dockerhub-api 1.3.10__tar.gz → 1.4.0__tar.gz

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dockerhub-api
-Version: 1.3.10
+Version: 1.4.0
 Summary: Docker Hub API + MCP Server
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: <3.15,>=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: scion-sdk[mcp]>=0.9.0
+Requires-Dist: scion-sdk[mcp]<0.11,>=0.10.2
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: python-dotenv>=1.2.4
 Provides-Extra: test
@@ -84,8 +84,7 @@ multi-arch inspection, OCI referrers, and gated push/remove) and **Docker Scout*
   expiry, with one transparent re-mint on 401.
 - **Rate-Limit Telemetry:** `X-RateLimit-*` headers surfaced in every result;
   HTTP 429 retried with bounded `Retry-After` backoff.
-- **Safety by Default:** Removes and org-settings writes are gated behind
-  `DOCKERHUB_ALLOW_DESTRUCTIVE` (default `False`); secrets are redacted from tool
+- **Safety by Default:** Removes and org-settings writes are declared destructive; the SDK asks the caller to confirm (`confirm=true`) before any request. Secrets are redacted from tool
   results (plaintext tokens appear exactly once — on creation). Repository creation
   stays enabled: it is the primary release-provisioning use case.
 - **Integrated Graph Agent:** Built-in Pydantic AI agent (`dockerhub-agent`) with
@@ -279,7 +278,6 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
-        "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
         "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
@@ -328,7 +326,6 @@ own runtime secret boundary.
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
-        "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
         "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
@@ -376,7 +373,6 @@ docker run -i --rm \
   -e ADMINTOOL=True \
   -e AUDITTOOL=True \
   -e AUTHTOOL=True \
-  -e DOCKERHUB_ALLOW_DESTRUCTIVE=False \
   -e DOCKERHUB_TLS_PROFILE=system \
   -e DOCKERHUB_TOKEN=dckr_pat_your_personal_access_token \
   -e DOCKERHUB_URL=https://hub.docker.com \
@@ -423,8 +419,7 @@ the detailed transport contract.
 |---|---|---|
 | Reads (repos, tags, members, logs, SCIM) | allowed | — |
 | Repository create / immutable-tag config / invites / role updates | allowed | — |
-| Removes (PATs, OATs, groups, members, invites) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
-| Org-settings writes (`PUT /v2/orgs/{org}/settings`) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
+| Removes (PATs, OATs, groups, members, invites) and org-settings writes | confirmation required | `confirm=true` per call, or operator setting `SCION_ALLOW_DESTRUCTIVE` |
 
 ---
 
@@ -488,7 +483,6 @@ network transport, connector ingestion, Arbora delegation, or trace export.
 | `DOCKER_REGISTRY_URL` | `https://registry-1.docker.io` |  |
 | `DOCKER_REGISTRY_AUTH_URL` | `https://auth.docker.io/token` | token-service realm; auto-discovered from the 401 challenge |
 | `DOCKER_SCOUT_URL` | `https://api.scout.docker.com` |  |
-| `DOCKERHUB_ALLOW_DESTRUCTIVE` | `False` |  |
 | `AUTHTOOL` | `True` |  |
 | `REPOSTOOL` | `True` |  |
 | `ORGTOOL` | `True` |  |

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/README.md

@@ -60,8 +60,7 @@ multi-arch inspection, OCI referrers, and gated push/remove) and **Docker Scout*
   expiry, with one transparent re-mint on 401.
 - **Rate-Limit Telemetry:** `X-RateLimit-*` headers surfaced in every result;
   HTTP 429 retried with bounded `Retry-After` backoff.
-- **Safety by Default:** Removes and org-settings writes are gated behind
-  `DOCKERHUB_ALLOW_DESTRUCTIVE` (default `False`); secrets are redacted from tool
+- **Safety by Default:** Removes and org-settings writes are declared destructive; the SDK asks the caller to confirm (`confirm=true`) before any request. Secrets are redacted from tool
   results (plaintext tokens appear exactly once — on creation). Repository creation
   stays enabled: it is the primary release-provisioning use case.
 - **Integrated Graph Agent:** Built-in Pydantic AI agent (`dockerhub-agent`) with
@@ -255,7 +254,6 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
-        "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
         "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
@@ -304,7 +302,6 @@ own runtime secret boundary.
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
-        "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
         "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
@@ -352,7 +349,6 @@ docker run -i --rm \
   -e ADMINTOOL=True \
   -e AUDITTOOL=True \
   -e AUTHTOOL=True \
-  -e DOCKERHUB_ALLOW_DESTRUCTIVE=False \
   -e DOCKERHUB_TLS_PROFILE=system \
   -e DOCKERHUB_TOKEN=dckr_pat_your_personal_access_token \
   -e DOCKERHUB_URL=https://hub.docker.com \
@@ -399,8 +395,7 @@ the detailed transport contract.
 |---|---|---|
 | Reads (repos, tags, members, logs, SCIM) | allowed | — |
 | Repository create / immutable-tag config / invites / role updates | allowed | — |
-| Removes (PATs, OATs, groups, members, invites) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
-| Org-settings writes (`PUT /v2/orgs/{org}/settings`) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
+| Removes (PATs, OATs, groups, members, invites) and org-settings writes | confirmation required | `confirm=true` per call, or operator setting `SCION_ALLOW_DESTRUCTIVE` |
 
 ---
 
@@ -464,7 +459,6 @@ network transport, connector ingestion, Arbora delegation, or trace export.
 | `DOCKER_REGISTRY_URL` | `https://registry-1.docker.io` |  |
 | `DOCKER_REGISTRY_AUTH_URL` | `https://auth.docker.io/token` | token-service realm; auto-discovered from the 401 challenge |
 | `DOCKER_SCOUT_URL` | `https://api.scout.docker.com` |  |
-| `DOCKERHUB_ALLOW_DESTRUCTIVE` | `False` |  |
 | `AUTHTOOL` | `True` |  |
 | `REPOSTOOL` | `True` |  |
 | `ORGTOOL` | `True` |  |

