graphjin 3.18.3 → 3.18.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +49 -7
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -85,13 +85,57 @@ Copy the JSON config shown and add it to your Claude Desktop config file (see be
|
|
|
85
85
|
| macOS | `~/Library/Application Support/Claude/claude_desktop_config.json` |
|
|
86
86
|
| Windows | `%APPDATA%\Claude\claude_desktop_config.json` |
|
|
87
87
|
|
|
88
|
+
## Authenticate the CLI / MCP
|
|
89
|
+
|
|
90
|
+
Before `graphjin cli` or `graphjin mcp` can talk to a server, point them at one. There are no `--server` or `--token` flags — both come from a single saved config file (`~/.config/graphjin/client.json`, mode `0600`):
|
|
91
|
+
|
|
92
|
+
```bash
|
|
93
|
+
graphjin cli setup http://localhost:8080 # local dev, no auth needed
|
|
94
|
+
graphjin cli setup https://graphjin.example.com # signs in via the server's OIDC IdP
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
What `setup` does, depending on the server:
|
|
98
|
+
|
|
99
|
+
- **No built-in login** (the server has `auth_login.enabled: false`): saves only the URL. CLI calls send no `Authorization` header.
|
|
100
|
+
- **Built-in login enabled**: kicks off an [RFC 8628 device-code flow](https://www.rfc-editor.org/rfc/rfc8628). The CLI prints a verification URL + short code, opens your browser, you sign in with the configured identity provider (Google, Okta, Keycloak, Auth0-as-IdP, Azure AD — anything OIDC), and the server mints a 30-day JWT. Both URL and JWT are saved to `client.json`.
|
|
101
|
+
|
|
102
|
+
After setup every `graphjin cli ...` command just works:
|
|
103
|
+
|
|
104
|
+
```bash
|
|
105
|
+
graphjin cli health
|
|
106
|
+
graphjin cli query list
|
|
107
|
+
graphjin cli schema tables
|
|
108
|
+
graphjin cli setup show # print the saved config (token redacted)
|
|
109
|
+
graphjin cli setup logout # delete client.json
|
|
110
|
+
graphjin cli setup # re-run sign-in against the same server (refresh token)
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
To enable built-in login, set this on the server:
|
|
114
|
+
|
|
115
|
+
```yaml
|
|
116
|
+
auth:
|
|
117
|
+
jwt:
|
|
118
|
+
secret: "long-random-shared-secret" # used to sign and verify local JWTs
|
|
119
|
+
|
|
120
|
+
auth_login:
|
|
121
|
+
enabled: true
|
|
122
|
+
audience_graphjin: true # shorthand for audience: "graphjin-cli"
|
|
123
|
+
oidc:
|
|
124
|
+
issuer_url: "https://accounts.google.com"
|
|
125
|
+
client_id: "..."
|
|
126
|
+
client_secret: "..." # or $GJ_AUTH_LOGIN_OIDC_CLIENT_SECRET
|
|
127
|
+
allowed_domains: ["example.com"] # optional allow-list
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
Successful authentication is recorded in structured logs with the verified `email` and `name` claims (when present), giving you a clean audit trail of who called every endpoint.
|
|
131
|
+
|
|
88
132
|
### MCP install for OpenAI Codex + Claude Code
|
|
89
133
|
|
|
90
|
-
GraphJin includes a guided installer that configures MCP for OpenAI Codex, Claude Code, or both.
|
|
134
|
+
GraphJin includes a guided installer that configures MCP for OpenAI Codex, Claude Code, or both. Run `graphjin mcp setup <server-url>` first — `mcp install` reads the server URL from `client.json`, and the MCP-client config it writes is credential-free, so rotating tokens (re-running `mcp setup`) needs no edits to Claude / Codex.
|
|
91
135
|
|
|
92
136
|
```bash
|
|
93
|
-
|
|
94
|
-
graphjin mcp install
|
|
137
|
+
graphjin mcp setup https://graphjin.example.com
|
|
138
|
+
graphjin mcp install # guided: target client + scope
|
|
95
139
|
```
|
|
96
140
|
|
|
97
141
|
#### OpenAI Codex
|
|
@@ -112,10 +156,8 @@ graphjin mcp install --client claude --scope global --yes
|
|
|
112
156
|
|
|
113
157
|
#### Troubleshooting
|
|
114
158
|
|
|
115
|
-
- `
|
|
116
|
-
-
|
|
117
|
-
- `graphjin mcp install --client codex --server http://my-host:8080/ --yes`
|
|
118
|
-
- Claude installs use `graphjin mcp --server <url>` under the hood.
|
|
159
|
+
- `mcp install` requires a saved server URL — run `graphjin mcp setup <server-url>` first if you see "no GraphJin server configured".
|
|
160
|
+
- The generated MCP-client config is `args: ["mcp"]`. `graphjin mcp` reads server + token from `client.json` on its own, in proxy mode when a server is saved or local mode when it's not.
|
|
119
161
|
- If Codex CLI does not support `codex mcp add --scope` (older versions), GraphJin automatically falls back to updating:
|
|
120
162
|
- global scope: `~/.codex/config.toml`
|
|
121
163
|
- local scope: `.codex/config.toml`
|