add McpProtection plugin

annot/pom.xml

@@ -90,6 +90,11 @@
             <artifactId>junit-jupiter-engine</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-params</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.hamcrest</groupId>
             <artifactId>hamcrest</artifactId>

annot/src/main/java/com/predic8/membrane/annot/util/JsonPathUtil.java

@@ -0,0 +1,99 @@
+/* Copyright 2026 predic8 GmbH, www.predic8.com
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License. */
+
+package com.predic8.membrane.annot.util;
+
+import com.predic8.membrane.annot.yaml.ParsingContext;
+
+public final class JsonPathUtil {
+
+
+    private JsonPathUtil() {}
+
+    /**
+     * Returns the parent path before the last JSONPath segment.
+     *
+     * @param jsonPath JSONPath created by {@link ParsingContext}
+     * @return parent path without the last segment
+     */
+    public static String getParentPath(String jsonPath) {
+        return jsonPath.substring(0, findLastSegmentStart(jsonPath));
+    }
+
+    /**
+     * Returns the last part of a JSONPath created by {@link ParsingContext}.
+     * <p>
+     * Examples:
+     * {@code $.api.methods} -> {@code methods}
+     * {@code $.api.methods['rpc.echo']} -> {@code rpc.echo}
+     * {@code $.api.methods[0]} -> {@code 0}
+     *
+     * @param jsonPath JSONPath created by {@link ParsingContext}
+     * @return unescaped field name or array index of the last segment
+     */
+    public static String getLastSegment(String jsonPath) {
+        String segment = jsonPath.substring(findLastSegmentStart(jsonPath));
+
+        if (segment.startsWith(".")) {
+            return segment.substring(1);
+        }
+
+        if (isQuotedPropertySegment(segment)) {
+            return decodeQuotedPropertySegment(segment);
+        }
+
+        if (isArrayIndexSegment(segment)) {
+            return segment.substring(1, segment.length() - 1);
+        }
+
+        throw new IllegalArgumentException("Unsupported JSONPath segment: " + segment);
+    }
+
+    private static boolean isQuotedPropertySegment(String segment) {
+        return segment.startsWith("['") && segment.endsWith("']");
+    }
+
+    private static boolean isArrayIndexSegment(String segment) {
+        return segment.startsWith("[") && segment.endsWith("]");
+    }
+
+    /**
+     * Removes JSONPath bracket quoting and unescapes supported characters.
+     */
+    private static String decodeQuotedPropertySegment(String segment) {
+        return segment.substring(2, segment.length() - 2)
+                .replace("\\'", "'")
+
+                .replace("\\\\", "\\");
+    }
+
+    /**
+     * Returns the start index of the last JSONPath segment.
+     */
+    private static int findLastSegmentStart(String jsonPath) {
+        int depth = 0;
+        for (int i = jsonPath.length() - 1; i >= 0; i--) {
+            char c = jsonPath.charAt(i);
+            if (c == ']') {
+                depth++;
+            } else if (c == '[') {
+                depth--;
+            }
+            if (depth == 0 && (c == '.' || c == '[')) {
+                return i;
+            }
+        }
+        throw new IllegalArgumentException("Cannot determine parent path of: " + jsonPath);
+    }
+}

annot/src/main/java/com/predic8/membrane/annot/yaml/ParsingContext.java

@@ -20,6 +20,9 @@
 import org.jetbrains.annotations.*;
 import org.slf4j.*;
 
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
 /**
  * Immutable parsing state passed down while traversing YAML.
  * - context: current element scope used for local type resolution in {@link Grammar}.
@@ -29,6 +32,7 @@
 public record ParsingContext<T extends BeanRegistry & BeanLifecycleManager>(String context, T registry, Grammar grammar, JsonNode topLevel, String path, String key) {
 
     private static final Logger log = LoggerFactory.getLogger(ParsingContext.class);
+    public static final Pattern VALID_PROPERTY_NAME = Pattern.compile("[A-Za-z_][A-Za-z0-9_]*");
 
     public ParsingContext<T> updateContext(String context) {
         return new ParsingContext<>(context, registry, grammar, topLevel, path,key);
@@ -96,7 +100,7 @@ public String getPath() {
      * such as `.` or `'` that JSONPath would otherwise interpret as syntax.
      */
     private static String toJsonPathProperty(String property) {
-        if (property.matches("[A-Za-z_][A-Za-z0-9_]*")) {
+        if (VALID_PROPERTY_NAME.matcher(property).matches()) {
             return "." + property;
         }
         return "['" + property

annot/src/main/java/com/predic8/membrane/annot/yaml/error/LineYamlErrorRenderer.java

@@ -25,6 +25,8 @@
 
 import java.nio.file.Path;
 
+import static com.predic8.membrane.annot.util.JsonPathUtil.getLastSegment;
+import static com.predic8.membrane.annot.util.JsonPathUtil.getParentPath;
 import static com.predic8.membrane.common.TerminalColorsMini.*;
 