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_access_tokens.py

@@ -5,6 +5,8 @@ CONCEPT:DH-OS.identity.jwt-auth-lifecycle-endpoint — JWT auth lifecycle (PAT m
 
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from dockerhub_api.api.api_client_base import DockerHubApiBase
 from dockerhub_api.dockerhub_input_models import (
     AccessTokenCreateModel,
@@ -70,8 +72,8 @@ class DockerHubApiAccessTokens(DockerHubApiBase):
         envelope["data"] = validate_lenient(AccessToken, envelope["data"])
         return envelope
 
+    @destructive_operation
     def delete_access_token(self, uuid: str) -> dict[str, Any]:
         """Delete a personal access token. Destructive — gated."""
-        self._guard_destructive("delete_access_token")
         model = AccessTokenModel(uuid=uuid)
         return self._request("DELETE", f"/v2/access-tokens/{model.uuid}")

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_base.py

@@ -10,8 +10,7 @@ headers are captured into the result envelope (and kept on the client as
 ``Retry-After`` backoff.
 
 CONCEPT:DH-OS.identity.destructive-action-gating-member — destructive-action gating. Deletes and org-settings writes
-raise :class:`DestructiveOperationError` unless the client was built with
-``allow_destructive=True``.
+are declared with the SDK ``destructive_operation`` decorator; the SDK asks the caller to confirm.
 """
 
 import logging
@@ -40,10 +39,6 @@ DEFAULT_MAX_RETRIES = 3
 DEFAULT_TIMEOUT = 30.0
 
 
-class DestructiveOperationError(PermissionError):
-    """Raised when a destructive operation is attempted while gated off."""
-
-
 class DockerHubApiBase:
     """Shared transport, auth header, retry, and envelope logic."""
 
@@ -58,7 +53,6 @@ class DockerHubApiBase:
         timeout: float = DEFAULT_TIMEOUT,
         max_retries: int = DEFAULT_MAX_RETRIES,
         retry_after_cap: float = DEFAULT_RETRY_AFTER_CAP,
-        allow_destructive: bool = False,
         debug: bool = False,
         transport: httpx.BaseTransport | None = None,
     ):
@@ -75,7 +69,6 @@ class DockerHubApiBase:
         self.timeout = timeout
         self.max_retries = max_retries
         self.retry_after_cap = retry_after_cap
-        self.allow_destructive = allow_destructive
         self.debug = debug
         #: Last rate-limit snapshot seen on any response.
         self.rate_limit: dict[str, Any] = {}
@@ -188,18 +181,6 @@ class DockerHubApiBase:
             "rate_limit": dict(self.rate_limit) if self.rate_limit else {},
         }
 
-    # ------------------------------------------------------------------ #
-    # Destructive gating
-    # ------------------------------------------------------------------ #
-
-    def _guard_destructive(self, operation: str) -> None:
-        if not self.allow_destructive:
-            raise DestructiveOperationError(
-                f"Destructive operation '{operation}' is disabled. "
-                "Build the client with allow_destructive=True or set "
-                "DOCKERHUB_ALLOW_DESTRUCTIVE=True to enable it."
-            )
-
     # ------------------------------------------------------------------ #
     # Request engine
     # ------------------------------------------------------------------ #

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_groups.py

@@ -6,6 +6,8 @@ CONCEPT:DH-OS.identity.destructive-action-gating-member — destructive-action g
 
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from dockerhub_api.api.api_client_base import DockerHubApiBase
 from dockerhub_api.dockerhub_input_models import (
     GroupCreateModel,
@@ -99,9 +101,9 @@ class DockerHubApiGroups(DockerHubApiBase):
         envelope["data"] = validate_lenient(Group, envelope["data"])
         return envelope
 
+    @destructive_operation
     def delete_group(self, org: str, group_name: str) -> dict[str, Any]:
         """Delete a group. Destructive — gated."""
-        self._guard_destructive("delete_group")
         model = GroupModel(org=org, group_name=group_name)
         return self._request(
             "DELETE", f"/v2/orgs/{model.org}/groups/{model.group_name}"
@@ -146,11 +148,11 @@ class DockerHubApiGroups(DockerHubApiBase):
         envelope["data"] = validate_lenient(OrgMember, envelope["data"])
         return envelope
 
+    @destructive_operation
     def remove_group_member(
         self, org: str, group_name: str, username: str
     ) -> dict[str, Any]:
         """Remove a username from a group. Destructive — gated."""
-        self._guard_destructive("remove_group_member")
         model = GroupMemberModel(org=org, group_name=group_name, username=username)
         return self._request(
             "DELETE",

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_org_access_tokens.py

@@ -5,6 +5,8 @@ CONCEPT:DH-OS.identity.jwt-auth-lifecycle-endpoint — JWT auth lifecycle (OAT m
 
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from dockerhub_api.api.api_client_base import DockerHubApiBase
 from dockerhub_api.dockerhub_input_models import (
     OrgAccessTokenCreateModel,
@@ -97,9 +99,9 @@ class DockerHubApiOrgAccessTokens(DockerHubApiBase):
         envelope["data"] = validate_lenient(OrgAccessToken, envelope["data"])
         return envelope
 
+    @destructive_operation
     def delete_org_access_token(self, org: str, token_id: str) -> dict[str, Any]:
         """Delete an organization access token. Destructive — gated."""
-        self._guard_destructive("delete_org_access_token")
         model = OrgAccessTokenModel(org=org, token_id=token_id)
         return self._request(
             "DELETE", f"/v2/orgs/{model.org}/access-tokens/{model.token_id}"

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_orgs.py

@@ -7,6 +7,8 @@ org-settings writes).
 
