dockerhub-api 1.0.1__tar.gz → 1.3.2__tar.gz

{dockerhub_api-1.0.1 → dockerhub_api-1.3.2}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Audel Rouhi
+Copyright (c) 2026 Project Maintainers
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{dockerhub_api-1.0.1 → dockerhub_api-1.3.2}/PKG-INFO

@@ -1,35 +1,33 @@
 Metadata-Version: 2.4
 Name: dockerhub-api
-Version: 1.0.1
-Summary: Docker Hub API + MCP Server + A2A Server
-Author-email: Audel Rouhi <knucklessg1@gmail.com>
+Version: 1.3.2
+Summary: Docker Hub API + MCP Server
+Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Environment :: Console
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
-Requires-Python: <3.15,>=3.11
+Requires-Python: <3.15,>=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: agent-utilities>=1.0.0
-Requires-Dist: httpx>=0.27.0
-Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.11
+Requires-Dist: httpx>=0.28.1
+Requires-Dist: python-dotenv>=1.2.4
 Provides-Extra: mcp
-Requires-Dist: agent-utilities[mcp]>=1.0.0; extra == "mcp"
-Provides-Extra: agent
-Requires-Dist: agent-utilities[agent,logfire]>=1.0.0; extra == "agent"
+Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.11; extra == "mcp"
 Provides-Extra: all
-Requires-Dist: dockerhub-api[agent,logfire,mcp]>=1.0.0; extra == "all"
+Requires-Dist: dockerhub-api[mcp]>=1.0.1; extra == "all"
 Provides-Extra: test
-Requires-Dist: pytest-xdist>=3.6.0; extra == "test"
-Requires-Dist: pytest; extra == "test"
-Requires-Dist: pytest-asyncio; extra == "test"
-Requires-Dist: pytest-cov; extra == "test"
+Requires-Dist: pytest-xdist>=3.8.0; extra == "test"
+Requires-Dist: pytest>=9.1.1; extra == "test"
+Requires-Dist: pytest-asyncio>=1.4.0; extra == "test"
+Requires-Dist: pytest-cov>=7.1.0; extra == "test"
 Dynamic: license-file
 
 # Dockerhub Api
-## CLI or API | MCP | Agent
+## CLI or API | MCP
 
 ![PyPI - Version](https://img.shields.io/pypi/v/dockerhub-api)
 ![MCP Server](https://badge.mcpx.dev?type=server 'MCP Server')
@@ -43,10 +41,9 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/dockerhub-api)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/dockerhub-api)
 
-*Version: 1.0.1*
+*Version: 1.3.2*
 
 > **Documentation** — Installation, deployment, usage across the API, CLI, and MCP
-> interfaces, the integrated A2A agent server, and guidance on the backing
 > Docker Hub platform are maintained in [docs/](docs/index.md).
 
 ---
@@ -75,7 +72,7 @@ that wraps the official **Docker Hub API v2** (`https://hub.docker.com`): reposi
 and tags, immutable tags, personal and organization access tokens, organization
 members/settings/invites, teams, audit logs, and SCIM 2.0 provisioning — plus the
 **Registry HTTP API v2** (`registry-1.docker.io`: manifests, blobs, digests,
-multi-arch inspection, OCI referrers, and gated push/delete) and **Docker Scout**
+multi-arch inspection, OCI referrers, and gated push/remove) and **Docker Scout**
 (`api.scout.docker.com`: CVE/SBOM/policy intelligence).
 
 ---
@@ -93,14 +90,14 @@ multi-arch inspection, OCI referrers, and gated push/delete) and **Docker Scout*
   expiry, with one transparent re-mint on 401.
 - **Rate-Limit Telemetry:** `X-RateLimit-*` headers surfaced in every result;
   HTTP 429 retried with bounded `Retry-After` backoff.
-- **Safety by Default:** Deletes and org-settings writes are gated behind
+- **Safety by Default:** Removes and org-settings writes are gated behind
   `DOCKERHUB_ALLOW_DESTRUCTIVE` (default `False`); secrets are redacted from tool
   results (plaintext tokens appear exactly once — on creation). Repository creation
   stays enabled: it is the primary release-provisioning use case.
 - **Integrated Graph Agent:** Built-in Pydantic AI agent (`dockerhub-agent`) with
   A2A and AG-UI web interfaces.
 - **Native Telemetry & Tracing:** Out-of-the-box OpenTelemetry exports and Langfuse
-  tracing via agent-utilities.
+  tracing via agent-connector-sdk.
 
