claude-mpm 5.6.23__py3-none-any.whl → 5.6.72__py3-none-any.whl

claude_mpm/auth/token_storage.py

@@ -0,0 +1,252 @@
+"""Secure OAuth token storage with Fernet encryption and keyring.
+
+This module provides encrypted persistence for OAuth tokens, using
+the system keyring for encryption key storage and Fernet symmetric
+encryption for the actual token data.
+
+Security Features:
+    - Encryption keys stored in system keyring (not on disk)
+    - Fernet symmetric encryption for token data
+    - File permissions restricted to owner only (600)
+    - Credentials stored in user-specific directory
+"""
+
+import json
+import stat
+from pathlib import Path
+from typing import Optional
+
+import keyring
+from cryptography.fernet import Fernet, InvalidToken
+
+from claude_mpm.auth.models import OAuthToken, StoredToken, TokenMetadata, TokenStatus
+
+# Keyring service identifier for encryption keys
+KEYRING_SERVICE = "claude-mpm-oauth"
+
+# Default credentials directory
+CREDENTIALS_DIR = Path.home() / ".claude-mpm" / "credentials"
+
+
+class TokenStorage:
+    """Secure storage for OAuth tokens using Fernet encryption.
+
+    Tokens are encrypted using Fernet symmetric encryption with keys
+    stored securely in the system keyring. Token files are stored
+    with restricted permissions (600) in the credentials directory.
+
+    Attributes:
+        credentials_dir: Directory where encrypted tokens are stored.
+
+    Example:
+        ```python
+        storage = TokenStorage()
+
+        # Store a token
+        token = OAuthToken(
+            access_token="abc123",
+            expires_at=datetime.now(timezone.utc) + timedelta(hours=1),
+            scopes=["read", "write"]
+        )
+        metadata = TokenMetadata(service_name="github-mcp", provider="github")
+        storage.store("github-mcp", token, metadata)
+
+        # Retrieve the token
+        stored = storage.retrieve("github-mcp")
+        if stored:
+            print(f"Token expires at: {stored.token.expires_at}")
+        ```
+    """
+
+    def __init__(self, credentials_dir: Optional[Path] = None) -> None:
+        """Initialize token storage.
+
+        Args:
+            credentials_dir: Custom directory for storing encrypted tokens.
+                Defaults to ~/.claude-mpm/credentials/
+        """
+        self.credentials_dir = credentials_dir or CREDENTIALS_DIR
+        self._ensure_credentials_dir()
+
+    def _ensure_credentials_dir(self) -> None:
+        """Create credentials directory with secure permissions if needed."""
+        if not self.credentials_dir.exists():
+            self.credentials_dir.mkdir(parents=True, mode=0o700)
+        else:
+            # Ensure directory has correct permissions
+            self.credentials_dir.chmod(0o700)
+
+    def _get_encryption_key(self, service_name: str) -> bytes:
+        """Get or create the Fernet encryption key for a service.
+
+        Keys are stored in the system keyring, not on disk.
+
+        Args:
+            service_name: Name of the service to get/create key for.
+
+        Returns:
+            Fernet encryption key as bytes.
+        """
+        key_name = f"{service_name}-key"
+        existing_key = keyring.get_password(KEYRING_SERVICE, key_name)
+
+        if existing_key:
+            return existing_key.encode()
+
+        # Generate new key and store in keyring
+        new_key = Fernet.generate_key()
+        keyring.set_password(KEYRING_SERVICE, key_name, new_key.decode())
+        return new_key
+
+    def _delete_encryption_key(self, service_name: str) -> None:
+        """Delete the encryption key for a service from keyring.
+
+        Args:
+            service_name: Name of the service to delete key for.
+        """
+        key_name = f"{service_name}-key"
+        try:
+            keyring.delete_password(KEYRING_SERVICE, key_name)
+        except keyring.errors.PasswordDeleteError:
+            pass  # Key doesn't exist, nothing to delete
+
+    def _get_token_path(self, service_name: str) -> Path:
+        """Get the file path for a service's encrypted token.
+
+        Args:
+            service_name: Name of the service.
+
+        Returns:
+            Path to the encrypted token file.
+        """
+        # Sanitize service name for filesystem
+        safe_name = "".join(
+            c if c.isalnum() or c in "-_" else "_" for c in service_name
+        )
+        return self.credentials_dir / f"{safe_name}.enc"
+
+    def store(
+        self,
+        service_name: str,
+        token: OAuthToken,
+        metadata: TokenMetadata,
+    ) -> None:
+        """Store an OAuth token securely.
+
+        The token is encrypted using Fernet symmetric encryption with
+        a key stored in the system keyring. The encrypted data is
+        written to a file with 600 permissions.
+
+        Args:
+            service_name: Unique identifier for the service.
+            token: OAuth token data to store.
+            metadata: Token metadata including provider info.
+        """
+        stored_token = StoredToken(
+            version=1,
+            metadata=metadata,
+            token=token,
+        )
+
+        # Serialize to JSON
+        token_json = stored_token.model_dump_json()
+
+        # Encrypt the token data
+        key = self._get_encryption_key(service_name)
+        fernet = Fernet(key)
+        encrypted_data = fernet.encrypt(token_json.encode())
+
+        # Write encrypted data with secure permissions
+        token_path = self._get_token_path(service_name)
+        token_path.write_bytes(encrypted_data)
+
+        # Set file permissions to owner read/write only (600)
+        token_path.chmod(stat.S_IRUSR | stat.S_IWUSR)
+
+    def retrieve(self, service_name: str) -> Optional[StoredToken]:
+        """Retrieve a stored OAuth token.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            StoredToken if found and valid, None otherwise.
+        """
+        token_path = self._get_token_path(service_name)
+
+        if not token_path.exists():
+            return None
+
+        try:
+            # Read encrypted data
+            encrypted_data = token_path.read_bytes()
+
+            # Decrypt
+            key = self._get_encryption_key(service_name)
+            fernet = Fernet(key)
+            decrypted_data = fernet.decrypt(encrypted_data)
+
+            # Deserialize
+            return StoredToken.model_validate_json(decrypted_data)
+
+        except (InvalidToken, json.JSONDecodeError, ValueError):
+            # Token is corrupted or invalid
+            return None
+
+    def delete(self, service_name: str) -> bool:
+        """Delete a stored token and its encryption key.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            True if token was deleted, False if it didn't exist.
+        """
+        token_path = self._get_token_path(service_name)
+
+        if not token_path.exists():
+            return False
+
+        # Delete the token file
+        token_path.unlink()
+
+        # Delete the encryption key from keyring
+        self._delete_encryption_key(service_name)
+
+        return True
+
+    def list_services(self) -> list[str]:
+        """List all services with stored tokens.
+
+        Returns:
+            List of service names that have stored tokens.
+        """
+        services = []
+        for path in self.credentials_dir.glob("*.enc"):
+            # Extract service name from filename
+            service_name = path.stem
+            services.append(service_name)
+        return sorted(services)
+
+    def get_status(self, service_name: str) -> TokenStatus:
+        """Get the status of a stored token.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            TokenStatus indicating the token's current state.
+        """
+        stored = self.retrieve(service_name)
+
+        if stored is None:
+            token_path = self._get_token_path(service_name)
+            if token_path.exists():
+                # File exists but couldn't be decrypted
+                return TokenStatus.INVALID
+            return TokenStatus.MISSING
+
+        if stored.token.is_expired():
+            return TokenStatus.EXPIRED
+
+        return TokenStatus.VALID