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from dockerhub_api.api.api_client_base import DockerHubApiBase
 from dockerhub_api.dockerhub_input_models import (
     BulkInviteModel,
@@ -37,6 +39,7 @@ class DockerHubApiOrgs(DockerHubApiBase):
         envelope["data"] = validate_lenient(OrgSettings, envelope["data"])
         return envelope
 
+    @destructive_operation
     def update_org_settings(
         self,
         org: str,
@@ -50,7 +53,6 @@ class DockerHubApiOrgs(DockerHubApiBase):
         org-approved images, with carve-outs for Docker Official Images and
         Verified Publisher images.
         """
-        self._guard_destructive("update_org_settings")
         model = OrgSettingsModel(
             org=org,
             restricted_images_enabled=restricted_images_enabled,
@@ -104,9 +106,9 @@ class DockerHubApiOrgs(DockerHubApiBase):
         envelope["data"] = validate_lenient(OrgMember, envelope["data"])
         return envelope
 
+    @destructive_operation
     def remove_org_member(self, org: str, username: str) -> dict[str, Any]:
         """Remove a member from the organization. Destructive — gated."""
-        self._guard_destructive("remove_org_member")
         model = OrgMemberModel(org=org, username=username)
         return self._request("DELETE", f"/v2/orgs/{model.org}/members/{model.username}")
 
@@ -118,9 +120,9 @@ class DockerHubApiOrgs(DockerHubApiBase):
         envelope["data"] = validate_lenient(InvitePage, envelope["data"])
         return envelope
 
+    @destructive_operation
     def delete_invite(self, invite_id: str) -> dict[str, Any]:
         """Cancel an invite. Destructive — gated."""
-        self._guard_destructive("delete_invite")
         model = InviteModel(invite_id=invite_id)
         return self._request("DELETE", f"/v2/invites/{model.invite_id}")
 

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_registry.py

@@ -6,8 +6,8 @@ multi-arch platform resolution, digest resolution, and (gated) deletes.
 CONCEPT:DH-OS.governance.oci-referrers-attestation-discovery — OCI Referrers / attestation discovery.
 CONCEPT:DH-OS.governance.chunked-blob-push-upload — chunked blob push (upload session + manifest put).
 
-Pushes, deletes, and blob uploads are destructive and gated by
-``allow_destructive`` (``DOCKERHUB_ALLOW_DESTRUCTIVE``). ``_catalog`` is
+Pushes, deletes, and blob uploads are destructive: the SDK
+asks the caller to confirm each. ``_catalog`` is
 intentionally omitted: Docker Hub does not support registry-wide catalog
 listing (it requires a registry-scoped token the Hub token service won't issue).
 """
@@ -15,6 +15,8 @@ listing (it requires a registry-scoped token the Hub token service won't issue).
 import json as _json
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from dockerhub_api.api.api_client_registry_base import (
     ACCEPT_MANIFESTS,
     OCTET_STREAM,
@@ -96,6 +98,7 @@ class RegistryApi(RegistryApiBase):
         }
         return envelope
 
+    @destructive_operation
     def put_manifest(
         self,
         repo: str,
@@ -104,7 +107,6 @@ class RegistryApi(RegistryApiBase):
         media_type: str,
     ) -> dict[str, Any]:
         """``PUT /v2/{repo}/manifests/{reference}`` — push a manifest (gated)."""
-        self._guard_destructive("put_manifest")
         body = manifest if isinstance(manifest, str) else _json.dumps(manifest)
         return self._registry_request(
             "PUT",
@@ -115,13 +117,13 @@ class RegistryApi(RegistryApiBase):
             content_type=media_type,
         )
 
+    @destructive_operation
     def delete_manifest(self, repo: str, reference: str) -> dict[str, Any]:
         """``DELETE /v2/{repo}/manifests/{digest}`` — delete a tag/manifest (gated).
 
         Docker Hub requires deletion by digest; pass a tag and it is resolved
         to its digest first.
         """
-        self._guard_destructive("delete_manifest")
         target = reference
         if not reference.startswith("sha256:"):
             resolved = self.resolve_digest(repo, reference)
@@ -140,13 +142,13 @@ class RegistryApi(RegistryApiBase):
         """``HEAD /v2/{repo}/blobs/{digest}`` — blob existence check."""
         return self._registry_exists(repo, f"/blobs/{digest}")
 
+    @destructive_operation
     def delete_blob(self, repo: str, digest: str) -> dict[str, Any]:
         """``DELETE /v2/{repo}/blobs/{digest}`` — delete a blob (gated).
 
         Often returns ``405`` on Docker Hub (blob delete disabled); the status
         is surfaced cleanly rather than masked.
         """
-        self._guard_destructive("delete_blob")
         return self._registry_request(
             "DELETE",
             repo,
@@ -293,13 +295,14 @@ class RegistryApi(RegistryApiBase):
 
     # ------------------------------- push -------------------------------- #
 
+    @destructive_operation
     def start_upload(self, repo: str) -> dict[str, Any]:
         """``POST /v2/{repo}/blobs/uploads/`` — open a blob upload session (gated)."""
-        self._guard_destructive("start_upload")
         return self._registry_request(
             "POST", repo, "/blobs/uploads/", scope_actions="pull,push"
         )
 
+    @destructive_operation
     def upload_chunk(
         self,
         repo: str,
@@ -308,7 +311,6 @@ class RegistryApi(RegistryApiBase):
         content_range: str | None = None,
     ) -> dict[str, Any]:
         """``PATCH {location}`` — upload one blob chunk (gated)."""
-        self._guard_destructive("upload_chunk")
         extra = {"Content-Range": content_range} if content_range else None
         return self._registry_request(
             "PATCH",
@@ -320,6 +322,7 @@ class RegistryApi(RegistryApiBase):
             extra_headers=extra,
         )
 
