How to Implement MCP Authorization: A Complete Security Guide

// MCP Authorization Architecture
class MCPAuthorizationSystem {
  constructor() {
    this.tokenValidator = new MCPTokenValidator();
    this.permissionEngine = new MCPPermissionEngine();
    this.sessionManager = new MCPSessionManager();
    this.auditLogger = new MCPAuditLogger();
    this.policyEngine = new MCPPolicyEngine();
  }

  async authorizeRequest(request) {
    // 1. Validate authentication token
    const identity = await this.tokenValidator.validate(request.token);
    
    // 2. Create or retrieve session
    const session = await this.sessionManager.getSession(identity.userId);
    
    // 3. Evaluate permissions for requested operation
    const permitted = await this.permissionEngine.evaluate({
      user: identity,
      session: session,
      operation: request.operation,
      context: request.context
    });

    // 4. Log authorization decision
    await this.auditLogger.log({
      userId: identity.userId,
      operation: request.operation,
      result: permitted ? 'GRANTED' : 'DENIED',
      timestamp: new Date()
    });

    return permitted;
  }
}

// OAuth 2.0 implementation for MCP
class MCPOAuthProvider {
  constructor() {
    this.scopes = {
      'mcp:read': 'Read access to MCP resources',
      'mcp:write': 'Write access to MCP resources',
      'mcp:tools:execute': 'Execute MCP tools',
      'mcp:admin': 'Administrative access',
      'mcp:delegate': 'Allow delegation to AI agents'
    };
  }

  async generateAuthorizationUrl(clientId, redirectUri, scopes) {
    const state = this.generateSecureState();
    const codeChallenge = this.generatePKCEChallenge();
    
    const params = new URLSearchParams({
      response_type: 'code',
      client_id: clientId,
      redirect_uri: redirectUri,
      scope: scopes.join(' '),
      state: state,
      code_challenge: codeChallenge,
      code_challenge_method: 'S256'
    });

    return `https://auth.yourdomain.com/oauth/authorize?${params}`;
  }

  async exchangeCodeForToken(code, clientId, clientSecret, codeVerifier) {
    const response = await fetch('https://auth.yourdomain.com/oauth/token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`
      },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code: code,
        code_verifier: codeVerifier,
        scope: 'mcp:delegate mcp:tools:execute'
      })
    });

    const tokenData = await response.json();
    
    if (!response.ok) {
      throw new Error(`OAuth token exchange failed: ${tokenData.error}`);
    }

    return {
      accessToken: tokenData.access_token,
      refreshToken: tokenData.refresh_token,
      expiresIn: tokenData.expires_in,
      scopes: tokenData.scope.split(' ')
    };
  }

  generateSecureState() {
    return require('crypto').randomBytes(32).toString('base64url');
  }

  generatePKCEChallenge() {
    const codeVerifier = require('crypto').randomBytes(32).toString('base64url');
    const codeChallenge = require('crypto')
      .createHash('sha256')
      .update(codeVerifier)
      .digest('base64url');
    
    return { codeVerifier, codeChallenge };
  }
}

// JWT token validation for MCP
class MCPTokenValidator {
  constructor() {
    this.publicKey = process.env.JWT_PUBLIC_KEY;
    this.tokenCache = new Map();
  }

  async validate(token) {
    // Check cache first
    if (this.tokenCache.has(token)) {
      const cached = this.tokenCache.get(token);
      if (cached.expiresAt > Date.now()) {
        return cached.identity;
      }
      this.tokenCache.delete(token);
    }

    try {
      const jwt = require('jsonwebtoken');
      const decoded = jwt.verify(token, this.publicKey, {
        algorithms: ['RS256'],
        issuer: 'https://auth.yourdomain.com',
        audience: 'mcp-server'
      });

      const identity = {
        userId: decoded.sub,
        username: decoded.username,
        email: decoded.email,
        scopes: decoded.scope?.split(' ') || [],
        roles: decoded.roles || [],
        sessionId: decoded.sid,
        issuedAt: decoded.iat,
        expiresAt: decoded.exp * 1000
      };

