Stéphane Tailland
2143c5f0bb
A scope authorises a read and says nothing about volume. An agent reads a thousand records in seconds where a person clicks ten, and until now nothing noticed: the token is valid, the tool is permitted, the ACL passes. identifier: credential keys the counter on the sub claim — the end user, whoever is asking on their behalf — so an agent looping under one person's identity spends that person's budget and cannot spend everyone's. Per-route namespace, so a busy catalog cannot exhaust another domain's. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
# A read-volume cap per caller identity.
|
|
#
|
|
# A scope authorises a read and says nothing about volume. An agent reads a
|
|
# thousand records in seconds where a person clicks ten, and the difference is
|
|
# invisible to every control the estate had until now — the token is valid, the
|
|
# tool is permitted, the ACL passes.
|
|
#
|
|
# `identifier: credential` keys the counter on what the openid-connect plugin
|
|
# published as the caller's credential, which is the `sub` claim: the end user,
|
|
# whoever is asking on their behalf. So an agent looping under one person's
|
|
# identity spends that person's budget, and cannot spend everyone's.
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-catalog-mcp-rate-limiting
|
|
namespace: ${NAMESPACE}
|
|
plugin: rate-limiting-advanced
|
|
config:
|
|
identifier: credential
|
|
# Per-route counters. Sharing a namespace across domains would let a busy
|
|
# catalog exhaust the budget for payments.
|
|
namespace: ${NAME}-catalog-mcp
|
|
strategy: local
|
|
sync_rate: -1
|
|
window_type: sliding
|
|
window_size:
|
|
- 60
|
|
limit:
|
|
- ${MCP_READS_PER_MINUTE}
|
|
# Loud rather than silent: a caller that hits the cap is told, and the headers
|
|
# say when it resets. An agent that only sees a 429 with no Retry-After
|
|
# retries immediately and makes it worse.
|
|
hide_client_headers: false
|
|
error_code: 429
|
|
error_message: >-
|
|
Read volume limit reached for this identity. This is a cap on how much can
|
|
be read per minute, not a permission problem.
|