+    @destructive_operation
     def complete_upload(
         self,
         repo: str,
@@ -328,7 +331,6 @@ class RegistryApi(RegistryApiBase):
         final_chunk: bytes | None = None,
     ) -> dict[str, Any]:
         """``PUT {location}?digest=`` — finalize a blob upload (gated)."""
-        self._guard_destructive("complete_upload")
         return self._registry_request(
             "PUT",
             repo,
@@ -339,9 +341,9 @@ class RegistryApi(RegistryApiBase):
             content_type=OCTET_STREAM,
         )
 
+    @destructive_operation
     def mount_blob(self, repo: str, digest: str, from_repo: str) -> dict[str, Any]:
         """``POST /v2/{repo}/blobs/uploads/?mount=&from=`` — cross-repo mount (gated)."""
-        self._guard_destructive("mount_blob")
         return self._registry_request(
             "POST",
             repo,

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/api/api_client_registry_base.py

@@ -74,7 +74,6 @@ class RegistryApiBase(DockerHubApiBase):
         registry_token_manager: Any | None = None,
         tls_profile: ResolvedTLSProfile | None = None,
         timeout: float | None = None,
-        allow_destructive: bool = False,
         debug: bool = False,
         transport: httpx.BaseTransport | None = None,
         **kwargs: Any,
@@ -85,7 +84,6 @@ class RegistryApiBase(DockerHubApiBase):
             url=url or DEFAULT_REGISTRY_URL,
             tls_profile=tls_profile,
             timeout=timeout if timeout is not None else 30.0,
-            allow_destructive=allow_destructive,
             debug=debug,
             transport=transport,
             **kwargs,

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/auth.py

@@ -339,12 +339,6 @@ def _resolve_tls_profile(
     )
 
 
-def _resolve_allow_destructive(allow_destructive: bool | None) -> bool:
-    if allow_destructive is None:
-        return setting("DOCKERHUB_ALLOW_DESTRUCTIVE", False)
-    return allow_destructive
-
-
 @dataclass
 class _HubCredentials:
     url: str
@@ -407,7 +401,6 @@ def get_client(
     token: str | None = None,
     jwt: str | None = None,
     tls_profile: ResolvedTLSProfile | None = None,
-    allow_destructive: bool | None = None,
     config: dict | None = None,
 ) -> Any:
     """Factory for the Docker Hub :class:`~dockerhub_api.api_client.Api` client.
@@ -422,8 +415,8 @@ def get_client(
        password, a PAT ``dckr_pat_*``, or an org token).
     3. Anonymous — public, unauthenticated endpoints only.
 
-    ``DOCKERHUB_ALLOW_DESTRUCTIVE`` (default ``False``) gates deletes and
-    org-settings writes. CONCEPT:DH-OS.identity.destructive-action-gating-member — destructive-action gating.
+    Deletes and org-settings writes are declared destructive with the SDK and ask the caller to confirm.
+    CONCEPT:DH-OS.identity.destructive-action-gating-member — destructive-action gating.
 
     A resolved ``username`` (personal account or org) the caller's identity is
     not entitled to is denied before any credential exchange happens.
@@ -433,7 +426,6 @@ def get_client(
     creds = _resolve_hub_credentials(url, username, token, jwt, config)
     _deny_unless_entitled(creds.username)
     profile = _resolve_tls_profile(tls_profile)
-    allow_destructive = _resolve_allow_destructive(allow_destructive)
 
     if creds.jwt:
         logger.info("Using pre-minted Docker Hub JWT")
@@ -441,7 +433,6 @@ def get_client(
             url=creds.url,
             token=creds.jwt,
             tls_profile=profile,
-            allow_destructive=allow_destructive,
         )
 
     if creds.username and creds.token:
@@ -459,14 +450,13 @@ def get_client(
             url=creds.url,
             token_manager=manager,
             tls_profile=profile,
-            allow_destructive=allow_destructive,
         )
 
     logger.warning(
         "No Docker Hub credentials configured — anonymous client "
         "(public endpoints only). Set DOCKERHUB_USERNAME and DOCKERHUB_TOKEN."
     )
-    return Api(url=creds.url, tls_profile=profile, allow_destructive=allow_destructive)
+    return Api(url=creds.url, tls_profile=profile)
 
 
 def _resolve_credentials(
@@ -509,7 +499,6 @@ def get_registry_client(
     username: str | None = None,
     token: str | None = None,
     tls_profile: ResolvedTLSProfile | None = None,
-    allow_destructive: bool | None = None,
     config: dict | None = None,
     transport: Any | None = None,
 ) -> Any:
@@ -519,7 +508,7 @@ def get_registry_client(
     scoped tokens via :class:`RegistryTokenManager` using the same
     ``DOCKER_HUB_USER`` / ``DOCKER_HUB_TOKEN`` credentials (anonymous when
     unset, which still works for public pulls). Pushes, deletes, and blob
-    uploads are gated by ``DOCKERHUB_ALLOW_DESTRUCTIVE``.
+    uploads are declared destructive with the SDK.
 
