How mizcausevic-dev/mcp-policy-lab works
Purpose and principal workflow
MCP Policy Lab is a FastAPI control surface that scores a sample inventory of MCP servers and tools, classifies server posture as stable, review, or contain, and presents operator-facing summaries and review queues. The main workflow begins when an operator or API client makes an HTTP request: FastAPI routes either request a rendered HTML view or obtain policy results and return JSON. The sample inventory is loaded from a local JSON file; the sampled code does not connect to live MCP servers or persist operator decisions.
Components
HTTP entry and API
• FastAPI routes — app/main.py: Defines the application and HTML and JSON endpoints; initializes a PolicyService instance and delegates page rendering and API responses.
Operator presentation
• HTML review surfaces — app/render.py: Builds the overview, policy queue, tool matrix, audit, and API-summary pages from policy data, including operator-oriented risk and coverage displays.
Policy evaluation
• Policy service — app/services/policy_service.py: Loads inventory, evaluates server risk and posture, and derives dashboard summaries, server details, tool matrices, review queues, and sample payloads.
Inventory input
• Sample policy inventory — app/data/sample_policy_data.json: Supplies the local server and tool records used to calculate posture; this is sample input, not evidence of a live MCP connection.
External caller
• Operator or API client — null: External HTTP caller that initiates the documented HTML or JSON request workflow.
Relationships
• Operator or API client -> FastAPI routes: Sends an HTTP request to an application endpoint; routes are defined in app/main.py.
• FastAPI routes -> HTML review surfaces: Calls the relevant render function for HTML page requests.
• FastAPI routes -> Policy service: Calls service methods to fulfill JSON endpoints, including summary, catalog, detail, tool, evaluation, and sample requests.
• HTML review surfaces -> Policy service: Calls service methods to assemble page data; the renderer also builds its own service instance.
• Policy service -> Sample policy inventory: Reads and parses the JSON inventory when constructing a service instance.
Coverage limits
The source excerpts establish the route, rendering, evaluation, and inventory-loading flow, but do not show every renderer implementation detail. The repository documents SVG proof assets generated from service state, but the sampled asset-generation script is partial, so its complete rendering flow is not mapped here. No sampled code establishes live MCP connectivity, a database, or persistent policy state.
Main entry points: main.py FastAPI routes · policy_service.py Policy service · render.py HTML review surfaces · sample_policy_data.json Sample policy inventory
Components 5
HTTP entry and API
- FastAPI routes
app/main.py
Operator presentation
- HTML review surfaces
app/render.py
Policy evaluation
- Policy service
app/services/policy_service.py
Inventory input
- Sample policy inventory · Local sample records; not a live MCP connection.
app/data/sample_policy_data.json
Other components
- Operator or API client
Connections 5
- Operator or API client → FastAPI routes: HTTP request
- FastAPI routes → HTML review surfaces: renders pages
- FastAPI routes → Policy service: calls methods · Fulfills JSON endpoints.
- HTML review surfaces → Policy service: calls methods · Assembles page data; the renderer also creates its own service instance.
- Policy service → Sample policy inventory: reads JSON · When constructing a service instance.