@gorlitzer-labs/comb 0.1.3 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +34 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -65,6 +65,40 @@ Values are never printed, never passed as command-line arguments, never logged.
|
|
|
65
65
|
`comb get NAME --reveal` exists for when you genuinely need to read one, and
|
|
66
66
|
refuses without the flag.
|
|
67
67
|
|
|
68
|
+
## Tokens in MCP configs
|
|
69
|
+
|
|
70
|
+
An HTTP MCP server with a bearer token tends to end up as a plaintext
|
|
71
|
+
`"headers": {"Authorization": "Bearer …"}` in `~/.claude.json` — a file every
|
|
72
|
+
agent session reads, and that gets pasted into conversations. Claude Code can
|
|
73
|
+
fetch headers from a command instead (`headersHelper`), so the token can stay
|
|
74
|
+
in comb:
|
|
75
|
+
|
|
76
|
+
```bash
|
|
77
|
+
comb set AGENT_COORD_REMOTE_TOKEN --url "http://my-box:8765 (agent-coord-remote)"
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
```sh
|
|
81
|
+
#!/bin/sh
|
|
82
|
+
# ~/.claude/bin/agent-coord-remote-headers.sh (chmod +x)
|
|
83
|
+
export PATH="$HOME/Library/pnpm:/opt/homebrew/bin:/usr/bin:/bin" # Claude may not have your shell PATH
|
|
84
|
+
exec comb run --with AGENT_COORD_REMOTE_TOKEN -- \
|
|
85
|
+
sh -c 'printf "{\"Authorization\":\"Bearer %s\"}" "$AGENT_COORD_REMOTE_TOKEN"'
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
```jsonc
|
|
89
|
+
// ~/.claude.json → mcpServers
|
|
90
|
+
"agent-coord-remote": {
|
|
91
|
+
"type": "http",
|
|
92
|
+
"url": "http://my-box:8765/mcp",
|
|
93
|
+
"headersHelper": "/Users/you/.claude/bin/agent-coord-remote-headers.sh"
|
|
94
|
+
}
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
The helper prints the headers as JSON and Claude reads them at connect time. The
|
|
98
|
+
token never sits in the config, and `comb run` keeps it out of argv. Moving a token
|
|
99
|
+
that was already in plaintext is not the same as rotating it: run `comb audit`,
|
|
100
|
+
and if it shows up as LEAKED, rotate it.
|
|
101
|
+
|
|
68
102
|
## `comb audit`
|
|
69
103
|
|
|
70
104
|
This is the half no vault does, and the half that makes manual rotation
|