     A resolved ``username`` (personal account or org) the caller's identity is
     not entitled to is denied before any token is minted.
@@ -541,7 +530,6 @@ def get_registry_client(
     username, token = _resolve_credentials(username, token, config)
     _deny_unless_entitled(username)
     profile = _resolve_tls_profile(tls_profile)
-    allow_destructive = _resolve_allow_destructive(allow_destructive)
 
     token_manager = RegistryTokenManager(
         username=username,
@@ -555,7 +543,6 @@ def get_registry_client(
         url=url,
         registry_token_manager=token_manager,
         tls_profile=profile,
-        allow_destructive=allow_destructive,
         transport=transport,
     )
 

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/mcp/__init__.py

@@ -15,8 +15,6 @@ from scion_sdk.exceptions import (
     UnauthorizedError,
 )
 
-from dockerhub_api.api.api_client_base import DestructiveOperationError
-
 #: Keys whose values are always masked in MCP tool results.
 SECRET_KEYS = {"secret", "password", "access_token", "refresh_token", "jwt"}
 REDACTED = "***redacted***"
@@ -76,7 +74,6 @@ HANDLED_ERRORS = (
     UnauthorizedError,
     ParameterError,
     MissingParameterError,
-    DestructiveOperationError,
     ValueError,
 )
 

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/ontology/certification.json

@@ -1,11 +1,11 @@
 {
   "api_version": "graphos.io/v1",
   "artifacts": {
-    "dockerhub_api/ontology/dockerhub.ttl": "04f8546a078e863362b02e29aeb0625414c955394ce0884df5b4726fed6205e3",
+    "dockerhub_api/ontology/dockerhub.ttl": "d498f4e75964cdb27a76fddccb23e42556e7eee994d8d91ba773c0ed2cc9dc5e",
     "dockerhub_api/ontology/fixtures/records.json": "cdf24bdcd53b75daef789c05f93d55ced4ce4a138360a2ff9f1e34c55f8f6da8",
     "dockerhub_api/ontology/mappings/source.yaml": "84985121b0fe97a045b04a5c40183d434d3d7ca1bca29202080cb390955545a6",
     "dockerhub_api/ontology/migrations/manifest.json": "81a24f182615e83dc844c6e7f3a211d47705d2bfce4ee45b5c4b24134e64909f",
-    "dockerhub_api/ontology/shapes/connector.shacl.ttl": "202ba0d2203b8a638b9bb035af8454ab6ea536e9d6d5a54f521c770b2dacc2ef"
+    "dockerhub_api/ontology/shapes/connector.shacl.ttl": "1417340d744e6cf9488ab231ff0ff21ed79cf126f54a901966da4827aa41d05b"
   },
   "checks": {
     "declared_tool_schema": "passed",
@@ -29,5 +29,5 @@
   "signer": "UNSIGNED-PREVIEW",
   "signing_public_key": "",
   "status": "source-validated",
-  "validated_at": "2026-11-06T18:16:59Z"
+  "validated_at": "2026-11-12T19:24:12Z"
 }

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/ontology/dockerhub.ttl

@@ -2,6 +2,7 @@
 @prefix foaf: <http://xmlns.com/foaf/0.1/> .
 @prefix dc: <http://purl.org/dc/terms/> .
 @prefix : <http://knuckles.team/kg#> .
+@prefix core: <https://knuckles-team.github.io/ontology/core#> .
 @prefix owl: <http://www.w3.org/2002/07/owl#> .
 @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
 @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@@ -12,12 +13,14 @@
 # per-package IRI. Backs the dockerhub-api MCP tool surface  and its native ingestion (dockerhub:repository / :image / …).
 
 :Namespace a owl:Class ;
+    rdfs:subClassOf core:Namespace ;
     rdfs:label "Docker Hub Namespace" ;
     rdfs:comment "A Docker Hub account/organization namespace that owns image repositories (the {namespace} in namespaces/{ns}/repositories)." .
 
 
 
 :ContainerImage a owl:Class ;
+    rdfs:subClassOf core:ContainerImage ;
     rdfs:label "Container Image" ;
     rdfs:comment "A concrete, content-addressable OCI/Docker image (a repository tag resolving to a digest, size, and platform) — the repository-tag and registry-manifest tools." .
 
@@ -25,7 +28,7 @@
 :AccessToken a owl:Class ;
     rdfs:label "Access Token" ;
     rdfs:comment "A personal or organization access token (PAT / OAT) scoped for registry and API access (the access-token and org-access-token tools). Secret material is never ingested." ;
-    rdfs:subClassOf :Credential .
+    rdfs:subClassOf core:Credential .
 
 
 # --- links (owl:ObjectProperty) ---

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api/ontology/shapes/connector.shacl.ttl

@@ -1,5 +1,5 @@
-@prefix : <http://knuckles.team/kg#> .
-@prefix shape: <http://knuckles.team/kg/dockerhub/shape#> .
+@prefix : <https://knuckles-team.github.io/ontology/core#> .
+@prefix shape: <https://knuckles-team.github.io/ontology/connector/dockerhub-shapes#> .
 @prefix sh: <http://www.w3.org/ns/shacl#> .
 @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
 

