specguard-mcp 0.1.19 → 0.1.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -643,7 +643,9 @@ reads. With both set the **agent** key wins, so the revoke answers inside the sa
|
|
|
643
643
|
Lists the agent keys (`sga_…` keys) covering a SpecGuard repository — the keys minted for people
|
|
644
644
|
or automation principals from the /account page, each covering one or more repositories. One row
|
|
645
645
|
per live key: `id`, `name`, `owner`, `token_hint`, `repository_count` (how many repositories the
|
|
646
|
-
key's grant covers — the blast radius), `permissions` and `
|
|
646
|
+
key's grant covers — the blast radius), `permissions`, `created_at` and `last_used_at` — when the
|
|
647
|
+
key's token last authenticated, `null` meaning the key has never been presented, so the inventory
|
|
648
|
+
answers "is this live key still being used" before you cut anything.
|
|
647
649
|
|
|
648
650
|
| argument | |
|
|
649
651
|
| --- | --- |
|
|
@@ -20,7 +20,10 @@ import type { ToolDefinition } from "./types.js";
|
|
|
20
20
|
* this repository: `id`, `name`, `owner`, `token_hint`, `repository_count`
|
|
21
21
|
* (the size of the key's stored set — the blast radius a revoke would land
|
|
22
22
|
* on), `permissions` (rendered the way the web panel renders it, "read only"
|
|
23
|
-
* for the minimal grant)
|
|
23
|
+
* for the minimal grant), `created_at` and `last_used_at` (SPGD-1108 — the
|
|
24
|
+
* offboarding arc's decision half: when the key's token last authenticated,
|
|
25
|
+
* null meaning the key has NEVER been presented — the negative is served, not
|
|
26
|
+
* omitted). `token_hint` is a hint and never
|
|
24
27
|
* the token: the plaintext existed for exactly one response at mint time and
|
|
25
28
|
* nothing persisted it. Revoked rows leave the listing — a retained revoked
|
|
26
29
|
* row is not a credential — and the still-presented triage over those rows is
|
|
@@ -21,7 +21,10 @@ import { requireString } from "./args.js";
|
|
|
21
21
|
* this repository: `id`, `name`, `owner`, `token_hint`, `repository_count`
|
|
22
22
|
* (the size of the key's stored set — the blast radius a revoke would land
|
|
23
23
|
* on), `permissions` (rendered the way the web panel renders it, "read only"
|
|
24
|
-
* for the minimal grant)
|
|
24
|
+
* for the minimal grant), `created_at` and `last_used_at` (SPGD-1108 — the
|
|
25
|
+
* offboarding arc's decision half: when the key's token last authenticated,
|
|
26
|
+
* null meaning the key has NEVER been presented — the negative is served, not
|
|
27
|
+
* omitted). `token_hint` is a hint and never
|
|
25
28
|
* the token: the plaintext existed for exactly one response at mint time and
|
|
26
29
|
* nothing persisted it. Revoked rows leave the listing — a retained revoked
|
|
27
30
|
* row is not a credential — and the still-presented triage over those rows is
|
|
@@ -40,7 +43,10 @@ const listRepositoryAgentKeys = {
|
|
|
40
43
|
title: "List repository agent keys",
|
|
41
44
|
description: "Lists the agent keys (`sga_…` keys) covering a SpecGuard repository: one row per live key " +
|
|
42
45
|
"with its `id`, `name`, `owner`, `token_hint`, `repository_count` (how many repositories the " +
|
|
43
|
-
"key's grant covers — the blast radius), `permissions` and `
|
|
46
|
+
"key's grant covers — the blast radius), `permissions`, `created_at` and `last_used_at` — " +
|
|
47
|
+
"when the key's token last authenticated, null meaning the key has never been presented, so " +
|
|
48
|
+
"the inventory answers \"is this live key still being used\" before a revoke — the decision " +
|
|
49
|
+
"half of offboarding. " +
|
|
44
50
|
"Agent keys have NO mint tool on this bridge — minting is deliberately web-only — so the `id` " +
|
|
45
51
|
"this listing serves is the ONLY way to name a key to `revoke_repository_agent_key`: list " +
|
|
46
52
|
"first, then revoke. " +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"list-repository-agent-keys.js","sourceRoot":"","sources":["../../../src/tools/list-repository-agent-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C
|
|
1
|
+
{"version":3,"file":"list-repository-agent-keys.js","sourceRoot":"","sources":["../../../src/tools/list-repository-agent-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,uBAAuB,GAAmB;IAC9C,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,4BAA4B;IACnC,WAAW,EACT,4FAA4F;QAC5F,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,uBAAuB;QACvB,+FAA+F;QAC/F,2FAA2F;QAC3F,sBAAsB;QACtB,+FAA+F;QAC/F,wFAAwF;QACxF,8FAA8F;QAC9F,sCAAsC;QACtC,wFAAwF;QACxF,yBAAyB;QACzB,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,8FAA8F;QAC9F,mDAAmD;QACnD,kGAAkG;QAClG,oDAAoD;IACtD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gFAAgF;oBAChF,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,aAAa,EACrE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
|