 ---
 
@@ -109,54 +106,48 @@ multi-arch inspection, OCI referrers, and gated push/delete) and **Docker Scout*
 ```bash
 pip install dockerhub-api            # API client only
 pip install "dockerhub-api[mcp]"     # + MCP server
-pip install "dockerhub-api[agent]"   # + A2A agent server
 pip install "dockerhub-api[all]"     # everything
 ```
 
 | Extra | Adds |
 |---|---|
-| `mcp` | FastMCP server (`dockerhub-mcp`) via `agent-utilities[mcp]` |
-| `agent` | Pydantic-AI A2A agent (`dockerhub-agent`) + Logfire via `agent-utilities[agent,logfire]` |
+| `mcp` | FastMCP server (`dockerhub-mcp`) via `agent-connector-sdk` |
+| `agent` | Pydantic-AI A2A agent (`dockerhub-agent`) + Logfire via `agent-connector-sdk` |
 | `all` | `mcp` + `agent` |
 | `test` | pytest toolchain for development |
 
 ```bash
-# MCP server only (recommended for tool hosting — slim deps)
+# Connector-focused MCP server (includes the shared graph engine)
 uv pip install "dockerhub-api[mcp]"
 
-# Full agent runtime (Pydantic AI + epistemic-graph engine)
-uv pip install "dockerhub-api[agent]"
+# Agent runtime (adds model orchestration to the shared graph engine)
 
 # Everything (development)
 uv pip install "dockerhub-api[all]"      # or: python -m pip install "dockerhub-api[all]"
 ```
 
-### Container images (`:mcp` vs `:agent`)
+### Container images (`:mcp`)
 
-One multi-stage `docker/Dockerfile` builds two right-sized images, selected by `--target`:
+One multi-stage `docker/Dockerfile` builds the MCP-only image (`--target mcp`):
 
 | Image tag | Build target | Contents | Entrypoint |
 |-----------|--------------|----------|------------|
-| `knucklessg1/dockerhub-api:mcp` | `--target mcp` | `dockerhub-api[mcp]` — **slim**, no engine/`pydantic-ai`/`dspy`/`llama-index`/`tree-sitter` | `dockerhub-mcp` |
-| `knucklessg1/dockerhub-api:latest` | `--target agent` (default) | `dockerhub-api[agent]` — **full** agent runtime + epistemic-graph engine | `dockerhub-agent` |
+| `example/dockerhub-api:mcp` | `--target mcp` | `dockerhub-api[mcp]` — **connector-focused**, includes `epistemic-graph[full]`; no model-orchestration stack | `dockerhub-mcp` |
 
 ```bash
-docker build --target mcp   -t knucklessg1/dockerhub-api:mcp    docker/   # slim MCP server
-docker build --target agent -t knucklessg1/dockerhub-api:latest docker/   # full agent
+docker build --target mcp   -t example/dockerhub-api:mcp    docker/   # connector-focused MCP server
 ```
 
-`docker/mcp.compose.yml` runs the slim `:mcp` server; `docker/agent.compose.yml` runs the
-agent (`:latest`) with a co-located `:mcp` sidecar.
+agent (`immutable agent digest`) with a co-located `:mcp` sidecar.
 
 ### Knowledge-graph database (`epistemic-graph`)
 
-The **full agent** (`[agent]` / `:latest`) embeds the **epistemic-graph** engine (pulled in
-transitively via `agent-utilities[agent]`). For production — or to share one knowledge graph
-across multiple agents — run **epistemic-graph as its own database container** and point the
-agent at it instead of embedding it. Deployment recipes (single-node + Raft HA), connection
-config, and the full database architecture (with diagrams) are documented in the
+Agent Connector SDK core dependency (`epistemic-graph[full]`). The `[mcp]` extra keeps
+deployments can use the bundled engine. For production or shared state, run
+**epistemic-graph as a dedicated database service** and configure the runtime to use it.
+Deployment recipes (single-node + Raft HA), connection configuration, and architecture
+diagrams are documented in the
 [epistemic-graph deployment guide](https://knuckles-team.github.io/epistemic-graph/deployment/).
-The slim `[mcp]` server does **not** require the database.
 