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dockerhub-api
-Version: 1.3.10
+Version: 1.4.0
 Summary: Docker Hub API + MCP Server
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: <3.15,>=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: scion-sdk[mcp]>=0.9.0
+Requires-Dist: scion-sdk[mcp]<0.11,>=0.10.2
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: python-dotenv>=1.2.4
 Provides-Extra: test
@@ -84,8 +84,7 @@ multi-arch inspection, OCI referrers, and gated push/remove) and **Docker Scout*
   expiry, with one transparent re-mint on 401.
 - **Rate-Limit Telemetry:** `X-RateLimit-*` headers surfaced in every result;
   HTTP 429 retried with bounded `Retry-After` backoff.
-- **Safety by Default:** Removes and org-settings writes are gated behind
-  `DOCKERHUB_ALLOW_DESTRUCTIVE` (default `False`); secrets are redacted from tool
+- **Safety by Default:** Removes and org-settings writes are declared destructive; the SDK asks the caller to confirm (`confirm=true`) before any request. Secrets are redacted from tool
   results (plaintext tokens appear exactly once — on creation). Repository creation
   stays enabled: it is the primary release-provisioning use case.
 - **Integrated Graph Agent:** Built-in Pydantic AI agent (`dockerhub-agent`) with
@@ -279,7 +278,6 @@ _9 action-routed tool(s) (default) · 54 verbose 1:1 tool(s). Each is enabled un
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
-        "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
         "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
@@ -328,7 +326,6 @@ own runtime secret boundary.
         "ADMINTOOL": "True",
         "AUDITTOOL": "True",
         "AUTHTOOL": "True",
-        "DOCKERHUB_ALLOW_DESTRUCTIVE": "False",
         "DOCKERHUB_TLS_PROFILE": "system",
         "DOCKERHUB_TOKEN": "dckr_pat_your_personal_access_token",
         "DOCKERHUB_URL": "https://hub.docker.com",
@@ -376,7 +373,6 @@ docker run -i --rm \
   -e ADMINTOOL=True \
   -e AUDITTOOL=True \
   -e AUTHTOOL=True \
-  -e DOCKERHUB_ALLOW_DESTRUCTIVE=False \
   -e DOCKERHUB_TLS_PROFILE=system \
   -e DOCKERHUB_TOKEN=dckr_pat_your_personal_access_token \
   -e DOCKERHUB_URL=https://hub.docker.com \
@@ -423,8 +419,7 @@ the detailed transport contract.
 |---|---|---|
 | Reads (repos, tags, members, logs, SCIM) | allowed | — |
 | Repository create / immutable-tag config / invites / role updates | allowed | — |
-| Removes (PATs, OATs, groups, members, invites) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
-| Org-settings writes (`PUT /v2/orgs/{org}/settings`) | **blocked** | `DOCKERHUB_ALLOW_DESTRUCTIVE=True` |
+| Removes (PATs, OATs, groups, members, invites) and org-settings writes | confirmation required | `confirm=true` per call, or operator setting `SCION_ALLOW_DESTRUCTIVE` |
 
 ---
 
@@ -488,7 +483,6 @@ network transport, connector ingestion, Arbora delegation, or trace export.
 | `DOCKER_REGISTRY_URL` | `https://registry-1.docker.io` |  |
 | `DOCKER_REGISTRY_AUTH_URL` | `https://auth.docker.io/token` | token-service realm; auto-discovered from the 401 challenge |
 | `DOCKER_SCOUT_URL` | `https://api.scout.docker.com` |  |
-| `DOCKERHUB_ALLOW_DESTRUCTIVE` | `False` |  |
 | `AUTHTOOL` | `True` |  |
 | `REPOSTOOL` | `True` |  |
 | `ORGTOOL` | `True` |  |

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api.egg-info/SOURCES.txt

@@ -60,6 +60,7 @@ tests/test_api_teams.py
 tests/test_api_tokens.py
 tests/test_api_wrapper.py
 tests/test_auth.py
+tests/test_destructive_declaration.py
 tests/test_dockerhub_a2a_validation.py
 tests/test_dockerhub_mcp_validation.py
 tests/test_fleet_name.py

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/dockerhub_api.egg-info/requires.txt

@@ -1,4 +1,4 @@
-scion-sdk[mcp]>=0.9.0
+scion-sdk[mcp]<0.11,>=0.10.2
 httpx>=0.28.1
 python-dotenv>=1.2.4
 

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dockerhub-api"
-version = "1.3.10"
+version = "1.4.0"
 description = "Docker Hub API + MCP Server"
 readme = "README.md"
 classifiers = [ "Development Status :: 5 - Production/Stable", "License :: OSI Approved :: MIT License", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]
 requires-python = ">=3.12, <3.15"
-dependencies = [ "scion-sdk[mcp]>=0.9.0", "httpx>=0.28.1", "python-dotenv>=1.2.4",]
+dependencies = [ "scion-sdk[mcp]>=0.10.2,<0.11", "httpx>=0.28.1", "python-dotenv>=1.2.4",]
 [[project.authors]]
 name = "Repository Maintainers"
 email = "maintainers@knuckles.team"

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/tests/test_api_org.py

@@ -4,7 +4,6 @@ import json
 
 import pytest
 
-from dockerhub_api.api.api_client_base import DestructiveOperationError
 
 
 def test_get_org_settings(api):
@@ -12,13 +11,8 @@ def test_get_org_settings(api):
     assert result["data"]["restricted_images"]["enabled"] is False
 
 
-def test_update_org_settings_gated(api):
-    with pytest.raises(DestructiveOperationError, match="update_org_settings"):
-        api.update_org_settings(org="acme", restricted_images_enabled=True)
-
-
-def test_update_org_settings_payload(hub, api_destructive):
-    result = api_destructive.update_org_settings(
+def test_update_org_settings_payload(hub, api):
+    result = api.update_org_settings(
         org="acme",
         restricted_images_enabled=True,
         allow_official_images=True,
@@ -72,11 +66,9 @@ def test_update_member_role(hub, api):
     assert hub.requests[-1].method == "PUT"
 
 
-def test_remove_member_gated(api, api_destructive):
-    with pytest.raises(DestructiveOperationError):
-        api.remove_org_member(org="acme", username="dev")
+def test_remove_member_gated(api):
     assert (
-        api_destructive.remove_org_member(org="acme", username="dev")["status_code"]
+        api.remove_org_member(org="acme", username="dev")["status_code"]
         == 204
     )
 
@@ -86,10 +78,8 @@ def test_list_invites(api):
     assert result["data"]["results"][0]["id"] == "inv-1"
 
 
-def test_delete_invite_gated(api, api_destructive):
-    with pytest.raises(DestructiveOperationError):
-        api.delete_invite(invite_id="inv-1")
-    assert api_destructive.delete_invite(invite_id="inv-1")["status_code"] == 204
+def test_delete_invite_gated(api):
+    assert api.delete_invite(invite_id="inv-1")["status_code"] == 204
 
 
 def test_resend_invite(hub, api):

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/tests/test_api_registry.py

@@ -3,7 +3,6 @@
 import httpx
 import pytest
 
-from dockerhub_api.api.api_client_base import DestructiveOperationError
 from tests.conftest import (
     AMD64_DIGEST,
     CONFIG_DIGEST,
@@ -86,45 +85,33 @@ def test_check_manifest_and_blob(registry_api):
 # --------------------------- destructive gating --------------------------- #
 
