alvis/AgapHost
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

agap-mcp: MediaWiki + Todoist tools, vault trust-gate, registry wiring

Browse Source 
Commits a cluster of entangled agap-mcp / Adolf-tooling WIP that had accumulated
uncommitted in shared files (server.js, the three MCP-config layers). Bundled as
one commit because server.js interleaves all of it and cannot be cleanly split;
each stream is named here for the record. Authorized by alvis 2026-07-23.

- **kb#95 — family MediaWiki tools:** new src/mediawiki.js (wiki_search / wiki_read
  / wiki_edit, MediaWiki login->CSRF->edit flow, no new deps), registered in
  server.js and fetched from the family.alogins.net Vaultwarden login item.
  Proven standalone against family.alogins.net (search/read/edit, revid 1520 on a
  bot-userspace page). Wired into all three layers: openai/shared-mcp.json,
  adolf/openclaw.json, openai/agent-registry.yaml.

- **kb#147 — vault trust-gate (A2A-15), DORMANT:** new src/trust-gate.js (+ two
  test files), requireVaultAccess() around the vw_* tools, gated by
  AGAP_MCP_ENFORCE_VAULT_TRUST (docker-compose.yml, default 0). OFF by default —
  vw_* behaviour is byte-for-byte unchanged until an operator sets ENFORCE=1 and
  populates AGAP_MCP_AGENT_TOKENS from Vaultwarden. That activation is a separate
  human step; kb#147 remains escalated for human verification and is NOT verified
  by this commit. js-yaml added to read the registry. agent-registry.yaml mounted
  read-only as the trust-class source of truth.

- **Todoist tools:** new src/todoist.js (initTodoist + 6 todoist_* tools),
  registered in server.js, sourced from the TODOIST_TOKEN Vaultwarden item.

- **kanboard cutover cleanup:** removes src/kanboard.js and its imports — the
  kanboard_* slice moved to the standalone kanboard-mcp on 2026-07-06.

- **openai/validate_capability_grants.py:** cross-checks the registry against the
  live openclaw.json + shared-mcp.json layers; passes (exit 0).

No secrets committed: all tokens come from Vaultwarden via env/.env; the trust
gate's AGAP_MCP_AGENT_TOKENS defaults to `{}` (fail-closed). node_modules/ now
gitignored, package-lock.json tracked.

NOT YET ACTIVATED: agap-mcp has not been rebuilt and adolf-llm/adolf not
restarted, so the wiki/todoist tools are wired but not live. That restart is the
outstanding step on kb#95 (and stays a human/orchestrator action).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
alvis
2026-07-23 06:48:07 +00:00
parent 288cb6b36a
commit b548a8f345
15 changed files with 2876 additions and 365 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
adolf/openclaw.json
View File

