vmware-debug 2.2.0__py3-none-any.whl → 2.3.0__py3-none-any.whl

vmware_debug/__init__.py

@@ -6,4 +6,4 @@ remediation to vmware-aiops / vmware-pilot. Never writes to any VMware system
 and never executes fixes; its only writes go to the local case ledger.
 """
 
-__version__ = "2.2.0"
+__version__ = "2.3.0"

vmware_debug/mcp_server/server.py

@@ -898,5 +898,8 @@ def main(
     )
 
 
+# Role metadata for network callers (HLD §18).
+import vmware_debug.policy_roles  # noqa: F401
+
 if __name__ == "__main__":
     main()

vmware_debug/policy_roles.py

@@ -0,0 +1,27 @@
+"""What vmware-policy needs to apply roles to this skill (HLD §18 D-21/D-22).
+
+Policy cannot see which tools escape a role or how a missing target resolves; this
+module declares them. Imported by the MCP server (roles apply only to a network
+MCP server). With a vmware-policy that has no roles module (< 1.24) nothing is
+declared.
+"""
+
+from __future__ import annotations
+
+from vmware_policy import skill_name
+
+#: Tools that give their holder more than a role. Host-path tools are added by
+#: policy while a file root is set.
+ESCAPES = frozenset()
+
+
+try:
+    from vmware_policy.roles import declare_role_metadata
+except ImportError:  # vmware-policy without roles: nothing to declare
+    declare_role_metadata = None
+
+if declare_role_metadata is not None:
+    declare_role_metadata(
+        skill_name(__name__),
+        escapes=ESCAPES,
+    )

