CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

mcp --http: --broker-profiles (store keys from the broker vault, memory only), --read-only, project by folder name under the roots

Browse source
This commit is contained in:
CRTkafa 2026-10-29 18:38:11 +07:00
parent 164ba390dd
commit a108aae53f
6 changed files with 121 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/mcp.md
View file

@ -50,6 +50,12 @@ refused unless `--allow-origin` names it.
storebound mcp --http --host 0.0.0.0 --auth introspect --introspect-url https://auth.example.com/introspect \
--introspect-key-file ~/.storebound/introspect.key --resource https://mcp.example.com/mcp --issuer https://auth.example.com
```
- `--read-only`: only the tools that change nothing are listed and callable.
- `--broker-profiles a,b`: a host that keeps no key files takes these credential profiles from the credential broker's
vault (`GET /api/store-credentials/<profile>/asc-api-key | play-service-account`, a key with the `store-credentials`
scope; docs/credential-broker.md). They reach each tool call as `STOREBOUND_PROFILE_<NAME>_*` env, held in memory for
10 minutes and never written. A project picks its profile as usual (the config's `account`).
- `project` may also be a folder name under the roots (a shared server keeps its checkouts there).
- `/health` answers `{ ok, version }` without auth.
## Desktop machine interface