 ---
 
@@ -167,12 +158,12 @@ The slim `[mcp]` server does **not** require the database.
 ```python
 from dockerhub_api.auth import get_client
 
-api = get_client()   # reads DOCKERHUB_URL / DOCKER_HUB_USER / DOCKER_HUB_TOKEN
+api = get_client()  # reads DOCKERHUB_URL / DOCKER_HUB_USER / DOCKER_HUB_TOKEN
 
 repos = api.get_repositories(namespace="acme", ordering="-last_updated")
 api.create_repository(namespace="acme", name="release-images", is_private=True)
 tags = api.get_repository_tags(namespace="acme", repository="release-images")
-print(api.rate_limit)   # latest X-RateLimit-* snapshot
+print(api.rate_limit)  # latest X-RateLimit-* snapshot
 ```
 
 Every client method returns a uniform envelope:
@@ -193,6 +184,7 @@ _Auto-generated — do not edit (synced by the `mcp-readme-table` pre-commit hoo
 | `hub_admin` | `ADMINTOOL` | Client diagnostics: 'rate_limit' returns the latest |
 | `hub_audit` | `AUDITTOOL` | Read a Docker Hub account's audit trail: 'logs' lists events |
 | `hub_auth` | `AUTHTOOL` | Manage Docker Hub authentication, personal access tokens (PATs), |
+| `dockerhub_ingest_repositories` | `KGTOOL` | Natively ingest repositories into the epistemic-graph as typed :Repository/:ContainerImage nodes. |
 | `hub_org` | `ORGTOOL` | Manage a Docker Hub organization: settings (restricted images), |
 | `hub_registry` | `REGISTRYTOOL` | Docker Registry v2 image operations (``registry-1.docker.io``): |
 | `hub_repos` | `REPOSTOOL` | Manage Docker Hub repositories: list/create/inspect repositories, |
@@ -271,11 +263,10 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
 
 <!-- MCP-CONFIG-EXAMPLES:START -->
 
-> **Install the slim `[mcp]` extra.** All examples install `dockerhub-api[mcp]` — the
-> MCP-server extra that pulls only the FastMCP / FastAPI tooling (`agent-utilities[mcp]`).
-> It deliberately **excludes** the heavy agent runtime (`pydantic-ai`, the epistemic-graph
-> engine, `dspy`, `llama-index`), so `uvx` / container installs are far smaller. Use the
-> full `[agent]` extra only when you need the integrated Pydantic AI agent.
+> **Install the connector-focused `[mcp]` extra.** Examples use `dockerhub-api[mcp]` to add
+> FastMCP / FastAPI through `agent-connector-sdk`; the required Agent Connector SDK core
+> still carries `epistemic-graph[full]`. The `[agent-runtime]` extra additionally
+> enables model orchestration.
 
 #### stdio Transport (local IDEs — Cursor, Claude Desktop, VS Code)
 
@@ -290,20 +281,19 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
         "dockerhub-mcp"
       ],
       "env": {
-        "MCP_TOOL_MODE": "condensed",
+        "MCP_TOOL_MODE": "intent",
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
         "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
-        "DOCKERHUB_JWT": "",
+        "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
         "DOCKERHUB_USERNAME": "your_dockerhub_username",
-        "DOCKER_HUB_TOKEN": "",
-        "DOCKER_HUB_USER": "",
         "DOCKER_REGISTRY_AUTH_URL": "https://auth.docker.io/token",
         "DOCKER_REGISTRY_URL": "https://registry-1.docker.io",
         "DOCKER_SCOUT_URL": "https://api.scout.docker.com",
+        "KGTOOL": "True",
         "ORGTOOL": "True",
         "REGISTRYTOOL": "True",
         "REPOSTOOL": "True",
@@ -316,6 +306,10 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
 }
 ```
 
+Runtime references require an alias-aware launcher such as Arbora. Other
+launchers must omit those entries and inject the resolved values through their
+own runtime secret boundary.
+
 #### Streamable-HTTP Transport (networked / production)
 
 ```json
@@ -334,22 +328,21 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
       ],
       "env": {
         "TRANSPORT": "streamable-http",
-        "HOST": "0.0.0.0",
+        "HOST": "127.0.0.1",
         "PORT": "8000",
-        "MCP_TOOL_MODE": "condensed",
+        "MCP_TOOL_MODE": "intent",
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
         "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
-        "DOCKERHUB_JWT": "",
+        "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
         "DOCKERHUB_USERNAME": "your_dockerhub_username",
-        "DOCKER_HUB_TOKEN": "",
-        "DOCKER_HUB_USER": "",
         "DOCKER_REGISTRY_AUTH_URL": "https://auth.docker.io/token",
         "DOCKER_REGISTRY_URL": "https://registry-1.docker.io",
         "DOCKER_SCOUT_URL": "https://api.scout.docker.com",
+        "KGTOOL": "True",
         "ORGTOOL": "True",
         "REGISTRYTOOL": "True",
         "REPOSTOOL": "True",
@@ -374,54 +367,60 @@ Alternatively, connect to a pre-deployed Streamable-HTTP instance by `url`:
 }
 ```
 
-Deploying the Streamable-HTTP server via Docker:
+Run a reviewed container image as a least-privilege stdio child (no
+listener or published port):
 
 ```bash
-docker run -d \
-  --name dockerhub-mcp-mcp \
-  -p 8000:8000 \
-  -e TRANSPORT=streamable-http \
-  -e HOST=0.0.0.0 \
-  -e PORT=8000 \
-  -e MCP_TOOL_MODE=condensed \
+docker run -i --rm \
+  --read-only \
+  --cap-drop=ALL \
+  --security-opt=no-new-privileges \
+  --pids-limit=256 \
+  --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
+  -e TRANSPORT=stdio \
+  -e MCP_TOOL_MODE=intent \
   -e ADMINTOOL=True \
   -e AUDITTOOL=True \
   -e AUTHTOOL=True \
   -e DOCKERHUB_ALLOW_DESTRUCTIVE=False \
-  -e DOCKERHUB_JWT="" \
+  -e DOCKERHUB_TLS_PROFILE=system \
   -e DOCKERHUB_TOKEN=dckr_pat_your_personal_access_token \
   -e DOCKERHUB_URL=https://hub.docker.com \
   -e DOCKERHUB_USERNAME=your_dockerhub_username \
-  -e DOCKER_HUB_TOKEN="" \
-  -e DOCKER_HUB_USER="" \
   -e DOCKER_REGISTRY_AUTH_URL=https://auth.docker.io/token \
   -e DOCKER_REGISTRY_URL=https://registry-1.docker.io \
   -e DOCKER_SCOUT_URL=https://api.scout.docker.com \
+  -e KGTOOL=True \
   -e ORGTOOL=True \
   -e REGISTRYTOOL=True \
   -e REPOSTOOL=True \
   -e SCIMTOOL=True \
   -e SCOUTTOOL=True \
   -e TEAMSTOOL=True \
-  knucklessg1/dockerhub-api:mcp
+  registry.example.invalid/dockerhub-api@sha256:<digest> dockerhub-mcp
 ```
 
+For containerized network HTTP, supply an authenticated TLS ingress (or
+direct server TLS), exact `MCP_ALLOWED_HOSTS`, and an exact trusted-proxy
+CIDR policy through the operator-owned deployment profile. The generator
+does not emit an unauthenticated non-loopback listener.
+
 _Auto-generated from the code-read env surface (`MCP_TOOL_MODE` + package vars) — do not edit._
 <!-- MCP-CONFIG-EXAMPLES:END -->
 
 <!-- BEGIN GENERATED: additional-deployment-options -->
 ### Additional Deployment Options
 
-`dockerhub-api` can also run as a **local container** (Docker / Podman / `uv`) or be
-consumed from a **remote deployment**. The
-[Deployment guide](https://knuckles-team.github.io/dockerhub-api/deployment/) has full, copy-paste
-`mcp_config.json` for all four transports — **stdio**, **streamable-http**,
-**local container / uv**, and **remote URL**:
+`dockerhub-api` can run as a local stdio process or container, or behind a remote
+network boundary. The
+[Deployment guide](https://knuckles-team.github.io/dockerhub-api/deployment/) carries
+the detailed transport contract.
 