{vmware_debug-2.2.0.dist-info → vmware_debug-2.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 2.2.0
+Version: 2.3.0
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug
@@ -145,6 +145,71 @@ pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this packa
 pip install --no-index --find-links dist vmware-debug
 ```
 
+<!-- usage: remote-and-exposure -->
+## Remote access (HTTPS) and limiting tools
+
+By default `vmware-debug mcp` speaks stdio to one local client and offers every tool. Two options change that
+(vmware-policy ≥ 1.21.0).
+
+**Serve over HTTPS** so clients on other machines can connect. Every caller needs a bearer token:
+
+```bash
+vmware-audit token create alice          # prints the token once; give it to alice
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+vmware-debug mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-debug https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-debug": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- The server will not start without a token, refuses Host/Origin values outside `--public-name`, and checks
+  before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.
+- Behind a TLS-terminating reverse proxy on the same machine use `--transport http --host 127.0.0.1
+  --public-name mcp.example.com` and pass the `Authorization` header through.
+- Behind a load balancer or gateway on another machine, keep `--transport https` (a self-signed certificate is
+  fine), list in `--public-name` the host name the balancer sends as `Host`, and have it forward `Authorization`.
+  Its health probe can use `GET /healthz`, which needs no token and returns only `{"status": "ok"}`
+  (vmware-policy ≥ 1.23.0).
+- Send `traceparent` or `X-Request-ID` with each request to have it stored on the audit row;
+  `vmware-audit log --correlation-id ID` then finds the calls behind one platform request.
+- The audit log records each caller as `token:<name>`. Calls naming different targets run in parallel; calls that
+  name no target run one at a time, so name the target when several people share a server.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
+
+**Offer only read tools, plus the writes you choose:**
+
+```bash
+vmware-debug mcp --expose read --allow-write close_case
+# or: VMWARE_DEBUG_MCP_EXPOSE=read VMWARE_DEBUG_MCP_ALLOW_WRITE=close_case vmware-debug mcp
+```
+
+Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server
+(exit 2). This limits what clients are offered; it is not authorization, so the account itself should be
+least-privilege.
+
+Details: `skills/vmware-debug/references/setup-guide.md` ("Serving MCP over HTTPS", "Limiting which tools are offered").
+
 ## License
 
 MIT.

{vmware_debug-2.2.0.dist-info → vmware_debug-2.3.0.dist-info}/RECORD

@@ -1,10 +1,11 @@
-vmware_debug/__init__.py,sha256=JjgubSbR8Xhn-i8kk8lV2EtYQxwqZUwSAQqxyW3k46o,376
+vmware_debug/__init__.py,sha256=0dK-ncVKNGTFt0B6J-gsebCoG4w8IvlMccw14J5iOtM,376
 vmware_debug/cli.py,sha256=nho92ORzfyqEPPvnFWuAY3J5uyWpVdzx5kAd7DPmbcA,5690
 vmware_debug/envelope.py,sha256=66AQzI_h4JoopUcFxHvqaFe48rYRZz0uX9Wdm5lDcuI,11235
+vmware_debug/policy_roles.py,sha256=iaKA3rT5qg0tfjO59cZHjsJTF4xirIzmsxfkVytrgH0,844
 vmware_debug/mcp/__init__.py,sha256=isuSzMWp1iXgJWGz2Q0JyUXlDTfcFfHNPSTHALuNHaA,220
 vmware_debug/mcp/tools.py,sha256=TcWywxro1zqGYFmJC8NUgxb7DMyGpSQbZusJrHzqnGI,2796
 vmware_debug/mcp_server/__init__.py,sha256=QZpQxriDdqDCYaS-HP7McsaPbTPbHwcamIwu-7UxY-E,49
-vmware_debug/mcp_server/server.py,sha256=uz4BnW-6Zu7G4fYYffT6B5cfOQ7xVFDzLWsmpASTrfc,47379
+vmware_debug/mcp_server/server.py,sha256=pzaqn3oZIgxszVmCzRGZY33rrvupgrdtsPxducXTiGc,47475
 vmware_debug/ops/__init__.py,sha256=Co9u0zZexST7-IOUBOAS5eq5RHkaEeI2FqfYijzhI1g,46
 vmware_debug/ops/skill_names.py,sha256=JkBaKBJYyq0RrEqzro-e-zhSVh7Cn5wlxjAoakgXSyY,3990
 vmware_debug/ops/timeline.py,sha256=GzafF7jkEfa6cr3H2wO0At7fZEBdn_9m9_0Omh7faTs,27556
@@ -25,7 +26,7 @@ vmware_debug/ops/cases/store.py,sha256=dIgdAR111_gDoZ4rYbTtccuiaQVdksMCDoZOHKmbW
 vmware_debug/ops/cases/timeline.py,sha256=WbJg2xUrqyHxMERBFYA-tgU9Mmy67whH9GGh96R8ifk,7843
 vmware_debug/rules/evidence_sources.yaml,sha256=w8YOdUtKw-oi-t9c5ePJaktx7CwZlfFinH8aQAQfhzo,11387
 vmware_debug/rules/grading_rules.yaml,sha256=USCp7D2geU_CZgscvo8GMHEHZPgqbzbjqE-qwWG3QtA,3261
-vmware_debug-2.2.0.dist-info/METADATA,sha256=HCpMz0WTX-CNGVrBN0YmFA3M6IANeTRMH7fRJFyAPVM,8059
-vmware_debug-2.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-vmware_debug-2.2.0.dist-info/entry_points.txt,sha256=4d14JRHy0ouSOfCJyczaxUFH6p8AsHZNS19AKom0v4c,109
-vmware_debug-2.2.0.dist-info/RECORD,,
+vmware_debug-2.3.0.dist-info/METADATA,sha256=bwr3Fy4vc2DdqHHEwVaRQFbZCpZR-Ocu6NxYpncz894,11541
+vmware_debug-2.3.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+vmware_debug-2.3.0.dist-info/entry_points.txt,sha256=4d14JRHy0ouSOfCJyczaxUFH6p8AsHZNS19AKom0v4c,109
+vmware_debug-2.3.0.dist-info/RECORD,,