 
-def test_delete_manifest_gated_by_default(registry_api):
-    with pytest.raises(DestructiveOperationError, match="delete_manifest"):
-        registry_api.delete_manifest("nginx", "latest")
-
-
-def test_delete_manifest_resolves_tag_then_deletes(registry, registry_api_destructive):
-    result = registry_api_destructive.delete_manifest("nginx", "latest")
+def test_delete_manifest_resolves_tag_then_deletes(registry, registry_api):
+    result = registry_api.delete_manifest("nginx", "latest")
     assert result["status_code"] == 202
     paths = _registry_paths(registry)
     # tag resolved to a digest, then DELETE issued against the digest
     assert f"/v2/library/nginx/manifests/{INDEX_DIGEST}" in paths
 
 
-def test_delete_blob_surfaces_405_cleanly(registry_api_destructive):
-    result = registry_api_destructive.delete_blob("nginx", CONFIG_DIGEST)
+def test_delete_blob_surfaces_405_cleanly(registry_api):
+    result = registry_api.delete_blob("nginx", CONFIG_DIGEST)
     assert result["status_code"] == 405
 
 
-def test_push_session_gated(registry_api):
-    with pytest.raises(DestructiveOperationError):
-        registry_api.start_upload("myorg/app")
-    with pytest.raises(DestructiveOperationError):
-        registry_api.put_manifest("myorg/app", "v1", {"schemaVersion": 2}, "media")
-
-
-def test_full_push_session(registry, registry_api_destructive):
-    started = registry_api_destructive.start_upload("myorg/app")
+def test_full_push_session(registry, registry_api):
+    started = registry_api.start_upload("myorg/app")
     location = started["headers"]["Location"]
     assert started["status_code"] == 202
 
-    patched = registry_api_destructive.upload_chunk("myorg/app", location, b"layerbytes")
+    patched = registry_api.upload_chunk("myorg/app", location, b"layerbytes")
     assert patched["status_code"] == 202
 
-    completed = registry_api_destructive.complete_upload(
+    completed = registry_api.complete_upload(
         "myorg/app", location, AMD64_DIGEST, final_chunk=b""
     )
     assert completed["status_code"] == 201
 
-    put = registry_api_destructive.put_manifest(
+    put = registry_api.put_manifest(
         "myorg/app",
         "v1",
         {"schemaVersion": 2, "mediaType": "x", "config": {}, "layers": []},
@@ -133,8 +120,8 @@ def test_full_push_session(registry, registry_api_destructive):
     assert put["status_code"] == 201
 
 
-def test_mount_blob(registry_api_destructive):
-    result = registry_api_destructive.mount_blob("myorg/app", CONFIG_DIGEST, "library/nginx")
+def test_mount_blob(registry_api):
+    result = registry_api.mount_blob("myorg/app", CONFIG_DIGEST, "library/nginx")
     assert result["status_code"] == 201
 
 

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/tests/test_api_teams.py

@@ -4,7 +4,6 @@ import json
 
 import pytest
 
-from dockerhub_api.api.api_client_base import DestructiveOperationError
 
 
 def test_list_groups(hub, api):
@@ -44,25 +43,21 @@ def test_update_group_requires_change(api):
         api.update_group(org="acme", group_name="platform")
 
 
-def test_delete_group_gated(api, api_destructive):
-    with pytest.raises(DestructiveOperationError):
-        api.delete_group(org="acme", group_name="platform")
+def test_delete_group_gated(api):
     assert (
-        api_destructive.delete_group(org="acme", group_name="platform")["status_code"]
+        api.delete_group(org="acme", group_name="platform")["status_code"]
         == 204
     )
 
 
-def test_group_members_roundtrip(hub, api, api_destructive):
+def test_group_members_roundtrip(hub, api):
     members = api.get_group_members(org="acme", group_name="platform")
     assert members["data"]["results"][0]["username"] == "tester"
 
     added = api.add_group_member(org="acme", group_name="platform", member="dev")
     assert added["data"]["username"] == "dev"
 
-    with pytest.raises(DestructiveOperationError):
-        api.remove_group_member(org="acme", group_name="platform", username="dev")
-    removed = api_destructive.remove_group_member(
+    removed = api.remove_group_member(
         org="acme", group_name="platform", username="dev"
     )
     assert removed["status_code"] == 204

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/tests/test_api_tokens.py

@@ -4,7 +4,6 @@ import json
 
 import pytest
 
-from dockerhub_api.api.api_client_base import DestructiveOperationError
 
 
 def test_list_pats_pagination(hub, api):
@@ -40,13 +39,8 @@ def test_update_pat_requires_a_change(api):
         api.update_access_token(uuid="pat-1")
 
 
-def test_delete_pat_gated_by_default(api):
-    with pytest.raises(DestructiveOperationError, match="delete_access_token"):
-        api.delete_access_token(uuid="pat-1")
-
-
-def test_delete_pat_allowed_when_enabled(hub, api_destructive):
-    result = api_destructive.delete_access_token(uuid="pat-1")
+def test_delete_pat_allowed_when_enabled(hub, api):
+    result = api.delete_access_token(uuid="pat-1")
     assert result["status_code"] == 204
     assert hub.requests[-1].method == "DELETE"
 
@@ -91,11 +85,9 @@ def test_get_update_oat(hub, api):
     assert result["data"]["is_active"] is False
 
 
-def test_delete_oat_gated(api, api_destructive, hub):
-    with pytest.raises(DestructiveOperationError):
-        api.delete_org_access_token(org="acme", token_id="oat-1")  # nosec B105 B106 — fake test credential
+def test_delete_oat_gated(api, hub):
     assert (
-        api_destructive.delete_org_access_token(org="acme", token_id="oat-1")[  # nosec B105 B106 — fake test credential
+        api.delete_org_access_token(org="acme", token_id="oat-1")[  # nosec B105 B106 — fake test credential
             "status_code"
         ]
         == 204

