Shared Client Boundary & Auth Strategy Hook

+44public interface ContrastApiClient {
+45
+46  ApplicationsResponse searchApplications(
+47      String name, String[] tags, List<AppMetadataFilter> metadataFilters, int limit, int offset)
+48      throws Exception;
+49
+50  List<AppMetadataField> getApplicationMetadataFields() throws Exception;
+51
+52  MetadataFilterResponse getSessionMetadata(String appId) throws Exception;
+53
+54  SessionMetadataResponse getLatestSessionMetadata(String appId) throws Exception;
+55
+56  Traces searchVulnerabilities(
+57      TraceFilterBody filters, int limit, int offset, EnumSet<TraceExpandValue> expand)
+58      throws Exception;
+59
+60  // ... 12 more domain methods: getVulnerability, getRules, getLibraryPage,
+61  //     searchAttacks, getProtectRules, getRouteCoverage, getScanProject...
+62
+77  Rules getRules() throws Exception;
+78
+96  ScanProject getScanProject(String projectName) throws Exception;
+97}
    

+22/** Binds transport-specific authentication context for one tool execution. */
+23@FunctionalInterface
+24public interface AuthenticationStrategy {
+25
+26  AutoCloseable authenticate(@Nullable ToolContext toolContext) throws Exception;
+27}
    

+26public abstract class BaseTool {
+27
+28  private static final AutoCloseable NOOP_AUTHENTICATION_SCOPE = () -> {};
+29
+30  private AuthenticationStrategy authenticationStrategy;
+31
+32  @Autowired(required = false)
+33  public final void setAuthenticationStrategy(AuthenticationStrategy authenticationStrategy) {
+34    this.authenticationStrategy = authenticationStrategy;
+35  }
+36
+42  public final boolean isAuthenticationStrategyConfigured() {
+43    return authenticationStrategy != null;
+44  }
+45
+46  protected final AutoCloseable authenticate(@Nullable ToolContext toolContext) throws Exception {
+47    if (authenticationStrategy == null) {
+48      return NOOP_AUTHENTICATION_SCOPE;
+49    }
+50    var scope = authenticationStrategy.authenticate(toolContext);
+51    return scope != null ? scope : NOOP_AUTHENTICATION_SCOPE;
+52  }
    

 73  protected final PaginatedToolResponse<R> executePipeline(
 74      Integer page, Integer pageSize, Supplier<P> paramsSupplier) {
+75    return executePipeline(page, pageSize, paramsSupplier, null);
+76  }
+77
+78  protected final PaginatedToolResponse<R> executePipeline(
+79      Integer page, Integer pageSize,
+80      Supplier<P> paramsSupplier, @Nullable ToolContext toolContext) {
      // ... validation steps unchanged ...
  
      // 5. Execute with auth scope
+106    try (var ignored = authenticate(toolContext)) {
 107      var result = doExecute(pagination, params, collector);
        // ... success response building ...
+     } catch (UnauthorizedException e) { // ... exception handlers ...
    

+49@Service
+50@RequiredArgsConstructor
+51public class SdkApiClient implements ContrastApiClient {
+52
+53  private final ContrastSDKFactory contrastSDKFactory;
+54  private final SDKExtensionFactory sdkExtensionFactory;
+55
+56  @Override
+57  public ApplicationsResponse searchApplications(
+58      String name, String[] tags, List<AppMetadataFilter> metadataFilters, int limit, int offset)
+59      throws Exception {
+60    return sdkExtensionFactory.getSDKExtension()
+61        .getApplicationsFiltered(localOrganization(), name, tags, metadataFilters, limit, offset);
+62  }
+63
+   // ... 19 more methods, each following the same pattern:
+   //   delegate to SDK/SDKExtension, inject localOrganization()
+ 
+130  @Override
+131  public Rules getRules() throws Exception {
+132    return contrastSDKFactory.getSDK().getRules(localOrganization());
+133  }
+134
+186  private String localOrganization() {
+187    return contrastSDKFactory.getOrgId();
+188  }
+189}
    

