mcpscope

package

v2.219.0 Latest Latest Go to latest Published: Oct 28, 2026 License: MIT Imports: 11 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coilyco/agent-compose

Links

Open Source Insights

Documentation ¶

Overview ¶

Package mcpscope narrows the host MCP inventory to one role's servers for a native launch. See docs/claude-launch-identity.md.

Index ¶

Variables
func SkillName(server string) string
func WriteSettings(dir, role, base string, allow []map[string]any, deny []string) (string, error)
type Connector
- func GrantedConnectors(role string) []Connector
type Inventory
- func Load(path string, roles []string) (*Inventory, error)
- func (inv *Inventory) Select(role string) Selection
- func (inv *Inventory) SelectWith(role string, table []Connector) Selection
type Selection
type Server

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrNoInventory = errors.New("mcpscope: no MCP inventory")

ErrNoInventory marks an absent inventory, which leaves the launch unscoped.

Functions ¶

func SkillName ¶ added in v2.200.0

func SkillName(server string) string

SkillName is the generated tool-reference skill for one inventory server.

func WriteSettings ¶ added in v2.210.0

func WriteSettings(dir, role, base string, allow []map[string]any, deny []string) (string, error)

WriteSettings merges allow and deny into the bundle's settings fragment, since Claude takes one --settings file. A missing base starts empty. Named by content.

Types ¶

type Connector ¶ added in v2.210.0

type Connector struct {
	URL   string
	Roles []string
	Deny  []string
}

Connector is a claude.ai connector that strict mode hides, so a granted role runs behind an allowlist. Deny holds tool names a grant keeps out, empty for full access.

func GrantedConnectors ¶ added in v2.214.0

func GrantedConnectors(role string) []Connector

GrantedConnectors are the shipped connectors a role holds, with no inventory read. The launch spec hands them to a launcher that renders the allowlist itself.

type Inventory ¶

type Inventory struct {
	Servers map[string]Server
}

Inventory is the parsed host inventory.

func Load ¶

func Load(path string, roles []string) (*Inventory, error)

Load reads an mcporter inventory and checks every role tag against roles, resolving retired slugs, so a renamed role cannot silently lose its servers.

func (*Inventory) Select ¶

func (inv *Inventory) Select(role string) Selection

Select keeps every untagged server and every server tagged for role.

func (*Inventory) SelectWith ¶ added in v2.210.0

func (inv *Inventory) SelectWith(role string, table []Connector) Selection

SelectWith is Select with an explicit connector table, so a test needs no shipped one.

type Selection ¶

type Selection struct {
	Role     string
	Selected []string
	Omitted  []string
	Scoped   int // selected servers that carry a role tag
	// contains filtered or unexported fields
}

Selection is one role's servers and the ones it leaves out.

func (Selection) Allowlist ¶ added in v2.210.0

func (sel Selection) Allowlist(home string) []map[string]any

Allowlist is the allowedMcpServers entry list that stands in for --strict-mcp-config: each selected server by URL or exact command, then each granted connector by URL.

func (Selection) CodexOverrides ¶

func (sel Selection) CodexOverrides() []string

CodexOverrides disables each omitted server for one Codex launch, since the Codex registry is a shared host file that cannot hold a per-seat list.

func (Selection) Connectors ¶ added in v2.210.0

func (sel Selection) Connectors() []Connector

Connectors are the claude.ai connectors the role is granted.

func (Selection) DeniedTools ¶ added in v2.210.0

func (sel Selection) DeniedTools() []string

DeniedTools are the tool names the granted connectors keep out of the session.

func (Selection) GooseArgs ¶

func (sel Selection) GooseArgs(keep []string, home string) ([]string, error)

GooseArgs replaces goose's configured extensions for one session with the role's servers, keeping the builtin and platform extensions named in keep.

func (Selection) GooseOmitted ¶ added in v2.211.0

func (sel Selection) GooseOmitted() []string

GooseOmitted names the selected servers goose cannot reach, because its flag carries a URL and no header. The launch warns with them. COI-2639

func (Selection) HeaderOmissions ¶ added in v2.217.0

func (sel Selection) HeaderOmissions() []string

HeaderOmissions is one line per header left off the config, so the launch names the cause. The value is never read into the line.

func (Selection) OmittedSkills ¶ added in v2.200.0

func (sel Selection) OmittedSkills() []string

OmittedSkills names the tool-reference skill of each server the role leaves out, so a session home does not list tools its harness never mounts.

func (Selection) OpenCodeConfig ¶

func (sel Selection) OpenCodeConfig(home string) (string, error)

OpenCodeConfig is an inline config that defines the role's servers and turns off each omitted one, for OPENCODE_CONFIG_CONTENT. OpenCode merges it last.

func (Selection) Summary ¶

func (sel Selection) Summary() string

Summary is the one line a launch prints so the narrowing is never silent.

func (Selection) WriteClaude ¶

func (sel Selection) WriteClaude(dir, home string) (string, error)

WriteClaude renders a --mcp-config file under dir, named by its content so seats of one role share it. ${HOME} expands against home, as the host projection does.

type Server ¶

type Server struct {
	Command string            `json:"command"`
	Args    []string          `json:"args"`
	Env     map[string]string `json:"env"`
	Cwd     string            `json:"cwd"`
	URL     string            `json:"url"`
	BaseURL string            `json:"baseUrl"`
	Headers map[string]string `json:"headers"`
	AOS     struct {
		Roles []string `json:"roles"`
	} `json:"x-aos"`
}

Server is one inventory entry in mcporter's shape. Unknown keys are ignored.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL