Add approval to duo session MCP tools

TL;DR: Add the capacity to approve a duo sessions next steps via MCP no UI client needed.

Note

Triggering a flow is tracked in #607619 (closed). The final tool name is being settled in gitlab-org#21395 (closed) (candidates include send_duo_session_input and submit_duo_session_response).

What

**Note: ** Implementation suggestion subject to further evaluation.

Expose the existing flow resume REST endpoint as a route-backed MCP tool via route_setting :mcp:

  • POST /ai/duo_workflows/workflows/:workflow_id/resume → approve_duo_flow (params: workflow_id, human_approval, human_message)

The endpoint already carries route_setting :authorization (resume_duo_workflow); add allow_mcp_access_create via the McpAccess concern.

Required ApiTool enhancements (CE, generic)

  1. MCP description override (route_setting :mcp, description:): a route's desc is written for the REST reference; an MCP client sees the description alone and uses it to pick tools
  2. required: params: Grape marks these params optional (server-side defaults), so the generated schema tells the model the tool is callable with no arguments; required: lets the route mark what a caller must supply, intersected with exposed params

Includes specs (api_tool_spec, EE request specs — note the route-discovery memoization reset needed in specs, list_tools_spec) and docs entries in doc/user/model_context_protocol/mcp_server_tools.md.

Reference: prototype !246597 (closed); a working spike exists on branch mcp-duo-flows-async (the trigger parts of the spike feed into #607619 (closed)).

Part of &21395 (closed)

Edited by 🤖 GitLab Bot 🤖