Metadata-Version: 2.5
Name: fastmcp-edge-authz
Version: 0.0.1
Summary: Edge policy enforcement point for FastMCP servers: verifies end-user tokens and applies an allow/deny policy before calling upstreams with a service credential (planned; this release only reserves the name).
Project-URL: Homepage, https://github.com/stephaneberle9/fastmcp-edge-authz
Project-URL: Repository, https://github.com/stephaneberle9/fastmcp-edge-authz
Author-email: Stephan Eberle <stephaneberle9@gmail.com>
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 1 - Planning
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# fastmcp-edge-authz

> [!NOTE]
> Planned, not implemented. The releases published so far only reserve the
> package name on PyPI and contain no code.

`fastmcp-edge-authz` is meant to become the policy enforcement point for
[FastMCP](https://gofastmcp.com) servers that front an upstream API through one
shared service credential, so the upstream cannot tell end users apart. On
every request it will:

1. verify the end user's token from an external identity provider;
2. decide with a configurable allow/deny policy, either a local TOML allowlist
   or a remote policy decision point;
3. write an audit entry naming the user and the decision;
4. drop the end-user identity and call the upstream with the service
   credential.

The framework-neutral parts (principals, decisions, the versioned policy file
and the audit log) come from
[python-edge-authz](https://github.com/stephaneberle9/python-edge-authz). For a
server where each user brings their own upstream credential, see
[fastmcp-edge-byok](https://github.com/stephaneberle9/fastmcp-edge-byok).

## License

MIT
