@systemdox/mcp-server 0.1.11 → 0.1.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -20,13 +20,21 @@ HTTP. Point any HTTP-capable MCP client at it — nothing to install or update.
|
|
|
20
20
|
"type": "http",
|
|
21
21
|
"url": "https://<your-workspace>.mcp.systemdox.com/mcp",
|
|
22
22
|
"headers": {
|
|
23
|
-
|
|
23
|
+
// Reference the key via an env var — never commit the literal key.
|
|
24
|
+
"Authorization": "Bearer ${SYSTEMDOX_API_KEY}"
|
|
24
25
|
}
|
|
25
26
|
}
|
|
26
27
|
}
|
|
27
28
|
}
|
|
28
29
|
```
|
|
29
30
|
|
|
31
|
+
> **Never commit the literal key.** The `pweb_` prefix is deliberately scanner-friendly,
|
|
32
|
+
> and a key in a committed `.mcp.json` is a long-lived read/write credential retained in
|
|
33
|
+
> git history across every clone, fork, and CI log. MCP clients that expand environment
|
|
34
|
+
> variables in `.mcp.json` (e.g. Claude Code) resolve `${SYSTEMDOX_API_KEY}` at load time;
|
|
35
|
+
> deliver the value from your shell, a secret manager, or your CI secret store. For clients
|
|
36
|
+
> that don't expand variables, inject the key at deploy time and keep the file untracked.
|
|
37
|
+
|
|
30
38
|
- **URL** — `https://<your-workspace>.mcp.systemdox.com/mcp`. `<your-workspace>`
|
|
31
39
|
is your tenant's **slug**; it must match the tenant that owns the API key, or
|
|
32
40
|
the request is rejected `403`. Set a slug on the workspace first (owner/admin →
|
|
@@ -35,6 +43,11 @@ HTTP. Point any HTTP-capable MCP client at it — nothing to install or update.
|
|
|
35
43
|
`X-API-Key`-only request is rejected at the gateway.)
|
|
36
44
|
- **Transport** — stateless request/response (JSON); each call is independent,
|
|
37
45
|
which suits serverless hosting. There is no long-lived SSE stream.
|
|
46
|
+
- **Scope** — the key is the boundary. A key bound to a single space (a
|
|
47
|
+
"department" key) sees only that space's context; org-wide planner endpoints
|
|
48
|
+
(`get_planning_context`) are barred to it and answer `403`. Give each
|
|
49
|
+
department's repo its own key via `${SYSTEMDOX_API_KEY}`, and an agent in one
|
|
50
|
+
department never sees another's checks, specs, or docs.
|
|
38
51
|
|
|
39
52
|
## Option B — Local (stdio) via npx
|
|
40
53
|
|
|
@@ -54,7 +67,8 @@ npx @systemdox/mcp-server setup
|
|
|
54
67
|
"command": "npx",
|
|
55
68
|
"args": ["@systemdox/mcp-server"],
|
|
56
69
|
"env": {
|
|
57
|
-
|
|
70
|
+
// Provided by your shell / secret store — not committed in the file.
|
|
71
|
+
"SYSTEMDOX_API_KEY": "${SYSTEMDOX_API_KEY}"
|
|
58
72
|
}
|
|
59
73
|
}
|
|
60
74
|
}
|
package/package.json
CHANGED