 /**
@@ -58,6 +60,12 @@ public static String renderErrorReport(ParsingContext pc) throws JsonProcessingE
         return renderErrorReport(pc, null);
     }
 
+    /**
+     * Renders a YAML representation of the JSON node with line-based error markers
+     * and, if available, the source file path.
+     *
+     * @return YAML string with ">" prefixes and red color for error lines
+     */
     public static String renderErrorReport(ParsingContext pc, Path sourceFile) throws JsonProcessingException {
 
         JsonNode node = pc.getNode();
@@ -270,6 +278,9 @@ private static String markLinesWithPrefix(String yaml, Path sourceFile) {
         return result.toString().trim();
     }
 
+    /**
+     * Counts the leading spaces in a YAML line.
+     */
     private static int getIndentation(String line) {
         int indent = 0;
         for (char c : line.toCharArray()) {
@@ -281,67 +292,4 @@ private static int getIndentation(String line) {
         }
         return indent;
     }
-
-    static String getParentPath(String jsonPath) {
-        return jsonPath.substring(0, findLastSegmentStart(jsonPath));
-    }
-
-    /**
-     * Returns the last part of a JSONPath created by {@link ParsingContext}.
-     * Examples:
-     * `$.api.methods` -> `methods`
-     * `$.api.methods['rpc.echo']` -> `rpc.echo`
-     * `$.api.methods[0]` -> `0`
-     */
-    static String getLastSegment(String jsonPath) {
-        String segment = jsonPath.substring(findLastSegmentStart(jsonPath));
-
-        if (isPropertySegment(segment)) {
-            return segment.substring(1);
-        }
-
-        if (isQuotedPropertySegment(segment)) {
-            return decodeQuotedPropertySegment(segment);
-        }
-
-        if (isArrayIndexSegment(segment)) {
-            return segment.substring(1, segment.length() - 1);
-        }
-
-        throw new IllegalArgumentException("Unsupported JSONPath segment: " + segment);
-    }
-
-    private static boolean isPropertySegment(String segment) {
-        return segment.startsWith(".");
-    }
-
-    private static boolean isQuotedPropertySegment(String segment) {
-        return segment.startsWith("['") && segment.endsWith("']");
-    }
-
-    private static String decodeQuotedPropertySegment(String segment) {
-        return segment.substring(2, segment.length() - 2)
-                .replace("\\'", "'")
-                .replace("\\\\", "\\");
-    }
-
-    private static boolean isArrayIndexSegment(String segment) {
-        return segment.startsWith("[") && segment.endsWith("]");
-    }
-
-    private static int findLastSegmentStart(String jsonPath) {
-        int depth = 0;
-        for (int i = jsonPath.length() - 1; i >= 0; i--) {
-            char c = jsonPath.charAt(i);
-            if (c == ']') {
-                depth++;
-            } else if (c == '[') {
-                depth--;
-            }
-            if (depth == 0 && (c == '.' || c == '[')) {
-                return i;
-            }
-        }
-        throw new IllegalArgumentException("Cannot determine parent path of: " + jsonPath);
-    }
 }

annot/src/main/java/com/predic8/membrane/annot/yaml/parsing/binding/ScalarValueConverter.java

@@ -42,6 +42,9 @@ public final class ScalarValueConverter {
     private final SpelEvaluator spelEvaluator = new SpelEvaluator();
     private final ReferenceResolver referenceResolver = new ReferenceResolver();
 
+    /**
+     * Converts a YAML scalar node to the setter target type or resolves a reference.
+     */
     public Object coerceScalarOrReference(ParsingContext<?> ctx, Method setter, JsonNode node, String key, Class<?> wanted) throws WrongEnumConstantException {
         if (wanted.equals(String.class))
             return node.isTextual() ? spelEvaluator.resolve(node.asText(), String.class) : node.asText();
@@ -55,12 +58,18 @@ public Object coerceScalarOrReference(ParsingContext<?> ctx, Method setter, Json
         return coerceNonTextual(ctx, setter, node, key, wanted);
     }
 
+    /**
+     * Converts a scalar node directly, evaluating SpEL first for textual values.
+     */
     public static Object convertScalarOrSpel(JsonNode node, Class<?> targetType) {
         if (node == null || !node.isTextual())
             return SCALAR_MAPPER.convertValue(node, targetType);
         return STATIC_SPEL_EVALUATOR.resolve(node.asText(), targetType);
     }
 
+    /**
+     * Handles textual YAML values, including SpEL, numbers, references, and maps.
+     */
     private Object coerceTextual(ParsingContext<?> ctx, Method setter, JsonNode node, String key, Class<?> wanted) {
         String evaluated = evaluateSpelForString(key, node.asText());
         if (evaluated == null) {
@@ -84,6 +93,9 @@ private Object coerceTextual(ParsingContext<?> ctx, Method setter, JsonNode node
         throw unsupported(wanted, key, node);
     }
 