+25/** Temporary stdio-only bridge for tools that have not migrated to ContrastApiClient yet. */
+26public abstract class LocalSdkPaginatedTool<P extends ToolParams, R> extends PaginatedTool<P, R> {
+27
+28  @Autowired protected ContrastSDKFactory sdkFactory;
+29  @Autowired protected SDKExtensionFactory sdkExtensionFactory;
+30
+31  protected ContrastSDK getContrastSDK()   { return sdkFactory.getSDK(); }
+34  protected String getOrgId()             { return sdkFactory.getOrgId(); }
+38  protected SDKExtension getSDKExtension() { return sdkExtensionFactory.getSDKExtension(); }
+41}
    

-20import com.contrast.labs.ai.mcp.contrast.tool.base.PaginatedTool;
+20import com.contrast.labs.ai.mcp.contrast.tool.base.LocalSdkPaginatedTool;
  ...
-38public class SearchVulnerabilitiesTool extends PaginatedTool<VulnerabilityFilterParams, VulnLight> {
+38public class SearchVulnerabilitiesTool
+39    extends LocalSdkPaginatedTool<VulnerabilityFilterParams, VulnLight> {
    

+28@Test
+29void executePipeline_should_remain_noop_when_authentication_strategy_is_not_configured() {
+30  var events = new ArrayList<String>();
+31  var tool = new RecordingSingleTool(events);
+32  var result = tool.executePipeline(TestParams::valid, null);
+33  assertThat(result.isSuccess()).isTrue();
+34  assertThat(tool.isAuthenticationStrategyConfigured()).isFalse();
+35  assertThat(events).containsExactly("doExecute");
+36}
+37
+41@Test
+42void executePipeline_should_bind_configured_strategy_before_doExecute_and_close_afterward() {
+43  var events = new ArrayList<String>();
+44  var tool = new RecordingSingleTool(events);
+45  var context = new ToolContext(Map.of("requestId", "req-123"));
+46  tool.setAuthenticationStrategy(tc -> {
+47    events.add("authenticate");
+48    assertThat(tc).isSameAs(context);
+49    return () -> events.add("close");
+50  });
+51  var result = tool.executePipeline(TestParams::valid, context);
+52  assertThat(result.isSuccess()).isTrue();
+53  assertThat(events).containsExactly("authenticate", "doExecute", "close");
+54}
    

+44@Test
+45void contrastApiClient_should_be_pure_interface_without_default_or_static_methods() {
+46  assertThat(ContrastApiClient.class.isInterface()).isTrue();
+47  assertThat(ContrastApiClient.class.getDeclaredMethods())
+48      .allSatisfy(method -> {
+49        assertThat(method.isDefault()).isFalse();
+50        assertThat(Modifier.isStatic(method.getModifiers())).isFalse();
+51      });
+52}
+53
+56@Test
+57void contrastApiClient_method_signatures_should_not_expose_auth_or_org_parameters() {
+58  var source = Files.readString(CLIENT_SOURCE, StandardCharsets.UTF_8);
+59  assertThat(FORBIDDEN_AUTH_PARAMETER_TOKENS)
+60      .allSatisfy(token -> assertThat(source).doesNotContain(token));
+61}
    

+1#!/usr/bin/env bash
+2# Temporary S4A slice gate — remove once S4 is proven and boundary checks are covered by CI.
+3set -euo pipefail
+ // ... setup and logging ...
+33./gradlew --no-daemon :contrast-mcp-core:test :contrast-mcp-stdio-app:compileJava
+34
+37assert_not_contains "client_has_no_hidden_auth_or_org_parameters" "${CLIENT_SOURCE}" \
+38  'orgId|organizationId|organizationUuid|bearer|token|apiKey|serviceKey|credential'
+39
+40# For each Java file in core tool/base, assert no local SDK leakage
+41assert_not_contains "core_base_has_no_local_sdk_factory_access" ... \
+42  'ContrastSDKFactory|SDKExtensionFactory|SDKHelper|SdkApiClient|get_scan_results|sarif|SARIF'