claude_mpm/cli/commands/commander.py

@@ -43,12 +43,12 @@ def display_commander_banner():
 
     # Commander ASCII art banner
     banner = f"""
-{CYAN}╭{'─' * (width - 2)}╮{RESET}
-{CYAN}│{RESET}{BOLD}  ⚡ MPM Commander {RESET}{DIM}v{version}{RESET}{' ' * (width - 24 - len(version))}│
-{CYAN}│{RESET}{DIM}  Multi-Project AI Orchestration{RESET}{' ' * (width - 36)}│
-{CYAN}├{'─' * (width - 2)}┤{RESET}
-{CYAN}│{RESET}  {YELLOW}ALPHA{RESET} - APIs may change                                {' ' * (width - 55)}│
-{CYAN}╰{'─' * (width - 2)}╯{RESET}
+{CYAN}╭{"─" * (width - 2)}╮{RESET}
+{CYAN}│{RESET}{BOLD}  ⚡ MPM Commander {RESET}{DIM}v{version}{RESET}{" " * (width - 24 - len(version))}│
+{CYAN}│{RESET}{DIM}  Multi-Project AI Orchestration{RESET}{" " * (width - 36)}│
+{CYAN}├{"─" * (width - 2)}┤{RESET}
+{CYAN}│{RESET}  {YELLOW}ALPHA{RESET} - APIs may change                                {" " * (width - 55)}│
+{CYAN}╰{"─" * (width - 2)}╯{RESET}
 """
     print(banner)
 

claude_mpm/cli/commands/mcp.py

@@ -33,7 +33,27 @@ def manage_mcp(args):
     """
     logger = get_logger("cli.mcp")
 
