authorizeAgent
authorizeAgent():
HookFunction
Defined in: agent.ts:19
A before hook authorizing an agent-token call against the token’s capability scope.
Deny-by-default (reuses @mantlejs/mantle’s matchesCapabilityScope, the same matcher
@mantlejs/mcp’s expose map is built on) — a call whose path+method isn’t covered by the
token’s scope throws Forbidden.
Opt-in per route: this is the only hook that accepts an agent token. authenticate("jwt")
rejects a type: "agent" payload outright, so a route with no authorizeAgent() hook attached
can never be reached with an agent token, no matter what scope it carries.
Skips (passes through) for internal calls — params.provider undefined — matching
authenticate("jwt")’s own convention.