      // Cache valid token
      this.tokenCache.set(token, {
        identity,
        expiresAt: identity.expiresAt
      });

      return identity;
    } catch (error) {
      throw new Error(`Token validation failed: ${error.message}`);
    }
  }

  async introspectToken(token) {
    // For opaque tokens, use introspection endpoint
    const response = await fetch('https://auth.yourdomain.com/oauth/introspect', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Bearer ${process.env.INTROSPECTION_TOKEN}`
      },
      body: new URLSearchParams({ token })
    });

    const result = await response.json();
    
    if (!result.active) {
      throw new Error('Token is not active');
    }

    return {
      userId: result.sub,
      scopes: result.scope?.split(' ') || [],
      expiresAt: result.exp * 1000,
      clientId: result.client_id
    };
  }
}

// RBAC system designed for MCP operations
class MCPPermissionEngine {
  constructor() {
    this.roles = {
      'mcp-user': {
        permissions: [
          'mcp:tools:read',
          'mcp:tools:execute:basic',
          'mcp:resources:read:own'
        ],
        restrictions: {
          maxToolChainLength: 3,
          allowedTools: ['search', 'read-file', 'calculator']
        }
      },
      'mcp-power-user': {
        permissions: [
          'mcp:tools:read',
          'mcp:tools:execute:advanced',
          'mcp:resources:read:team',
          'mcp:resources:write:own'
        ],
        restrictions: {
          maxToolChainLength: 5,
          allowedTools: ['*'],
          excludedTools: ['admin', 'system']
        }
      },
      'mcp-admin': {
        permissions: [
          'mcp:*'
        ],
        restrictions: {
          maxToolChainLength: 10,
          allowedTools: ['*']
        }
      }
    };

    this.toolPermissions = {
      'database-query': {
        requiredPermissions: ['mcp:tools:execute:advanced'],
        additionalChecks: ['database-access']
      },
      'file-system': {
        requiredPermissions: ['mcp:tools:execute:basic'],
        additionalChecks: ['file-path-validation']
      },
      'external-api': {
        requiredPermissions: ['mcp:tools:execute:advanced'],
        additionalChecks: ['api-quota-check']
      }
    };
  }

  async evaluate(authContext) {
    const { user, operation, context } = authContext;

    // Get user roles and permissions
    const userPermissions = this.getUserPermissions(user.roles);
    
    // Check if user has required permissions for operation
    if (!this.hasRequiredPermissions(userPermissions, operation)) {
      return { granted: false, reason: 'Insufficient permissions' };
    }

    // Evaluate tool-specific restrictions
    if (operation.type === 'tool-execution') {
      const toolCheck = await this.evaluateToolPermissions(
        operation.toolName,
        userPermissions,
        context
      );
      
      if (!toolCheck.granted) {
        return toolCheck;
      }
    }

    // Check context-specific restrictions
    const contextCheck = await this.evaluateContextRestrictions(
      user,
      operation,
      context
    );

    return contextCheck;
  }

  getUserPermissions(roles) {
    const permissions = new Set();
    const restrictions = {};

    roles.forEach(roleName => {
      const role = this.roles[roleName];
      if (role) {
        role.permissions.forEach(perm => permissions.add(perm));
        Object.assign(restrictions, role.restrictions);
      }
    });

    return { permissions: Array.from(permissions), restrictions };
  }

  async evaluateToolPermissions(toolName, userPermissions, context) {
    const toolConfig = this.toolPermissions[toolName];
    
    if (!toolConfig) {
      return { granted: false, reason: `Unknown tool: ${toolName}` };
    }

    // Check required permissions
    const hasPermissions = toolConfig.requiredPermissions.every(perm =>
      userPermissions.permissions.includes(perm) ||
      userPermissions.permissions.includes('mcp:*')
    );

    if (!hasPermissions) {
      return { 
        granted: false, 
        reason: `Missing required permissions for ${toolName}` 
      };
    }

    // Run additional checks
    for (const checkName of toolConfig.additionalChecks) {
      const checkResult = await this.runAdditionalCheck(checkName, context);
      if (!checkResult.passed) {
        return { granted: false, reason: checkResult.reason };
      }
    }

    return { granted: true };
  }

  async runAdditionalCheck(checkName, context) {
    switch (checkName) {
      case 'database-access':
        return this.checkDatabaseAccess(context);
      case 'file-path-validation':
        return this.validateFilePath(context);
      case 'api-quota-check':
        return this.checkAPIQuota(context);
      default:
        return { passed: false, reason: `Unknown check: ${checkName}` };
    }
  }

  async checkDatabaseAccess(context) {
    // Implement database access validation
    const { query, database } = context.parameters;
    