-    # First check if MCP package is installed for any command
+    # Commands that don't require full MCP Gateway or mcp package
+    # These only need mcp_service_registry which doesn't require the mcp package
+    service_mgmt_commands = {
+        MCPCommands.ENABLE.value,
+        MCPCommands.DISABLE.value,
+        MCPCommands.LIST.value,
+    }
+
+    # Route service management commands directly without any MCP dependencies
+    if args.mcp_command in service_mgmt_commands:
+        try:
+            from .mcp_command_router import MCPCommandRouter
+
+            router = MCPCommandRouter(logger)
+            return router.route_command(args)
+        except Exception as e:
+            logger.error(f"Error running service command: {e}", exc_info=True)
+            print(f"Error: {e}")
+            return 1
+
+    # Now check for mcp package for other commands
     import importlib.util
 
     mcp_spec = importlib.util.find_spec("mcp")
@@ -58,22 +78,14 @@ def manage_mcp(args):
         except ImportError as e:
             # Provide minimal fallbacks for basic commands
             logger.warning(f"Some MCP Gateway services not available: {e}")
-
-            # Allow install command to proceed
-            if args.mcp_command == MCPCommands.INSTALL.value:
-                MCPConfiguration = None
-                MCPServiceRegistry = None
-                ToolRegistry = None
-                MCPGateway = None
-            else:
-                print(
-                    "\nError: MCP Gateway services not fully available",
-                    file=sys.stderr,
-                )
-                print(f"Details: {e}", file=sys.stderr)
-                print("\nTry running:", file=sys.stderr)
-                print("  claude-mpm mcp install", file=sys.stderr)
-                return 1
+            print(
+                "\nError: MCP Gateway services not fully available",
+                file=sys.stderr,
+            )
+            print(f"Details: {e}", file=sys.stderr)
+            print("\nTry running:", file=sys.stderr)
+            print("  claude-mpm mcp install", file=sys.stderr)
+            return 1
 
         if not args.mcp_command:
             # No subcommand - show status by default

claude_mpm/cli/commands/mcp_command_router.py

@@ -48,6 +48,15 @@ class MCPCommandRouter:
         if args.mcp_command == MCPCommands.EXTERNAL.value:
             return self._manage_external(args)
 
+        if args.mcp_command == MCPCommands.ENABLE.value:
+            return self._enable_service(args)
+
+        if args.mcp_command == MCPCommands.DISABLE.value:
+            return self._disable_service(args)
+
+        if args.mcp_command == MCPCommands.LIST.value:
+            return self._list_services(args)
+
         if args.mcp_command == "cleanup":
             return self._cleanup_locks(args)
 
@@ -134,6 +143,27 @@ class MCPCommandRouter:
         handler = MCPExternalCommands(self.logger)
         return handler.manage_external(args)
 
+    def _enable_service(self, args) -> int:
+        """Enable MCP service command handler."""
+        from .mcp_service_commands import MCPServiceCommands
+
+        handler = MCPServiceCommands(self.logger)
+        return handler.enable_service(args)
+
+    def _disable_service(self, args) -> int:
+        """Disable MCP service command handler."""
+        from .mcp_service_commands import MCPServiceCommands
+
+        handler = MCPServiceCommands(self.logger)
+        return handler.disable_service(args)
+
+    def _list_services(self, args) -> int:
+        """List MCP services command handler."""
+        from .mcp_service_commands import MCPServiceCommands
+
+        handler = MCPServiceCommands(self.logger)
+        return handler.list_services(args)
+
     def _show_help(self):
         """Show available MCP commands."""
         print("\nAvailable MCP commands:")
@@ -148,6 +178,10 @@ class MCPCommandRouter:
         print("  config   - View and manage configuration")
         print("  external - Manage external MCP services")
         print("  cleanup  - Clean up legacy files")
+        print("\nService management:")
+        print("  enable   - Enable an MCP service in configuration")
+        print("  disable  - Disable an MCP service from configuration")
+        print("  list     - List available and enabled MCP services")
         print("\nFor help with a specific command:")
         print("  claude-mpm mcp <command> --help")
         print("\nExamples:")
@@ -159,3 +193,8 @@ class MCPCommandRouter:
         print("  claude-mpm mcp tools")
         print("  claude-mpm mcp register my-tool")
         print("  claude-mpm mcp test my-tool")
+        print("\nService management examples:")
+        print("  claude-mpm mcp list --available       # List all available services")
+        print("  claude-mpm mcp enable kuzu-memory     # Enable a service")
+        print("  claude-mpm mcp enable mcp-github --interactive  # Enable with prompts")
+        print("  claude-mpm mcp disable mcp-github     # Disable a service")