RbacToolCallInterceptor
Rasuvaeff\Yii3McpRbacBridge\RbacToolCallInterceptor
Class — Rasuvaeff\Yii3McpRbacBridge — Source
Enforces the RBAC permission from the PermissionMap on every tools/call. Tools without a mapped permission pass through; a mapped tool requires the current identity to hold the permission — a guest (null id) is checked as a guest and denied by any sane RBAC setup (fail-closed).
The denial is a regular MCP tool-error envelope, so the agent sees the reason instead of a transport failure.
Methods
intercept()
php
intercept(Interceptor\ToolCallContext $context, callable $next): mixed