+    /**
+     * Handles already typed JSON values such as booleans and numbers.
+     */
     private Object coerceNonTextual(ParsingContext<?> ctx, Method setter, JsonNode node, String key, Class<?> wanted) {
         if (isInteger(wanted))
             return node.isInt() ? node.intValue() : parseInt(node.asText());
@@ -102,17 +114,24 @@ private Object coerceNonTextual(ParsingContext<?> ctx, Method setter, JsonNode n
 
     /**
      * Converts the value of one entry from an {@code @MCOtherAttributes} map.
-     * Example: for `methods: { 'rpc.echo': { params: ... } }` the key is `rpc.echo`.
+     * Example: for {@code methods: { 'rpc.echo': { params: ... } }} the key is {@code rpc.echo}.
      * The nested object is then bound as the configured Java type for the map value,
-     * not left as a raw map. Plain scalar values such as `timeout: 5` stay plain values.
+     * not left as a raw map. Plain scalar values such as {@code timeout: 5} stay plain values.
      */
     private Object convertAnySetterValue(ParsingContext<?> ctx, Method setter, JsonNode node, String key) {
         Class<?> valueType = getMapValueType(setter);
         if (valueType == null || valueType == Object.class) {
             return SCALAR_MAPPER.convertValue(node, Object.class);
         }
         if (valueType == String.class) {
-            return node.isTextual() ? evaluateSpelForString(key, node.asText()) : node.asText();
+            if (node.isTextual())
+                return evaluateSpelForString(key, node.asText());
+            if (node.isObject() || node.isArray())
+                throw unsupported(valueType, key, node);
+            return SCALAR_MAPPER.convertValue(node, valueType);
+        }
+        if (isScalarCompatible(valueType)) {
+            return SCALAR_MAPPER.convertValue(node, valueType);
         }
         return bind(
                 ctx.updateContext(getElementName(valueType)).addProperty(key),
@@ -121,6 +140,9 @@ private Object convertAnySetterValue(ParsingContext<?> ctx, Method setter, JsonN
         );
     }
 
+    /**
+     * Returns the runtime class used as the value type of a map setter parameter.
+     */
     private static Class<?> getMapValueType(Method setter) {
         Type genericType = setter.getGenericParameterTypes()[0];
         if (!(genericType instanceof ParameterizedType parameterizedType)) {
@@ -150,6 +172,9 @@ private String evaluateSpelForString(String key, String value) {
         }
     }
 
+    /**
+     * Parses numeric text and reports invalid values as configuration errors.
+     */
     private Object parseNumericOrThrow(ParsingContext<?> ctx, String key, Class<?> wanted, String value, JsonNode node) {
         try {
             if (isInteger(wanted))
@@ -167,12 +192,18 @@ private Object parseNumericOrThrow(ParsingContext<?> ctx, String key, Class<?> w
         throw unsupported(wanted, key, node);
     }
 
+    /**
+     * Checks whether the target type should be treated as a bean reference.
+     */
     private static boolean isBeanReference(Class<?> wanted) {
         if (wanted == Integer.TYPE || wanted == Long.TYPE || wanted == Float.TYPE || wanted == Double.TYPE || wanted == Boolean.TYPE || wanted == String.class)
             return false;
         return !wanted.isEnum();
     }
 
+    /**
+     * Parses enum values case-insensitively.
+     */
     @SuppressWarnings("unchecked")
     private static <E extends Enum<E>> E parseEnum(Class<?> enumClass, JsonNode node) throws WrongEnumConstantException {
         String value = node.asText().toUpperCase(ROOT);
@@ -203,6 +234,31 @@ private static boolean isNumber(Class<?> wanted) {
         return isInteger(wanted) || isLong(wanted) || isDouble(wanted);
     }
 
+    /**
+     * Checks whether Jackson can convert the node as a scalar value.
+     */
+    private static boolean isScalarCompatible(Class<?> wanted) {
+        return wanted.isEnum()
+                || isPrimitiveScalar(wanted)
+                || isPrimitiveWrapper(wanted)
+                || Number.class.isAssignableFrom(wanted);
+    }
+
+    private static boolean isPrimitiveScalar(Class<?> wanted) {
+        return wanted.isPrimitive() && wanted != void.class;
+    }
+
+    private static boolean isPrimitiveWrapper(Class<?> wanted) {
+        return wanted == Boolean.class
+                || wanted == Character.class
+                || wanted == Byte.class
+                || wanted == Short.class
+                || wanted == Integer.class
+                || wanted == Long.class
+                || wanted == Float.class
+                || wanted == Double.class;
+    }
+
     private static ConfigurationParsingException unsupported(Class<?> wanted, String key, JsonNode node) {
         return new ConfigurationParsingException("Unsupported setter type: %s for key '%s' with node type %s".formatted(wanted.getName(), key, node.getNodeType()));
     }