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/tests/test_api_wrapper.py

@@ -4,7 +4,6 @@ and destructive gating at the facade level."""
 
 import pytest
 
-from dockerhub_api.api.api_client_base import DestructiveOperationError
 from dockerhub_api.api_client import Api
 
 
@@ -46,11 +45,6 @@ def test_facade_composes_all_domain_mixins():
         assert callable(getattr(Api, method, None)), f"missing {method}"
 
 
-def test_destructive_call_blocked_by_default(api):
-    with pytest.raises(DestructiveOperationError):
-        api.delete_access_token(uuid="uuid-1")
-
-
-def test_destructive_call_allowed_when_enabled(api_destructive):
-    result = api_destructive.delete_access_token(uuid="uuid-1")
+def test_destructive_call_allowed_when_enabled(api):
+    result = api.delete_access_token(uuid="uuid-1")
     assert result["status_code"] in (200, 202, 204)

{dockerhub_api-1.3.10 → dockerhub_api-1.4.0}/tests/test_auth.py

@@ -167,12 +167,6 @@ def test_get_client_uses_token_manager(monkeypatch):
     assert client._token_manager.identifier == "tester"
 
 
-def test_get_client_destructive_env(monkeypatch):
-    monkeypatch.setenv("DOCKERHUB_ALLOW_DESTRUCTIVE", "True")
-    client = get_client()
-    assert client.allow_destructive is True
-
-
 def test_get_client_anonymous(monkeypatch):
     monkeypatch.delenv("DOCKERHUB_USERNAME", raising=False)
     monkeypatch.delenv("DOCKERHUB_TOKEN", raising=False)

dockerhub_api-1.4.0/tests/test_destructive_declaration.py

@@ -0,0 +1,98 @@
+"""CONN-DOCKERHUB-API-CONNECTOR-CONTENT-R003: destructive operations use the SDK's one declaration and guard."""
+
+from __future__ import annotations
+
+import asyncio
+from unittest.mock import patch
+
+import httpx
+import pytest
+from fastmcp import Client
+from scion_sdk.connector import build_server
+
+pytestmark = pytest.mark.spec("CONN-DOCKERHUB-API-CONNECTOR-CONTENT-R003")
+
+DESTRUCTIVE_TOOLS = {
+    "dockerhub_delete_access_token": {"uuid": "u1"},
+    "dockerhub_delete_group": {"org": "acme", "group_name": "g"},
+    "dockerhub_delete_invite": {"invite_id": "i1"},
+    "dockerhub_delete_org_access_token": {"org": "acme", "token_id": "t1"},
+    "dockerhub_remove_group_member": {
+        "org": "acme",
+        "group_name": "g",
+        "username": "u",
+    },
+    "dockerhub_remove_org_member": {"org": "acme", "username": "u"},
+    "dockerhub_update_org_settings": {"org": "acme", "restricted_images_enabled": True},
+    "dockerhub_registry_delete_blob": {
+        "repo": "acme/app",
+        "digest": "sha256:" + "a" * 64,
+    },
+    "dockerhub_registry_delete_manifest": {"repo": "acme/app", "reference": "latest"},
+    "dockerhub_registry_start_upload": {"repo": "acme/app"},
+}
+
+
+def _server(requests: list[httpx.Request], monkeypatch):
+    real = httpx.Client
+
+    def record(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(200, json={})
+
+    def client(*args, **kwargs):
+        kwargs["transport"] = httpx.MockTransport(record)
+        return real(*args, **kwargs)
+
+    monkeypatch.setattr("dockerhub_api.api.api_client_base.httpx.Client", client)
+    monkeypatch.setenv("DOCKERHUB_JWT", "jwt")
+    monkeypatch.delenv("SCION_ALLOW_DESTRUCTIVE", raising=False)
+    with patch("sys.argv", ["dockerhub-mcp"]):
+        return build_server("dockerhub_api", command_args=[])[1]
+
+
+def test_declared_operations_are_destructive_tools_that_ask_first(monkeypatch):
+    mcp = _server([], monkeypatch)
+
+    async def _run():
+        async with Client(mcp) as client:
+            tools = {t.name: t for t in await client.list_tools()}
+            for name in DESTRUCTIVE_TOOLS:
+                assert tools[name].annotations.destructive_hint is True, name
+            for name, tool in tools.items():
+                properties = tool.input_schema["properties"]
+                assert "allow_destructive" not in properties, name
+                if tool.annotations and tool.annotations.destructive_hint:
+                    assert "confirm" in properties, name
+
+    asyncio.run(_run())
+
+
+@pytest.mark.parametrize("name", sorted(DESTRUCTIVE_TOOLS))
+def test_unconfirmed_call_sends_no_request(name, monkeypatch):
+    requests: list[httpx.Request] = []
+    mcp = _server(requests, monkeypatch)
+
+    async def _run():
+        async with Client(mcp) as client:
+            refused = await client.call_tool(
+                name, DESTRUCTIVE_TOOLS[name], raise_on_error=False
+            )
+            assert refused.structured_content["cancelled"] is True
+
+    asyncio.run(_run())
+    assert requests == []
+
+
+def test_confirmed_call_sends_one_request(monkeypatch):
+    requests: list[httpx.Request] = []
+    mcp = _server(requests, monkeypatch)
+
+    async def _run():
+        async with Client(mcp) as client:
+            await client.call_tool(
+                "dockerhub_delete_access_token", {"uuid": "u1", "confirm": True}
+            )
+
+    asyncio.run(_run())
+    assert [r.method for r in requests] == ["DELETE"]