alvis
b548a8f345
Commits a cluster of entangled agap-mcp / Adolf-tooling WIP that had accumulated
uncommitted in shared files (server.js, the three MCP-config layers). Bundled as
one commit because server.js interleaves all of it and cannot be cleanly split;
each stream is named here for the record. Authorized by alvis 2026-07-23.
- **kb#95 — family MediaWiki tools:** new src/mediawiki.js (wiki_search / wiki_read
/ wiki_edit, MediaWiki login->CSRF->edit flow, no new deps), registered in
server.js and fetched from the family.alogins.net Vaultwarden login item.
Proven standalone against family.alogins.net (search/read/edit, revid 1520 on a
bot-userspace page). Wired into all three layers: openai/shared-mcp.json,
adolf/openclaw.json, openai/agent-registry.yaml.
- **kb#147 — vault trust-gate (A2A-15), DORMANT:** new src/trust-gate.js (+ two
test files), requireVaultAccess() around the vw_* tools, gated by
AGAP_MCP_ENFORCE_VAULT_TRUST (docker-compose.yml, default 0). OFF by default —
vw_* behaviour is byte-for-byte unchanged until an operator sets ENFORCE=1 and
populates AGAP_MCP_AGENT_TOKENS from Vaultwarden. That activation is a separate
human step; kb#147 remains escalated for human verification and is NOT verified
by this commit. js-yaml added to read the registry. agent-registry.yaml mounted
read-only as the trust-class source of truth.
- **Todoist tools:** new src/todoist.js (initTodoist + 6 todoist_* tools),
registered in server.js, sourced from the TODOIST_TOKEN Vaultwarden item.
- **kanboard cutover cleanup:** removes src/kanboard.js and its imports — the
kanboard_* slice moved to the standalone kanboard-mcp on 2026-07-06.
- **openai/validate_capability_grants.py:** cross-checks the registry against the
live openclaw.json + shared-mcp.json layers; passes (exit 0).
No secrets committed: all tokens come from Vaultwarden via env/.env; the trust
gate's AGAP_MCP_AGENT_TOKENS defaults to `{}` (fail-closed). node_modules/ now
gitignored, package-lock.json tracked.
NOT YET ACTIVATED: agap-mcp has not been rebuilt and adolf-llm/adolf not
restarted, so the wiki/todoist tools are wired but not live. That restart is the
outstanding step on kb#95 (and stays a human/orchestrator action).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
1.9 KiB
YAML
45 lines
1.9 KiB
YAML
services:
|
|
agap-mcp:
|
|
build: .
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
environment:
|
|
- PORT=3100
|
|
- NODE_TLS_REJECT_UNAUTHORIZED=0
|
|
- HTTPS_PROXY=
|
|
- HTTP_PROXY=
|
|
- ALL_PROXY=
|
|
- https_proxy=
|
|
- http_proxy=
|
|
- all_proxy=
|
|
- BITWARDENCLI_APPDATA_DIR=/bw-data
|
|
- BW_EMAIL=adolf46@proton.me
|
|
- BW_PASSWORD=${BW_PASSWORD}
|
|
- VAULTWARDEN_URL=http://localhost:8041
|
|
- GITEA_URL=http://localhost:3000
|
|
- HA_URL=http://192.168.1.4:8123
|
|
- ZABBIX_URL=http://192.168.1.4:81
|
|
- RADICALE_URL=http://localhost:5232
|
|
- RADICALE_USER=alvis
|
|
# kb#147 (A2A-15) — vault trust gate, OFF by default (0). Flipping this
|
|
# to 1 requires a container restart AND real values for
|
|
# AGENT_REGISTRY_PATH/AGAP_MCP_AGENT_TOKENS below to be populated first
|
|
# (see src/trust-gate.js) — that restart is the deliberate handover
|
|
# step this task does NOT perform (never restart the live agap-mcp
|
|
# service unattended). Until both are set, vw_* tools behave exactly
|
|
# as before this change.
|
|
- AGAP_MCP_ENFORCE_VAULT_TRUST=0
|
|
- AGENT_REGISTRY_PATH=/agent-registry.yaml
|
|
# JSON map {"<bearer-token>": "<agent-id>"}. Real per-agent tokens must
|
|
# be generated, stored in Vaultwarden (e.g. AGAP_MCP_TOKEN_ADOLF,
|
|
# AGAP_MCP_TOKEN_CLAUDE_CODER), and referenced here via .env — never
|
|
# inlined in this committed file. Empty object = no caller resolves to
|
|
# any agent, i.e. fail-closed once ENFORCE is turned on.
|
|
- AGAP_MCP_AGENT_TOKENS=${AGAP_MCP_AGENT_TOKENS:-{}}
|
|
volumes:
|
|
- /home/alvis/.config/Bitwarden CLI:/bw-data
|
|
# Read-only: agent-registry.yaml is the version-controlled source of
|
|
# truth for trust classes (kb#134/kb#147) — mounted, never copied, so
|
|
# a registry edit takes effect on container restart with no rebuild.
|
|
- /home/alvis/agap_git/openai/agent-registry.yaml:/agent-registry.yaml:ro
|