@@ -122,10 +122,41 @@
// OpenClaw's documented CLI-native alias for transport: "streamable-http".
mcp: {
servers: {
// kb#144 (A2A-12): toolFilter.include is OpenClaw's OWN per-server
// tool-scoping mechanism (mcp.servers.*.toolFilter, zod-validated;
// applied in agent-bundle-mcp-materialize.js when THIS container's own
// tool bundle is built). CORRECTION (kb#144 second pass, 2026-07-22):
// this does NOT reach the model on Adolf's kimi backbone -- Kimi CLI
// (inside the separate adolf-llm container) reads its own
// project-root .mcp.json, seeded from openai/shared-mcp.json, and
// applies ITS OWN enabledTools/disabledTools (McpServerCommonFields,
// computeEnabledNames). Live wire.jsonl verification (restart + one
// real turn) proved OpenClaw's toolFilter alone left Kimi's actual
// tool counts unchanged. This block is still correct for OpenClaw's
// own MCP client surface -- see openai/shared-mcp.json for the layer
// that actually scopes what the model sees.
//
// Scoped to Adolf's CORE memory ops: recall/retain/reflect (the
// hooks below do IMPLICIT recall/retain automatically; these MCP
// tools cover explicit "remember this" / "what do you recall about
// X" turns) plus single-memory read/update and directive CRUD
// (standing instructions). Cuts 20 rarely-used/admin tools: the
// mental-model CRUD (7), document CRUD (3), operation-tracking (3),
// tags (1), bank admin (4), sync_retain, invalidate_memory -- none
// of which Adolf's Matrix persona drives turn-to-turn; reach the
// hindsight MCP directly (unscoped) for that admin work instead of
// paying for it on every Adolf turn. 29 tools -> 9.
hindsight: {
type: "http",
url: "http://hindsight:8888/mcp/adolf/",
toolFilter: {
include: ["recall", "retain", "reflect", "list_memories", "get_memory", "update_memory", "list_directives", "create_directive", "delete_directive"],
},
},
// Already minimal (5 tools -- message_send/cron_create/cron_list/
// nodes_invoke/browser_invoke, all core to Adolf's matrix-chat +
// cron-scheduling + browser capabilities) -- deliberately NO
// toolFilter here, not an oversight.
"openclaw-tools": {
type: "http",
url: "http://openclaw-tools:8020/mcp",
@@ -138,9 +169,18 @@
// instance on :3103 (app-wide jsonrpc token). Not part of the openai
// compose network, so reached via host.docker.internal (already
// extra_hosts-mapped for this container) rather than a service name.
// kb#144: scoped to task-triage/proactive-monitoring core --
// list/read/search/create/update/move/status/assign/comment/
// activity. Cuts subtask CRUD, task-link CRUD, tag CRUD, and
// destructive remove_task/remove_comment (9 tools) -- deep
// task-graph management is claude-coder's job (the actual task
// worker), not Adolf's lighter triage/reporting role. 23 -> 14.
kanboard: {
type: "http",
url: "http://host.docker.internal:3104/mcp",
toolFilter: {
include: ["kanboard_list_projects", "kanboard_get_project", "kanboard_list_tasks", "kanboard_my_tasks", "kanboard_get_task", "kanboard_search_tasks", "kanboard_list_users", "kanboard_project_activity", "kanboard_create_task", "kanboard_update_task", "kanboard_move_task", "kanboard_change_task_status", "kanboard_assign_task", "kanboard_add_comment"],
},
},
// marketplace-mcp (kb task #61) -- the SAME shared marketplace-mcp
// instance Claude Code and OpenWebUI use (single service, port 3101,
@@ -149,21 +189,48 @@
// shared bearer token (MARKETPLACE_MCP_TOKEN in Vaultwarden / this
// container's env, injected via openai/.env -> docker-compose.yml).
// Reached via host.docker.internal, same reasoning as kanboard above.
// kb#144: scoped to READ-ONLY discovery (find_best/search/product/
// recommendations/reviews/compare/status). Cuts the checkout
// surface -- add_to_cart, get_cart, login, open_vnc, save_session,
// submit_sms (6 tools) -- real-money/session-auth actions Adolf
// shouldn't take unattended from background Matrix chat. This
// whole server is also the FIRST candidate to move OUT to Torgash
// (kb#130's marketplace-analyst persona, not yet built) per
// design §2/§8; scoping now both cuts tokens and removes purchase
// risk in the meantime rather than waiting on Torgash to exist.
// 13 -> 7.
marketplace: {
type: "http",
url: "http://host.docker.internal:3101/mcp",
headers: {
Authorization: "Bearer ${MARKETPLACE_MCP_TOKEN}",
},
toolFilter: {
include: ["marketplace_find_best", "marketplace_search", "marketplace_get_product", "marketplace_get_recommendations", "marketplace_get_reviews", "marketplace_compare_prices", "marketplace_status"],
},
},
// agap-mcp (kb#64) -- the SAME shared agap-mcp instance Claude Code uses
// (network_mode: host, :3100, unauthenticated on localhost). Grants Adolf
// the same access as Claude: vault (vw_* for credential fetching) plus
// gitea/ha/zabbix/radicale. Reached via host.docker.internal like
// kanboard/marketplace above.
// kb#144: scoped to Adolf's proactive-auditor/personal-assistant
// core -- vault read/write (trusted, credential help), HA
// (smart-home monitoring), Zabbix (the literal "proactive
// auditor" job), calendar read/write (minus admin
// create/delete_calendar), Todoist. Cuts all 6 gitea_* tools
// (repo/wiki/issue management is claude-coder's infra-ops domain,
// not Adolf's Matrix persona) plus radicale_create_calendar/
// delete_calendar (rare calendar-admin ops) -- 8 tools. 32 -> 24.
// kb#95: added wiki_search/wiki_read/wiki_edit (family MediaWiki,
// family.alogins.net / РодоВики -- source of truth for relatives,
// dates, events) -- squarely Adolf's persona domain. 35 -> 27.
agap: {
type: "http",
url: "http://host.docker.internal:3100/mcp",
toolFilter: {
include: ["vw_get_password", "vw_get_item", "vw_list_items", "vw_create_login", "vw_update_password", "ha_get_state", "ha_list_entities", "ha_call_service", "ha_get_history", "zabbix_get_problems", "zabbix_get_hosts", "zabbix_get_items", "zabbix_get_triggers", "radicale_list_calendars", "radicale_list_events", "radicale_get_event", "radicale_put_event", "radicale_delete_event", "radicale_move_event", "todoist_list_tasks", "todoist_list_projects", "todoist_create_task", "todoist_update_task", "todoist_complete_task", "wiki_search", "wiki_read", "wiki_edit"],
},
},
},
},
@@ -198,6 +265,21 @@
"quota-command": {
enabled: true,
},
// Kimi quota footer (kb #85) — installed external plugin, bind-mounted
// read-only from openai/kimi-quota-footer-plugin (see that project's
// docker-compose.yml adolf.volumes) onto
// .openclaw/extensions/kimi-quota-footer. Appends a compact Kimi
// usage line to every outgoing reply via the reply_payload_sending
// hook (not a raw conversation hook, so no allowConversationAccess/
// allowPromptInjection opt-in needed), reusing the same LLM-free
// adolf-llm:8010/usage route as quota-command above. Verified this
// hook fires on Adolf's actual send path (sendDurableMessageBatch ->
// deliverOutboundPayloadsInternal) as long as channels.matrix.streaming
// stays unset/"off" as it is today — see the plugin's index.js header
// comment for the streaming caveat if that ever changes.
"kimi-quota-footer": {
enabled: true,
},
},
},
}