-- **Local container / uv** — launch the server from `mcp_config.json` via `uvx`,
-  `docker run`, or `podman run`, or point at a local streamable-http container by `url`.
-- **Remote URL** — connect to a server deployed behind Caddy at
-  `http://dockerhub-mcp.arpa/mcp` using the `"url"` key.
+- **Local container** — launch a reviewed immutable image as a least-privilege
+  stdio child with no listener or published port.
+- **Remote URL** — connect through an operator-supplied authenticated HTTPS
+  ingress. Keep its URL, outbound identity references, trust profile, and exact
+  `MCP_ALLOWED_HOSTS` in `AgentConfig`.
 <!-- END GENERATED: additional-deployment-options -->
 
 ## Safety Model
@@ -430,14 +429,14 @@ consumed from a **remote deployment**. The
 |---|---|---|
 | Reads (repos, tags, members, logs, SCIM) | allowed | — |
 | Repository create / immutable-tag config / invites / role updates | allowed | — |
-| Deletes (PATs, OATs, groups, members, invites) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
+| Removes (PATs, OATs, groups, members, invites) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
 | Org-settings writes (`PUT /v2/orgs/{org}/settings`) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
 
 ---
 
 ## Concepts
 
-The concept registry (`CONCEPT:HUB-1.x`) is documented in
+The concept registry (`CONCEPT:DH-OS.governance.hub-x`) is documented in
 [docs/concepts.md](docs/concepts.md).
 
 ## License
@@ -445,23 +444,88 @@ The concept registry (`CONCEPT:HUB-1.x`) is documented in
 MIT — see [LICENSE](LICENSE).
 
 
-<!-- BEGIN agent-os-genesis-deploy (generated; do not edit between markers) -->
-
-## Deploy with `agent-os-genesis`
-
-This package can be provisioned for you — skill-guided — by the **`agent-os-genesis`**
-universal skill (its *single-package deploy mode*): it picks your install method, seeds
-secrets to OpenBao/Vault (or `.env`), trusts your enterprise CA, registers the MCP
-server, and verifies it — the same machinery that stands up the whole Agent OS, narrowed
-to just this package. Ask your agent to **"deploy `dockerhub-api` with agent-os-genesis"**.
-
-| Install mode | Command |
-|------|---------|
-| Bare-metal, prod (PyPI) | `uvx dockerhub-mcp` · or `uv tool install dockerhub-api` |
-| Bare-metal, dev (editable) | `uv pip install -e ".[all]"` · or `pip install -e ".[all]"` |
-| Container, prod | deploy `knucklessg1/dockerhub-api:latest` via docker-compose / swarm / podman / podman-compose / kubernetes |
-| Container, dev (editable) | deploy `docker/compose.dev.yml` (source-mounted at `/src`; edits live on restart) |
-
-Secrets are read-existing + seeded via `vault_sync` — you are only prompted for what's missing.
 
-<!-- END agent-os-genesis-deploy -->
+<!-- GOVERNED-CAPABILITY:START -->
+## Governed capability contract
+
+This package ships a compact canonical skill surface with specialist procedures
+kept as referenced workflows. The current MCP tools, skill metadata,
+`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,
+tool-schema fingerprints, and certification metadata form one versioned
+capability contract. Validate them together; do not rely on stale tool names or
+historical per-task skill wrappers.
+
+Runtime endpoints, credentials, certificate trust, tenant identity, retention,
+and observability policy are deployment inputs and are never packaged values.
+See [Configuration, trust, and privacy](docs/configuration.md) before enabling a
+network transport, connector ingestion, Arbora delegation, or trace export.