    // Check if query is read-only
    const isReadOnly = /^SELECT\s/i.test(query.trim());
    if (!isReadOnly && !context.user.permissions.includes('mcp:database:write')) {
      return { passed: false, reason: 'Write operations not permitted' };
    }

    // Check database access permissions
    const allowedDatabases = context.user.allowedDatabases || [];
    if (!allowedDatabases.includes(database)) {
      return { passed: false, reason: 'Database access not permitted' };
    }

    return { passed: true };
  }
}

// Session management for MCP with AI agent considerations
class MCPSessionManager {
  constructor() {
    this.sessions = new Map();
    this.sessionTimeout = 24 * 60 * 60 * 1000; // 24 hours
    this.maxConcurrentSessions = 5;
  }

  async createSession(userId, authToken, agentContext) {
    // Cleanup expired sessions
    await this.cleanupExpiredSessions(userId);

    // Check concurrent session limit
    const userSessions = Array.from(this.sessions.values())
      .filter(s => s.userId === userId && !s.expired);
    
    if (userSessions.length >= this.maxConcurrentSessions) {
      throw new Error('Maximum concurrent sessions exceeded');
    }

    const sessionId = require('crypto').randomUUID();
    const session = {
      sessionId,
      userId,
      authToken,
      agentContext: {
        agentType: agentContext.agentType, // 'claude', 'chatgpt', 'cursor'
        version: agentContext.version,
        capabilities: agentContext.capabilities
      },
      permissions: await this.calculateSessionPermissions(userId, agentContext),
      toolHistory: [],
      createdAt: new Date(),
      lastActivity: new Date(),
      expired: false
    };

    this.sessions.set(sessionId, session);
    
    // Set automatic expiration
    setTimeout(() => {
      this.expireSession(sessionId);
    }, this.sessionTimeout);

    return session;
  }

  async getSession(sessionId) {
    const session = this.sessions.get(sessionId);
    
    if (!session || session.expired) {
      throw new Error('Session not found or expired');
    }

    // Update last activity
    session.lastActivity = new Date();
    
    return session;
  }

  async updateSessionPermissions(sessionId, newPermissions) {
    const session = await this.getSession(sessionId);
    
    // Log permission changes for audit
    console.log('Session permissions updated:', {
      sessionId,
      userId: session.userId,
      oldPermissions: session.permissions,
      newPermissions,
      timestamp: new Date()
    });

    session.permissions = newPermissions;
    return session;
  }

  async calculateSessionPermissions(userId, agentContext) {
    // Base permissions from user roles
    const userPermissions = await this.getUserBasePermissions(userId);
    
    // Apply agent-specific restrictions
    const agentRestrictions = this.getAgentRestrictions(agentContext.agentType);
    
    return this.combinePermissions(userPermissions, agentRestrictions);
  }

  getAgentRestrictions(agentType) {
    const restrictions = {
      'claude': {
        maxToolChainLength: 10,
        allowedOperations: ['read', 'write', 'execute'],
        rateLimit: { requests: 100, window: 3600 }
      },
      'chatgpt': {
        maxToolChainLength: 5,
        allowedOperations: ['read', 'execute'],
        rateLimit: { requests: 50, window: 3600 }
      },
      'cursor': {
        maxToolChainLength: 3,
        allowedOperations: ['read', 'write'],
        rateLimit: { requests: 200, window: 3600 }
      }
    };

    return restrictions[agentType] || restrictions['claude'];
  }
}

// API Key management for MCP service authentication
class MCPAPIKeyManager {
  constructor() {
    this.apiKeys = new Map();
    this.keyPrefix = 'mcp_';
    this.keyLength = 32;
  }

  async generateAPIKey(serviceId, permissions, expiresIn = null) {
    const keyId = require('crypto').randomUUID();
    const keySecret = this.keyPrefix + require('crypto')
      .randomBytes(this.keyLength)
      .toString('base64url');

    const hashedSecret = await this.hashAPIKey(keySecret);
    
    const apiKey = {
      keyId,
      serviceId,
      hashedSecret,
      permissions,
      createdAt: new Date(),
      expiresAt: expiresIn ? new Date(Date.now() + expiresIn) : null,
      lastUsed: null,
      usageCount: 0,
      active: true
    };

    this.apiKeys.set(keyId, apiKey);

