine.md
  • Updated documentation to detail new wildcard patterns for tool names: *, server__*, *__toolName, and *__*.
  • Revised sections on special syntax for MCP tools to include new targeting options for all MCP servers or specific tool names across servers.
• packages/cli/src/config/policy-engine.integration.test.ts
  • Added an integration test case to verify that the global MCP wildcard (*) in settings correctly allows any tool from any MCP server but not built-in tools.
• packages/core/src/policy/policy-engine.test.ts
  • Added unit tests for the global wildcard (*) matching any tool.
  • Added unit tests for the *__* wildcard matching any MCP tool.
  • Added unit tests for the *__tool wildcard matching a specific tool across all servers.
  • Updated existing MCP server wildcard tests to explicitly pass serverName to the engine.check method for more accurate testing.
  • Added test cases for getExcludedTools to ensure it correctly identifies global, MCP category, and tool-specific wildcards.
• packages/core/src/policy/policy-engine.ts
  • Modified isWildcardPattern to recognize global (*) and composite (*__*, server__*, *__tool) wildcards.
  • Removed getWildcardPrefix function as it is no longer needed with the new matching logic.
  • Refactored matchesWildcard to accept serverName and delegate to matchesCompositePattern for __ patterns.
  • Introduced matchesCompositePattern function to handle server__*, *__tool, and *__* patterns, including robustness checks for server context and tool qualification.
  • Added getToolMetadata helper function to extract actual server and unqualified tool names.
  • Updated ruleMatches to use the refactored matchesWildcard function with the serverName parameter.
  • Modified getExcludedTools to pass undefined for serverName when checking processed wildcard patterns.
• packages/core/src/policy/toml-loader.test.ts
  • Added a test case to confirm that mcpName = "*" in TOML is transformed into toolName = "*__*".
  • Added a test case to confirm that mcpName = "*" combined with a specific toolName in TOML is transformed into toolName = "*__<toolName>".

Activity

• No specific review comments or activities have been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Size Change: +757 B (0%)

Total Size: 25.2 MB

ℹ️ View Unchanged

Filename	Size	Change
./bundle/gemini.js	25.2 MB	+757 B (0%)
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B

_{compressed-size-action}

[gemini-code-assist]

Code Review

This pull request introduces powerful wildcard support for the policy engine, including global (*), all-MCP (*__*), and cross-server tool (*__tool) patterns. The implementation is robust, with the core logic in policy-engine.ts cleanly refactored to handle these new cases. The changes are well-supported by a comprehensive suite of new unit and integration tests, and the documentation in policy-engine.md has been updated clearly to reflect the new capabilities. The code quality is high, and I did not find any critical or high-severity issues. Great work!