Add GP for MCP server

JohnMcPMS · JohnMcPMS · commit 33cd89a9d133 · 2025-07-21T16:30:47.000-07:00
diff --git a/doc/admx/DesktopAppInstaller.admx b/doc/admx/DesktopAppInstaller.admx
@@ -176,6 +176,16 @@
         <decimal value="0" />
       </disabledValue>
     </policy>
+    <policy name="EnableWindowsPackageManagerMcpServer" class="Machine" displayName="$(string.EnableWindowsPackageManagerMcpServer)" explainText="$(string.EnableWindowsPackageManagerMcpServerExplanation)" key="Software\Policies\Microsoft\Windows\AppInstaller" valueName="EnableWindowsPackageManagerMcpServer">
+      <parentCategory ref="AppInstaller" />
+      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS5" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
     <policy name="WindowsPackageManagerDefaultProxy" class="Machine" displayName="$(string.WindowsPackageManagerDefaultProxy)" explainText="$(string.WindowsPackageManagerDefaultProxyExplanation)" presentation="$(presentation.WindowsPackageManagerDefaultProxy)" key="Software\Policies\Microsoft\Windows\AppInstaller">
       <parentCategory ref="AppInstaller" />
       <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS5" />
diff --git a/doc/admx/en-US/DesktopAppInstaller.adml b/doc/admx/en-US/DesktopAppInstaller.adml
@@ -116,6 +116,13 @@ If you disable this setting, users will not be able to use the Windows Package M
         If you enable this setting, users will be able to configure the Windows Package Manager's use of proxy through the command line.
 
         If you disable or do not configure this setting, users will not be able to to configure the Windows Package Manager's use of proxy through the command line.</string>
+      <string id="EnableWindowsPackageManagerMcpServer">Enable Windows Package Manager MCP Server</string>
+      <string id="EnableWindowsPackageManagerMcpServerExplanation">
+        This policy controls whether the Windows Package Manager Model Context Protocol (MCP) server can be used.
+
+        If you enable or do not configure this setting, users will be able to use the Windows Package Manager's MCP server.
+
+        If you disable this setting, users will not be able to to use the Windows Package Manager's MCP server.</string>
       <string id="WindowsPackageManagerDefaultProxy">Set Windows Package Manager Default Proxy</string>
       <string id="WindowsPackageManagerDefaultProxyExplanation">This policy controls the default proxy used by the Windows Package Manager.
 
diff --git a/src/AppInstallerCLICore/Commands/McpCommand.cpp b/src/AppInstallerCLICore/Commands/McpCommand.cpp
@@ -10,7 +10,7 @@ using namespace AppInstaller::CLI::Workflow;
 namespace AppInstaller::CLI
 {
     McpCommand::McpCommand(std::string_view parent) :
-        Command("mcp", {}, parent, Settings::TogglePolicy::Policy::Configuration)
+        Command("mcp", {}, parent, Settings::TogglePolicy::Policy::McpServer)
     {
     }
 
diff --git a/src/AppInstallerCLIPackage/Shared/Strings/en-us/winget.resw b/src/AppInstallerCLIPackage/Shared/Strings/en-us/winget.resw
@@ -3384,4 +3384,7 @@ Please specify one of them using the --source option to proceed.</value>
 MCP stands for Model Context Protocol and should probably remain as-is.
 An unlocalized JSON fragment will follow on another line.</comment>
   </data>
+  <data name="PolicyEnableMcpServer" xml:space="preserve">
+    <value>Enable Windows Package Manager MCP Server</value>
+  </data>
 </root>
diff --git a/src/AppInstallerSharedLib/GroupPolicy.cpp b/src/AppInstallerSharedLib/GroupPolicy.cpp
@@ -326,6 +326,8 @@ namespace AppInstaller::Settings
             return TogglePolicy(policy, "EnableWindowsPackageManagerConfiguration"sv, String::PolicyEnableWinGetConfiguration);
         case TogglePolicy::Policy::ProxyCommandLineOptions:
             return TogglePolicy(policy, "EnableWindowsPackageManagerProxyCommandLineOptions"sv, String::PolicyEnableProxyCommandLineOptions);
+        case TogglePolicy::Policy::McpServer:
+            return TogglePolicy(policy, "EnableWindowsPackageManagerMcpServer"sv, String::PolicyEnableMcpServer);
         default:
             THROW_HR(E_UNEXPECTED);
         }
diff --git a/src/AppInstallerSharedLib/Public/winget/GroupPolicy.h b/src/AppInstallerSharedLib/Public/winget/GroupPolicy.h
@@ -47,6 +47,7 @@ namespace AppInstaller::Settings
             WinGetCommandLineInterfaces,
             Configuration,
             ProxyCommandLineOptions,
+            McpServer,
             Max,
         };
 