    // Return the unhashed key only once
    return {
      keyId,
      apiKey: keySecret,
      permissions,
      expiresAt: apiKey.expiresAt
    };
  }

  async validateAPIKey(keySecret) {
    const hashedKey = await this.hashAPIKey(keySecret);
    
    for (const [keyId, apiKey] of this.apiKeys) {
      if (apiKey.hashedSecret === hashedKey && apiKey.active) {
        // Check expiration
        if (apiKey.expiresAt && apiKey.expiresAt < new Date()) {
          apiKey.active = false;
          throw new Error('API key expired');
        }

        // Update usage statistics
        apiKey.lastUsed = new Date();
        apiKey.usageCount++;

        return {
          keyId,
          serviceId: apiKey.serviceId,
          permissions: apiKey.permissions
        };
      }
    }

    throw new Error('Invalid API key');
  }

  async hashAPIKey(keySecret) {
    return require('crypto')
      .createHash('sha256')
      .update(keySecret)
      .digest('hex');
  }

  async revokeAPIKey(keyId) {
    const apiKey = this.apiKeys.get(keyId);
    if (apiKey) {
      apiKey.active = false;
      apiKey.revokedAt = new Date();
    }
  }

  async rotateAPIKey(keyId) {
    const oldKey = this.apiKeys.get(keyId);
    if (!oldKey) {
      throw new Error('API key not found');
    }

    // Generate new key with same permissions
    const newKey = await this.generateAPIKey(
      oldKey.serviceId,
      oldKey.permissions,
      oldKey.expiresAt ? oldKey.expiresAt.getTime() - Date.now() : null
    );

    // Mark old key for rotation (grace period)
    oldKey.rotatedAt = new Date();
    oldKey.replacedBy = newKey.keyId;

    return newKey;
  }
}

// Context-aware authorization for complex MCP operations
class MCPContextualAuthorizer {
  constructor() {
    this.permissionPolicies = new Map();
    this.contextEvaluators = new Map();
  }

  async evaluatePermission(request) {
    const {
      user,
      operation,
      context,
      toolChain,
      sessionHistory
    } = request;

    // Base permission check
    const basePermitted = await this.checkBasePermissions(user, operation);
    if (!basePermitted) {
      return { granted: false, reason: 'Base permissions denied' };
    }

    // Context-specific evaluation
    const contextResult = await this.evaluateContext(context, user);
    if (!contextResult.granted) {
      return contextResult;
    }

    // Tool chain validation
    const chainResult = await this.validateToolChain(toolChain, user);
    if (!chainResult.granted) {
      return chainResult;
    }

    // Time and resource-based checks
    const resourceResult = await this.checkResourceConstraints(user, operation);
    if (!resourceResult.granted) {
      return resourceResult;
    }

    return { granted: true, constraints: this.buildConstraints(request) };
  }

  async evaluateContext(context, user) {
    // Data classification check
    const dataClassification = await this.classifyData(context.data);
    const userClearance = user.dataClearance || 'public';

    const clearanceLevels = ['public', 'internal', 'confidential', 'restricted'];
    const userLevel = clearanceLevels.indexOf(userClearance);
    const dataLevel = clearanceLevels.indexOf(dataClassification);

    if (dataLevel > userLevel) {
      return {
        granted: false,
        reason: `Insufficient data clearance. Required: ${dataClassification}, User: ${userClearance}`
      };
    }

    // Location-based restrictions
    if (context.location && !this.isLocationAllowed(context.location, user)) {
      return {
        granted: false,
        reason: 'Operation not permitted from current location'
      };
    }

    // Time-based restrictions
    if (!this.isTimeAllowed(user)) {
      return {
        granted: false,
        reason: 'Operation not permitted at current time'
      };
    }

    return { granted: true };
  }

  async validateToolChain(toolChain, user) {
    const maxChainLength = user.restrictions?.maxToolChainLength || 5;
    
    if (toolChain.length > maxChainLength) {
      return {
        granted: false,
        reason: `Tool chain too long. Max: ${maxChainLength}, Requested: ${toolChain.length}`
      };
    }

