mcp-schema-registry proxy

The mcp-schema-registry proxy binding forwards every matched tools/call, unmodified, to a single exit — typically an mcp-schema-registry client connected to the schema registry — optionally restricting individual tools or glob patterns to a guarded role first. Unlike client, a proxy binding does not connect to a schema registry or take an options.server of its own, and performs no request translation; it only guards and forwards.

mcp_schema_registry_proxy:
  type: mcp-schema-registry
  kind: proxy
  exit: schema_registry_client
  routes:
    - when:
        - tool: [ register_schema, delete_schema_version, delete_subject, set_compatibility ]
      guarded:
        my_guard:
          - kafka-sr:write
    - when:
        - tool: "*"

Configuration (* required)

exit*

string

Binding every matched tools/call is forwarded to, unconditionally.

exit: schema_registry_client

options

object

Reserved for a future proxy-specific option. Currently has no usable properties.

routes

array of object

Conditional mcp-schema-registry proxy routes, matching by tool name or glob pattern and applying a guarded restriction before forwarding every matched tools/call unmodified to exit. Routes are evaluated in order; the first matching route wins. Omit routes entirely to forward every tools/call to exit unguarded.

routes:
  - when:
      - tool: register_schema
    guarded:
      my_guard:
        - kafka-sr:write
  - when:
      - tool: "*"

routes[].when*

array of object

List of conditions (any match) restricting this route to particular tools. Required.

routes:
  - when:
      - tool: register_schema
      - tool: set_compatibility

when[].tool*

string, array of string

Tool name matched by tools/call, or a * glob pattern matching many tool names in bulk (such as list_*). Required.

routes[].with

object

Reserved for a future per-route override. Currently has no effect: a matched tools/call is always forwarded unmodified.

routes[].guarded

object as map of named array of string

Roles required by the named guard for a tools/call against this route. Roles for the same guard are unioned into one entry; roles naming a different guard add a separate entry that must also authorize.

routes:
  - when:
      - tool: register_schema
    guarded:
      my_guard:
        - kafka-sr:write

telemetry

object

Defines the desired telemetry for the binding.

telemetry.metrics

array

Telemetry metrics to track

telemetry:
  metrics:
    - stream.*

telemetry.attributes

object as map of named string properties

Telemetry attributes to add to the binding metrics.