diff --git a/src/AppInstallerSharedLib/Public/winget/Resources.h b/src/AppInstallerSharedLib/Public/winget/Resources.h
@@ -60,6 +60,7 @@ namespace AppInstaller
             WINGET_DEFINE_RESOURCE_STRINGID(PolicyEnableWindowsPackageManagerCommandLineInterfaces);
             WINGET_DEFINE_RESOURCE_STRINGID(PolicyEnableWinGetConfiguration);
             WINGET_DEFINE_RESOURCE_STRINGID(PolicyEnableProxyCommandLineOptions);
+            WINGET_DEFINE_RESOURCE_STRINGID(PolicyEnableMcpServer);
 
             WINGET_DEFINE_RESOURCE_STRINGID(SettingsWarningInvalidFieldFormat);
             WINGET_DEFINE_RESOURCE_STRINGID(SettingsWarningInvalidFieldValue);
diff --git a/src/PowerShell/Microsoft.WinGet.SharedLib/PolicySettings/Enums.cs b/src/PowerShell/Microsoft.WinGet.SharedLib/PolicySettings/Enums.cs
@@ -1,4 +1,4 @@
-﻿// -----------------------------------------------------------------------------
+// -----------------------------------------------------------------------------
 // <copyright file="Enums.cs" company="Microsoft Corporation">
 //     Copyright (c) Microsoft Corporation. Licensed under the MIT License.
 // </copyright>
@@ -96,6 +96,11 @@ public enum Policy
         /// Enabled configuration.
         /// </summary>
         Configuration,
+
+        /// <summary>
+        /// Enabled MCP server.
+        /// </summary>
+        McpServer,
     }
 
     /// <summary>
diff --git a/src/PowerShell/Microsoft.WinGet.SharedLib/PolicySettings/TogglePolicy.cs b/src/PowerShell/Microsoft.WinGet.SharedLib/PolicySettings/TogglePolicy.cs
@@ -1,4 +1,4 @@
-﻿// -----------------------------------------------------------------------------
+// -----------------------------------------------------------------------------
 // <copyright file="TogglePolicy.cs" company="Microsoft Corporation">
 //     Copyright (c) Microsoft Corporation. Licensed under the MIT License.
 // </copyright>
@@ -125,6 +125,8 @@ internal static TogglePolicy Create(Policy policy)
                     return new TogglePolicy(policy, "EnableWindowsPackageManagerCommandLineInterfaces", GroupPolicyResource.PolicyEnableWindowsPackageManagerCommandLineInterfaces);
                 case Policy.Configuration:
                     return new TogglePolicy(policy, "EnableWindowsPackageManagerConfiguration", GroupPolicyResource.PolicyEnableWinGetConfiguration);
+                case Policy.McpServer:
+                    return new TogglePolicy(policy, "EnableWindowsPackageManagerMcpServer", GroupPolicyResource.PolicyEnableMcpServer);
                 default:
                     throw new ArgumentException(null, nameof(policy));
             }
diff --git a/src/PowerShell/Microsoft.WinGet.SharedLib/Resources/GroupPolicyResource.Designer.cs b/src/PowerShell/Microsoft.WinGet.SharedLib/Resources/GroupPolicyResource.Designer.cs
diff --git a/src/PowerShell/Microsoft.WinGet.SharedLib/Resources/GroupPolicyResource.resx b/src/PowerShell/Microsoft.WinGet.SharedLib/Resources/GroupPolicyResource.resx
@@ -1,4 +1,4 @@
-﻿<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -144,6 +144,9 @@
   <data name="PolicyEnableLocalManifests" xml:space="preserve">
     <value>Enable Windows App Installer Local Manifest Files</value>
   </data>
+  <data name="PolicyEnableMcpServer" xml:space="preserve">
+    <value>Enable Windows Package Manager MCP Server</value>
+  </data>
   <data name="PolicyEnableMSStoreSource" xml:space="preserve">
     <value>Enable Windows App Installer Microsoft Store Source</value>
   </data>
diff --git a/src/WinGetMCPServer/Response/ToolResponse.cs b/src/WinGetMCPServer/Response/ToolResponse.cs
@@ -6,15 +6,33 @@
 
