​

Capabilities

┌─────────────────────────────────────────────────────────────┐
│                       CAPABILITY                            │
│                                                             │
│   tool:     "database"          (Which integration/system?) │
│   action:   "update"            (What operation?)           │
│   resource: "users"             (On what target?)           │
└─────────────────────────────────────────────────────────────┘

​

The 3 Elements

​

1. Tool

• In direct Python code: set in @dmint.protected("tool.action") or dmint.authorize("tool", "action", ...)
• In MCP: the integration_id declared in mcp_protection.json (e.g. postgres, filesystem, github)

​

2. Action

• select, update, delete, drop
• read_file, write_file, delete_file
• run_command, git_push

​

3. Resource

• A specific table: "users", "orders"
• A filesystem path or prefix: "/var/log/*", "/tmp"
• A wildcard: "*" (applies to any resource)

​

Resource Matching Rules

1. Exact Match: A rule with resource: "public.users" matches only when the tool call targets "public.users".
2. Wildcard Match: A rule with resource: "*" matches any target resource for that (tool, action).
3. No Resource Required (NO_RESOURCE): For commands that have no natural target (e.g. get_system_time), Dmint treats the resource as * or empty.

​

Capability Examples

​

Defining Capabilities in Code

# Tool: "payment_gateway", Action: "charge"
@dmint.protected("payment_gateway.charge")
def charge_card(amount_cents: int, customer_id: str):
    ...

{
  "integration_id": "github",
  "tools": [
    {
      "mcp_tool_name": "create_issue",
      "action": "create",
      "resource": "issues"
    },
    {
      "mcp_tool_name": "delete_repository",
      "action": "delete",
      "resource": "repositories"
    }
  ]
}