+<!-- GOVERNED-CAPABILITY:END -->
+
+## Environment Variables
+
+<!-- ENV-VARS-TABLE:START -->
+
+#### Package environment variables
+
+| Variable | Example | Description |
+|----------|---------|-------------|
+| `HOST` | `0.0.0.0` |  |
+| `PORT` | `8000` |  |
+| `TRANSPORT` | `stdio` | options: stdio, streamable-http, sse |
+| `FASTMCP_LOG_LEVEL` | `ERROR` |  |
+| `NO_COLOR` | `1` |  |
+| `TERM` | `dumb` | forced to "dumb" by the server to disable ANSI/color output |
+| `ENABLE_OTEL` | `True` |  |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | `http://localhost:8080/api/public/otel` |  |
+| `OTEL_EXPORTER_OTLP_PUBLIC_KEY` | secret-injected |  |
+| `OTEL_EXPORTER_OTLP_SECRET_KEY` | secret-injected |  |
+| `OTEL_EXPORTER_OTLP_PROTOCOL` | `http/protobuf` |  |
+| `EUNOMIA_TYPE` | `none` | options: none, embedded, remote |
+| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` |  |
+| `EUNOMIA_REMOTE_URL` | `http://eunomia-server:8000` |  |
+| `DOCKER_HUB_USER` | — | Official hub-tool credential names (primary): |
+| `DOCKER_HUB_TOKEN` | secret-injected |  |
+| `DOCKERHUB_URL` | `https://hub.docker.com` | Fallback aliases: DOCKERHUB_USERNAME / DOCKERHUB_TOKEN / DOCKERHUB_JWT |
+| `DOCKERHUB_USERNAME` | `your_dockerhub_username` |  |
+| `DOCKERHUB_TOKEN` | secret-injected | password, PAT, or org access token |
+| `DOCKERHUB_JWT` | — | optional pre-minted bearer (overrides the above) |
+| `DOCKERHUB_TLS_PROFILE` | `system` | Named outbound TLS policy from AgentConfig. Use a reference for runtime-only trust material; peer and hostname verification remain mandatory. |
+| `DOCKERHUB_TLS_PROFILE_REF` | — |  |
+| `DOCKER_REGISTRY_URL` | `https://registry-1.docker.io` |  |
+| `DOCKER_REGISTRY_AUTH_URL` | `https://auth.docker.io/token` | token-service realm; auto-discovered from the 401 challenge |
+| `DOCKER_SCOUT_URL` | `https://api.scout.docker.com` |  |
+| `DOCKERHUB_ALLOW_DESTRUCTIVE` | `False` |  |
+| `AUTHTOOL` | `True` |  |
+| `REPOSTOOL` | `True` |  |
+| `ORGTOOL` | `True` |  |
+| `TEAMSTOOL` | `True` |  |
+| `AUDITTOOL` | `True` |  |
+| `SCIMTOOL` | `True` |  |
+| `ADMINTOOL` | `True` |  |
+| `REGISTRYTOOL` | `True` |  |
+| `SCOUTTOOL` | `True` |  |
+| `KGTOOL` | `True` |  |
+
+#### Inherited agent-connector-sdk variables (apply to every connector)
+
+| Variable | Example | Description |
+|----------|---------|-------------|
+| `MCP_TOOL_MODE` | `intent` | Tool surface: `intent` \| `condensed` \| `verbose` \| `both` |
+| `MCP_ENABLED_TOOLS` | — | Comma-separated tool allow-list |
+| `MCP_DISABLED_TOOLS` | — | Comma-separated tool deny-list |
+| `MCP_ENABLED_TAGS` | — | Comma-separated tag allow-list |
+| `MCP_DISABLED_TAGS` | — | Comma-separated tag deny-list |
+| `MCP_CLIENT_AUTH` | — | Outbound MCP child auth: `oidc-client-credentials` \| `basic` \| `none` |
+| `OIDC_CLIENT_ID` | — | OIDC client id (service-account auth) |
+| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |
+| `MCP_BASIC_AUTH_USERNAME` | — | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |
+| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |
+| `DEBUG` | `False` | Verbose logging |
+| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |
+| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |
+| `PROVIDER` | `openai` | LLM provider for the agent |
+| `MODEL_ID` | `gpt-4o` | Model id for the agent |
+| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |
+
+_36 package + 16 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set — do not edit._
+<!-- ENV-VARS-TABLE:END -->