    // Check for dangerous tool combinations
    const dangerousCombinations = [
      ['database-write', 'external-api'],
      ['file-delete', 'admin-tools'],
      ['user-impersonation', 'privilege-escalation']
    ];

    for (const combination of dangerousCombinations) {
      if (combination.every(tool => toolChain.includes(tool))) {
        return {
          granted: false,
          reason: `Dangerous tool combination detected: ${combination.join(', ')}`
        };
      }
    }

    // Progressive privilege verification
    let currentPrivilegeLevel = 0;
    for (const tool of toolChain) {
      const toolPrivilege = this.getToolPrivilegeLevel(tool);
      
      if (toolPrivilege > currentPrivilegeLevel + 1) {
        return {
          granted: false,
          reason: `Privilege escalation detected in tool chain at: ${tool}`
        };
      }
      
      currentPrivilegeLevel = Math.max(currentPrivilegeLevel, toolPrivilege);
    }

    return { granted: true };
  }

  buildConstraints(request) {
    return {
      maxExecutionTime: 60000, // 1 minute
      maxDataSize: 10 * 1024 * 1024, // 10MB
      allowedDomains: request.user.allowedDomains || [],
      auditRequired: true,
      rateLimits: {
        requests: 100,
        window: 3600
      }
    };
  }
}

// Specialized authorization for Claude Code MCP integrations
class ClaudeCodeMCPAuth {
  constructor() {
    this.codeExecutionPolicies = {
      'read-only': {
        allowedOperations: ['file-read', 'directory-list', 'git-status'],
        restrictions: ['no-write', 'no-execute', 'no-network']
      },
      'development': {
        allowedOperations: ['file-read', 'file-write', 'git-operations', 'npm-install'],
        restrictions: ['sandbox-only', 'no-system-calls']
      },
      'full-access': {
        allowedOperations: ['*'],
        restrictions: ['audit-required', 'approval-required']
      }
    };
  }

  async authorizeCodeOperation(request) {
    const { user, operation, codeContext } = request;

    // Get user's code execution policy
    const policy = this.codeExecutionPolicies[user.codePolicy || 'read-only'];

    // Check if operation is allowed
    if (!this.isOperationAllowed(operation.type, policy.allowedOperations)) {
      return {
        granted: false,
        reason: `Operation ${operation.type} not allowed under ${user.codePolicy} policy`
      };
    }

    // Validate code safety
    const safetyCheck = await this.validateCodeSafety(operation.code);
    if (!safetyCheck.safe) {
      return {
        granted: false,
        reason: `Code safety violation: ${safetyCheck.reason}`
      };
    }

    // Check sandbox requirements
    if (policy.restrictions.includes('sandbox-only')) {
      if (!codeContext.sandboxed) {
        return {
          granted: false,
          reason: 'Code execution must be sandboxed'
        };
      }
    }

    return { granted: true, policy: policy };
  }

  async validateCodeSafety(code) {
    // Check for dangerous patterns
    const dangerousPatterns = [
      /eval\s*\(/,
      /exec\s*\(/,
      /system\s*\(/,
      /require\s*\(\s*['"]child_process['"]\s*\)/,
      /import\s+.*\s+from\s+['"]child_process['"]/,
      /fs\.unlinkSync/,
      /fs\.rmdirSync/
    ];

    for (const pattern of dangerousPatterns) {
      if (pattern.test(code)) {
        return {
          safe: false,
          reason: `Dangerous pattern detected: ${pattern.source}`
        };
      }
    }

    return { safe: true };
  }
}

// Authorization for LangChain MCP workflows
class LangChainMCPAuth {
  constructor() {
    this.chainPolicies = {
      'basic': {
        maxChainLength: 3,
        allowedAgents: ['search', 'calculator', 'summarizer'],
        memoryRestrictions: 'session-only'
      },
      'advanced': {
        maxChainLength: 10,
        allowedAgents: ['*'],
        excludedAgents: ['code-executor', 'file-system'],
        memoryRestrictions: 'persistent-allowed'
      },
      'enterprise': {
        maxChainLength: 50,
        allowedAgents: ['*'],
        memoryRestrictions: 'full-persistence',
        auditRequired: true
      }
    };
  }

  async authorizeChainExecution(request) {
    const { user, chain, memory } = request;
    const policy = this.chainPolicies[user.chainPolicy || 'basic'];

