Fusion18 Secure Gateway
Proof of concept v1a · secure MCP access layer for Microsoft 365 Copilot
Endpoints
| Path | Purpose |
|---|---|
/mcp/ | MCP server (streamable HTTP). Requires an Entra-style bearer token. |
/healthz | Liveness check (public). |
/idp/jwks | Public signing keys of the mock identity provider. |
/idp/token | Mints test tokens. Disabled without the demo secret. |
Tools
| Tool | Required role |
|---|---|
read_workbook | Spreadsheet.Read |
analyze_spreadsheet | Spreadsheet.Read |
Security checks on every call
- Token signature, issuer, audience, expiry and tenant
- Tool-level role check, before anything runs
- Resource-level check with the caller’s own permissions
- One audit record per call, allowed or denied, with no tokens or contents
Demo environment: identities and files are simulated. Real Entra ID, Microsoft Graph and Copilot packaging come in v2a.