 namespace WinGetMCPServer.Response
 {
+    using Microsoft.WinGet.SharedLib.PolicySettings;
     using ModelContextProtocol.Protocol;
     using System.Text.Json;
     using System.Text.Json.Serialization;
+    using WinGetMCPServer.Exceptions;
+    using static System.Runtime.InteropServices.JavaScript.JSType;
 
     /// <summary>
     /// Contains reusable responses for tools.
     /// </summary>
     internal static class ToolResponse
     {
+        /// <summary>
+        /// Checks whether the server is disabled by group policy.
+        /// </summary>
+        public static void CheckGroupPolicy()
+        {
+            if (!GroupPolicy.GetInstance().IsEnabled(Policy.McpServer))
+            {
+                throw new ToolResponseException(new CallToolResponse()
+                {
+                    IsError = true,
+                    Content = [new Content() { Text = "The Windows Package Manager MCP server is disabled by group policy." }]
+                });
+            }
+        }
+
         /// <summary>
         /// Constructs a response from an object.
         /// </summary>
diff --git a/src/WinGetMCPServer/WinGetMCPServer.csproj b/src/WinGetMCPServer/WinGetMCPServer.csproj
@@ -35,6 +35,7 @@
     <ProjectReference Include="..\Microsoft.Management.Deployment\Microsoft.Management.Deployment.vcxproj">
       <Private>False</Private>
     </ProjectReference>
+    <ProjectReference Include="..\PowerShell\Microsoft.WinGet.SharedLib\Microsoft.WinGet.SharedLib.csproj" />
   </ItemGroup>
 
   <Import Project="..\targets\EmbeddedCsWinRT.targets" />
diff --git a/src/WinGetMCPServer/WingetPackageTools.cs b/src/WinGetMCPServer/WingetPackageTools.cs
@@ -40,6 +40,8 @@ public CallToolResponse FindPackages(
         {
             try
             {
+                ToolResponse.CheckGroupPolicy();
+
                 var catalog = ConnectCatalog();
 
                 // First attempt a more exact match
@@ -83,6 +85,8 @@ public async Task<CallToolResponse> InstallPackage(
         {
             try
             {
+                ToolResponse.CheckGroupPolicy();
+
                 var packageCatalog = ConnectCatalog(catalog);
 
                 if (cancellationToken.IsCancellationRequested)

Original file line number	Diff line number	Diff line change
`@@ -10,7 +10,7 @@ using namespace AppInstaller::CLI::Workflow;`
`10`	`10`	`namespace AppInstaller::CLI`
`11`	`11`	`{`
`12`	`12`	`McpCommand::McpCommand(std::string_view parent) :`
`13`		`- Command("mcp", {}, parent, Settings::TogglePolicy::Policy::Configuration)`
	`13`	`+ Command("mcp", {}, parent, Settings::TogglePolicy::Policy::McpServer)`
`14`	`14`	`{`
`15`	`15`	`}`
`16`	`16`
Original file line number	Diff line number	Diff line change
`@@ -326,6 +326,8 @@ namespace AppInstaller::Settings`
`326`	`326`	`return TogglePolicy(policy, "EnableWindowsPackageManagerConfiguration"sv, String::PolicyEnableWinGetConfiguration);`
`327`	`327`	`case TogglePolicy::Policy::ProxyCommandLineOptions:`
`328`	`328`	`return TogglePolicy(policy, "EnableWindowsPackageManagerProxyCommandLineOptions"sv, String::PolicyEnableProxyCommandLineOptions);`
	`329`	`+ case TogglePolicy::Policy::McpServer:`
	`330`	`+ return TogglePolicy(policy, "EnableWindowsPackageManagerMcpServer"sv, String::PolicyEnableMcpServer);`
`329`	`331`	`default:`
`330`	`332`	`THROW_HR(E_UNEXPECTED);`
`331`	`333`	`}`