    // Validate chain length
    if (chain.length > policy.maxChainLength) {
      return {
        granted: false,
        reason: `Chain too long: ${chain.length} > ${policy.maxChainLength}`
      };
    }

    // Validate agents in chain
    for (const agent of chain) {
      if (!this.isAgentAllowed(agent.type, policy)) {
        return {
          granted: false,
          reason: `Agent ${agent.type} not allowed`
        };
      }
    }

    // Validate memory usage
    const memoryCheck = this.validateMemoryPolicy(memory, policy);
    if (!memoryCheck.valid) {
      return {
        granted: false,
        reason: memoryCheck.reason
      };
    }

    return { granted: true };
  }
}

// Audit logging for MCP authorization events
class MCPAuditLogger {
  constructor() {
    this.auditStream = require('fs').createWriteStream('mcp-audit.log', { flags: 'a' });
  }

  async log(event) {
    const auditEntry = {
      timestamp: new Date().toISOString(),
      eventId: require('crypto').randomUUID(),
      ...event
    };

    // Write to file
    this.auditStream.write(JSON.stringify(auditEntry) + '\n');

    // Send to SIEM if configured
    if (process.env.SIEM_ENDPOINT) {
      await this.sendToSIEM(auditEntry);
    }

    // Trigger alerts for high-risk events
    if (this.isHighRiskEvent(event)) {
      await this.triggerAlert(auditEntry);
    }
  }

  isHighRiskEvent(event) {
    const highRiskIndicators = [
      event.result === 'DENIED' && event.operation.includes('admin'),
      event.authFailureCount > 5,
      event.operation.includes('privilege-escalation'),
      event.toolChain?.length > 10
    ];

    return highRiskIndicators.some(indicator => indicator);
  }

  async generateComplianceReport(startDate, endDate) {
    // Implementation for compliance reporting
    const events = await this.getEventsByDateRange(startDate, endDate);
    
    return {
      totalEvents: events.length,
      authSuccesses: events.filter(e => e.result === 'GRANTED').length,
      authFailures: events.filter(e => e.result === 'DENIED').length,
      highRiskEvents: events.filter(e => this.isHighRiskEvent(e)).length,
      topUsers: this.getTopUsers(events),
      topOperations: this.getTopOperations(events)
    };
  }
}

// Testing framework for MCP authorization
class MCPAuthorizationTester {
  constructor(authSystem) {
    this.authSystem = authSystem;
    this.testCases = [];
  }

  addTestCase(name, request, expectedResult) {
    this.testCases.push({ name, request, expectedResult });
  }

  async runAllTests() {
    const results = [];

    for (const testCase of this.testCases) {
      try {
        const result = await this.authSystem.authorizeRequest(testCase.request);
        const passed = result.granted === testCase.expectedResult.granted;
        
        results.push({
          name: testCase.name,
          passed,
          expected: testCase.expectedResult,
          actual: result
        });
      } catch (error) {
        results.push({
          name: testCase.name,
          passed: false,
          error: error.message
        });
      }
    }

    return results;
  }

  // Predefined test scenarios
  createStandardTestSuite() {
    // Valid user with proper permissions
    this.addTestCase('Valid User - Basic Operation', {
      token: 'valid-token',
      operation: { type: 'tool-execution', toolName: 'search' },
      context: {}
    }, { granted: true });

    // Invalid token
    this.addTestCase('Invalid Token', {
      token: 'invalid-token',
      operation: { type: 'tool-execution', toolName: 'search' },
      context: {}
    }, { granted: false });

    // Privilege escalation attempt
    this.addTestCase('Privilege Escalation', {
      token: 'basic-user-token',
      operation: { type: 'tool-execution', toolName: 'admin-delete' },
      context: {}
    }, { granted: false });

    // Tool chain length violation
    this.addTestCase('Tool Chain Too Long', {
      token: 'valid-token',
      operation: { 
        type: 'tool-chain', 
        toolChain: new Array(20).fill('basic-tool') 
      },
      context: {}
    }, { granted: false });
  }
}